protocolbuffers · copybara-service · Jan 28, 2026
diff --git a/.github/workflows/release_prep.sh b/.github/workflows/release_prep.sh
@@ -9,7 +9,7 @@ TAG=$1
 PREFIX="protobuf-${TAG:1}"
 ARCHIVE="$PREFIX.bazel.tar.gz"
 ARCHIVE_TMP=$(mktemp)
-INTEGRITY_FILE=${PREFIX}/bazel/private/prebuilt_tool_integrity.bzl
+INTEGRITY_FILE=${PREFIX}/bazel/private/oss/toolchains/prebuilt/tool_integrity.bzl
 
 # NB: configuration for 'git archive' is in /.gitattributes
 git archive --format=tar --prefix=${PREFIX}/ ${TAG} > $ARCHIVE_TMP

diff --git a/bazel/private/oss/BUILD.bazel b/bazel/private/oss/BUILD.bazel
@@ -31,7 +31,7 @@ bzl_library(
 bzl_library(
     name = "py_proto_library_bzl",
     srcs = ["py_proto_library.bzl"],
-    visibility = ["//visibility:public"],
+    visibility = ["//bazel:__pkg__"],
     deps = [
         "//bazel/common:proto_common_bzl",
         "//bazel/common:proto_info_bzl",

diff --git a/bazel/private/oss/cc_proto_library.bzl b/bazel/private/oss/cc_proto_library.bzl
@@ -15,6 +15,10 @@ load("//bazel/flags:flags.bzl", "get_flag_value")
 load("//bazel/private:cc_proto_support.bzl", "cc_proto_compile_and_link")
 load("//bazel/private:toolchain_helpers.bzl", "toolchains")
 
+visibility([
+    "//bazel/...",
+])
+
 _CC_PROTO_TOOLCHAIN = Label("//bazel/private:cc_toolchain_type")
 
 _ProtoCcFilesInfo = provider(fields = ["files"], doc = "Provide cc proto files.")

diff --git a/bazel/private/oss/proto_bazel_features.bzl b/bazel/private/oss/proto_bazel_features.bzl
@@ -7,6 +7,10 @@
 #
 """Vendored version of bazel_features for protobuf, to keep a one-step setup"""
 
+visibility([
+    "//",
+])
+
 _PROTO_BAZEL_FEATURES = """bazel_features = struct(
   cc = struct(
     protobuf_on_allowlist = {protobuf_on_allowlist},

diff --git a/bazel/private/oss/py_proto_library.bzl b/bazel/private/oss/py_proto_library.bzl
@@ -5,6 +5,10 @@ load("//bazel/common:proto_common.bzl", "proto_common")
 load("//bazel/common:proto_info.bzl", "ProtoInfo")
 load("//bazel/private:toolchain_helpers.bzl", "toolchains")
 
+visibility([
+    "//bazel",
+])
+
 _PY_PROTO_TOOLCHAIN = Label("//bazel/private:python_toolchain_type")
 
 _PyProtoInfo = provider(

diff --git a/toolchain/platforms.bzl → ...ate/oss/toolchains/prebuilt/platforms.bzl b/toolchain/platforms.bzl → ...ate/oss/toolchains/prebuilt/platforms.bzl
@@ -1,5 +1,7 @@
 "List of published platforms on protobuf GitHub releases"
 
+visibility("private")
+
 # Keys are chosen to match the filenames published on protocolbuffers/protobuf releases
 # NB: keys in this list are nearly identical to /toolchain/BUILD.bazel#TOOLCHAINS
 # Perhaps we should share code.

diff --git a/bazel/private/oss/toolchains/prebuilt/protoc_authenticity.bzl b/bazel/private/oss/toolchains/prebuilt/protoc_authenticity.bzl
@@ -4,6 +4,8 @@ load("//bazel/common:proto_common.bzl", "proto_common")
 load("//bazel/private:toolchain_helpers.bzl", "toolchains")
 load(":tool_integrity.bzl", "RELEASE_VERSION")
 
+visibility("private")
+
 def _protoc_authenticity_impl(ctx):
     # When this flag is disabled, then users have no way to replace the protoc binary with their own toolchain registration.
     # Therefore there's no validation to perform.

diff --git a/bazel/private/oss/toolchains/prebuilt/protoc_extension.bzl b/bazel/private/oss/toolchains/prebuilt/protoc_extension.bzl
@@ -1,9 +1,13 @@
 "Module extensions for use under bzlmod"
 
 load("@bazel_skylib//lib:modules.bzl", "modules")
-load("//toolchain:platforms.bzl", "PROTOBUF_PLATFORMS")
+load(":platforms.bzl", "PROTOBUF_PLATFORMS")
 load(":protoc_toolchain.bzl", "prebuilt_protoc_repo")
 
+visibility([
+    "//src/google/protobuf",
+])
+
 def create_all_toolchain_repos(name = "prebuilt_protoc"):
     for platform in PROTOBUF_PLATFORMS.keys():
         prebuilt_protoc_repo(

diff --git a/bazel/private/oss/toolchains/prebuilt/protoc_toolchain.bzl b/bazel/private/oss/toolchains/prebuilt/protoc_toolchain.bzl
@@ -1,8 +1,10 @@
 "Repository rule that downloads a pre-compiled protoc from our official release for a single platform."
 
-load("//toolchain:platforms.bzl", "PROTOBUF_PLATFORMS")
+load(":platforms.bzl", "PROTOBUF_PLATFORMS")
 load(":tool_integrity.bzl", "RELEASED_BINARY_INTEGRITY", "RELEASE_VERSION")
 
+visibility("private")
+
 def release_version_to_artifact_name(release_version, platform):
     # versions have a "v" prefix like "v28.0"
     stripped_version = release_version.removeprefix("v")
@@ -34,7 +36,7 @@ def _prebuilt_protoc_repo_impl(rctx):
 # Generated by @protobuf//bazel/private/oss/toolchains/prebuilt:protoc_toolchain.bzl
 load("@com_google_protobuf//bazel/toolchains:proto_toolchain.bzl", "proto_toolchain")
 
-package(default_visibility = ["//visibility:public"])
+package(default_visibility = ["@com_google_protobuf//bazel/private/oss/toolchains/prebuilt:__pkg__"])
 
 proto_toolchain(
     name = "prebuilt_protoc_toolchain",

diff --git a/bazel/private/oss/toolchains/prebuilt/tool_integrity.bzl b/bazel/private/oss/toolchains/prebuilt/tool_integrity.bzl
@@ -6,6 +6,8 @@ so that the integrity of the prebuilt tools is included in the release artifact.
 The checked in content is only here to allow load() statements in the sources to resolve, and permit local testing.
 """
 
+visibility("private")
+
 # An arbitrary version of protobuf that includes pre-built binaries.
 # See /examples/example_without_cc_toolchain which uses this for testing.
 # TODO: add some automation to update this version occasionally.