Check Starlark contracts in the fork

.bazelci/presubmit.yml

@@ -147,9 +147,8 @@ tasks:
     build_targets: *build_targets
     test_targets: *test_targets
     test_flags: *windows_test_flags
-    # TODO(pzembrod): reenable once Commit #53428ca hits Bazel ROLLING - should be within 08/2026
-    # coverage_flags: *windows_coverage_flags
-    # coverage_targets: *coverage_targets
+    coverage_flags: *windows_coverage_flags
+    coverage_targets: *coverage_targets
 
 # Bazel 7
   ubuntu_bazel_7:
@@ -230,15 +229,15 @@ tasks:
     coverage_targets: *test_targets_bazel_less_than_9
 
 # Bazel 9
-  ubuntu:
+  ubuntu_bazel_9:
     name: Ubuntu (Bazel 9)
     bazel: 9.x
     platform: ubuntu2404
     build_targets: *build_targets
     test_targets: *test_targets
     coverage_flags: *common_coverage_flags
     coverage_targets: *coverage_targets
-  macos_intel:
+  macos_intel_bazel_9:
     name: MacOS Intel (Bazel 9)
     bazel: 9.x
     platform: macos
@@ -247,7 +246,7 @@ tasks:
     test_flags: *macos_test_flags
     coverage_flags: *common_coverage_flags
     coverage_targets: *coverage_targets
-  macos:
+  macos_bazel_9:
     name: MacOS (Bazel 9)
     bazel: 9.x
     platform: macos_arm64
@@ -256,9 +255,50 @@ tasks:
     test_flags: *macos_test_flags
     coverage_flags: *common_coverage_flags
     coverage_targets: *coverage_targets
-  windows:
+  windows_bazel_9:
     name: Windows (Bazel 9)
     bazel: 9.x
+    platform: windows
+    build_targets: *build_targets
+    test_targets: *test_targets
+    test_flags: *windows_test_flags
+    coverage_flags: *windows_coverage_flags
+    coverage_targets: *test_targets
+
+# Bazel 10
+  ubuntu_bazel_10:
+    name: Ubuntu (Bazel 10)
+    bazel: 10.*  # TODO(pzembrod): Change to 10.x after 10.0.0 is released. Same for other jobs.
+    platform: ubuntu2404
+    build_targets: *build_targets
+    test_targets: *test_targets
+    coverage_flags: *common_coverage_flags
+    coverage_targets: *coverage_targets
+  macos_intel_bazel_10:
+    name: MacOS Intel (Bazel 10)
+    bazel: 10.*
+    platform: macos
+    environment:
+      ANDROID_HOME: ""
+      ANDROID_NDK_HOME: ""
+    build_targets: *build_targets
+    test_targets: *test_targets
+    test_flags: *macos_test_flags
+    coverage_flags: *common_coverage_flags
+    coverage_targets: *coverage_targets
+  macos_bazel_10:
+    name: MacOS (Bazel 10)
+    bazel: 10.*
+    platform: macos_arm64
+    build_targets: *build_targets
+    test_targets: *test_targets
+    test_flags: *macos_test_flags
+    coverage_flags: *common_coverage_flags
+    coverage_targets: *coverage_targets
+  windows_bazel_10:
+    name: Windows (Bazel 10)
+    bazel: 10.*
+    platform: windows
     build_targets: *build_targets
     test_targets: *test_targets
     test_flags: *windows_test_flags

.bazelrc

@@ -1,3 +1,7 @@
-# Required by googletest 1.17.
-common --cxxopt=-std=c++17
+common --enable_platform_specific_config
+# TODO: Remove https://github.com/bazelbuild/bazel/pull/31423
+common:windows --remote_download_all
+
+common --check_direct_dependencies=off
+
 test --test_env=PATH=/bin:/usr/bin:/usr/local/bin

.bcr/metadata.template.json

@@ -10,6 +10,11 @@
       "email": "pzembrod@google.com",
       "github": "pzembrod",
       "name": "Philip Zembrod"
+    },
+    {
+      "email": "bgorshenev@google.com",
+      "github": "lilygorsheneva",
+      "name": "Lily Gorsheneva"
     }
   ],
   "versions": [],

.github/workflows/release.yaml

@@ -23,9 +23,29 @@ permissions:
   attestations: write
   contents: write
 jobs:
+  check-commit-status:
+    name: Check commit status
+    runs-on: ubuntu-latest
+    permissions:
+      statuses: read
+    steps:
+      - name: Require a green commit
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          status="$(gh api \
+            --header "X-GitHub-Api-Version: 2022-11-28" \
+            "repos/${GITHUB_REPOSITORY}/commits/${GITHUB_SHA}/status" \
+            --jq '.state')"
+          if [[ "${status}" != "success" ]]; then
+            echo "::error::Commit ${GITHUB_SHA} is not green (combined status: ${status})."
+            exit 1
+          fi
   release:
+    needs: check-commit-status
     uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.2.3
     with:
+      bazel_test_command: "true"
       prerelease: false
       release_files: rules_cc-*.tar.gz
       tag_name: ${{ inputs.tag_name || github.ref_name }}

.github/workflows/sty.yaml

@@ -0,0 +1,108 @@
+name: Starlark types
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  sty:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: tamird/sty@95e2b424a7f52fa0b0946da98eb2cc328e9b4107
+        with:
+          audit-loads: true
+          bazel-version: '9.3.0'
+          advisory-pathspecs: '*.bzl'
+          advisory-bazel-load-context: '@cross_repo_test//toolchain_include_dirs:toolchain_config'
+          advisory-require-bazel-load-context: tests/builtins_bzl/cc/cc_shared_library/test2/toolchain_include_dirs/cc_toolchain_config.bzl
+          files: |
+            @bazel_skylib//:bzl_library.bzl
+            @bazel_skylib//lib:paths.bzl
+            @bazel_skylib//rules:common_settings.bzl
+            @bazel_skylib//rules/directory:providers.bzl
+            cc/BUILD
+            cc/action_names.bzl
+            cc/cc_import.bzl
+            cc/cc_postmark.bzl
+            cc/cc_rules_extension_support.bzl
+            cc/cc_shared_library.bzl
+            cc/common/BUILD
+            cc/common/cc_shared_library_info.bzl
+            cc/common/debug_package_info.bzl
+            cc/common/feature_names.bzl
+            cc/common/objc_info.bzl
+            cc/extensions.bzl
+            cc/private/cc_shared_library_hint_info.bzl
+            cc/private/cc_shared_library_info.bzl
+            cc/private/debug_package_info.bzl
+            cc/private/graph_node_info.bzl
+            cc/private/paths.bzl
+            cc/private/rules_impl/failing_cc_proto_library.bzl
+            cc/private/rules_impl/fdo/fdo_prefetch_hints.bzl
+            cc/private/rules_impl/fdo/fdo_profile.bzl
+            cc/private/rules_impl/fdo/memprof_profile.bzl
+            cc/private/rules_impl/fdo/propeller_optimize.bzl
+            cc/private/rules_impl/native_cc_common.bzl
+            cc/private/rules_impl/objc_compilation_context_info.bzl
+            cc/private/toolchain/cc_configure.bzl
+            cc/private/toolchain/unix_cc_configure.bzl
+            cc/repositories.bzl
+            cc/starlark_doc_extract_helper.bzl
+            cc/system_library.bzl
+            cc/toolchains/actions.bzl
+            cc/toolchains/actions/BUILD
+            cc/toolchains/args/BUILD
+            cc/toolchains/args/libraries_to_link/private/library_link_args.bzl
+            cc/toolchains/args_list.bzl
+            cc/toolchains/artifacts.bzl
+            cc/toolchains/capabilities/BUILD
+            cc/toolchains/cc_toolchain.bzl
+            cc/toolchains/cc_toolchain_alias.bzl
+            cc/toolchains/cc_toolchain_config_info.bzl
+            cc/toolchains/directory_tool.bzl
+            cc/toolchains/fdo_prefetch_hints.bzl
+            cc/toolchains/fdo_profile.bzl
+            cc/toolchains/feature.bzl
+            cc/toolchains/feature_constraint.bzl
+            cc/toolchains/feature_injection.bzl
+            cc/toolchains/feature_set.bzl
+            cc/toolchains/features/BUILD
+            cc/toolchains/features/legacy/BUILD
+            cc/toolchains/impl/cc_artifact_category.bzl
+            cc/toolchains/impl/external_feature.bzl
+            cc/toolchains/impl/label_utils.bzl
+            cc/toolchains/impl/libc_version.bzl
+            cc/toolchains/impl/markdown_helpers.bzl
+            cc/toolchains/legacy_file_group.bzl
+            cc/toolchains/legacy_tool.bzl
+            cc/toolchains/make_variable.bzl
+            cc/toolchains/memprof_profile.bzl
+            cc/toolchains/mutually_exclusive_category.bzl
+            cc/toolchains/nested_args.bzl
+            cc/toolchains/propeller_optimize.bzl
+            cc/toolchains/providers.bzl
+            cc/toolchains/tool.bzl
+            cc/toolchains/tool_capability.bzl
+            cc/toolchains/variables/BUILD
+            cc/use_cc_toolchain.bzl
+            local_bazel.bzl
+            tests/cc/testutil/toolchains/additional_toolchains.bzl
+            tests/cc/testutil/toolchains/features.bzl
+            tests/load_from_macro/tags.bzl
+            tests/rule_based_toolchain/action_type_sets
+            tests/rule_based_toolchain/args/make_var_provider.bzl
+            tests/rule_based_toolchain/helpers.bzl
+            tests/rule_based_toolchain/legacy_features_as_args/goldens
+            tests/rule_based_toolchain/tool/execution_requirements.bzl

BUILD

@@ -4,7 +4,10 @@ package(default_visibility = ["//visibility:public"])
 
 licenses(["notice"])
 
-exports_files(["LICENSE"])
+exports_files([
+    "LICENSE",
+    "stubs.toml",
+])
 
 exports_files(["copy.bara.sky"])
 
@@ -51,6 +54,7 @@ filegroup(
     srcs = [
         "BUILD",
         "MODULE.bazel",
+        "stubs.toml",
         "//cc:srcs",
     ],
     visibility = ["//:__subpackages__"],

MODULE.bazel

@@ -4,7 +4,7 @@ module(
     compatibility_level = 1,
 )
 
-bazel_dep(name = "apple_support", version = "2.8.0")
+bazel_dep(name = "apple_support", version = "2.9.1")
 bazel_dep(name = "bazel_features", version = "1.50.0")
 bazel_dep(name = "bazel_skylib", version = "1.8.0")
 bazel_dep(name = "platforms", version = "0.0.10")
@@ -19,9 +19,7 @@ register_toolchains(
 )
 
 bazel_dep(name = "rules_shell", version = "0.2.0", dev_dependency = True)
-
-bazel_dep(name = "rules_python", version = "1.7.0")
-
+bazel_dep(name = "rules_python", version = "2.0.0", dev_dependency = True)
 bazel_dep(name = "googletest", version = "1.17.0", dev_dependency = True)
 single_version_override(
     module_name = "googletest",

cc/BUILD

@@ -30,6 +30,8 @@ filegroup(
 )
 
 exports_files([
+    "cc_postmark_initializers.bzli",
+    "cc_toolchain_config_lib.bzli",
     "defs.bzl",
     "action_names.bzl",
     "system_library.bzl",
@@ -74,6 +76,7 @@ filegroup(
     testonly = 1,
     srcs = glob([
         "**/*.bzl",
+        "**/*.bzli",
         "**/BUILD",
     ]) + [
         "//cc/common:srcs",

cc/cc_import.bzl

@@ -15,5 +15,8 @@
 
 load("@cc_compatibility_proxy//:proxy.bzl", _cc_import = "cc_import")
 
+# TODO(https://github.com/bazelbuild/bazel/issues/32343): Annotate **kwargs
+# when Bazel can derive them from the wrapped cc_import rule.
 def cc_import(**kwargs):
+    # type: (**Unpack[KeywordArgs[_cc_import]]) -> None
     _cc_import(**kwargs)

cc/cc_postmark.bzl

@@ -14,20 +14,21 @@
 
 """PostMark is not implemented in Bazel."""
 
-def _get_postmark_attrs():
-    return {}
-
-def _postmark_initializer(**kwargs):
-    return kwargs
+load("//cc:cc_postmark_initializers.bzl", _get_postmark_attrs = "get_postmark_attrs", _postmark_initializer = "postmark_initializer")
 
 def _add_postmark_action(
         ctx,  # @unused
         cc_toolchain,  # @unused
         binary,  # @unused
         output_binary_for_linking):  # @unused
+    # type: (object, object, object, object) -> None
     pass
 
+# The public toolchain never enables PostMark. A broader bool makes the
+# cc_binary branch that passes internal-only action keywords reachable.
+# TODO: Use bool when the public implementation supports that action.
 def _get_use_postmark(ctx):  # @unused
+    # type: (object) -> Literal[False]
     return False
 
 postmark = struct(

cc/cc_postmark_initializers.bzli

@@ -0,0 +1,7 @@
+"""Contracts for the PostMark initializer compatibility layer."""
+
+# TODO(https://github.com/bazelbuild/starlark/pull/362): Move the initializers into source when supported Bazel versions can bind
+# K and V on the function. A signature comment cannot bind these type parameters.
+
+def _get_postmark_attrs[K, V]() -> dict[K, V]: ...
+def _postmark_initializer[T](**kwargs: T) -> dict[str, T]: ...

cc/cc_shared_library.bzl

@@ -15,5 +15,8 @@
 
 load("@cc_compatibility_proxy//:proxy.bzl", _cc_shared_library = "cc_shared_library")
 
+# TODO(https://github.com/bazelbuild/bazel/issues/32343): Annotate **kwargs
+# when Bazel can derive them from the wrapped cc_shared_library rule.
 def cc_shared_library(**kwargs):
+    # type: (**Unpack[KeywordArgs[_cc_shared_library]]) -> None
     _cc_shared_library(**kwargs)