feat: mirror protoc releases to a Starlark constant

This allows rules_proto to supply a pre-built binary toolchain for protoc without needing any Bazel module supplied by the protocolbuffers maintainers.
Obviates the need for protobuf to be released to the BCR as in protocolbuffers/protobuf#16014
Allows the protocolbuffers team to stop caring about Bazel builds for external users, and to close associated bugs.

Next step in rules_proto supplying a toolchain that doesn't require users build protoc from sources.

.github/workflows/mirror_protoc_release.yml

@@ -0,0 +1,19 @@
+name: Mirror Releases
+on:
+  # Trigger manually in the UI
+  workflow_dispatch:
+  # Trigger daily at 06:10 UTC
+  schedule:
+    - cron: "10 6 * * *"
+
+jobs:
+  mirror:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: |
+          ./tools/protoc/mirror_protoc_releases.sh
+          npx @bazel/buildifier tools/protoc/versions.bzl
+      - uses: peter-evans/create-pull-request@v5
+        with:
+          commit-message: "chore: mirror protoc release"

tools/protoc/mirror_protoc_release.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# By default, mirrors the most recent release of protoc from
+# https://github.com/protocolbuffers/protobuf/releases
+#
+# To mirror a different version, set VERSION in the environment.
+# To use a different fork, set REPOSITORY in the environment.
+set -o nounset -o errexit -o pipefail
+
+SCRIPT_DIR="$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
+REPOSITORY=${REPOSITORY:-"protocolbuffers/protobuf"}
+VERSIONS_BZL="$SCRIPT_DIR/versions.bzl"
+
+RELEASES=$(mktemp)
+curl > $RELEASES \
+  --silent \
+  --header "Accept: application/vnd.github.v3+json" \
+  https://api.github.com/repos/${REPOSITORY}/releases?per_page=50
+
+# If $VERSION unset, mirror the latest release
+VERSION=${VERSION:-$(jq --raw-output '.[0].tag_name' $RELEASES)}
+echo "Mirroring integrity hashes for $REPOSITORY at release $VERSION ..."
+
+DOWNLOAD_URLS_FILTER='
+map(select(.tag_name == $version))[0]
+| .assets
+| map(.browser_download_url)[]
+'
+# Workaround: protobuf doesn't publish their integrity hashes to e.g. checksums.txt
+# Create a file that looks like a checksums.txt from a shasum command, i.e.
+# sha384-RVFu8PJJCOSXwYTqH7FyWRSgsP1AAjcEa+VViddVTgtd9wYvZjQoQ8jmlFxwfFw+ protobuf-26.0-rc3.tar.gz
+# sha384-JYSXGTSBfwUU6UzqazUTkT3lTZDzx10YdaNQYjojrT7X1Ro1fA+T4tjJw0e8UISV protobuf-26.0-rc3.zip
+CHECKSUMS=$(mktemp)
+for url in $(jq --arg version $VERSION --raw-output "$DOWNLOAD_URLS_FILTER" <$RELEASES); do
+    sha=$(curl -sSL $url | shasum -b -a 384 | awk "{ print \$1 }" | xxd -r -p | base64)
+    echo "sha384-${sha} $(basename $url)"
+done | tee "$CHECKSUMS"
+
+# Format as a dictionary of version to dictionary of filename to sha
+# {
+#  "v26.0-rc3": {
+#    "protobuf-26.0-rc3.tar.gz": "sha384-RVFu8PJJCOSXwYTqH7FyWRSgsP1AAjcEa+VViddVTgtd9wYvZjQoQ8jmlFxwfFw+",
+#    "protobuf-26.0-rc3.zip": "sha384-JYSXGTSBfwUU6UzqazUTkT3lTZDzx10YdaNQYjojrT7X1Ro1fA+T4tjJw0e8UISV",
+#    ...
+TO_DICTIONARY_FILTER='
+.
+| rtrimstr("\n")
+| split("\n")
+| map(
+    split(" ")
+    | {"key": .[1], "value": .[0]}
+  )
+| from_entries
+| { ($version): .}
+'
+NEW_VERSION=$(mktemp)
+jq "$TO_DICTIONARY_FILTER" \
+  --slurp --raw-input \
+  --arg version $VERSION \
+  $CHECKSUMS \
+  > $NEW_VERSION
+
+# Read existing versions.bzl content into a json object for easy merging
+EXISTING_VERSIONS=$(mktemp)
+python3 -c "import json; exec(open('$VERSIONS_BZL').read()); print(json.dumps(PROTOC_VERSIONS))" > $EXISTING_VERSIONS
+
+# Locate the PROTOC_VERSIONS declaration in the source file and replace it with a merge of both data sources
+NEW=$(mktemp)
+sed '/PROTOC_VERSIONS =/Q' $VERSIONS_BZL > $NEW
+echo -n "PROTOC_VERSIONS = " >> $NEW
+jq --slurp '.[0] * .[1]' $NEW_VERSION $EXISTING_VERSIONS >> $NEW
+cp $NEW $VERSIONS_BZL
+
+echo "Done, see updates in $VERSIONS_BZL"

tools/protoc/versions.bzl

@@ -0,0 +1,92 @@
+"""Mirrored integrity hashes for the pre-built protoc binaries distributed by the protobuf project.
+
+See ./mirror_protoc_release.sh for automation to update this file.
+See .github/workflows/mirror_protoc_release.yml for automation that runs the script daily.
+"""
+
+PROTOC_VERSIONS = {
+    "v24.4": {
+        "protobuf-24.4.tar.gz": "sha384-qRqrWm8nUDacIup44ogek2J6UZn7xIBR6lH6yUONPDEbGe4E9z84ga5HGr6W8/81",
+        "protobuf-24.4.zip": "sha384-GL7gM4ob5QOWRJcJlKJ7BtEuJwMSahQmx+YZgFT+naB+HJnrYlsT64x6C3WsneCC",
+        "protoc-24.4-linux-aarch_64.zip": "sha384-1yUAFmmBLZ3LU/vJoLxBX/MWJeanKe7p9SYkVmqlWwghayQEzifO6zsZ65fbQrNZ",
+        "protoc-24.4-linux-ppcle_64.zip": "sha384-vx5i4cMWTK4d0P7yCucDG5T8z9nk+Ypi85+nOTZNrONPSsBoDpmrsjTeErcAxTD6",
+        "protoc-24.4-linux-s390_64.zip": "sha384-gXY/gbqiOqNOfnHh7Ae1CJDUeFQ+0ZdgJrjNoeZ0Q5dL5IrRiHIdD0D1nV8wo4d8",
+        "protoc-24.4-linux-x86_32.zip": "sha384-7ssqfPe6uiKeT2d0WFAOoa8xHePYPWfOpYZrGRHlvj7U7CKO9CweqRCqiZ/ItLVg",
+        "protoc-24.4-linux-x86_64.zip": "sha384-gpzw2FvYI08YGwr4zWVcNfNvEiy8UegP/oa5NyG7gejthfpyzXWtKAtT3fo5Zmct",
+        "protoc-24.4-osx-aarch_64.zip": "sha384-OlqTHfI/D8J2R3r0Y9o7BQIrODGYNTPCveDyte0zhniECsgDddFSZHR1JxjjtUj0",
+        "protoc-24.4-osx-universal_binary.zip": "sha384-cNqrP+ghI+h/Cvd/KBBlfmYiP/rfhdiBjXSJaDUchlJoAJnW6J72jG0W81PXTxpj",
+        "protoc-24.4-osx-x86_64.zip": "sha384-rM42wIQ9S33LqbL7aTmUT4RIxZfv93GNrShlwj3RYFbAQ4iGJ4vtHOgPwv1QCovr",
+        "protoc-24.4-win32.zip": "sha384-l9ruRjAjGgLYJAQ/r+2Rw7mcUDSvH5CqFZK422aNMbPKLzmjXxtfhK91JT9xl+cU",
+        "protoc-24.4-win64.zip": "sha384-HR8U6fkwvpJvc5LlN7fdl6KgAM3BOtxJm0+HyyaT4EWtQIkdKlGW2kd7cQL56X3L",
+    },
+    "v25.0": {
+        "protobuf-25.0.tar.gz": "sha384-P0ngnobCm0ky9qhdvrY05tttQOUAlSoLJmrmvQ6PxIcyjmRI2pd9AE+kDOlaNXlU",
+        "protobuf-25.0.zip": "sha384-nmAo5cvh4VzfVryFDKtZjUcLIZE8oLrY010sbGWdXCSAoMt8gyMwA3hy0AnjNdun",
+        "protoc-25.0-linux-aarch_64.zip": "sha384-du9ecUx9YoI5tiMy6tdnPDR6adBOHXEewdgu1RSIuXkuck+9ymNbP40JeTCP4iT0",
+        "protoc-25.0-linux-ppcle_64.zip": "sha384-cev+I039Hf0msDxGM19RIBQW1QuDjxpU0CmCUVWOz1L6rwislt7fWWCSqPHkK/5J",
+        "protoc-25.0-linux-s390_64.zip": "sha384-+IxQIVSFY7Gc51F1BT6ND9mvxhbmSs6vuDf6tUvovIw0kXfAf4M2jRQT3v+t28Pb",
+        "protoc-25.0-linux-x86_32.zip": "sha384-5F1kwccK4s1+Gem7FjBicugCZiF+MS+No4Ir9VBDLXDnMAt8ZiLnDq720OeNdkWW",
+        "protoc-25.0-linux-x86_64.zip": "sha384-AqqCvVkkkYUOsvaEvBtwU07NE59MAkY5iZGUijxsfMyBwxu5MN66GX5yyycqNX2f",
+        "protoc-25.0-osx-aarch_64.zip": "sha384-eENvcEjQetZRGhJ9Ra60DZf8xwJ/cerY2XLXeSAVE8hDmszcLBo6tDLYUAxwKLSU",
+        "protoc-25.0-osx-universal_binary.zip": "sha384-0KzjkWqJz3/kRSGCfZfjMrJivAB/qEYaUUAgTHwj4Y/mPgp3DVVF0+y41teEXrcL",
+        "protoc-25.0-osx-x86_64.zip": "sha384-V0wb9+Jpl2FDMIrnUkhXfQW/gaF88LYAraK7MQjFnPplsZQI7UQPoJgfkViMFvRe",
+        "protoc-25.0-win32.zip": "sha384-j5hykBNIj6DOI59c6ekpRyzVOd4A+1Gbi7MmpGn1PkUiI28z0f2MdqRU7MXx1eY3",
+        "protoc-25.0-win64.zip": "sha384-L8syrXxlXJ/9KH8n20f5OqeLtuKs4ceW9I3Pj390kdDZ1LVmCd3IcThhfkHhxapx",
+    },
+    "v25.1": {
+        "protobuf-25.1.tar.gz": "sha384-vkC/WSZOsysT/cnXFT78JfjhYyHb0/MHPKazkhW0/0HTAtaVIwskmsRix2E2q28a",
+        "protobuf-25.1.zip": "sha384-cxZEvMlThaA5zqvQfeZbco4CuyZfq/Tjqdmc1aChwlBLnnaQNOxQMDzAy9nKsNbF",
+        "protoc-25.1-linux-aarch_64.zip": "sha384-M06CY8AuIGM0mNGcSYucGr2EfJqgqLCrMYPrYN9ZoQLlI3IXZ06CV3YLOqUZV496",
+        "protoc-25.1-linux-ppcle_64.zip": "sha384-ke4q7W7ji8ae0TZnt9xmmx+EzmY4L8OxCT9z6PITWkfyFDiEcaAC+EOxIuFqX8dO",
+        "protoc-25.1-linux-s390_64.zip": "sha384-5udatx+PxFTJSmqj9PUgAx1oCbEUJeO68imWwUU/KsxYl0iXa3K3Et1pnvELOLEb",
+        "protoc-25.1-linux-x86_32.zip": "sha384-ZG1pQ1UU1omt0s+BesBmMjtpu9il2aYHOuxmp9tId2U+gah1UK0xFgiQlba0XqNT",
+        "protoc-25.1-linux-x86_64.zip": "sha384-8WetDm7/55ury/IJkEMVwqX59ceqGAVL5N2n7QSaLrDACoU7i4LC2IpqSDRdeD6O",
+        "protoc-25.1-osx-aarch_64.zip": "sha384-2OpLcAbCfmUiEStbmTMl3gnUvCw9lkSjn0fpIYvTkBMpSGJI/efcBMb5fa5DWwxN",
+        "protoc-25.1-osx-universal_binary.zip": "sha384-CXzbLkL0hu6lP6nQW3JFeS0wOqXjYhmJSf85+Ks2/KGzsAXgaoxlyCFNM2wA3mnW",
+        "protoc-25.1-osx-x86_64.zip": "sha384-fCDutzbY3iorBOLgUofTrmy6BwarxRNvLfXlAwTRZjuJvWA10BdHciEJQmI+lIg5",
+        "protoc-25.1-win32.zip": "sha384-u/oMsxPUEg0G9soGgxId3YjQSo+lDuwJhGtqDFa0ADlz9BKKKCGw0KMYVyzbhBqm",
+        "protoc-25.1-win64.zip": "sha384-bo9+6PAX04kumoq1RjA829m2Rkhijnw8nQ6Le4wYX47qNF9sooeS84ZE55IjdVXh",
+    },
+    "v25.2": {
+        "protobuf-25.2.tar.gz": "sha384-5L9OGrv5rdD6M30RA4A8X3RW+cAK05fFt93H56lw1KtkTlazrh3qTxOuMjL11+bn",
+        "protobuf-25.2.zip": "sha384-0Qno40/wqkCHuTM2rCgVd+nS66Ule3YnqsdTGf3bCZKjnQPrQqmufTXyIvttCw7P",
+        "protoc-25.2-linux-aarch_64.zip": "sha384-XoUL9QXarwVOUqdQd6jQQIxWADtJglQKKX6eCn1wqyObKcOMzmBAxIgPs6JZfKzh",
+        "protoc-25.2-linux-ppcle_64.zip": "sha384-uCsYCijlcpLVM5OAoK5AvmZ/ZG4FxFW5nq4YxHhNbM8rkKorhGwePsfdxjWXD0U8",
+        "protoc-25.2-linux-s390_64.zip": "sha384-7jphWhRqYWg8CJLMtCT1F4LZI9b7exag21s4apghBvfrB9qLhv9CfutAElsezfso",
+        "protoc-25.2-linux-x86_32.zip": "sha384-yQzrtHYPcYthqzCvwm7bRFM7Zsjg+x+qju+V8XJKLiyt2b89l3dmTnJuzVlZX1Eo",
+        "protoc-25.2-linux-x86_64.zip": "sha384-nkqix3MGaILzAx76L/MzgH8YtCp0aR7pSL1X18PVHCw8H/KYV6JwP6ox1UBYPFiq",
+        "protoc-25.2-osx-aarch_64.zip": "sha384-YcvtjYGTERd2jJ93Qx1JRMyjCadaIJCqH76yzrLDGQ+Owak1Eu0SEV2hYkwDsr0q",
+        "protoc-25.2-osx-universal_binary.zip": "sha384-xTq7pC3gKeD4FRdW8kVYdwoVpJ8xRiLChLaaOqHWMQrUd7PFGjEn7EooP0FElM7d",
+        "protoc-25.2-osx-x86_64.zip": "sha384-x+WkzgB4xuctw/qwwYOpIJ8iDyz4QobOU60EUZJeTkTjJ4B0E7ag42KNQbTxIXJ2",
+        "protoc-25.2-win32.zip": "sha384-I0dFedVdL5x1X1Wie/IYJDstKZsKZwOZyaeGq1b00xPfoJibc/Jj7yDTBvGKAM8V",
+        "protoc-25.2-win64.zip": "sha384-zwfHd9XCgWXwTNAcC8dUR/9gPKKdF/pbfS2FqRyMzSzaaTfKLkeMRJQSql9CtcFo",
+    },
+    "v25.3": {
+        "protobuf-25.3.tar.gz": "sha384-CORK2b6dJeBIjaE509agfyBXFsQTbNHx/bntTWnz1hgMq3mFQeh5MJXeT2JnGQYG",
+        "protobuf-25.3.zip": "sha384-kDAMVpfn4VNyjywFJiuLoelCfc3AypQMlmfF+VcDWh7pBwp7mZtPdAR29WttBsYn",
+        "protoc-25.3-linux-aarch_64.zip": "sha384-jwCvnInYx9lD4bNy3EI/leVIVGqpyYkJ3qZSXXtIERcaBRIS1hAi4Tluu9Cy4eiy",
+        "protoc-25.3-linux-ppcle_64.zip": "sha384-aLa68jnCzwO7pS0ler84UxwzaL7srl+9fFZuR3ykh4FJIDJW/jCQGTeuos8VfWcI",
+        "protoc-25.3-linux-s390_64.zip": "sha384-PrlMkT15A2RsI4QYbRgvxq/xsNV7i1jzMbIZkSHDUMyZPC2Txf1ydLrmsIdQ/NQP",
+        "protoc-25.3-linux-x86_32.zip": "sha384-GeYiLamJeiA/5/JY1bE9JisEoQwy9T65ZwQHmfc6JFV2VkWbUkRHGJqt3BeCBtP/",
+        "protoc-25.3-linux-x86_64.zip": "sha384-RJ5r9hcTEMpphUBr1LLyYhjTc6k4tGkqGOW/UOHqHCSTGyFKG2DD7hfZ0XHdrc7e",
+        "protoc-25.3-osx-aarch_64.zip": "sha384-B2T/H3pEAm/tEnOLvMhTRae5zq5PCcPMzTjWspe+vjS/CmTxVxnlMH1XjxgibILi",
+        "protoc-25.3-osx-universal_binary.zip": "sha384-mhajph4BOcfzO74CC5u5JJ/eQ/sY6/Js1sDBVTszZmmo0nxqHU065rnDkHM5yy9i",
+        "protoc-25.3-osx-x86_64.zip": "sha384-AUt06iBAyAmj1bB9KVjilbCX3moW/RLLUwJK3XNLzM3JY9/jIcaY61Juf/gCON3A",
+        "protoc-25.3-win32.zip": "sha384-PoVupdbxosMbZs//vJDkLXjTzY2pfF3vI3lJ9J+SoMqsv17r/kFEzH8brM64x0FS",
+        "protoc-25.3-win64.zip": "sha384-Fe23g3o7lyfGIpl8YNK6zLecYvp1A7dRjOozoztLQPoIFYlKmETsjh5+p4USHrkL",
+    },
+    "v26.0-rc3": {
+        "protobuf-26.0-rc3.tar.gz": "sha384-RVFu8PJJCOSXwYTqH7FyWRSgsP1AAjcEa+VViddVTgtd9wYvZjQoQ8jmlFxwfFw+",
+        "protobuf-26.0-rc3.zip": "sha384-JYSXGTSBfwUU6UzqazUTkT3lTZDzx10YdaNQYjojrT7X1Ro1fA+T4tjJw0e8UISV",
+        "protoc-26.0-rc-3-linux-aarch_64.zip": "sha384-26j+lJ8JbQrtOiT71bvYSOaBVsE/nhqqudV3Ax/DzJL0dtqKhV0RQ5Oe+y4Ylw0E",
+        "protoc-26.0-rc-3-linux-ppcle_64.zip": "sha384-1QxiTOdrXbB/tr1u0LpheREKIdPzOafq6IEx72V54DuKHhIyDUCkxzNXyC+pNfXQ",
+        "protoc-26.0-rc-3-linux-s390_64.zip": "sha384-NYWag2bs+quuhzhYlhXcQaJHc1banME7D3UGGVjidZ3G9rEzp6wT1rrwyl9IndkI",
+        "protoc-26.0-rc-3-linux-x86_32.zip": "sha384-FO9tf/Lg8gpln8lzUpZDGh0D1uGxK//DjmCuzaT8rKFLt5Am8Tx16VAvEmXAvFj3",
+        "protoc-26.0-rc-3-linux-x86_64.zip": "sha384-NtInGn1e9vyypMxSFhfSGifK5uEgKe2N9CHdAr9Q7sEloTKVrxjE3hjDDgkkTSam",
+        "protoc-26.0-rc-3-osx-aarch_64.zip": "sha384-UTqN2Wk/mUGOYz+zFb7LB9l/tD8gpU+L6EaJX2ZfgiagPCOZtkhA1cF952lkZ2Fr",
+        "protoc-26.0-rc-3-osx-universal_binary.zip": "sha384-xMK8xRZtDJy3mplkAR4IJ7R8shM2WaMkYlRtGeJ/jLkpAJLuLVXbp4XUkFsaonQY",
+        "protoc-26.0-rc-3-osx-x86_64.zip": "sha384-75RTRf96480dKHzhPpoQHcLLN7ngcCZDIJz1k7E77aKLe/Y8OUftST/a7Sm/sSjQ",
+        "protoc-26.0-rc-3-win32.zip": "sha384-pi4UBm/miGxltC4159CiCBfd7E3W7EeMA8UaNbHbhGI+uAtFLPALrokfRwfSMkM3",
+        "protoc-26.0-rc-3-win64.zip": "sha384-TLwRUg/VqBoaX7gXunN/6+66104prygpwFgJKZlC2e+0S5VlPRMpnQaVyzGDwEAV",
+    },
+}