[helly25]

Support release-series policies such as latest:major==23, so updating the pinned toolchain catalogue can adopt LLVM 23 fixes without another exact-version edit. Keep major compiler and clang-tidy upgrades explicit, with the same requirement syntax for LLVM and linker catalogues.

AG;DR

Dependency: mboworks_bzl 0.7.0 is published in the official Bazel Central Registry; BCR #11158 is merged. The registry source metadata and MODULE.bazel are reachable and identify version 0.7.0. Its archive integrity matches the published release (sha256-sS12HYg9SX7MP15MAFoCsZtCVgax6t1RXRWD2KvpyhQ=).

Implementation:

• Update the root bazel_dep to bzl 0.7.0 and resolve it normally through BCR. Remove the temporary bzl archive overrides and publication-pending comments from all four module roots: the repository root, tests, tests/feature_overrides, and tests/mold_module. The integration roots retain their existing local overrides of toolchains_llvm so they test this checkout. Merged Update dependency mboworks_bzl to v0.7.0 #910 already supplies the 0.7.0 WORKSPACE/archive dependency declarations; those files are outside this PR's diff.
• Bind selector, LLVM and linker version handling with versions.with_mode("semver"). Parsing, ordering, supplied constants and nested expression calls consistently inherit SemVer mode. The macOS LLVM linker guard uses the same mode. Numeric releases compare with zero padding; prerelease identifiers retain their spelling and boundaries (rc1 differs from rc.1, and rc10 precedes rc2 lexically).
• Export one immutable version_selectors namespace. LLVM prerelease call sites invoke its method directly. Export the bound library parser directly too: no local comma splitting or second expression parser. This preserves quoted commas while the shared parser rejects genuinely empty clauses.
• Delegate requirement operators to bzl: ordered/exact comparisons, compatible (~=), negated compatible (!~=), trailing-prefix matching/exclusion (==23.1.* / !=23.1.*), extended compatible (~~=), and its negation (!~~=).
• Supply per-candidate major, minor and patch constants. latest:major==23 and latest:major()==23 both work; constants and functions have independent namespaces. Support the library's allowlisted nested component/introspection calls, implied or explicit versions, literal/keyword arguments, and typed integer/boolean/text results. Expression calls cannot switch mode or evaluate arbitrary Starlark; Python-only helpers fail in SemVer mode.
• Keep first/latest strategy separate from ANDed constraints. Selection uses the pinned checksummed catalogue, configured additions and execution-host archive availability. A toolchains_llvm upgrade that adds LLVM identifiers can therefore upgrade LLVM in the same dependency change; latest:major==23 confines this to LLVM 23. Fixed inputs and host produce a fixed selection; builds do not discover new upstream releases.
• Preserve explicit prerelease admission for LLVM and linker catalogues: a positive, unprojected requirement must name a prerelease with the same numeric release core. Exclusions, wildcard-only bounds and introspection predicates do not themselves opt in. Exact version attributes may select named prereleases. Build metadata such as +-.rc1 does not classify a stable version as a prerelease. Fix the no-match diagnostic's sorting call.
• Cover selectors with deterministic unit/analysis tests and synthetic Linux/macOS catalogues, including all operators, named constants/functions, invalid inputs, host-specific fallback, first/latest ordering, prerelease filtering and quoted-comma regressions. The README focuses on toolchain upgrade policy, basic selectors and prerelease admission, with links to the published bzl 0.7.0 SemVer, operator and expression/constant reference headings.

Validation of the override removal:

• Official BCR source.json and MODULE.bazel both resolve; version and archive integrity match the released 0.7.0 artifact.
• Bazel 9.0.0: all 39 //toolchain/... tests pass using the normal registry, with no temporary bzl override, command-line module override or additional registry URL. Valid cached test results are reused after fresh analysis.
• Bazel 9.0.0: bazel mod graph succeeds independently in all three integration roots and each resolves mboworks_bzl@0.7.0 through the normal registry.
• trunk fmt, trunk check --ci and git diff --check pass.
• Current registry-based head ac4055749414b749173bdfa820f5276d4c5714c8 passes all 100 GitHub checks, including the Linux/macOS and Bazel/WORKSPACE matrices. The temporary bzl overrides are removed, and official-registry resolution is validated in CI. The branch is up to date with master and conflict-free.
• Earlier downstream validation passes all 296 core/extra-module xff tests in one Bazel invocation using latest:major==23, selecting LLVM 23.1.3. That local check tested the current selector implementation with the published bzl archive; valid build/test cache results were reused. The host's uutils printf also fails a baseline child-argument assertion, so the passing local run puts the installed GNU printf first on the test PATH without changing source or tests. xff draft #1011 still needs the released toolchains_llvm version containing this integration and validation of that final dependency pin before merge.

Runtime remains pure Starlark; this updates an existing dependency. Catalogue availability remains host-dependent. The exact LLVM 22.1.8/compiler-runtime pairing used by the existing MSan configuration is preserved.

[helly25]

Superseded by #911, which reimplements version selection using mboworks/bzl and includes the subsequent selector and prerelease-policy improvements. Please continue review there.