Update Protobuf Bazel Workspace (#7094)

## Summary

This PR updates TensorBoard’s local Bazel/protobuf build stack to stay
compatible with the TensorFlow 2.21 ecosystem changes that this branch
needs:

- Bazel 6.5.0 -> 7.7.0
- protobuf build/runtime alignment to 6.31.1
- related Bazel repo-loading, packaging, and test fixes needed for local
source builds and CI

The goal of this PR is to keep the smallest working set of changes
needed to make the branch build, test, and package correctly with the
upgraded toolchain.

## What changed

### Bazel / workspace updates
- update `.bazelversion` and Bazel version guards to 7.7.0
- update workspace dependencies and repository wiring needed for Bazel 7
- keep existing repo setup model (`WORKSPACE`) rather than switching
this PR to bzlmod

### Protobuf 6.31.1 alignment
- update the Bazel-side protobuf dependency to 6.31.1
- add the small compatibility shims/patches needed for protobuf’s Bazel
build in this repo
- regenerate/update checked-in generated artifacts where required

### rules_closure / Soy compatibility
- keep TensorBoard’s existing Closure/Soy toolchain working with
protobuf 6
- vendor `third_party/safe_html_types` as a build-time Java dependency
override for the existing Soy toolchain
- explicitly prevent `rules_closure_dependencies(...)` from
re-introducing conflicting older transitive copies

### Packaging and test fixes
- keep `tensorboard.compat` package exports working correctly in Bazel
runfiles and wheel/runtime smoke tests
- keep `test_pip_package` and local Bazel test flows working under the
upgraded toolchain
- reduce PR-specific drift where possible by reverting summary modules
back toward upstream import structure

## Vendored code

This PR vendors `third_party/safe_html_types`, which is the main true
vendored code in this branch.

Why it is needed:
- TensorBoard still uses the Closure/Soy Java toolchain during Bazel
builds
- the older transitive safe-html-types classes pulled by that toolchain
were not working for this protobuf 6.31.1 upgrade path
- this vendored copy is used as a build-time dependency override so the
branch can stay on the upgraded Bazel/protobuf stack

Why this is safe:
- it is build-time Java tooling support, not TensorBoard Python runtime
logic
- it is not intended to change TensorBoard user-facing behavior
- it is scoped to keeping the existing Soy/Closure path working with
protobuf 6

We investigated avoiding vendoring here, but the straightforward
`http_archive` alternatives we tried did not work for this branch’s
current dependency combination.

## Review-driven cleanup in this PR

In response to review, this PR now also:
- adds clearer comments for patches and Bazel helper/shim files
- documents the vendored `safe_html_types` dependency more explicitly
- keeps optional cleanup/refactor work out of scope where possible
- simplifies some summary-module changes back toward upstream shape

## Validation

Validated through the local/container workflow used for this branch,
including:
- Bazel repo loading / fetch
- focused and full Bazel test runs
- pip package build
- `test_pip_package` smoke validation
- TensorBoard import/runtime verification against TensorFlow 2.21

## Follow-up work

The following are better handled in follow-up PRs rather than expanding
this one further:
- CI/setup-python cleanup and container-specific Python setup
simplification
- any future move to bzlmod
- further dependency-management cleanup in `third_party/repo.bzl`
- splitting this large change into smaller independently reviewable PRs
once the full working baseline is settled

Author: psamanoelton

.bazelignore

@@ -0,0 +1,2 @@
+.bazel-user-root
+.bazelisk-home

.bazelrc

@@ -1,5 +1,33 @@
+common --noenable_bzlmod
+# Let the OS-specific sections below (`common:linux`, `common:macos`, etc.)
+# take effect so one `.bazelrc` can carry the required per-platform C++ flags.
+common --enable_platform_specific_config
 common --experimental_repo_remote_exec  # from TensorFlow
+# Bazel-generated Python package init files can shadow TensorBoard's real
+# compat package init at test runtime; keep this test-only so pip packaging
+# still copies the intended package tree.
+test --incompatible_default_to_explicit_init_py
 
 # Use C++ backing implementations for Python proto parsing and deserialization,
 # which is much faster (~10x).
 build --define=use_fast_cpp_protos=true
+
+# Protobuf 6.31.1 requires C++17 in this build. Keep the host and target
+# language level aligned across supported platforms.
+common:linux --cxxopt=-std=c++17
+common:linux --host_cxxopt=-std=c++17
+common:macos --cxxopt=-std=c++17
+common:macos --host_cxxopt=-std=c++17
+common:windows --cxxopt=/std:c++17
+common:windows --host_cxxopt=/std:c++17
+
+# Local shells and virtualenvs can leak Python import state into Bazel tests,
+# which then import from the wrong environment instead of the test runfiles.
+test --test_env=PYTHONPATH=
+test --test_env=PYTHONHOME=
+test --test_env=PYTHONSTARTUP=
+test --test_env=PYTHONSAFEPATH=
+test --test_env=PYTHONNOUSERSITE=1
+test --test_env=PYTHONUSERBASE=
+test --test_env=BUILD_WORKSPACE_DIRECTORY=
+test --test_env=BUILD_WORKING_DIRECTORY=

.bazelversion

@@ -1 +1 @@
-6.5.0
+7.7.0

.gitattributes

@@ -1 +1,10 @@
+* text=auto
+*.bzl text eol=lf
+*.sh text eol=lf
+.bazel* text eol=lf
+BUILD text eol=lf
+BUILD.bazel text eol=lf
+WORKSPACE text eol=lf
+MODULE.bazel text eol=lf
+
 third_party/rust/** -diff -merge linguist-generated=true

.github/workflows/ci.yml

@@ -25,8 +25,8 @@ permissions:
 env:
   # Keep this Bazel version in sync with the `versions.check` directive
   # in our WORKSPACE file.
-  BAZEL_VERSION: '6.5.0'
-  BAZEL_SHA256SUM: 'a40ac69263440761199fcb8da47ad4e3f328cbe79ffbf4ecc14e5ba252857307'
+  BAZEL_VERSION: '7.7.0'
+  BAZEL_SHA256SUM: 'fe7e799cbc9140f986b063e06800a3d4c790525075c877d00a7112669824acbf'
   BUILDTOOLS_VERSION: '3.0.0'
   BUILDIFIER_SHA256SUM: 'e92a6793c7134c5431c58fbc34700664f101e5c9b1c1fcd93b97978e8b7f88db'
   BUILDOZER_SHA256SUM: '3d58a0b6972e4535718cdd6c12778170ea7382de7c75bc3728f5719437ffb84d'
@@ -48,7 +48,7 @@ jobs:
       fail-fast: false
       matrix:
         tf_version_id: ['tf', 'notf']
-        python_version: ['3.9']
+        python_version: ['3.10']
     steps:
       - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
       - uses: actions/setup-python@13ae5bb136fac2878aff31522b9efb785519f984 # v4.3.0
@@ -65,6 +65,11 @@ jobs:
         run: |
           python -m pip install -U pip
           pip install "${TENSORFLOW_VERSION}"
+          # tf-nightly currently pulls in tb-nightly as a dependency. Bazel's
+          # source-tree tests must import TensorBoard from runfiles rather than
+          # from site-packages, otherwise tests that rely on local-only modules
+          # like `tensorboard.test` resolve against the installed wheel and fail.
+          pip uninstall -y tensorboard tb-nightly || true
         if: matrix.tf_version_id != 'notf'
       - name: 'Install Python dependencies'
         run: |
@@ -73,14 +78,85 @@ jobs:
             -r ./tensorboard/pip_package/requirements.txt \
             -r ./tensorboard/pip_package/requirements_dev.txt \
             ;
-      - name: 'Install Chrome dependencies'
+      - name: 'Install system dependencies'
         run: |
+          py_abi="python${{ matrix.python_version }}"
           sudo apt-get update
-          sudo apt-get install -y libgbm-dev libxss1 libasound2
+          sudo apt-get install -y "${py_abi}-dev" libgbm-dev libxss1 libasound2
+          # Bazel's system_python repository resolves headers relative to the
+          # interpreter installed by actions/setup-python. The self-hosted
+          # ml-build container does not provide Python.h under that prefix, so
+          # copy the system headers into the managed interpreter include dir.
+          # A real directory copy is more robust here than a symlink because
+          # Bazel's repository setup may materialize or traverse this path in
+          # ways that do not preserve symlink behavior.
+          sudo mkdir -p "${pythonLocation}/include"
+          sudo rm -rf "${pythonLocation}/include/${py_abi}"
+          sudo mkdir -p "${pythonLocation}/include/${py_abi}"
+          sudo cp -a "/usr/include/${py_abi}/." "${pythonLocation}/include/${py_abi}/"
+          includepy="$(python - <<'PY'
+          import sysconfig
+          print(sysconfig.get_config_var("INCLUDEPY"))
+          PY
+          )"
+          # upb's system_python repository rule shells out to `python3` and
+          # uses sysconfig.get_config_var("INCLUDEPY"), which under
+          # actions/setup-python inside this container points at
+          # /opt/hostedtoolcache/... rather than ${pythonLocation}. Materialize
+          # that INCLUDEPY path too so Bazel's @system_python repo can symlink
+          # real headers into external/system_python/python.
+          sudo mkdir -p "$(dirname "${includepy}")"
+          sudo rm -rf "${includepy}"
+          sudo cp -a "${pythonLocation}/include/${py_abi}" "${includepy}"
+          test -f "${pythonLocation}/include/${py_abi}/Python.h"
+          test -f "${includepy}/Python.h"
+      - name: 'Debug Python toolchain'
+        run: |
+          py_abi="python${{ matrix.python_version }}"
+          echo "pythonLocation=${pythonLocation}"
+          echo "PATH=${PATH}"
+          which python
+          python --version
+          command -v python3.10-config || true
+          python3.10-config --includes || true
+          python - <<'PY'
+          import os
+          import pathlib
+          import sys
+          import sysconfig
+
+          print("sys.executable =", sys.executable)
+          for key in ("include", "platinclude", "stdlib", "platstdlib", "scripts", "data"):
+              print(f"{key} =", sysconfig.get_path(key))
+          for key in ("INCLUDEPY", "CONFINCLUDEPY", "LIBDIR", "LDLIBRARY", "MULTIARCH"):
+              print(f"{key} =", sysconfig.get_config_var(key))
+          include_dir = pathlib.Path(sysconfig.get_path("include"))
+          print("include_dir exists =", include_dir.exists(), include_dir)
+          print("Python.h exists =", (include_dir / "Python.h").exists())
+          print("pythonLocation =", os.environ.get("pythonLocation"))
+          PY
+          ls -la "${pythonLocation}" || true
+          ls -la "${pythonLocation}/include" || true
+          ls -la "${pythonLocation}/include/${py_abi}" || true
       - name: 'Check Pip state'
         run: pip freeze --all
       - name: 'Bazel: fetch'
         run: bazel fetch //tensorboard/...
+      - name: 'Debug Bazel system_python repo'
+        run: |
+          output_base="$(bazel info output_base)"
+          echo "output_base=${output_base}"
+          find "${output_base}/external/system_python" -maxdepth 3 \
+            \( -name 'Python.h' -o -name 'BUILD.bazel' -o -name 'WORKSPACE' \) \
+            -print | sort || true
+          if [ -f "${output_base}/external/system_python/BUILD.bazel" ]; then
+            sed -n '1,200p' "${output_base}/external/system_python/BUILD.bazel"
+          fi
+          if [ -d "${output_base}/external/system_python/python" ]; then
+            ls -la "${output_base}/external/system_python/python"
+          else
+            echo "system_python/python directory not found"
+          fi
       - name: 'Bazel: build'
         # Note we suppress a flood of warnings from the proto compiler.
         # Googlers see b/222706811 & b/182876485 discussion and preconditions
@@ -98,13 +174,21 @@ jobs:
         if: matrix.tf_version_id == 'notf'
       - name: 'Bazel: run Pip package test (with TensorFlow support)'
         run: |
-          bazel run //tensorboard/pip_package:test_pip_package -- \
+          # `bazel run` has been flaky under this self-hosted container runner
+          # even when the smoke test itself completes successfully. Build the
+          # launcher target, invoke the generated binary directly, then shut
+          # down the Bazel server so the step exits cleanly.
+          bazel build //tensorboard/pip_package:test_pip_package
+          ./bazel-bin/tensorboard/pip_package/test_pip_package \
             --tf-version "${TENSORFLOW_VERSION}"
+          bazel shutdown
         if: matrix.tf_version_id != 'notf'
       - name: 'Bazel: run Pip package test (non-TensorFlow only)'
         run: |
-          bazel run //tensorboard/pip_package:test_pip_package -- \
+          bazel build //tensorboard/pip_package:test_pip_package
+          ./bazel-bin/tensorboard/pip_package/test_pip_package \
             --tf-version notf
+          bazel shutdown
         if: matrix.tf_version_id == 'notf'
       - name: 'Bazel: run manual tests'
         run: |