Internal change

PiperOrigin-RevId: 922850859

Author: dmitriplotnikov

.bazelrc

@@ -32,3 +32,7 @@ build:windows --google_default_credentials=true
 build:macos --remote_cache=https://storage.googleapis.com/macos-cel-python-remote-cache
 build:macos --google_default_credentials=true
 
+# Silence deprecation warnings from external dependencies (Linux and macOS)
+build:linux --cxxopt=-Wno-deprecated-declarations
+build:macos --cxxopt=-Wno-deprecated-declarations
+

release/kokoro/release_linux.cfg

@@ -3,3 +3,8 @@
 
 build_file: "cel-python/release/kokoro/release_linux.sh"
 timeout_mins: 120
+
+container_properties {
+  docker_image: "us-central1-docker.pkg.dev/kokoro-container-bakery/kokoro/ubuntu/ubuntu2204/ktcb:current"
+  docker_sibling_containers: true
+}

release/kokoro/release_linux.sh

@@ -1,14 +1,27 @@
 #!/bin/bash
 set -e
 
+
+# Avoid virtualenv/pip trying to download/upgrade tools from PyPI on host
+export VIRTUALENV_NO_DOWNLOAD=1
+export PIP_DISABLE_PIP_VERSION_CHECK=1
+
+# Pass these environment variables to the cibuildwheel Docker container
+export CIBW_ENVIRONMENT="VIRTUALENV_NO_DOWNLOAD=1 PIP_DISABLE_PIP_VERSION_CHECK=1"
+export CIBW_DEPENDENCY_VERSIONS="latest"
+
 # If running locally (not on Kokoro), authenticate with gcloud.
 if [ -z "${KOKORO_BUILD_ID}" ]; then
   if ! gcloud auth application-default print-access-token --quiet > /dev/null; then
       gcloud auth application-default login
   fi
 fi
 
-pip install -U keyring keyrings.google-artifactregistry-auth twine cibuildwheel
+# We use --no-cache-dir to force pip to download packages fresh and bypass the local
+# cache. In Kokoro/RBE sandboxed environments, writing to the default cache directory
+# (~/.cache/pip) can encounter permission/sandbox restrictions or lead to stale
+# dependency resolution. Disabling the cache ensures a reliable, reproducible install.
+pip install --no-cache-dir -U keyring keyrings.google-artifactregistry-auth twine cibuildwheel
 
 REPO_DIR=$(mktemp -d)
 echo "Created temporary directory: ${REPO_DIR}"
@@ -52,16 +65,24 @@ cp -r "${SRC_DIR}"/{*,.*} . 2>/dev/null || true
 cp -r "${SRC_DIR}"/release/* . 2>/dev/null || true
 rm -rf cel_expr_python/*_test.py
 
+echo "Downloading bazelisk on host..."
+curl -LO https://github.com/bazelbuild/bazelisk/releases/download/v1.19.0/bazelisk-linux-amd64
+chmod +x bazelisk-linux-amd64
+
 # Check if pyproject.toml exists before running sed
 if [ -f pyproject.toml ]; then
   sed -i "" "s/\$VERSION/${VERSION}/g" pyproject.toml || sed -i "s/\$VERSION/${VERSION}/g" pyproject.toml
 fi
 
+export CIBW_CONTAINER_ENGINE_EXTRA_ARGS="--network=host"
+
 echo "Running cibuildwheel: ${CIBWHEEL_BIN}"
 # Default CIBWHEEL_BIN if not set
 if [ -z "${CIBWHEEL_BIN}" ]; then
   CIBWHEEL_BIN="python3 -m cibuildwheel"
 fi
+
+# Run cibuildwheel synchronously
 ${CIBWHEEL_BIN} --platform linux --output-dir dist
 
 if [ "${DRY_RUN}" = "true" ]; then

release/pyproject.toml

@@ -38,13 +38,22 @@ where = ["."]
 exclude = ["codelab*", "conformance*", "custom_ext*", "release*", "testing*", "wheelhouse*"]
 
 [tool.cibuildwheel]
-build = "cp311-* cp312-* cp313-* cp314-*"
-skip = "*musllinux* *win32*"
+build = "cp311-*"
+#build = "cp311-* cp312-* cp313-* cp314-*"
+skip = "*musllinux* *win32* *i686*"
 test-command = "python {project}/cel_basic_test.py"
 build-verbosity = 1
 
 [tool.cibuildwheel.linux]
-before-all = "echo 'Installing bazelisk'; curl -LO https://github.com/bazelbuild/bazelisk/releases/download/v1.19.0/bazelisk-linux-amd64 && chmod +x bazelisk-linux-amd64 && mv bazelisk-linux-amd64 /usr/local/bin/bazel"
+manylinux-x86_64-image = "manylinux_2_28"
+container-engine = "docker; disable_host_mount: True"
+test-command = ""
+# Google's internal Kokoro/RBE network uses a secure MITM proxy that resigns HTTPS
+# traffic with an internal Google CA. Since the public manylinux container does not
+# trust this CA, git fetches for external dependencies (like @cel-cpp) will fail
+# with SSL certificate errors. We disable http.sslVerify inside the container to
+# bypass this and allow Bazel to fetch SCM dependencies through the proxy.
+before-all = "git config --global http.sslVerify false && echo 'Installing bazelisk' && cp {project}/bazelisk-linux-amd64 /usr/local/bin/bazel"
 
 [tool.cibuildwheel.macos]
 before-all = "echo 'Installing bazelisk'; brew install bazelisk"