build(bazel): migrate the monorepo toolchain from 8.6.0 to 9.1.1

.bazelignore

@@ -51,3 +51,4 @@ src/clis/nvcf-cli/vendor
 
 # Bazel-managed caches we keep inside the workspace for CI cache: paths.
 .bazel-cache
+

.bazelrc

@@ -134,12 +134,10 @@ build:remote --experimental_remote_cache_compression_threshold=100
 # In-memory Merkle tree cache. Subsequent action lookups for inputs we
 # have already hashed reuse the result instead of recomputing. Pure
 # latency win on warm Bazel servers; no correctness impact.
-build:remote --experimental_remote_merkle_tree_cache
 # Default size is 1000 entries, which we blow through on cold protobuf
 # / cross-compiled-Go builds (~1100 actions per arch). 10000 keeps the
 # whole graph resident; cost is a few MB of JVM heap (well under our
 # -Xmx4g budget).
-build:remote --experimental_remote_merkle_tree_cache_size=10000
 
 # Re-lease cache entries Bazel has already seen during a long build.
 # bb-storage evicts blobs by LRU/TTL; without this flag a build that
@@ -246,3 +244,8 @@ build:release --strip=always
 # endpoint, etc.
 try-import %workspace%/user.bazelrc
 try-import %user.home%/.bazelrc.user
+
+# Bazel 9.1.1 bumps the protobuf module to 33.x while toolchains_protoc 0.6.1
+# only ships up to v29 protoc; allow the version-skew (descriptor gen is
+# wire-compatible). Revisit when toolchains_protoc ships a v33 protoc.
+common --@com_google_protobuf//bazel/toolchains:allow_nonstandard_protoc

.bazelversion

@@ -1 +1 @@
-8.6.0
+9.1.1

MODULE.bazel

@@ -30,6 +30,7 @@ module(
 )
 
 bazel_dep(name = "rules_python", version = "1.4.1")
+bazel_dep(name = "rules_shell", version = "0.8.0")
 
 # ============================================================================
 # OCI containers (multi-arch). Used by go_oci_image for nvcf-cli.
@@ -61,14 +62,19 @@ python.toolchain(
 # and registers a proto_toolchain that points at it. The C++ build of
 # protoc is no longer reachable from any of our targets.
 #
-# Pinned alongside the protobuf module version (29.x) we resolve to.
+# Prebuilt protoc pin. Bazel 9.1.1 resolves the protobuf module to 33.4;
+# toolchains_protoc 0.6.1 (latest) ships v33.0 but not the 33.4 patch, so we pin
+# protoc v33.0 (same major, compiles 33.4's protos) and allow the 33.0-vs-33.4
+# skew via --allow_nonstandard_protoc in .bazelrc. protobuf is declared directly
+# with repo_name com_google_protobuf so that .bazelrc flag reference resolves.
 # ============================================================================
 bazel_dep(name = "toolchains_protoc", version = "0.6.1")
+bazel_dep(name = "protobuf", version = "33.4", repo_name = "com_google_protobuf")
 
 protoc = use_extension("@toolchains_protoc//protoc:extensions.bzl", "protoc")
 protoc.toolchain(
     google_protobuf = "com_google_protobuf",
-    version = "v29.0",
+    version = "v33.0",
 )
 
 # ============================================================================
@@ -154,8 +160,8 @@ use_repo(
 # repo here; see rules/java/README.md.
 # ============================================================================
 bazel_dep(name = "rules_java", version = "8.14.0")
-bazel_dep(name = "rules_jvm_external", version = "6.7")
-bazel_dep(name = "contrib_rules_jvm", version = "0.27.0")
+bazel_dep(name = "rules_jvm_external", version = "7.0")
+bazel_dep(name = "contrib_rules_jvm", version = "0.33.0")
 
 maven = use_extension("@rules_jvm_external//:extensions.bzl", "maven")
 maven.install(
@@ -170,13 +176,14 @@ maven.install(
     ],
     lock_file = "//:maven_install.json",
     repositories = [
-        # Resolve through the internal Artifactory mirror, not public
-        # repo1.maven.org: the shared CI runner IP is rate-limited (429) on
-        # public Central, which fails go-lib-bazel-build-test on every MR.
-        # urm/artifactory/maven is the Central proxy + NVIDIA artifacts; the
-        # google mirror is a fallback.
-        "https://urm.nvidia.com/artifactory/maven",
+        # Public Central mirrors only. This is the public GitHub mirror; its
+        # hosted runners cannot resolve the internal Artifactory host, so the
+        # pinned closure must fetch from public repositories. The Google-hosted
+        # Central mirror is primary (not IP-rate-limited like repo1.maven.org);
+        # Maven Central is the fallback. Internal builds that need NVIDIA
+        # artifacts add the Artifactory virtual repo in their own overlay.
         "https://maven-central.storage-download.googleapis.com/maven2",
+        "https://repo.maven.apache.org/maven2",
     ],
 )
 use_repo(maven, "maven")