[pull] trunk from SeleniumHQ:trunk

.bazelrc

@@ -154,8 +154,14 @@ test:node_debug --test_output=streamed --test_strategy=exclusive --test_timeout=
 test:ruby_debug --test_output=streamed --test_env=RUBY_DEBUG_FORK_MODE=parent --run_under="@bundle//bin:rdbg --nonstop --open --command"
 
 
+# @llvm defaults to 14.0.
+build --macos_minimum_os=11.0
+
 build:release --stamp
 build:release --compilation_mode=opt
+# Match [profile.release] in rust/Cargo.toml, which Bazel doesn't read.
+build:release --@rules_rust//rust/settings:lto=fat
+build:release --@rules_rust//rust/settings:extra_rustc_flags=-Copt-level=z,-Ccodegen-units=1,-Cpanic=abort,-Cstrip=symbols
 
 # As regular `release` but all the build work happens on the RBE
 build:rbe_release --config=release

.github/workflows/check-authorization.yml

@@ -0,0 +1,19 @@
+name: Check Authorization
+
+permissions: {}
+
+on:
+  workflow_call:
+
+jobs:
+  check-authorization:
+    name: Check Authorization
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fail for unauthorized actor
+        if: ${{ !contains(fromJSON('["AutomatedTester","selenium-ci","jimevans","p0deje","titusfortner","bonigarcia","diemol","pujagani","harsha509"]'), github.actor) }}
+        env:
+          ACTOR: ${{ github.actor }}
+        run: |
+          echo "::error::@${ACTOR} is not authorized to run this workflow"
+          exit 1

.github/workflows/ci-ruby.yml

@@ -57,6 +57,7 @@ jobs:
       ruby-version: ${{ matrix.ruby-version }}
       run: >
         bazel test
+        --build_tests_only
         --keep_going
         --test_size_filters small
         //rb/...
@@ -82,6 +83,7 @@ jobs:
       run: >
         [ -s bazel-targets-rb.txt ] || echo //rb/... > bazel-targets-rb.txt;
         ./scripts/github-actions/bazel-test-if-targets.sh
+        --build_tests_only
         --keep_going
         --flaky_test_attempts 2
         --local_test_jobs 1
@@ -114,6 +116,7 @@ jobs:
       rerun-with-debug: true
       run: >
         bazel test
+        --build_tests_only
         --keep_going
         --flaky_test_attempts 2
         --local_test_jobs 1

.github/workflows/ci.yml

@@ -25,37 +25,46 @@ jobs:
     if: (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && github.ref == 'refs/heads/trunk'
     uses: ./.github/workflows/ci-build-index.yml
 
+  targets-mode:
+    name: Targets Mode
+    runs-on: ubuntu-latest
+    outputs:
+      mode: ${{ steps.mode.outputs.mode }}
+    steps:
+      - name: Decide whether to compute affected targets
+        id: mode
+        run: |
+          if [ "${{ github.event.repository.fork }}" = "true" ] || [ "${{ startsWith(github.head_ref, 'renovate/') }}" = "true" ]; then
+            mode=none
+          elif { [ "${{ github.event_name }}" != "pull_request" ] && [ "${{ github.event_name }}" != "push" ]; } || [ "${{ startsWith(github.head_ref, 'release-preparation-') }}" = "true" ]; then
+            mode=all
+          else
+            mode=check
+          fi
+          echo "mode=$mode" >> "$GITHUB_OUTPUT"
+
   check:
     name: Check Targets
-    if: >
-      github.event.repository.fork == false &&
-        (startsWith(github.head_ref, 'renovate/') != true || github.event_name == 'workflow_call')
+    needs: targets-mode
+    if: needs.targets-mode.outputs.mode == 'check'
     uses: ./.github/workflows/bazel.yml
     with:
       name: Check Targets
       cache-name: bazel-test-file-index
       run: |
-        if [ "${{ github.event_name }}" == "schedule" ] || \
-        [ "${{ github.event_name }}" == "workflow_call" ] || \
-        [ "${{ github.event_name }}" == "workflow_dispatch" ] || \
-        [ "${{ startsWith(github.head_ref, 'release-preparation-') }}" == "true" ]; then
-          echo "Running all targets for ${{ github.event_name }} event"
-          echo "//java/... //py/... //rb/... //dotnet/... //rust/... //javascript/..." > bazel-targets.txt
+        if [ -n "${{ github.event.pull_request.base.sha }}" ]; then
+          BASE_SHA="HEAD^1"
+        elif [ "${{ github.ref }}" = "refs/heads/trunk" ]; then
+          BASE_SHA="${{ github.event.before }}"
         else
-          if [ -n "${{ github.event.pull_request.base.sha }}" ]; then
-            BASE_SHA="HEAD^1"
-          elif [ "${{ github.ref }}" = "refs/heads/trunk" ]; then
-            BASE_SHA="${{ github.event.before }}"
-          else
-            ahead=$(gh api "repos/${{ github.repository }}/compare/trunk...${{ github.ref_name }}" --jq .ahead_by)
-            git fetch --no-tags --depth=$((ahead + 1)) origin "${{ github.ref_name }}"
-            BASE_SHA="HEAD~$ahead"
-          fi
-          if git cat-file -e "${BASE_SHA}^{commit}" 2>/dev/null; then
-            ./go bazel:affected_targets "${BASE_SHA}..HEAD" bazel-test-file-index
-          else
-            ./go bazel:affected_targets bazel-test-file-index
-          fi
+          ahead=$(gh api "repos/${{ github.repository }}/compare/trunk...${{ github.ref_name }}" --jq .ahead_by)
+          git fetch --no-tags --depth=$((ahead + 1)) origin "${{ github.ref_name }}"
+          BASE_SHA="HEAD~$ahead"
+        fi
+        if git cat-file -e "${BASE_SHA}^{commit}" 2>/dev/null; then
+          ./go bazel:affected_targets "${BASE_SHA}..HEAD" bazel-test-file-index
+        else
+          ./go bazel:affected_targets bazel-test-file-index
         fi
       artifact-name: check-targets
       artifact-path: |
@@ -64,7 +73,8 @@ jobs:
 
   read-targets:
     name: Read Targets
-    needs: check
+    needs: [targets-mode, check]
+    if: "!cancelled() && (needs.targets-mode.outputs.mode == 'all' || needs.check.result == 'success')"
     runs-on: ubuntu-latest
     outputs:
       java: ${{ steps.read.outputs.java }}
@@ -77,9 +87,13 @@ jobs:
       compile-manager: ${{ steps.read.outputs.compile-manager }}
     steps:
       - name: Download targets
+        if: needs.targets-mode.outputs.mode == 'check'
         uses: actions/download-artifact@v8
         with:
           name: check-targets
+      - name: Use every target
+        if: needs.targets-mode.outputs.mode == 'all'
+        run: echo "//java/... //py/... //rb/... //dotnet/... //rust/... //javascript/..." > bazel-targets.txt
       - name: Read targets
         id: read
         env:
@@ -194,7 +208,7 @@ jobs:
   ci-success:
     name: CI Success
     if: always()
-    needs: [check, read-targets, dotnet, java, grid, python, ruby, rust, javascript]
+    needs: [targets-mode, check, read-targets, dotnet, java, grid, python, ruby, rust, javascript]
     runs-on: ubuntu-latest
     steps:
       - name: Verify required jobs succeeded

.github/workflows/pre-release.yml

@@ -85,12 +85,11 @@ jobs:
     needs: [parse-tag, verify-cdp]
     uses: ./.github/workflows/restrict-trunk.yml
     with:
-      restrict: true
       message: |
         Trunk branch has been restricted for release preparation (${{ inputs.tag }}).
         To abandon the release, close the release preparation PR without merging and trunk will unlock automatically.
-        If trunk is still locked, run the "Unlock Trunk" workflow:
-        https://github.com/${{ github.repository }}/actions/workflows/unlock-trunk.yml
+        If trunk is still locked, run the "Manage Trunk Restrictions" workflow, which unlocks by default:
+        https://github.com/${{ github.repository }}/actions/workflows/restrict-trunk.yml
     secrets:
       SELENIUM_CI_TOKEN: ${{ secrets.SELENIUM_CI_TOKEN }}
       SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
@@ -302,8 +301,7 @@ jobs:
     if: always() && needs.restrict-trunk.result == 'success' && needs.create-pr.result != 'success'
     uses: ./.github/workflows/restrict-trunk.yml
     with:
-      restrict: false
-      skip_approval: true
+      unlock: true
     secrets:
       SELENIUM_CI_TOKEN: ${{ secrets.SELENIUM_CI_TOKEN }}
       SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

.github/workflows/release.yml

@@ -32,7 +32,7 @@ jobs:
       github.event.pull_request.merged == false
     uses: ./.github/workflows/restrict-trunk.yml
     with:
-      restrict: false
+      unlock: true
       message: "Trunk has been unlocked: ${{ github.event.pull_request.head.ref }} was closed without merging."
     secrets:
       SELENIUM_CI_TOKEN: ${{ secrets.SELENIUM_CI_TOKEN }}
@@ -71,19 +71,14 @@ jobs:
     with:
       tag: ${{ needs.extract-tag.outputs.tag }}
 
-  get-approval:
-    name: Get Approval
-    needs: parse-tag
-    uses: ./.github/workflows/get-approval.yml
-    with:
-      title: Release approval required
-      message: "Approval is required to publish ${{ needs.parse-tag.outputs.tag }}."
-    secrets:
-      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+  check-authorization:
+    name: Check Authorization
+    needs: extract-tag
+    uses: ./.github/workflows/check-authorization.yml
 
   create-tag:
     name: Create Tag
-    needs: [parse-tag, get-approval]
+    needs: [parse-tag, check-authorization]
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -104,7 +99,7 @@ jobs:
 
   github-release-draft:
     name: GitHub Release Draft
-    needs: [parse-tag, get-approval]
+    needs: [parse-tag, check-authorization]
     if: needs.parse-tag.outputs.language == 'all'
     runs-on: ubuntu-latest
     permissions:
@@ -143,7 +138,7 @@ jobs:
 
   publish:
     name: Build and Publish ${{ matrix.language }}
-    needs: [parse-tag, get-approval]
+    needs: [parse-tag, check-authorization]
     permissions:
       contents: read
       id-token: write
@@ -169,7 +164,7 @@ jobs:
 
   build-python:
     name: Build Python
-    needs: [parse-tag, get-approval]
+    needs: [parse-tag, check-authorization]
     if: needs.parse-tag.outputs.language == 'all' || needs.parse-tag.outputs.language == 'python'
     uses: ./.github/workflows/bazel.yml
     with:
@@ -282,7 +277,7 @@ jobs:
 
   reset-version:
     name: Generate Nightly Versions
-    needs: [parse-tag, get-approval]
+    needs: [parse-tag, check-authorization]
     uses: ./.github/workflows/bazel.yml
     with:
       name: Reset Versions
@@ -312,7 +307,7 @@ jobs:
   # The build can run any time; only publish-nightly-grid has to sit between those two jobs.
   nightly-grid:
     name: Build Nightly Grid
-    needs: [parse-tag, get-approval]
+    needs: [parse-tag, check-authorization]
     if: needs.parse-tag.outputs.language == 'all'
     uses: ./.github/workflows/bazel.yml
     with:
@@ -349,16 +344,16 @@ jobs:
       (needs.mirror.result == 'success' || needs.mirror.result == 'skipped')
     uses: ./.github/workflows/restrict-trunk.yml
     with:
-      restrict: false
+      unlock: true
     secrets:
       SELENIUM_CI_TOKEN: ${{ secrets.SELENIUM_CI_TOKEN }}
       SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
 
   on-release-complete:
     name: On Release Complete
     runs-on: ubuntu-latest
-    needs: [extract-tag, publish, publish-python, docs, create-tag, github-release-draft, github-release-publish, reset-version, update-version, publish-nightly-grid, mirror, verify, unrestrict-trunk]
-    if: always() && !cancelled() && needs.extract-tag.result != 'skipped'
+    needs: [extract-tag, check-authorization, publish, publish-python, docs, create-tag, github-release-draft, github-release-publish, reset-version, update-version, publish-nightly-grid, mirror, verify, unrestrict-trunk]
+    if: always() && !cancelled() && needs.extract-tag.result != 'skipped' && needs.check-authorization.result != 'failure'
     steps:
       - uses: actions/checkout@v6
       - name: Slack Notification