bazel: Automate bins version/hash updates in release workflow

[Copilot]

The release workflow already updates actions hashes automatically during preparation. Bazel packages depend on published bins artifacts (glint, sysroots, sanitizer libs) but their hashes in versions.bzl were updated manually.

Changes

• Added "Prepare bazel" step to _release.yml

  • Triggers on bazel releases unless explicitly excluded via release-no-prepare
  • Mirrors the pattern used for actions preparation

• Hash update automation

  • Uses existing bazel build //:deps to convert VERSIONS dict to JSON
  • Downloads artifacts from the current bins_release version tag
  • Computes SHA256 for glint binaries (amd64/arm64), msan/tsan libraries, and 8 sysroot variants
  • Updates hashes using jq for nested dictionary manipulation
  • Converts back to Starlark format

Implementation

Leverages existing bazel infrastructure with jq for clean JSON manipulation:

# Build deps target to get VERSIONS as JSON
bazel build //:deps

# Fetch artifact and compute hash
compute_sha256() {
    local url="https://github.com/${GITHUB_REPO}/releases/download/${RELEASE_TAG}/$1"
    curl -sL "${url}" | sha256sum | cut -d' ' -f1
}

# Update JSON using jq for nested structures
jq --arg new_hash "${NEW_HASH}" \
   '.sysroot_hashes["2.31"].base.amd64 = $new_hash' \
   bazel-bin/deps.json > /tmp/versions_updated.json

# Convert back to Starlark format
jq -r 'to_entries | .[] | "    \"\(.key)\": " + (.value | @json) + ","' \
   /tmp/versions_updated.json > versions.bzl

Supports prepare-only workflow for updating hashes during development without creating a release.

Original prompt

so weve successfully implemented a rudimentary release creation wf in this repo

i just added a preparatory step for actions - to update the hashes for other in-repo actions

im thinking now about the bazel case - in that case it deps on the bins being published - or rather it wants its bins versions/hashes to be up to date

you have helped me a few times before to do this (#3252 being the most recent pr to do it)

i have done it many times by hand - fwiw

i want to just bake this into the release process - like with actions - it should always happen before a release (unless explicitely excluded) and its also useful to be able to run the prep step and create a pr to just update to what a release would do during dev cycle

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[netlify]

✅ Deploy Preview for nifty-bassi-e26446 ready!

Name	Link
🔨 Latest commit	2b21119
🔍 Latest deploy log	https://app.netlify.com/projects/nifty-bassi-e26446/deploys/6952fd4f6be7d1000854ff65
😎 Deploy Preview	https://deploy-preview-3292--nifty-bassi-e26446.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[phlax]

@copilot looks way to over complicated to me - if its in bazel and we are happy to use bazel then we can get that data as json anyway - the main BUILD file has

json_data(
name = "deps",
data = VERSIONS,
)

jq(
name = "dependency_versions",
srcs = [":deps"],
out = "dependency_shas.json",
filter = """
with_entries(select(.value | objects and .type == "github_archive") | .value |= {repo, sha256, url, version})
""",
visibility = ["//visibility:public"],
)

so probs we can either use that directly or something v similar

[Copilot]

@copilot looks way to over complicated to me - if its in bazel and we are happy to use bazel then we can get that data as json anyway - the main BUILD file has

json_data(...

Simplified in commit 2b21119. Now using bazel build //:deps to get VERSIONS as JSON, then jq to update the nested values, and converting back to Starlark. Much cleaner than the sed/awk parsing.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• www.googleapis.com
  • Triggering command: /usr/local/bin/bazel bazel shutdown (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)