protocolbuffers/protobuf: version pins written twice

protobuf_version.bzl pins the versions of protoc and five language bindings, and Java, Ruby, Python and PHP write theirs a second time. The config keeps the Java and Ruby copies in step, and adds the license-header check the bindings don't have. This config was written to test alint; protobuf doesn't use alint.

What alint found

The bundled GitHub Actions rules (alint 0.16.1, on the workflows as of 7 May 2026) flag 106 action references that use a tag instead of a commit, most of them protobuf's own protocolbuffers/protobuf-ci actions, and release_bazel_module.yaml, which grants contents: write at the workflow level.

The config

protobuf holds the protoc compiler and about 10 language bindings, from C++ and Java to Rust and PHP, each with its own build files. The config compares the version pins, checks the BSD header across the bindings, and checks the PHP and C# manifests and the Apple privacy manifest. buildifier and clang-format run from command rules, and a command_idempotent rule checks the CMake file lists against the Bazel globs.

.alint.yml

- id: protobuf-java-version-coherent
  # fixed here: reads the BOM's own version, not every <version> in it
  kind: cross_file_value_equals
  source:
    file: protobuf_version.bzl
    extract:
      regex: 'PROTOBUF_JAVA_VERSION\s*=\s*"([^"]+)"'
  targets:
    - file: java/bom/pom.xml
      extract:
        regex: '(?s)<artifactId>protobuf-bom</artifactId>\s*<version>([^<]+)</version>'
  level: error

The Java version in protobuf_version.bzl has to match the one in the BOM's pom.xml. A second rule does the same for Ruby's gemspec.

.alint.yml

- id: protobuf-bsd-header-slash
  # fixed here: leaves out the generated C#, Objective-C and upb sources
  kind: file_header
  paths:
    include: ["src/**/*.{cc,h,cpp,inc}", "java/**/*.java", "objectivec/**/*.{m,h}", "rust/**/*.rs", "upb/**/*.{c,h}", "hpb/**/*.{cc,h}", "csharp/**/*.cs"]
    exclude: ["**/*.pb.cc", "**/*.pb.h", "**/*.pb.cs", "**/*_pb2.py", "**/*.pbobjc.*", "upb/reflection/{cmake,stage0}/**", "csharp/src/Google.Protobuf.Test.TestProtos/OldExtensions*.cs", "**/third_party/**"]
  pattern: 'Protocol Buffers - Google''s data interchange format'
  lines: 6
  level: warning

protobuf has no license-header check. This rule covers the bindings that use // comments; a second one covers Python, Ruby and the other # languages.

What stays outside alint

The conformance suite and the build stay with Bazel:

running the conformance suite and compiling protoc;
comparing binary protos across languages, and validating what the Apple privacy manifest says;
Google's internal Kokoro CI.