Various updates

.github/workflows/tests.yml

@@ -61,8 +61,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # TODO: This doesn't work with arm64 Macs yet, hence pinning to macos-13.
-        os: [macos-13, ubuntu-latest]
+        os: [macos-latest, ubuntu-latest]
         bazel_version: [latest] # rules_rust bzlmod support is experimental and needs latest version as of now (20230912).
         bzlmod: [true, false]
     runs-on: ${{ matrix.os }}

tests/MODULE.bazel

@@ -22,12 +22,13 @@ local_path_override(
 
 bazel_dep(name = "bazel_skylib", version = "1.8.2")
 bazel_dep(name = "platforms", version = "1.0.0")
-bazel_dep(name = "rules_cc", version = "0.0.9")
-bazel_dep(name = "rules_go", version = "0.50.1", repo_name = "io_bazel_rules_go")
+bazel_dep(name = "rules_cc", version = "0.2.8")
+bazel_dep(name = "rules_go", version = "0.58.2", repo_name = "io_bazel_rules_go")
 bazel_dep(name = "rules_rust", version = "0.67.0")
 bazel_dep(name = "rules_foreign_cc", version = "0.15.0")
 bazel_dep(name = "rules_shell", version = "0.6.1")
-bazel_dep(name = "abseil-cpp", version = "20240722.1", repo_name = "com_google_absl")
+bazel_dep(name = "openssl", version = "3.3.1.bcr.7")
+bazel_dep(name = "abseil-cpp", version = "20250814.1", repo_name = "com_google_absl")
 
 # TODO: Remove when protobuf is released with a version of rules_python that supports 8.x
 bazel_dep(name = "rules_python", version = "1.6.3")
@@ -63,10 +64,10 @@ llvm = use_extension("@toolchains_llvm//toolchain/extensions:llvm.bzl", "llvm")
 # When updating this version, also update the versions associated with
 # llvm_toolchain below, sys_paths_test in the workflows file, and xcompile_test
 # through the `llvm_toolchain_with_sysroot` toolchain.
+# We use C++17 and the first LLVM version with full suppor is 16.0.0.
+# We also use C++20 which has reasonable wide support starting with LLVM 17.0.0.
 LLVM_VERSIONS = {
-    "": "16.0.0",
-    "darwin-aarch64": "16.0.5",
-    "darwin-x86_64": "15.0.7",
+    "": "first:>=17.0.0,<18",
 }
 
 llvm.toolchain(

tests/WORKSPACE

@@ -48,10 +48,10 @@ load("@toolchains_llvm//toolchain:rules.bzl", "llvm_toolchain")
 # When updating this version, also update the versions associated with
 # llvm_toolchain below, sys_paths_test in the workflows file, and xcompile_test
 # through the `llvm_toolchain_with_sysroot` toolchain.
+# We use C++17 and the first LLVM version with full suppor is 16.0.0.
+# We also use C++20 which has reasonable wide support starting with LLVM 17.0.0.
 LLVM_VERSIONS = {
-    "": "16.0.0",
-    "darwin-aarch64": "16.0.5",
-    "darwin-x86_64": "15.0.7",
+    "": "first:>=17.0.0,<18",
 }
 
 llvm_toolchain(
@@ -253,18 +253,20 @@ http_archive(
 
 http_archive(
     name = "openssl",
-    build_file = "//openssl:openssl.bazel",
-    sha256 = "f6fb3079ad15076154eda9413fed42877d668e7069d9b87396d0804fdb3f4c90",
-    strip_prefix = "openssl-1.1.1c",
-    urls = ["https://www.openssl.org/source/openssl-1.1.1c.tar.gz"],
+    build_file = "//openssl:BUILD.bazel",
+    integrity = "sha256-d3zVlihMiDN1oqehG/XSeG/FQTJV76sgxQ1v/m0CC34=",
+    strip_prefix = "openssl-3.3.1",
+    url = "https://github.com/openssl/openssl/releases/download/openssl-3.3.1/openssl-3.3.1.tar.gz",
+    patch_cmds = [
+        "cp configs/BUILD.bazel configs",
+    ],
 )
 
 http_archive(
     name = "io_bazel_rules_go",
-    sha256 = "f4a9314518ca6acfa16cc4ab43b0b8ce1e4ea64b81c38d8a3772883f153346b8",
+    sha256 = "54bbb67a4196170cc60ef3b52a2747ad1759cba4764b4c4752b744080ad99947",
     urls = [
-        "https://mirror.bazel.build/github.com/bazelbuild/rules_go/releases/download/v0.50.1/rules_go-v0.50.1.zip",
-        "https://github.com/bazelbuild/rules_go/releases/download/v0.50.1/rules_go-v0.50.1.zip",
+        "https://github.com/bazelbuild/rules_go/releases/download/v0.58.2/rules_go-v0.58.2.zip",
     ],
 )
 

tests/WORKSPACE.bzlmod

@@ -4,13 +4,6 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
 # Well known repos; present here only for testing.
 
-http_archive(
-    name = "openssl",
-    build_file = "//openssl:openssl.bazel",
-    sha256 = "f6fb3079ad15076154eda9413fed42877d668e7069d9b87396d0804fdb3f4c90",
-    strip_prefix = "openssl-1.1.1c",
-    urls = ["https://www.openssl.org/source/openssl-1.1.1c.tar.gz"],
-)
 
 _ALL_CONTENT = """\
 filegroup(

tests/openssl/MODULE.bazel

@@ -0,0 +1,23 @@
+module(
+    name = "openssl",
+    version = "3.3.1.bcr.7",
+    # We use overlay, which requires at least 7.2.1
+    bazel_compatibility = [">=7.2.1"],
+    # Note: This should rarely change. For now, we hold it as a constant.
+    # Realistically, we should only change it if the major version of openssl changes.
+    # When that happens, we probably want to change this to a single-digit number representing that version number.
+    compatibility_level = 3030100,
+)
+
+bazel_dep(name = "platforms", version = "1.0.0")
+bazel_dep(name = "rules_cc", version = "0.2.4")
+bazel_dep(name = "rules_perl", version = "0.4.1")
+bazel_dep(name = "bazel_skylib", version = "1.8.2")
+
+http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+http_archive(
+    name = "openssl-generated-overlay",
+    integrity = "sha256-4RBLJl1SVyNTkyFQFunAnEPSF8EkPGj0Fjg/kKyhuL4=",
+    url = "https://github.com/raccoons-build/bazel-openssl-cc/releases/download/3.3.1.bcr.7/bazel-openssl-cc-3.3.1.bcr.7.tar.gz",
+)