Internal change

PiperOrigin-RevId: 922850859

Author: dmitriplotnikov

.bazelrc

@@ -32,3 +32,7 @@ build:windows --google_default_credentials=true
 build:macos --remote_cache=https://storage.googleapis.com/macos-cel-python-remote-cache
 build:macos --google_default_credentials=true
 
+# Silence deprecation warnings from external dependencies (Linux and macOS)
+build:linux --cxxopt=-Wno-deprecated-declarations
+build:macos --cxxopt=-Wno-deprecated-declarations
+

release/kokoro/release_linux.cfg

@@ -3,3 +3,8 @@
 
 build_file: "cel-python/release/kokoro/release_linux.sh"
 timeout_mins: 120
+
+container_properties {
+  docker_image: "us-central1-docker.pkg.dev/kokoro-container-bakery/kokoro/ubuntu/ubuntu2204/ktcb:current"
+  docker_sibling_containers: true
+}

release/kokoro/release_linux.sh

@@ -1,14 +1,77 @@
 #!/bin/bash
 set -e
 
+
+# Avoid virtualenv/pip trying to download/upgrade tools from PyPI on host
+export VIRTUALENV_NO_DOWNLOAD=1
+export PIP_DISABLE_PIP_VERSION_CHECK=1
+
+# Pass these environment variables to the cibuildwheel Docker container
+export CIBW_ENVIRONMENT="VIRTUALENV_NO_DOWNLOAD=1 PIP_DISABLE_PIP_VERSION_CHECK=1"
+export CIBW_DEPENDENCY_VERSIONS="latest"
+
 # If running locally (not on Kokoro), authenticate with gcloud.
 if [ -z "${KOKORO_BUILD_ID}" ]; then
   if ! gcloud auth application-default print-access-token --quiet > /dev/null; then
       gcloud auth application-default login
   fi
 fi
 
-pip install -U keyring keyrings.google-artifactregistry-auth twine cibuildwheel
+# We use --no-cache-dir to force pip to download packages fresh and bypass the local
+# cache. In Kokoro/RBE sandboxed environments, writing to the default cache directory
+# (~/.cache/pip) can encounter permission/sandbox restrictions or lead to stale
+# dependency resolution. Disabling the cache ensures a reliable, reproducible install.
+pip install --no-cache-dir -U keyring keyrings.google-artifactregistry-auth twine cibuildwheel
+
+# Patch cibuildwheel at runtime to bypass the RBE stdout buffering deadlock.
+# The RBE proxy buffers the persistent container bash stdout. By appending a 4KB
+# padding line to the end of every command output, we force the proxy to flush the
+# buffer immediately. We then read and discard this padding to keep the stream clean.
+OCI_PATH=$(python3 -c "import cibuildwheel.oci_container; print(cibuildwheel.oci_container.__file__)")
+echo "Patching cibuildwheel at $OCI_PATH..."
+
+cat << 'EOF' > patch_oci.py
+import sys
+import os
+
+path = sys.argv[1]
+with open(path, 'r') as f:
+    content = f.read()
+
+# 1. Force a 4KB flush at the end of every command execution
+target_write = 'printf "%04d%s\\n" $? {end_of_message}'
+replacement_write = 'printf "%04d%s\\n%4096s\\n" $? {end_of_message} " "'
+if target_write not in content:
+    print("Error: target_write not found!")
+    sys.exit(1)
+content = content.replace(target_write, replacement_write)
+
+# 2. Read and discard the 4KB padding to keep the stream clean
+target_read = """                # add the last line to output, without the footer
+                output_io.write(line[0:footer_offset])
+                output_io.flush()
+                break"""
+
+replacement_read = """                # add the last line to output, without the footer
+                output_io.write(line[0:footer_offset])
+                output_io.flush()
+                # Read and discard the 4KB padding line to clear the stream!
+                self.bash_stdout.readline()
+                break"""
+
+if target_read not in content:
+    print("Error: target_read not found!")
+    sys.exit(1)
+content = content.replace(target_read, replacement_read)
+
+with open(path, 'w') as f:
+    f.write(content)
+
+print("Successfully patched oci_container.py to bypass RBE buffering deadlock!")
+EOF
+
+python3 patch_oci.py "$OCI_PATH"
+rm patch_oci.py
 
 REPO_DIR=$(mktemp -d)
 echo "Created temporary directory: ${REPO_DIR}"
@@ -52,16 +115,24 @@ cp -r "${SRC_DIR}"/{*,.*} . 2>/dev/null || true
 cp -r "${SRC_DIR}"/release/* . 2>/dev/null || true
 rm -rf cel_expr_python/*_test.py
 
+echo "Downloading bazelisk on host..."
+curl -LO https://github.com/bazelbuild/bazelisk/releases/download/v1.19.0/bazelisk-linux-amd64
+chmod +x bazelisk-linux-amd64
+
 # Check if pyproject.toml exists before running sed
 if [ -f pyproject.toml ]; then
   sed -i "" "s/\$VERSION/${VERSION}/g" pyproject.toml || sed -i "s/\$VERSION/${VERSION}/g" pyproject.toml
 fi
 
+export CIBW_CONTAINER_ENGINE_EXTRA_ARGS="--network=host"
+
 echo "Running cibuildwheel: ${CIBWHEEL_BIN}"
 # Default CIBWHEEL_BIN if not set
 if [ -z "${CIBWHEEL_BIN}" ]; then
   CIBWHEEL_BIN="python3 -m cibuildwheel"
 fi
+
+# Run cibuildwheel synchronously
 ${CIBWHEEL_BIN} --platform linux --output-dir dist
 
 if [ "${DRY_RUN}" = "true" ]; then

release/pyproject.toml

@@ -38,13 +38,21 @@ where = ["."]
 exclude = ["codelab*", "conformance*", "custom_ext*", "release*", "testing*", "wheelhouse*"]
 
 [tool.cibuildwheel]
-build = "cp311-* cp312-* cp313-* cp314-*"
-skip = "*musllinux* *win32*"
+build = "cp311-*"
+#build = "cp311-* cp312-* cp313-* cp314-*"
+skip = "*musllinux* *win32* *i686*"
 test-command = "python {project}/cel_basic_test.py"
 build-verbosity = 1
 
 [tool.cibuildwheel.linux]
-before-all = "echo 'Installing bazelisk'; curl -LO https://github.com/bazelbuild/bazelisk/releases/download/v1.19.0/bazelisk-linux-amd64 && chmod +x bazelisk-linux-amd64 && mv bazelisk-linux-amd64 /usr/local/bin/bazel"
+manylinux-x86_64-image = "manylinux_2_28"
+container-engine = "docker; disable_host_mount: True"
+# Google's internal Kokoro/RBE network uses a secure MITM proxy that resigns HTTPS
+# traffic with an internal Google CA. Since the public manylinux container does not
+# trust this CA, git fetches for external dependencies (like @cel-cpp) will fail
+# with SSL certificate errors. We disable http.sslVerify inside the container to
+# bypass this and allow Bazel to fetch SCM dependencies through the proxy.
+before-all = "git config --global http.sslVerify false && echo 'Installing bazelisk' && cp {project}/bazelisk-linux-amd64 /usr/local/bin/bazel"
 
 [tool.cibuildwheel.macos]
 before-all = "echo 'Installing bazelisk'; brew install bazelisk"