sync

.bazelignore

@@ -7,3 +7,7 @@ third-party/abc/
 tmp
 # standalone workspace for downstream consumer tests
 test/downstream/
+# fmt ships its own BUILD.bazel assuming it is the workspace root; we overlay
+# fmt via new_local_repository(name="fmt"), so hide this nested package from
+# //... discovery (its glob(["include/fmt/*.h"]) matches nothing here).
+third-party/slang-elab/third_party/fmt/support/bazel/

.bazelrc

@@ -1,4 +1,8 @@
 common --enable_bzlmod
+
+# abc is driven programmatically by OpenROAD, so skip the interactive
+# readline dependency exposed by abc@0.64-yosyshq.bcr.2.
+common --@abc//:use_readline=false
 build --workspace_status_command=tools/workspace_status.sh
 
 # Release builds embed real git version info; dev builds use cache-safe placeholders.
@@ -40,9 +44,24 @@ build  --cxxopt=-fexceptions    --host_cxxopt=-fexceptions
 build --copt "-Wall"               --host_copt "-Wall"
 build --copt "-Wextra"             --host_copt "-Wextra"
 
+# Treat specific warnings as errors
+build --copt "-Werror=array-bounds"               --host_copt "-Werror=array-bounds"
+build --copt "-Werror=dangling"                   --host_copt "-Werror=dangling"
+build --copt "-Werror=dangling-assignment"        --host_copt "-Werror=dangling-assignment"
+build --copt "-Werror=dangling-assignment-gsl"    --host_copt "-Werror=dangling-assignment-gsl"
+build --copt "-Werror=dangling-field"             --host_copt "-Werror=dangling-field"
+build --copt "-Werror=dangling-gsl"               --host_copt "-Werror=dangling-gsl"
+build --copt "-Werror=fortify-source"             --host_copt "-Werror=fortify-source"
+build --copt "-Werror=return-stack-address"       --host_copt "-Werror=return-stack-address"
+
 # ... and disable the warnings we're not interested in.
 build --copt "-Wno-sign-compare"          --host_copt "-Wno-sign-compare"
 build --copt "-Wno-unused-parameter"      --host_copt "-Wno-unused-parameter"
+# False positive under Bazel's parse_headers feature: it compiles each
+# declared header as a main TU, which makes clang treat #pragma once as
+# a no-op and emit -Wpragma-once-outside-header.  Project convention is
+# #pragma once for all headers, so silence the warning project-wide.
+build --copt "-Wno-pragma-once-outside-header" --host_copt "-Wno-pragma-once-outside-header"
 build --copt "-Wno-gcc-compat"            --host_copt "-Wno-gcc-compat"
 build --copt "-Wno-nullability-extension" --host_copt "-Wno-nullability-extension"
 build --copt "-Wno-deprecated-declarations" --host_copt "-Wno-deprecated-declarations"
@@ -58,7 +77,6 @@ build --copt "-Wno-cast-function-type-mismatch"  --host_copt "-Wno-cast-function
 build --copt "-Wno-unused-but-set-variable"  --host_copt "-Wno-unused-but-set-variable"
 build --cxxopt "-Wno-deprecated-copy"  --host_cxxopt "-Wno-deprecated-copy"
 build --cxxopt "-Wno-deprecated-copy-with-user-provided-copy"  --host_cxxopt "-Wno-deprecated-copy-with-user-provided-copy"
-build --cxxopt "-Wno-dangling"  --host_cxxopt "-Wno-dangling"
 
 # For 3rd party code: Disable warnings entirely.
 # They are not actionable and just create noise.
@@ -90,6 +108,11 @@ build:asan --copt=-O1
 build:asan --copt=-g
 build:asan --copt=-fno-omit-frame-pointer
 build:asan --linkopt=-fsanitize=address
+# TCMalloc is incompatible with ASan: __asan_init's interceptor setup calls
+# dlsym -> malloc before TCMalloc is initialized, segfaulting at startup.
+# Override the per-target malloc attribute to use the system allocator, which
+# ASan intercepts cleanly.
+build:asan --custom_malloc=@bazel_tools//tools/cpp:malloc
 
 # Flags with enough debug symbols to get useful outputs with Linux `perf`
 build:profile --strip=never
@@ -120,11 +143,21 @@ build:ci --disk_cache=
 build:ci --config=opt
 
 # Setup remote cache
+# Anon: HTTPS read-only cache
 build --remote_cache=https://bazel.precisioninno.com
 build --remote_cache_compression=true
 build --remote_upload_local_results=false
+# CI: gRPC + Remote Asset API, requires --remote_header
+build:ci --remote_cache=grpcs://bazel.precisioninno.com:443
+build:ci --experimental_remote_downloader=grpcs://bazel.precisioninno.com:443
 
 # Without this, bazelisk build ... builds the bazel-orfs tests
 build --build_tag_filters=-orfs
 
+# clang-tidy via aspect_rules_lint, using clang-tidy from the LLVM toolchain.
+# Usage: bazel build --config=lint //src/utl/...
+build:lint --aspects=//tools/lint:linters.bzl%clang_tidy
+build:lint --output_groups=rules_lint_report
+build:lint --remote_download_outputs=all
+
 try-import %workspace%/user.bazelrc

.github/workflows/black.yaml

@@ -13,6 +13,6 @@ jobs:
     runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && 'self-hosted' || 'ubuntu-latest' }}
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - name: Run black
-        uses: psf/black@stable
+        uses: psf/black@87928e6d6761a4a6d22250e1fee5601b3998086e  # 26.5.1

.github/workflows/buildifier.yaml

@@ -15,21 +15,26 @@ jobs:
       fail-fast: false
       matrix:
         check:
+          # Drive buildifier from `git ls-files` instead of `-r .` so the
+          # scan stays inside this repo. With `-r .` buildifier was
+          # recursing into submodule contents (third-party/slang-elab/...)
+          # left on disk by self-hosted runners — files we can't fix from
+          # here since they're upstream-managed.
           - name: Buildifier format
-            run: ./buildifier -r -mode=check -lint=off .
+            run: "git ls-files -z ':(glob)**/*.bzl' ':(glob)**/*.bazel' ':(glob)**/BUILD' ':(glob)**/WORKSPACE' | xargs -0 -r ./buildifier -mode=check -lint=off"
           - name: Buildifier lint
-            run: ./buildifier -r -lint=warn .
+            run: "git ls-files -z ':(glob)**/*.bzl' ':(glob)**/*.bazel' ':(glob)**/BUILD' ':(glob)**/WORKSPACE' | xargs -0 -r ./buildifier -lint=warn"
     name: ${{ matrix.check.name }}
     env:
       BUILDIFIER_VERSION: v8.2.1
 
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
       - name: Cache buildifier
         id: cache-buildifier
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
         with:
           path: ./buildifier
           key: ${{ runner.os }}-buildifier-${{ env.BUILDIFIER_VERSION }}

.github/workflows/first-time-contributor.yml

@@ -14,7 +14,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Greet First-Time Contributor
-        uses: actions/first-interaction@v1
+        uses: actions/first-interaction@34f15e814fe48ac9312ccf29db4e74fa767cbab7  # v1.3.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           issue-message: |

.github/workflows/github-actions-are-differences-found.yml

@@ -8,7 +8,7 @@ jobs:
     runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && 'self-hosted' || 'ubuntu-latest' }}
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           fetch-depth: 0
       - name: Check ok files

.github/workflows/github-actions-are-odb-files-generated.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && 'self-hosted' || 'ubuntu-latest' }}
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           fetch-depth: 0
           submodules: 'recursive'

.github/workflows/github-actions-check-bazel-lock.yml

@@ -10,7 +10,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
-      - name: Verify lock file is up to date
-        run: bazelisk mod deps --lockfile_mode=error
+      - name: Update lock file to check for differences
+        run: |
+          cp MODULE.bazel MODULE.bazel.before
+          bazelisk mod deps --lockfile_mode=update
+
+      - name: Differences to be adressed
+        run: |
+          if ! diff MODULE.bazel.before MODULE.bazel ; then
+            echo "Run"
+            echo "bazelisk mod deps --lockfile_mode=update"
+            echo "and update pull request"
+            exit 1
+          fi

.github/workflows/github-actions-clang-tidy-bazel-post.yml

@@ -0,0 +1,184 @@
+name: clang-tidy-bazel-post
+
+# Runs in the base repository's context with a writable GITHUB_TOKEN, so it
+# can post reviewdog comments on PRs opened from forks (which the upstream
+# `clang-tidy-bazel` workflow cannot, since fork pull_request runs get a
+# read-only token by GitHub's design).
+#
+# Security: this workflow MUST NOT execute untrusted PR code. It only reads
+# the text artifact (clang-tidy.txt) produced by the upstream workflow and
+# the metadata file we wrote there ourselves. No checkout of the PR head,
+# no bazel build, no scripts from the fork.
+
+on:
+  workflow_run:
+    workflows: ["clang-tidy-bazel"]
+    types:
+      - completed
+
+permissions:
+  contents: read
+  pull-requests: write
+  # Needed for actions/download-artifact@v4 to fetch from another workflow.
+  actions: read
+
+jobs:
+  Post-Reviewdog:
+    # Run on success AND failure: Stage A intentionally exits non-zero when
+    # clang-tidy findings exist on the PR diff (to fail the required PR
+    # check), but the artifact is uploaded *before* that fail step, so the
+    # findings are still posted as review comments. Only skip on cancelled.
+    if: ${{ github.event.workflow_run.conclusion != 'cancelled' }}
+    runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && 'self-hosted' || 'ubuntu-latest' }}
+    steps:
+      # Reviewdog's github-pr-review reporter resolves the local git root
+      # before flushing comments and silently no-ops if .git is missing.
+      # Check out the base repo (default branch, shallow) so reviewdog has
+      # a .git directory to operate against. No fork code involved — this
+      # is the base repo at HEAD of its default branch.
+      - name: Check out base repo for reviewdog .git requirement
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          fetch-depth: 1
+          # Default ref in workflow_run context is the base repo's default
+          # branch, which is the safe choice here. Reviewdog uses GitHub
+          # API to fetch the actual PR diff, so the local SHA need not
+          # match the PR head.
+
+      - name: Download clang-tidy artifact
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
+        with:
+          name: clang-tidy-bazel
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Load PR metadata
+        id: meta
+        run: |
+          # pr-meta.txt is produced by the upstream workflow from the
+          # pull_request event payload. It is text we wrote ourselves —
+          # not arbitrary fork content — and is parsed with a strict
+          # allowlist below before being exported.
+          if [ ! -f pr-meta.txt ]; then
+            echo "::error::pr-meta.txt missing from artifact"
+            exit 1
+          fi
+          while IFS='=' read -r key value; do
+            case "$key" in
+              pr_number|head_sha|base_sha|head_repo|base_repo) ;;
+              *) continue ;;
+            esac
+            # Validate values: numbers, hex SHAs, or owner/repo slugs only.
+            case "$key" in
+              pr_number)
+                [[ "$value" =~ ^[0-9]+$ ]] || { echo "::error::bad pr_number"; exit 1; } ;;
+              head_sha|base_sha)
+                [[ "$value" =~ ^[0-9a-f]{40}$ ]] || { echo "::error::bad $key"; exit 1; } ;;
+              head_repo|base_repo)
+                [[ "$value" =~ ^[A-Za-z0-9._-]+/[A-Za-z0-9._-]+$ ]] || { echo "::error::bad $key"; exit 1; } ;;
+            esac
+            echo "$key=$value" >> "$GITHUB_OUTPUT"
+          done < pr-meta.txt
+
+      - name: Synthesize pull_request event payload
+        id: event
+        env:
+          PR_NUMBER: ${{ steps.meta.outputs.pr_number }}
+          HEAD_SHA: ${{ steps.meta.outputs.head_sha }}
+          BASE_SHA: ${{ steps.meta.outputs.base_sha }}
+          HEAD_REPO: ${{ steps.meta.outputs.head_repo }}
+          BASE_REPO: ${{ steps.meta.outputs.base_repo }}
+        run: |
+          # Reviewdog's `github-pr-review` reporter reads GITHUB_EVENT_PATH
+          # expecting a pull_request payload. The real event here is
+          # workflow_run, so we synthesize the minimum payload reviewdog
+          # needs and point GITHUB_EVENT_PATH at it for the next step.
+          EVENT_PATH="${RUNNER_TEMP}/pr-event.json"
+          python3 - <<'PY' > "$EVENT_PATH"
+          import json, os
+          payload = {
+            "action": "synchronize",
+            "number": int(os.environ["PR_NUMBER"]),
+            "pull_request": {
+              "number": int(os.environ["PR_NUMBER"]),
+              "head": {
+                "sha": os.environ["HEAD_SHA"],
+                "repo": {"full_name": os.environ["HEAD_REPO"]},
+              },
+              "base": {
+                "sha": os.environ["BASE_SHA"],
+                "repo": {"full_name": os.environ["BASE_REPO"]},
+              },
+            },
+            "repository": {
+              "full_name": os.environ["BASE_REPO"],
+              "owner": {"login": os.environ["BASE_REPO"].split("/")[0]},
+              "name": os.environ["BASE_REPO"].split("/")[1],
+            },
+          }
+          print(json.dumps(payload))
+          PY
+          echo "event_path=${EVENT_PATH}" >> "$GITHUB_OUTPUT"
+
+      - name: Set up reviewdog
+        uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f  # v1.5.0
+        with:
+          reviewdog_version: latest
+
+      - name: Dump reviewdog-visible env and event payload
+        # Gated on debug re-runs. Reviewdog emits "this is not PullRequest
+        # build" and posts nothing for fork PRs even though the synthesized
+        # pull_request payload is well-formed (verified locally against
+        # reviewdog v0.21.0). Suspect: step-level `env:` cannot override
+        # runner-protected GITHUB_EVENT_PATH / GITHUB_EVENT_NAME, so reviewdog
+        # reads the runner's workflow_run event payload instead of our synth.
+        # This step proves what reviewdog actually sees on the next debug
+        # re-run.
+        if: runner.debug == '1'
+        env:
+          GITHUB_EVENT_NAME: pull_request
+          GITHUB_EVENT_PATH: ${{ steps.event.outputs.event_path }}
+          GITHUB_SHA: ${{ steps.meta.outputs.head_sha }}
+          GITHUB_REPOSITORY: ${{ steps.meta.outputs.base_repo }}
+        run: |
+          echo "::group::GITHUB_* env visible to next step"
+          env | grep -E '^(GITHUB_|RUNNER_|REVIEWDOG_)' | sort
+          echo "::endgroup::"
+          echo "::group::Synth event file location and content"
+          echo "steps.event.outputs.event_path = ${{ steps.event.outputs.event_path }}"
+          echo "Effective GITHUB_EVENT_PATH    = ${GITHUB_EVENT_PATH}"
+          if [ -f "${GITHUB_EVENT_PATH}" ]; then
+            echo "--- file exists, content: ---"
+            cat "${GITHUB_EVENT_PATH}"
+          else
+            echo "::warning::GITHUB_EVENT_PATH file does not exist"
+          fi
+          echo "::endgroup::"
+          echo "::group::Synth file at literal path (should match above)"
+          SYNTH="${{ steps.event.outputs.event_path }}"
+          [ -f "${SYNTH}" ] && cat "${SYNTH}" || echo "missing"
+          echo "::endgroup::"
+
+      - name: Run reviewdog
+        env:
+          REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_EVENT_NAME: pull_request
+          GITHUB_EVENT_PATH: ${{ steps.event.outputs.event_path }}
+          GITHUB_SHA: ${{ steps.meta.outputs.head_sha }}
+          GITHUB_REPOSITORY: ${{ steps.meta.outputs.base_repo }}
+        run: |
+          # On debug re-runs add reviewdog's own -log-level=debug so the
+          # cienv detection trace is visible alongside the env dump above.
+          LOG_FLAGS=()
+          if [ "${RUNNER_DEBUG}" = "1" ]; then
+            LOG_FLAGS+=(-log-level=debug)
+          fi
+          reviewdog \
+            "${LOG_FLAGS[@]}" \
+            -efm="%E%f:%l:%c: error: %m" \
+            -efm="%W%f:%l:%c: warning: %m" \
+            -name="clang-tidy" \
+            -reporter=github-pr-review \
+            -filter-mode=added \
+            -fail-level=any \
+            < clang-tidy.txt