Bump clang version to 19 (#5440)

The version of clangd/clang-tidy on developer machines has slowly
diverged from the one on the CI builders, which is causing a slowly
increasing amount of pain as clang-tidy CI runs fail (incorrectly) over
things that a newer clangd/clang-tidy was perfectly fine with locally.
This bumps the Clang version used in the ubuntu builders to 19, which is
the most recent in Debian stable.

We use https://apt.llvm.org instead of LLVM's GitHub releases
(https://github.com/llvm/llvm-project/releases) as the former more
reliably has packages for newer Clang/LLVM versions on x64. The
community-build releases binaries on LLVM's GitHub have stopped
including Ubuntu packages that match the GitHub x64 Ubuntu workers for
some time (for at least the 18 and 19 releases).

By moving to apt.llvm.org packages we only download and install the
headers and libraries needed for development, rather than every output
of building llvm, which is much faster and saves lots of disk space. We
also remove the system installations of other versions of clang/llvm so
we should end up using negative disk space. We can no longer easily
cache the installation but apt.llvm.org is a reliable end point.

We bump the ubuntu image version for the github workers to 24.04, as
apt.llvm.org has stopped building images for 22.10 in 2022 at its end of
life.

The `pre_commit` workflow disabled sudo unlike the other workflows that
install Clang/LLVM, including the `clang-tidy` workflow (which is also
run on `pull_request`). We bring it into alignment with the other
workflows so that we can install the llvm packages. And we lock its
ubuntu image to 24.04 so that it can be moved in lockstep with the other
workflows that depend on Clang/LLVM.

---------

Co-authored-by: Jon Ross-Perkins <jperkins@google.com>

.github/actions/build-setup-common/action.yml

@@ -47,6 +47,9 @@ runs:
         echo '*** clang++'
         which clang++
         clang++ --version
+        echo '*** clang-tidy'
+        which clang-tidy
+        clang-tidy --version
 
     # Add our bazel configuration and print basic info to ease debugging.
     - name: Configure Bazel and print info

.github/actions/build-setup-macos/action.yml

@@ -23,14 +23,12 @@ runs:
           xcrun simctl delete all
         sudo rm -rf ~/Library/Developer/CoreSimulator/Caches/*
 
-    # Install and cache LLVM 16 from Homebrew. Some runners may have LLVM 16,
+    # Install and cache LLVM 19 from Homebrew. Some runners may have LLVM 19,
     # but this is reliable (including with libc++), and gives us testing at the
     # minimum supported LLVM version.
     - name: Cache Homebrew
       id: cache-homebrew-macos
       uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
-      env:
-        cache-name: cache-homebrew
       with:
         # Cover all the critical parts of Homebrew here. Homebrew on Arm macOS
         # uses its own prefix making this easy to cover, but we need a few
@@ -47,7 +45,8 @@ runs:
             '
           }}
         # Note the key needs to include all the packages we're adding.
-        key: Homebrew-Cache-${{ inputs.matrix_runner }}-${{ runner.arch }}
+        key:
+          Homebrew-Cache-${{ inputs.matrix_runner }}-${{ runner.arch }}-llvm@19
 
     - name: Install LLVM and Clang with Homebrew
       if: steps.cache-homebrew-macos.outputs.cache-hit != 'true'
@@ -61,11 +60,11 @@ runs:
         LEAVES=$(brew leaves | egrep -v '^(bazelisk|gh|git|git-lfs|gnu-tar|go@.*|jq|pipx|node@.*|openssl@.*|wget|yq|zlib)$')
         brew uninstall -f --ignore-dependencies $LEAVES
         echo '*** Installing LLVM deps'
-        brew install --force-bottle --only-dependencies llvm@16
+        brew install --force-bottle --only-dependencies llvm@19
         echo '*** Installing LLVM itself'
-        brew install --force-bottle --force --verbose llvm@16
-        echo '*** brew info llvm@16'
-        brew info llvm@16
+        brew install --force-bottle --force --verbose llvm@19
+        echo '*** brew info llvm@19'
+        brew info llvm@19
         echo '*** brew autoremove'
         brew autoremove
         echo '*** brew info'
@@ -78,7 +77,7 @@ runs:
     - name: Setup LLVM and Clang
       shell: bash
       run: |
-        LLVM_PATH="$(brew --prefix llvm@16)"
+        LLVM_PATH="$(brew --prefix llvm@19)"
         echo "Using ${LLVM_PATH}"
         echo "${LLVM_PATH}/bin" >> $GITHUB_PATH
         echo '*** ls "${LLVM_PATH}"'

.github/actions/build-setup-ubuntu/action.yml

@@ -22,48 +22,22 @@ runs:
         # to save time.
         large-packages: false
 
-    # Cache and install a recent version of LLVM. This uses the GitHub action
-    # cache to avoid directly downloading on each iteration and improve
-    # reliability.
-    - name: Cache LLVM and Clang installation
-      id: cache-llvm-ubuntu
-      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
-      env:
-        cache-name: cache-llvm
-      with:
-        path: ~/llvm
-        key: LLVM-16-Cache-ubuntu-${{ runner.arch }}
+    - name: Show system LLVM and Clang installation
+      shell: bash
+      run: |
+        dpkg -l '*clang*' '*llvm*'
 
+    # Install a recent version of LLVM. We use LLVM's apt.llvm.org in order to
+    # have access to all released versions, instead of the GitHub releases which
+    # are often missing binaries for ubuntu x64.
     - name: Download LLVM and Clang installation
-      if: steps.cache-llvm-ubuntu.outputs.cache-hit != 'true'
+      env:
+        clang_version: 19
       shell: bash
       run: |
-        cd ~
-        LLVM_RELEASE=clang+llvm-16.0.4-x86_64-linux-gnu-ubuntu-22.04
-        echo "*** Downloading $LLVM_RELEASE"
-        wget --show-progress=off "https://github.com/llvm/llvm-project/releases/download/llvmorg-16.0.4/$LLVM_RELEASE.tar.xz"
-        echo "*** Extracting $LLVM_RELEASE"
-        tar -xJf "$LLVM_RELEASE.tar.xz"
-        echo "*** Moving to 'llvm'"
-        mv "$LLVM_RELEASE" llvm
-        echo "*** Testing `clang++ --version`"
-        ~/llvm/bin/clang++ --version
+        echo '*** Installing upstream clang packages'
+        wget https://apt.llvm.org/llvm.sh
+        chmod +x llvm.sh
+        sudo ./llvm.sh ${clang_version} all
 
-        # The installation contains *huge* parts of LLVM we don't need for the
-        # toolchain. Prune them here to keep our cache small.
-        echo "*** Cleaning the 'llvm' directory"
-        rm llvm/lib/{*.a,*.so,*.so.*,*.bc}
-        rm llvm/bin/{flang-*,mlir-*,clang-{scan-deps,check,repl},*-test,llvm-{lto*,reduce,bolt*,exegesis,jitlink},bugpoint,opt,llc}
-        echo "*** Size of the 'llvm' directory"
-        du -hs llvm
-
-    - name: Setup LLVM and Clang paths
-      shell: bash
-      run: |
-        LLVM_PATH=~/llvm
-        echo "Using ${LLVM_PATH}"
-        echo "${LLVM_PATH}/bin" >> $GITHUB_PATH
-        echo '*** ls "${LLVM_PATH}"'
-        ls "${LLVM_PATH}"
-        echo '*** ls "${LLVM_PATH}/bin"'
-        ls "${LLVM_PATH}/bin"
+        echo "/lib/llvm-19/bin" >> "$GITHUB_PATH"

.github/workflows/clang_tidy.yaml

@@ -22,7 +22,7 @@ concurrency:
 
 jobs:
   clang-tidy:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
 
     steps:
       - name: Harden Runner
@@ -51,7 +51,7 @@ jobs:
       - id: test-setup
         uses: ./.github/actions/test-setup
         with:
-          matrix_runner: 'ubuntu-22.04'
+          matrix_runner: 'ubuntu-24.04'
           base_sha:
             ${{ github.event_name == 'pull_request' &&
             github.event.pull_request.base.sha ||

.github/workflows/nightly_release.yaml

@@ -34,7 +34,7 @@ permissions:
 
 jobs:
   release:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
@@ -68,7 +68,7 @@ jobs:
 
       - uses: ./.github/actions/build-setup-common
         with:
-          matrix_runner: ubuntu-22.04
+          matrix_runner: ubuntu-24.04
           remote_cache_upload: ${{ env.remote_cache_upload }}
 
       - name: Get nightly date

.github/workflows/pre_commit.yaml

@@ -15,12 +15,11 @@ permissions:
 
 jobs:
   pre-commit:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
         with:
-          disable-sudo: true
           egress-policy: block
           # When adding endpoints, see README.md.
           # prettier-ignore
@@ -46,7 +45,7 @@ jobs:
       # Ensure LLVM is set up consistently.
       - uses: ./.github/actions/build-setup-common
         with:
-          matrix_runner: ubuntu-latest
+          matrix_runner: ubuntu-24.04
           remote_cache_upload: '--remote_upload_local_results=false'
 
       - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1

.github/workflows/tests.yaml

@@ -25,7 +25,7 @@ jobs:
     strategy:
       matrix:
         # Test a recent version of each supported OS.
-        runner: ['ubuntu-22.04', 'macos-14']
+        runner: ['ubuntu-24.04', 'macos-14']
         build_mode: [fastbuild, opt]
     runs-on: ${{ matrix.runner }}