sync 0.32.0

.github/workflows/sync-upstream.sh

@@ -7,10 +7,16 @@
 #   sync-upstream.sh rename [--reverse]  # just the rename
 #
 # This fork differs from upstream in exactly one way: every
-# `github.com/google/cel-go` import is rewritten to `github.com/authzed/cel-go`.
+# `cel.dev/cel-go` import is rewritten to `github.com/authzed/cel-go`.
 # Merging upstream directly means both sides edited the same import lines, so it
 # conflicts on nearly every file upstream touched -- ~77 conflicts, none real.
 #
+# UPSTREAM_PATH is whatever upstream calls itself today; it was
+# `github.com/google/cel-go` until v0.32.0 moved it to `cel.dev/cel-go`. A sync
+# spanning such a move has to un-rename to the old path (to match the merge
+# base) and re-rename from the new one, which means two runs with the constant
+# changed in between.
+#
 # So the rename is applied last, and never merged:
 #
 #   1. un-rename, making our tree match the upstream commit we last synced from
@@ -37,7 +43,7 @@ set -euo pipefail
 
 cd "$(git rev-parse --show-toplevel)"
 
-UPSTREAM_PATH="github.com/google/cel-go"
+UPSTREAM_PATH="cel.dev/cel-go"
 FORK_PATH="github.com/authzed/cel-go"
 
 UPSTREAM_REMOTE="${UPSTREAM_REMOTE:-upstream}"
@@ -72,8 +78,12 @@ rename() {
     to="$UPSTREAM_PATH"
   fi
 
-  # -I skips binary files, and git grep only looks at tracked ones.
-  files="$(git grep -I --name-only --fixed-strings -e "$from" -- . || true)"
+  # -I skips binary files, and git grep only looks at tracked ones. This
+  # script is excluded because it names both paths itself: renaming it would
+  # collapse UPSTREAM_PATH and FORK_PATH onto the same value and break the
+  # next sync.
+  files="$(git grep -I --name-only --fixed-strings -e "$from" \
+    -- . ':(exclude).github/workflows/sync-upstream.sh' || true)"
   if [[ -z "$files" ]]; then
     echo "rename: no occurrences of ${from}; nothing to do"
     return 0

.github/workflows/tag-submodules.yml

@@ -0,0 +1,42 @@
+name: Tag Go Submodules
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  tag-submodules:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          fetch-depth: 0
+
+      - name: Configure Git
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "41898282+github-actions[bot]@://github.com"
+
+      - name: Auto-Detect and Tag Submodules
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          echo "Finding all subdirectories containing go.mod..."
+
+          # Find all go.mod files, exclude root (./go.mod), and get their directory paths
+          find . -mindepth 2 -name "go.mod" | while read -r gomod_path; do
+            # Extract directory path (e.g., ./pkg/submod1/go.mod -> pkg/submod1)
+            SUBDIR=$(dirname "$gomod_path" | sed 's|^\./||')
+
+            SUB_TAG="${SUBDIR}/${RELEASE_TAG}"
+
+            echo "----------------------------------------"
+            echo "Found Go module in: $SUBDIR"
+            echo "Creating tag: $SUB_TAG"
+
+            git tag -a "$SUB_TAG" -m "Release $SUB_TAG via GitHub Action"
+            git push origin "$SUB_TAG"
+          done

MODULE.bazel

@@ -37,16 +37,20 @@ bazel_dep(
 bazel_dep(name = "rules_shell", version = "0.6.1")
 bazel_dep(name = "rules_license", version = "1.0.0")
 
-
 # local_path_override(
 #     module_name = "cel-spec",
 #     path = "../cel-spec",
 # )
 bazel_dep(
     name = "cel-spec",
-    version = "0.25.1",
+    version = "0.25.2",
     repo_name = "dev_cel_expr",
 )
+git_override(
+    module_name = "cel-spec",
+    commit = "ba58ae5007845f3a1279b488cdeb79645ce958bb",
+    remote = "https://github.com/cel-expr/cel-spec",
+)
 
 go_sdk = use_extension("@io_bazel_rules_go//go:extensions.bzl", "go_sdk")
 go_sdk.download(version = "1.23.0")

README.md

@@ -1,14 +1,14 @@
 # Common Expression Language
 
 [![Go Report Card](https://goreportcard.com/badge/github.com/authzed/cel-go)](https://goreportcard.com/report/github.com/authzed/cel-go)
-[![GoDoc](https://godoc.org/github.com/authzed/cel-go?status.svg)][6]
+[![GoDoc](https://pkg.go.dev/badge/github.com/authzed/cel-go.svg)][6]
 
 > [!WARNING]
 > **On June 16, 2026, this repository will move to
 > github.com/cel-expr/cel-go!**
 >
 > Please update your links and dependencies. See the [pinned
-> issue](https://github.com/authzed/cel-go/issues/1329) for details.
+> issue](https://github.com/cel-expr/cel-go/issues/1329) for details.
 
 The Common Expression Language (CEL) is a non-Turing complete language designed
 for simplicity, speed, safety, and portability. CEL's C-like [syntax][1] looks
@@ -285,9 +285,9 @@ bazel test ...
 
 Released under the [Apache License](LICENSE).
 
-[1]:  https://github.com/google/cel-spec
+[1]:  https://github.com/cel-expr/cel-spec
 [2]:  https://groups.google.com/forum/#!forum/cel-go-discuss
-[3]:  https://github.com/google/cel-cpp
-[4]:  https://github.com/authzed/cel-go/issues
+[3]:  https://github.com/cel-expr/cel-cpp
+[4]:  https://github.com/cel-expr/cel-go/issues
 [5]:  https://bazel.build
-[6]:  https://godoc.org/github.com/authzed/cel-go
+[6]:  https://pkg.go.dev/github.com/authzed/cel-go