Fix and ensure Java 8/11 compatibility of prebuilt Java tools

Prebuilt Java tools meant to run on the user-specified `--java_{tool_,}runtime_version` must only use Java 8 language features and APIs. Previously, these tools were compiled with `--java_language_version=8`, but had access to a JDK 21 as the bootclasspath. In fact, `junitrunner` used `Stream#dropWhile`, which isn't available in a JDK 8.
Similarly, Java tools meant to run on the Java runtime provided by a Java (compilation) toolchain must only use Java 11 language features and APIs. This was the case, but they were in fact build with `--java_language_version=8` and a JDK 21, just like the other tools.

This PR splits tools into two groups and enforces consistent Java language and bootclasspath runtime for them via `--@rules_java//toolchains:incompatible_language_version_bootclasspath`. Constants in `//src:release_archive.bzl` can be used to set the two minimum versions globally.

Author: fmeum

.bazelrc

@@ -52,10 +52,13 @@ build:windows --per_file_copt=external/.*@/w
 build:windows --host_per_file_copt=external/.*@/w
 
 # Enable Java 21 language features
-build --java_runtime_version=21
-build --java_language_version=21
-build --tool_java_language_version=21
-build --tool_java_runtime_version=21
+common --java_runtime_version=21
+common --java_language_version=21
+common --tool_java_language_version=21
+common --tool_java_runtime_version=21
+# Ensure that Java language level and bootclasspath version are the same.
+# This avoids accidental usage of more recent Java APIs.
+common --@rules_java//toolchains:incompatible_language_version_bootclasspath
 
 # User-specific .bazelrc
 try-import %workspace%/user.bazelrc

src/BUILD

@@ -6,8 +6,7 @@ load("@rules_cc//cc:cc_binary.bzl", "cc_binary")
 load("@rules_java//java:java_binary.bzl", "java_binary")
 load("@rules_python//python:defs.bzl", "py_binary", "py_library")
 load("@rules_shell//shell:sh_binary.bzl", "sh_binary")
-load("//src:build_defs.bzl", "transition_java_language_8_archive")
-load("//src:release_archive.bzl", "release_archive")
+load("//src:release_archive.bzl", "minimum_java_compilation_runtime_filegroup", "minimum_java_runtime_filegroup", "release_archive")
 load(":embedded_tools.bzl", "srcsfile")
 load(":rule_size_test.bzl", "rule_size_test")
 
@@ -512,19 +511,33 @@ genrule(
 )
 
 # Following targets build java_tools.zip - platform independent part of java_tools
-JAVA_TOOLS_DEPLOY_JARS = [
-    "//src/java_tools/buildjar:JavaBuilder_deploy.jar",
-    "//src/java_tools/buildjar:VanillaJavaBuilder_deploy.jar",
-    "//src/java_tools/buildjar/java/com/google/devtools/build/buildjar/genclass:GenClass_deploy.jar",
-    "//src/java_tools/buildjar/java/com/google/devtools/build/java/turbine:turbine_direct_binary_deploy.jar",
-    "//src/java_tools/import_deps_checker/java/com/google/devtools/build/importdeps:ImportDepsChecker_deploy.jar",
-    "//src/java_tools/junitrunner/java/com/google/testing/coverage:JacocoCoverage_jarjar_deploy.jar",
-    "//src/java_tools/junitrunner/java/com/google/testing/junit/runner:Runner_deploy.jar",
-]
+minimum_java_runtime_filegroup(
+    name = "minimum_java_runtime_tools",
+    srcs = [
+        "//src/java_tools/junitrunner/java/com/google/testing/coverage:JacocoCoverage_jarjar_deploy.jar",
+        "//src/java_tools/junitrunner/java/com/google/testing/junit/runner:Runner_deploy.jar",
+    ],
+    visibility = ["//visibility:private"],
+)
+
+minimum_java_compilation_runtime_filegroup(
+    name = "minimum_java_compilation_runtime_tools",
+    srcs = [
+        "//src/java_tools/buildjar:JavaBuilder_deploy.jar",
+        "//src/java_tools/buildjar:VanillaJavaBuilder_deploy.jar",
+        "//src/java_tools/buildjar/java/com/google/devtools/build/buildjar/genclass:GenClass_deploy.jar",
+        "//src/java_tools/buildjar/java/com/google/devtools/build/java/turbine:turbine_direct_binary_deploy.jar",
+        "//src/java_tools/import_deps_checker/java/com/google/devtools/build/importdeps:ImportDepsChecker_deploy.jar",
+    ],
+    visibility = ["//visibility:private"],
+)
 
 release_archive(
     name = "jars_java_tools_zip",
-    srcs = JAVA_TOOLS_DEPLOY_JARS,
+    srcs = [
+        ":minimum_java_compilation_runtime_tools",
+        ":minimum_java_runtime_tools",
+    ],
     package_dir = "java_tools",
     visibility = ["//visibility:private"],
 )
@@ -545,12 +558,6 @@ release_archive(
     ],
 )
 
-transition_java_language_8_archive(
-    name = "java_tools_java8.zip",
-    archive_zip = ":java_tools.zip",
-    visibility = ["//src/test/shell/bazel:__pkg__"],
-)
-
 release_archive(
     name = "turbine_direct_graal_zip",
     srcs = ["//src/java_tools/buildjar/java/com/google/devtools/build/java/turbine:turbine_direct_graal"],
@@ -573,12 +580,6 @@ release_archive(
     ],
 )
 
-transition_java_language_8_archive(
-    name = "java_tools_prebuilt_java8.zip",
-    archive_zip = ":java_tools_prebuilt.zip",
-    visibility = ["//src/test/shell/bazel:__pkg__"],
-)
-
 # Following targets used by the java_tools_binaries Buildkite pipeline to upload
 # the java_tools_*.zip to either tmp/sources or tmp/build directories in GCS.
 sh_binary(
@@ -664,11 +665,6 @@ filegroup(
     ],
 )
 
-bzl_library(
-    name = "build_defs_bzl",
-    srcs = ["build_defs.bzl"],
-)
-
 java_binary(
     name = "CheckSunJnuEncoding",
     srcs = ["CheckSunJnuEncoding.java"],

src/build_defs.bzl

@@ -14,10 +14,8 @@
 
 package com.google.testing.junit.runner.internal;
 
-import static java.util.Arrays.stream;
-import static java.util.stream.Collectors.toList;
-
 import java.io.PrintStream;
+import java.util.ArrayList;
 import java.util.List;
 
 /**
@@ -28,40 +26,41 @@
  */
 public class SystemExitDetectingShutdownHook {
   public static Thread newShutdownHook(PrintStream testRunnerOut) {
-    Runnable hook = () -> {
-      boolean foundRuntimeExit = false;
-      for (StackTraceElement[] stack : Thread.getAllStackTraces().values()) {
-        @SuppressWarnings("JdkCollectors") // can't use ImmutableList here
-        List<String> framesStartingWithRuntimeExit =
-            stream(stack)
-                .dropWhile(
-                    frame ->
-                        !frame.getClassName().equals("java.lang.Runtime")
-                            || !frame.getMethodName().equals("exit"))
-                .map(SystemExitDetectingShutdownHook::frameString)
-                .collect(toList());
-        if (!framesStartingWithRuntimeExit.isEmpty()) {
-          foundRuntimeExit = true;
-          testRunnerOut.println("\nSystem.exit or Runtime.exit was called!");
-          testRunnerOut.println(String.join("\n", framesStartingWithRuntimeExit));
-        }
-      }
-      if (foundRuntimeExit) {
-        // We must call halt rather than exit, because exit would lead to a deadlock. We use a
-        // hopefully unique exit code to make it easier to identify this case.
-        Runtime.getRuntime().halt(121);
-      }
-    };
+    Runnable hook =
+        () -> {
+          boolean foundRuntimeExit = false;
+          for (StackTraceElement[] stack : Thread.getAllStackTraces().values()) {
+            List<String> framesStartingWithRuntimeExit = new ArrayList<>();
+            boolean foundRuntimeExitInThisThread = false;
+            for (StackTraceElement frame : stack) {
+              if (!foundRuntimeExitInThisThread
+                  && frame.getClassName().equals("java.lang.Runtime")
+                  && frame.getMethodName().equals("exit")) {
+                foundRuntimeExitInThisThread = true;
+              }
+              if (foundRuntimeExitInThisThread) {
+                framesStartingWithRuntimeExit.add(frameString(frame));
+              }
+            }
+            if (foundRuntimeExitInThisThread) {
+              foundRuntimeExit = true;
+              testRunnerOut.println("\nSystem.exit or Runtime.exit was called!");
+              testRunnerOut.println(String.join("\n", framesStartingWithRuntimeExit));
+            }
+          }
+          if (foundRuntimeExit) {
+            // We must call halt rather than exit, because exit would lead to a deadlock. We use a
+            // hopefully unique exit code to make it easier to identify this case.
+            Runtime.getRuntime().halt(121);
+          }
+        };
     return new Thread(hook, "SystemExitDetectingShutdownHook");
   }
 
   private static String frameString(StackTraceElement frame) {
     return String.format(
         "        at %s.%s(%s:%d)",
-        frame.getClassName(),
-        frame.getMethodName(),
-        frame.getFileName(),
-        frame.getLineNumber());
+        frame.getClassName(), frame.getMethodName(), frame.getFileName(), frame.getLineNumber());
   }
 
   private SystemExitDetectingShutdownHook() {}

src/java_tools/junitrunner/java/com/google/testing/junit/runner/internal/SystemExitDetectingShutdownHook.java

@@ -14,6 +14,37 @@
 
 """Rules to create a release archive"""
 
+load("@rules_java//java:java_binary.bzl", "java_binary")
+load("@with_cfg.bzl", "with_cfg")
+
+# The minimum --java_{tool_,}runtime_version supported by prebuilt Java tools.
+_MINIMUM_JAVA_RUNTIME_VERSION = 8
+
+# The minimum version of a java_toolchain's java_runtime supported by prebuilt Java tools.
+_MINIMUM_JAVA_COMPILATION_RUNTIME_VERSION = 11
+
+minimum_java_runtime_java_binary, _minimum_java_runtime_java_binary = (
+    # Don't warn about targeting very old Java versions.
+    with_cfg(java_binary)
+        .set("java_language_version", str(_MINIMUM_JAVA_RUNTIME_VERSION))
+        .extend("javacopt", ["-Xlint:-options"])
+        .build()
+)
+
+minimum_java_runtime_filegroup, _minimum_java_runtime_filegroup = (
+    # Don't warn about targeting very old Java versions.
+    with_cfg(native.filegroup)
+        .set("java_language_version", str(_MINIMUM_JAVA_RUNTIME_VERSION))
+        .extend("javacopt", ["-Xlint:-options"])
+        .build()
+)
+
+minimum_java_compilation_runtime_filegroup, _minimum_java_compilation_runtime_filegroup = (
+    with_cfg(native.filegroup)
+        .set("java_language_version", str(_MINIMUM_JAVA_COMPILATION_RUNTIME_VERSION))
+        .build()
+)
+
 def release_archive(name, srcs = [], src_map = {}, package_dir = "-", deps = [], **kwargs):
     """ Creates an zip of the srcs, and renamed label artifacts.
 

src/release_archive.bzl

@@ -233,18 +233,14 @@ sh_test(
     srcs = ["bazel_java17_test.sh"],
     args = [
         # java_tools zip to test
-        "$(rlocationpath //src:java_tools_java8.zip)",
-        "$(rlocationpath //src:java_tools_prebuilt_java8.zip)",
+        "$(rlocationpath //src:java_tools.zip)",
+        "$(rlocationpath //src:java_tools_prebuilt.zip)",
     ],
     data = [
         ":gen_rules_java_repo_name",
         ":test-deps",
-        # Use java_tools compiled at Java language 8 instead (aligned with the
-        # default compilation level of java_tools). For the purpose
-        # of this test, we need java_tools to be running with runtime >11 to
-        # test the failure modes of incompatible system classpaths.
-        "//src:java_tools_prebuilt_java8.zip",
-        "//src:java_tools_java8.zip",
+        "//src:java_tools.zip",
+        "//src:java_tools_prebuilt.zip",
         "@bazel_tools//tools/bash/runfiles",
     ],
     tags = ["local"],
@@ -294,8 +290,8 @@ JAVA_VERSIONS_COVERAGE = ("11", "17", "21")
         srcs = ["bazel_java_test.sh"],
         args = [
             # java_tools zips to test
-            "$(rlocationpath %s)" % ("//src:java_tools_zip" if java_version == "21" else "//src:java_tools_java8.zip"),
-            "$(rlocationpath %s)" % ("//src:java_tools_prebuilt_zip" if java_version == "21" else "//src:java_tools_prebuilt_java8.zip"),
+            "$(rlocationpath //src:java_tools_zip)",
+            "$(rlocationpath //src:java_tools_zip)",
             # --java_language_version value
             java_version,
             # --java_runtime_version value
@@ -304,8 +300,8 @@ JAVA_VERSIONS_COVERAGE = ("11", "17", "21")
         data = [
             ":gen_rules_java_repo_name",
             ":test-deps",
-            "//src:java_tools_zip" if java_version == "21" else "//src:java_tools_java8.zip",
-            "//src:java_tools_prebuilt_zip" if java_version == "21" else "//src:java_tools_prebuilt_java8.zip",
+            "//src:java_tools_prebuilt_zip",
+            "//src:java_tools_zip",
             "@bazel_tools//tools/bash/runfiles",
         ],
         exec_compatible_with = ["//:highcpu_machine"],
@@ -560,8 +556,8 @@ sh_test(
         srcs = ["bazel_coverage_java_test.sh"],
         args = [
             # java_tools zips to test
-            "$(rlocationpath %s)" % ("//src:java_tools_zip" if java_version == "21" else "//src:java_tools_java8.zip"),
-            "$(rlocationpath %s)" % ("//src:java_tools_prebuilt_zip" if java_version == "21" else "//src:java_tools_prebuilt_java8.zip"),
+            "$(rlocationpath //src:java_tools_zip)",
+            "$(rlocationpath //src:java_tools_prebuilt_zip)",
             # WORKSPACE file of the coverage output generator repo to test
             "$(rlocationpath //tools/test/CoverageOutputGenerator/java/com/google/devtools/coverageoutputgenerator:coverage_empty_workspace)",
             # --java_runtime_version value
@@ -570,10 +566,10 @@ sh_test(
         data = [
             ":gen_rules_java_repo_name",
             ":test-deps",
-            "//src:java_tools_prebuilt_zip" if java_version == "21" else "//src:java_tools_prebuilt_java8.zip",
-            "//src:java_tools_zip" if java_version == "21" else "//src:java_tools_java8.zip",
+            "//src:java_tools_prebuilt_zip",
+            "//src:java_tools_zip",
             "//tools/test/CoverageOutputGenerator/java/com/google/devtools/coverageoutputgenerator:coverage_empty_workspace",
-            "//tools/test/CoverageOutputGenerator/java/com/google/devtools/coverageoutputgenerator:coverage_output_generator_repo%s" % ("" if java_version == "21" else "_java8"),
+            "//tools/test/CoverageOutputGenerator/java/com/google/devtools/coverageoutputgenerator:coverage_output_generator_repo",
         ],
         tags = ["no_windows"],
     )
@@ -628,7 +624,7 @@ sh_test(
     data = [
         ":test-deps",
         "//tools/test/CoverageOutputGenerator/java/com/google/devtools/coverageoutputgenerator:coverage_empty_workspace",
-        "//tools/test/CoverageOutputGenerator/java/com/google/devtools/coverageoutputgenerator:coverage_output_generator_repo_java8",
+        "//tools/test/CoverageOutputGenerator/java/com/google/devtools/coverageoutputgenerator:coverage_output_generator_repo",
     ],
     tags = [
         "no_windows",

src/test/shell/bazel/BUILD

@@ -58,7 +58,7 @@ commit_hash=$(git rev-parse HEAD)
 timestamp=$(date +%s)
 bazel_version=$(bazel info release | cut -d' ' -f2)
 
-RELEASE_BUILD_OPTS="-c opt --tool_java_language_version=8 --java_language_version=8"
+RELEASE_BUILD_OPTS="-c opt"
 
 # Check that the build machine is set up for Unicode.
 bazel run ${RELEASE_BUILD_OPTS} //src:CheckSunJnuEncoding