Bazel: Switch to using toolchain resolution for java rules

Bump Bazel version to release 5.0.0. In this new Bazel release,
--incompatible_use_toolchain_resolution_for_java_rules is flipped, that
means that the build must be adapted to toolchain resolution.

Specification toolchain resolution for java rules is here: [1]. Main
tracking Bazel issue is here: [2].

Given that new Bazel release also added support for remote JDK 17, add
support for building with remote JDK 17 to produce major byte code
version 61. Note that some tests are still failing on JDK 17. This will
be fixed in follow-up change.

This change has a number of side effects:

o Remove workaround for Bazel worker multiplexer bug, see: [3].
o Demote severity for EP bug patterns from error to warning:
- DoNotMockAutoValue
o Re-enable EP bug pattern:
- FutureReturnValueIgnored

Test Plan:

To build with JDK 11 run:

  $ bazel build release

To build with JDK 17 run:

  $ bazel build --config java17 release

To build with JDK 11 on RBE run:

  $ bazel build --config=remote --remote_instance_name=<name> release

To build with JDK 17 on RBE run:

  $ bazel build --config=remote17 --remote_instance_name=<name> release

[1] https://docs.google.com/document/d/1MVbBxbKVKRJJY7DnkptHpvz7ROhyAYy4a-TZ-n7Q0r4/edit?usp=sharing
[2] https://github.com/bazelbuild/bazel/issues/7849
[3] https://github.com/bazelbuild/bazel/issues/13333

Change-Id: Ib3b923db7bb97a24d52ae8468ad1532a970203b5
diff --git a/.bazelrc b/.bazelrc
index db1fd57..407b005 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -2,7 +2,30 @@
 build --repository_cache=~/.gerritcodereview/bazel-cache/repository
 build --action_env=PATH
 build --disk_cache=~/.gerritcodereview/bazel-cache/cas
-build --java_toolchain=//tools:error_prone_warnings_toolchain_java11
+
+# Builds using remotejdk_11, executes using remotejdk_11 or local_jdk
+build --java_language_version=11
+build --java_runtime_version=remotejdk_11
+build --tool_java_language_version=11
+build --tool_java_runtime_version=remotejdk_11
+
+# Builds using remotejdk_17, executes using remotejdk_17 or local_jdk
+build:java17 --java_language_version=17
+build:java17 --java_runtime_version=remotejdk_17
+build:java17 --tool_java_language_version=17
+build:java17 --tool_java_runtime_version=remotejdk_17
+
+# Builds and executes on RBE using remotejdk_11
+build:remote --java_language_version=11
+build:remote --java_runtime_version=remotejdk_11
+build:remote --tool_java_language_version=11
+build:remote --tool_java_runtime_version=remotejdk_11
+
+# Builds and executes on RBE using remotejdk_17
+build:remote17 --java_language_version=17
+build:remote17 --java_runtime_version=remotejdk_17
+build:remote17 --tool_java_language_version=17
+build:remote17 --tool_java_runtime_version=remotejdk_17
 
 # Enable strict_action_env flag to. For more information on this feature see
 # https://groups.google.com/forum/#!topic/bazel-discuss/_VmRfMyyHBk.
@@ -15,6 +38,5 @@
 
 test --build_tests_only
 test --test_output=all
-test --java_toolchain=//tools:error_prone_warnings_toolchain_java11
 
 import %workspace%/tools/remote-bazelrc
diff --git a/.bazelversion b/.bazelversion
index 6aba2b2..0062ac9 100644
--- a/.bazelversion
+++ b/.bazelversion
@@ -1 +1 @@
-4.2.0
+5.0.0
diff --git a/BUILD b/BUILD
index f6ec40e..984fd955 100644
--- a/BUILD
+++ b/BUILD
@@ -4,16 +4,9 @@
 package(default_visibility = ["//visibility:public"])
 
 config_setting(
-    name = "java11",
+    name = "java17",
     values = {
-        "java_toolchain": "@bazel_tools//tools/jdk:toolchain_java11",
-    },
-)
-
-config_setting(
-    name = "java_next",
-    values = {
-        "java_toolchain": "//tools:toolchain_vanilla",
+        "java_language_version": "17",
     },
 )
 
diff --git a/Documentation/dev-bazel.txt b/Documentation/dev-bazel.txt
index c5c2dc0..bf4b2e4 100644
--- a/Documentation/dev-bazel.txt
+++ b/Documentation/dev-bazel.txt
@@ -18,7 +18,7 @@
 To build Gerrit from source, you need:
 
 * A Linux or macOS system (Windows is not supported at this time)
-* A JDK for Java 11|...
+* A JDK for Java 11 or Java 17
 * Python 3
 * link:https://github.com/nodesource/distributions/blob/master/README.md[Node.js (including npm),role=external,window=_blank]
 * Bower (`npm install -g bower`)
@@ -58,53 +58,21 @@
   $ bazel build :release
 ```
 
-[[java-13]]
-==== Java 13 support
+[[java-17]]
+==== Java 17 support
 
-Java 13 (and newer) is supported through vanilla java toolchain
-link:https://docs.bazel.build/versions/master/toolchains.html[Bazel option,role=external,window=_blank].
-To build Gerrit with Java 13 and newer, specify vanilla java toolchain and
-provide the path to JDK home:
+Java 17 is supported. To build Gerrit with Java 17, run:
 
 ```
-  $ bazel build \
-    --define=ABSOLUTE_JAVABASE=<path-to-java-13> \
-    --javabase=@bazel_tools//tools/jdk:absolute_javabase \
-    --host_javabase=@bazel_tools//tools/jdk:absolute_javabase \
-    --host_java_toolchain=@bazel_tools//tools/jdk:toolchain_vanilla \
-    --java_toolchain=@bazel_tools//tools/jdk:toolchain_vanilla \
-    :release
+  $ bazel build --config=java17 :release
 ```
 
-To run the tests, `--javabase` option must be passed as well, because
-bazel test runs the test using the target javabase:
+To run the tests with Java 17, run:
 
 ```
-  $ bazel test \
-    --define=ABSOLUTE_JAVABASE=<path-to-java-13> \
-    --javabase=@bazel_tools//tools/jdk:absolute_javabase \
-    --host_javabase=@bazel_tools//tools/jdk:absolute_javabase \
-    --host_java_toolchain=@bazel_tools//tools/jdk:toolchain_vanilla \
-    --java_toolchain=@bazel_tools//tools/jdk:toolchain_vanilla \
-    //...
+  $ bazel test --config=java17 //...
 ```
 
-To avoid passing all those options on every Bazel build invocation,
-they could be added to ~/.bazelrc resource file:
-
-```
-$ cat << EOF > ~/.bazelrc
-build --define=ABSOLUTE_JAVABASE=<path-to-java-13>
-build --javabase=@bazel_tools//tools/jdk:absolute_javabase
-build --host_javabase=@bazel_tools//tools/jdk:absolute_javabase
-build --host_java_toolchain=@bazel_tools//tools/jdk:toolchain_vanilla
-build --java_toolchain=@bazel_tools//tools/jdk:toolchain_vanilla
-EOF
-```
-
-Now, invoking Bazel with just `bazel build :release` would include
-all those options.
-
 === Node.js and npm packages
 See link:https://gerrit.googlesource.com/gerrit/+/master/polygerrit-ui/README.md#installing-node_js-and-npm-packages[Installing Node.js and npm packages,role=external,window=_blank].
 
diff --git a/WORKSPACE b/WORKSPACE
index 4dec585..67bc7094 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -111,6 +111,10 @@
     importpath = "github.com/howeyc/fsnotify",
 )
 
+register_toolchains("//tools:error_prone_warnings_toolchain_java11_definition")
+
+register_toolchains("//tools:error_prone_warnings_toolchain_java17_definition")
+
 # JGit external repository consumed from git submodule
 local_repository(
     name = "jgit",
diff --git a/tools/BUILD b/tools/BUILD
index 08c4829..8d6d48f 100644
--- a/tools/BUILD
+++ b/tools/BUILD
@@ -16,6 +16,18 @@
     visibility = ["//visibility:public"],
 )
 
+default_java_toolchain(
+    name = "error_prone_warnings_toolchain_java17",
+    configuration = dict(),
+    java_runtime = "@bazel_tools//tools/jdk:remotejdk_17",
+    package_configuration = [
+        ":error_prone",
+    ],
+    source_version = "17",
+    target_version = "17",
+    visibility = ["//visibility:public"],
+)
+
 # Error Prone errors enabled by default; see ../.bazelrc for how this is
 # enabled. This warnings list is originally based on:
 # https://github.com/bazelbuild/BUILD_file_generator/blob/master/tools/bazel_defs/java.bzl
@@ -110,7 +122,7 @@
         "-Xep:DoNotCallSuggester:ERROR",
         "-Xep:DoNotClaimAnnotations:ERROR",
         "-Xep:DoNotMock:ERROR",
-        "-Xep:DoNotMockAutoValue:ERROR",
+        "-Xep:DoNotMockAutoValue:WARN",
         "-Xep:DoubleBraceInitialization:ERROR",
         "-Xep:DoubleCheckedLocking:ERROR",
         "-Xep:DuplicateMapKeys:ERROR",
@@ -153,7 +165,7 @@
         "-Xep:FromTemporalAccessor:ERROR",
         "-Xep:FunctionalInterfaceClash:ERROR",
         "-Xep:FunctionalInterfaceMethodChanged:ERROR",
-        # "-Xep:FutureReturnValueIgnored:ERROR", // this check has a bug.
+        "-Xep:FutureReturnValueIgnored:ERROR",
         "-Xep:FuturesGetCheckedIllegalExceptionType:ERROR",
         "-Xep:GetClassOnAnnotation:ERROR",
         "-Xep:GetClassOnClass:ERROR",
diff --git a/tools/bzl/junit.bzl b/tools/bzl/junit.bzl
index dec5f67..4659c48 100644
--- a/tools/bzl/junit.bzl
+++ b/tools/bzl/junit.bzl
@@ -73,6 +73,11 @@
     "-Djava.locale.providers=COMPAT,CLDR,SPI",
 ]
 
+POST_JDK17_OPTS = [
+    # https://github.com/bazelbuild/bazel/issues/14502
+    "-Djava.security.manager=allow",
+]
+
 def junit_tests(name, srcs, **kwargs):
     s_name = name.replace("-", "_") + "TestSuite"
     _gen_suite(
@@ -81,6 +86,10 @@
         outname = s_name,
     )
     jvm_flags = kwargs.get("jvm_flags", []) + POST_JDK8_OPTS
+    jvm_flags = jvm_flags + select({
+        "//:java17": POST_JDK8_OPTS + POST_JDK17_OPTS,
+        "//conditions:default": POST_JDK8_OPTS,
+    })
     java_test(
         name = name,
         test_class = s_name,
diff --git a/tools/remote-bazelrc b/tools/remote-bazelrc
index 78b86d2..c9a83e4 100644
--- a/tools/remote-bazelrc
+++ b/tools/remote-bazelrc
@@ -30,8 +30,6 @@
 
 # Set several flags related to specifying the platform, toolchain and java
 # properties.
-build:remote --host_javabase=@rbe_jdk11//java:jdk
-build:remote --javabase=@rbe_jdk11//java:jdk
 build:remote --crosstool_top=@rbe_jdk11//cc:toolchain
 build:remote --extra_toolchains=@rbe_jdk11//config:cc-toolchain
 build:remote --extra_execution_platforms=@rbe_jdk11//config:platform