)]}'
{
  "commit": "d1d1a95c5fbc87766cf455f96f56452ae99d5f41",
  "tree": "e1bb26df387f52a23cca08bf277db2fd1ed3ab02",
  "parents": [
    "14c39139c0ac30d0cdfa426502c49164ca6fb5c1"
  ],
  "author": {
    "name": "Googler",
    "email": "noreply@google.com",
    "time": "Sun Oct 18 20:17:49 2026 -0700"
  },
  "committer": {
    "name": "Copybara-Service",
    "email": "copybara-worker@google.com",
    "time": "Sun Oct 18 20:18:37 2026 -0700"
  },
  "message": "Check disallowed copts before allowlist membership.\n\n_verify_no_disallowed_copts runs for every C++ target, once per copts, conlyopts and cxxopts attribute. It used to call allowlist.contains(ctx.label) first, for every policy. PackageGroupContents.containsPackage uses a hash set for exact //pkg entries but scans //pkg/... entries one by one, so a large prefix allowlist made the check expensive for every target, including the vast majority that use no disallowed flag.\n\nThe flags are now matched first, and the allowlist is consulted only when a flag matched, at most once per policy. Violations and their messages are unchanged.\n\nThis is needed before registering the -g0 debug info policy, whose allowlist has about 8k //pkg/... entries.\n\nStartblock:\n  * // Put other blockers before this line to avoid churning.\n  * has lgtm\n  * is approved\n  * and then\n  * all comments are resolved\n  * and then\n  *[] allows unknown commit\nPiperOrigin-RevId: 1002043792\nChange-Id: I68f80519dad93d597669a6aadfc71ef53f297719\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "b7008b256688fb6a41fa4c8fbca7399fa3257668",
      "old_mode": 33188,
      "old_path": "cc/common/cc_helper.bzl",
      "new_id": "a8f7619f3f259209da855fc7459a636beaf40ca7",
      "new_mode": 33188,
      "new_path": "cc/common/cc_helper.bzl"
    }
  ]
}