Release mechanics: per-build mangle-seed header, Starlark hash ports, leaner archive

.github/workflows/main.yml

@@ -59,68 +59,18 @@ jobs:
       - uses: pre-commit-ci/lite-action@v1.0.2
         if: always()
 
-  benchmark:
-    needs: [trunk, pre-commit]
-    # Informational only (hence continue-on-error): shared runners are noisy, so
-    # these numbers are for architecture/compiler shape comparisons (x86_64 gcc
-    # vs arm64 Apple clang) and gross regressions, not precise gating. Results
-    # appear in the job log and as a JSON artifact per OS.
-    #
-    # Runs only on `main`, and only when something under mbo/hash actually
-    # changed - there is nothing to compare otherwise, and no reason to spend
-    # runner time or risk noise on unrelated pushes.
-    if: github.ref == 'refs/heads/main'
-    continue-on-error: true
-    strategy:
-      matrix:
-        os: [ubuntu-latest, macos-26]
-    runs-on: ${{matrix.os}}
-    steps:
-      - uses: actions/checkout@v6
-      - uses: dorny/paths-filter@v3
-        id: changes
-        with:
-          filters: |
-            hash:
-              - 'mbo/hash/**'
-      - uses: bazelbuild/setup-bazelisk@v3
-        if: steps.changes.outputs.hash == 'true'
-      - name: Run hash benchmark
-        if: steps.changes.outputs.hash == 'true'
-        # Fast (README) size set; the tool's precautions (interleaving + warmup)
-        # and 9 repetitions so the artifact is comparable with google/benchmark's
-        # compare.py. The full-size dataset is measured out of band (see
-        # mbo/hash/measurements/).
-        run: |
-          bazel run -c opt //mbo/hash:hash_benchmark -- \
-            --benchmark_min_time=0.2s \
-            --benchmark_repetitions=9 \
-            --benchmark_min_warmup_time=0.05s \
-            --benchmark_enable_random_interleaving=true \
-            --benchmark_report_aggregates_only=true \
-            --benchmark_out="${GITHUB_WORKSPACE}/hash_benchmark.json" \
-            --benchmark_out_format=json
-      - uses: actions/upload-artifact@v4
-        if: steps.changes.outputs.hash == 'true'
-        with:
-          name: hash-benchmark-${{matrix.os}}
-          path: hash_benchmark.json
-
   test-gcc:
     needs: [trunk, pre-commit]
     secrets: inherit
     strategy:
       matrix:
         os: [ubuntu-latest]
         compiler: [gcc]
-        gcc_version: [13, 14]
+        # gcc 14 gets the full config set (asan/cpp23/opt) here, early. gcc 13 is
+        # still built (opt) later by test-bcr's ubuntu+gcc rungs, so it need not
+        # repeat in this job.
+        gcc_version: [14]
         bazel_config: [asan, cpp23, opt]
-        # Using `include` does not make the options show up in the generated config names...
-        exclude:
-          - bazel_config: asan
-            gcc_version: 13
-          - bazel_config: cpp23
-            gcc_version: 13
 
     uses: ./.github/workflows/test.yml
     with:
@@ -138,21 +88,29 @@ jobs:
         os: [ubuntu-latest, macos-26]
         compiler: [gcc, native, clang]
         gcc_version: [13]
-        llvm_version: [20.1.8]
+        # The pinned default toolchain (see bazelmod/llvm.MODULE.bazel).
+        llvm_version: [22.1.8]
         bazel_config: [opt]
-        # Bazel-version compatibility rungs, crossed with the os/compiler combos
-        # below. 7.2.1 is the earliest 7.x that works: MODULE.bazel uses
-        # `include()` (added in 7.2.0, so 7.1.x fails with "name 'include' is not
-        # defined") and the dep `depend_on_what_you_use@0.16.0` declares
-        # `bazel_compatibility: [>=7.2.1]` (so 7.2.0 is rejected too). Plus the
-        # latest 8.x (8.7.0), the latest 9.0.x (9.0.2), and the checked-in
-        # default 9.1.1.
-        bazel_version: [7.2.1, 8.7.0, 9.0.2, 9.1.1]
+        # Bazel-version compatibility rungs: one per supported major (we test
+        # the last three, 7/8/9), crossed with the os/compiler combos below.
+        # 7.2.1 is the earliest 7.x that works: MODULE.bazel uses `include()`
+        # (added in 7.2.0, so 7.1.x fails with "name 'include' is not defined")
+        # and the dep `depend_on_what_you_use@0.16.0` declares
+        # `bazel_compatibility: [>=7.2.1]` (so 7.2.0 is rejected too). 8.7.0 is
+        # the latest 8.x; 9.1.1 is the latest 9.x and the checked-in default.
+        bazel_version: [7.2.1, 8.7.0, 9.1.1]
         exclude:
           - os: ubuntu-latest
             compiler: native
           - os: macos-26
             compiler: gcc
+          # The 7.x/8.x rungs are a build-system-compat check (MODULE.bazel
+          # loading, rules resolution) - platform-agnostic, so run them on
+          # ubuntu only. macOS keeps the default 9.1.1 for platform coverage.
+          - os: macos-26
+            bazel_version: 7.2.1
+          - os: macos-26
+            bazel_version: 8.7.0
 
     uses: ./.github/workflows/test.yml
     with:
@@ -172,40 +130,35 @@ jobs:
         os: [ubuntu-latest, macos-26]
         compiler: [clang]
         # Hermetic toolchains_llvm clang (independent of the runner's Apple clang).
-        # Ladder: working default (20), macOS native match (21 = Apple clang 21), newest (22).
+        # Ladder: oldest supported (20.1.8) and the pinned default, also newest (22.1.8).
         # TODO(llvm-23): add 23.x here once released and listed in toolchains_llvm.
-        llvm_version: [20.1.8, 21.1.8, 22.1.8]
-        bazel_config: [asan, cpp23, fastbuild, opt]
+        llvm_version: [20.1.8, 22.1.8]
+        bazel_config: [asan, cpp23, opt]
         exclude:
-          # macOS asan works via toolchains_llvm's @loader_path rpath fix for the
-          # sanitizer runtime dylib (helly25 fork; upstream PR #767), on LLVM
-          # 22.1.8. 20.1.8 still hangs in compiler-rt FindDynamicShadowStart on
-          # macOS 26, so exclude only that combo; macOS asan rides the 22.1.8 rung.
-          - os: macos-26
-            llvm_version: 20.1.8
+          # asan runs only on the newest toolchain (both platforms); test-gcc
+          # already exercises asan early (gcc 14). macOS asan must be 22.1.8
+          # regardless - 20.1.8 hangs in compiler-rt FindDynamicShadowStart on
+          # macOS 26, while 22.1.8's sanitizer dylib uses toolchains_llvm's
+          # @loader_path rpath fix (helly25 fork; upstream PR #767) - so
+          # consolidating asan there also drops the redundant clang-20 asan.
+          - llvm_version: 20.1.8
             bazel_config: asan
-          # 20.1.8 is the default pin -> full config coverage
-          # 21.1.8 less coverage, just check opt
-          # 22.1.8 keep the complex configs, just drop fastbuild
-          - llvm_version: 21.1.8
-            bazel_config: asan
-          - llvm_version: 21.1.8
+          # C++23 is used on recent compilers, so exercise cpp23 on the newest
+          # clang only; the oldest rung just proves the minimum supported LLVM
+          # still builds (opt).
+          - llvm_version: 20.1.8
             bazel_config: cpp23
-          - llvm_version: 21.1.8
-            bazel_config: fastbuild
-          - llvm_version: 22.1.8
-            bazel_config: fastbuild
 
     uses: ./.github/workflows/test.yml
     with:
-      continue-on-error: true
+      continue-on-error: false
       os: ${{ matrix.os }}
       compiler: ${{ matrix.compiler }}
       llvm_version: ${{ matrix.llvm_version }}
       bazel_config: ${{ matrix.bazel_config }}
 
   done:
-    needs: [trunk, pre-commit, benchmark, test-gcc, test-clang, test-bcr]
+    needs: [trunk, pre-commit, test-gcc, test-clang, test-bcr]
     if: always()
     runs-on: ubuntu-latest
     steps:

.github/workflows/release_prep.sh

@@ -66,9 +66,13 @@ done
 # Exclude some dev stuff from the archive.
 EXCLUDES=(
   ".bcr"
+  ".gitattributes"
   ".github"
+  ".gitignore"
   ".pre-commit"
   ".pre-commit-config.yaml"
+  ".trunk"
+  "mbo/hash/measurements"
   "tools"
 )
 {