Pin tink-cc to its latest release in tink-cc-awskms

This commit adds `tink_cc_awskms_deps_init.bzl` which initializes tink-cc's dependencies

PiperOrigin-RevId: 586625922
Change-Id: I530e0f928d3a3f66a333cce82086f899c40000db

WORKSPACE

@@ -1,10 +1,8 @@
 workspace(name = "tink_cc_awskms")
 
-http_archive(
-    name = "tink_cc",
-    urls = ["https://github.com/tink-crypto/tink-cc/archive/main.zip"],
-    strip_prefix = "tink-cc-main",
-)
+load("@tink_cc_awskms//:tink_cc_awskms_deps.bzl", "tink_cc_awskms_deps")
+
+tink_cc_awskms_deps()
 
 load("@tink_cc//:tink_cc_deps.bzl", "tink_cc_deps")
 
@@ -14,6 +12,3 @@ load("@tink_cc//:tink_cc_deps_init.bzl", "tink_cc_deps_init")
 
 tink_cc_deps_init()
 
-load("@tink_cc_awskms//:tink_cc_awskms_deps.bzl", "tink_cc_awskms_deps")
-
-tink_cc_awskms_deps()

kokoro/create_github_release_branch.sh

@@ -47,9 +47,9 @@ fi
 
 GITHUB_RELEASE_UTIL_OPTS=()
 if [[ "${IS_KOKORO}" == "true" ]] ; then
-  # Note: KOKORO_GIT_COMMIT_tink_cc_awskms is populated by Kokoro.
+  # Note: KOKORO_GIT_COMMIT is populated by Kokoro.
   GITHUB_RELEASE_UTIL_OPTS+=(
-    -c "${KOKORO_GIT_COMMIT_tink_cc_awskms}"
+    -c "${KOKORO_GIT_COMMIT}"
     -t "${GITHUB_ACCESS_TOKEN}"
   )
 fi

kokoro/create_github_release_tag.sh

@@ -47,9 +47,9 @@ fi
 
 GITHUB_RELEASE_UTIL_OPTS=()
 if [[ "${IS_KOKORO}" == "true" ]] ; then
-  # Note: KOKORO_GIT_COMMIT_tink_cc_awskms is populated by Kokoro.
+  # Note: KOKORO_GIT_COMMIT is populated by Kokoro.
   GITHUB_RELEASE_UTIL_OPTS+=(
-    -c "${KOKORO_GIT_COMMIT_tink_cc_awskms}"
+    -c "${KOKORO_GIT_COMMIT}"
     -t "${GITHUB_ACCESS_TOKEN}"
   )
 fi

kokoro/gcp_ubuntu/bazel/run_tests.sh

@@ -14,18 +14,17 @@
 # limitations under the License.
 ################################################################################
 
-# By default when run locally this script runs the command below directly on the
-# host. The CONTAINER_IMAGE variable can be set to run on a custom container
-# image for local testing. E.g.:
+# Builds and tests tink-cc-awskms using Bazel.
 #
-# CONTAINER_IMAGE="gcr.io/tink-test-infrastructure/linux-tink-cc-base:latest" \
-#  sh ./kokoro/gcp_ubuntu/bazel/run_tests.sh
+# The behavior of this script can be modified using the following optional env
+# variables:
 #
-# The user may specify TINK_BASE_DIR as the folder where to look for
-# tink-cc-awskms and its dependencies. That is:
-#   ${TINK_BASE_DIR}/tink_cc
-#   ${TINK_BASE_DIR}/tink_cc_awskms
-# NOTE: tink_cc is fetched from GitHub if not found.
+# - CONTAINER_IMAGE (unset by default): By default when run locally this script
+#   executes tests directly on the host. The CONTAINER_IMAGE variable can be set
+#   to execute tests in a custom container image for local testing. E.g.:
+#
+#   CONTAINER_IMAGE="us-docker.pkg.dev/tink-test-infrastructure/tink-ci-images/linux-tink-cc-base:latest" \
+#     sh ./kokoro/gcp_ubuntu/bazel/run_tests.sh
 set -eEuo pipefail
 
 IS_KOKORO="false"
@@ -36,28 +35,18 @@ readonly IS_KOKORO
 
 RUN_COMMAND_ARGS=()
 if [[ "${IS_KOKORO}" == "true" ]]; then
-  TINK_BASE_DIR="$(echo "${KOKORO_ARTIFACTS_DIR}"/git*)"
-  source \
-    "${TINK_BASE_DIR}/tink_cc_awskms/kokoro/testutils/cc_test_container_images.sh"
+  readonly TINK_BASE_DIR="$(echo "${KOKORO_ARTIFACTS_DIR}"/git*)"
+  cd "${TINK_BASE_DIR}/tink_cc_awskms"
+  source ./kokoro/testutils/cc_test_container_images.sh
   CONTAINER_IMAGE="${TINK_CC_BASE_IMAGE}"
   RUN_COMMAND_ARGS+=( -k "${TINK_GCR_SERVICE_KEY}" )
 fi
-: "${TINK_BASE_DIR:=$(cd .. && pwd)}"
-readonly TINK_BASE_DIR
 readonly CONTAINER_IMAGE
 
 if [[ -n "${CONTAINER_IMAGE:-}" ]]; then
   RUN_COMMAND_ARGS+=( -c "${CONTAINER_IMAGE}" )
 fi
 
-cd "${TINK_BASE_DIR}/tink_cc_awskms"
-
-# Check for dependencies in TINK_BASE_DIR. Any that aren't present will be
-# downloaded.
-readonly GITHUB_ORG="https://github.com/tink-crypto"
-./kokoro/testutils/fetch_git_repo_if_not_present.sh "${TINK_BASE_DIR}" \
-  "${GITHUB_ORG}/tink-cc"
-
 ./kokoro/testutils/copy_credentials.sh "testdata" "aws"
 
 MANUAL_TARGETS=()
@@ -66,16 +55,5 @@ if [[ "${IS_KOKORO}" == "true" ]]; then
 fi
 readonly MANUAL_TARGETS
 
-cp "WORKSPACE" "WORKSPACE.bak"
-./kokoro/testutils/replace_http_archive_with_local_repository.py \
-  -f "WORKSPACE" -t ..
-
-trap cleanup EXIT
-
-cleanup() {
-  # Restore the original WORKSPACE on exit (moslty useful for local testing).
-  mv "WORKSPACE.bak" "WORKSPACE"
-}
-
 ./kokoro/testutils/run_command.sh "${RUN_COMMAND_ARGS[@]}" \
   ./kokoro/testutils/run_bazel_tests.sh . "${MANUAL_TARGETS[@]}"

kokoro/macos_external/bazel/run_tests.sh

@@ -23,18 +23,10 @@ fi
 readonly IS_KOKORO
 
 if [[ "${IS_KOKORO}" == "true" ]]; then
-  TINK_BASE_DIR="$(echo "${KOKORO_ARTIFACTS_DIR}"/git*)"
+  readonly TINK_BASE_DIR="$(echo "${KOKORO_ARTIFACTS_DIR}"/git*)"
   cd "${TINK_BASE_DIR}/tink_cc_awskms"
 fi
 
-: "${TINK_BASE_DIR:=$(cd .. && pwd)}"
-
-# Check for dependencies in TINK_BASE_DIR. Any that aren't present will be
-# downloaded.
-readonly GITHUB_ORG="https://github.com/tink-crypto"
-./kokoro/testutils/fetch_git_repo_if_not_present.sh "${TINK_BASE_DIR}" \
-  "${GITHUB_ORG}/tink-cc"
-
 ./kokoro/testutils/copy_credentials.sh "testdata" "aws"
 
 MANUAL_TARGETS=()
@@ -43,8 +35,4 @@ if [[ "${IS_KOKORO}" == "true" ]]; then
 fi
 readonly MANUAL_TARGETS
 
-cp "WORKSPACE" "WORKSPACE.bak"
-./kokoro/testutils/replace_http_archive_with_local_repository.py \
-  -f "WORKSPACE" -t "${TINK_BASE_DIR}"
 ./kokoro/testutils/run_bazel_tests.sh . "${MANUAL_TARGETS[@]}"
-mv "WORKSPACE.bak" "WORKSPACE"

tink_cc_awskms_deps.bzl

@@ -61,3 +61,12 @@ def tink_cc_awskms_deps():
             strip_prefix = "zlib-1.2.12",
             build_file = "@tink_cc_awskms//:third_party/zlib.BUILD.bazel",
         )
+
+    if not native.existing_rule("tink_cc"):
+        # Release from 2023-11-23.
+        http_archive(
+            name = "tink_cc",
+            sha256 = "3804afecbe7096d3786b660e9cd5f365f064743eec52d76984abb9da38dd0fb3",
+            strip_prefix = "tink-cc-2.1.0",
+            url = "https://github.com/tink-crypto/tink-cc/releases/download/v2.1.0/tink-cc-2.1.0.zip",
+        )