Merge branch 'stable-3.8' into stable-3.9

* stable-3.8:
  Update git submodules
  Update git submodules
  Document missing options of ls-projects command
  Bazel: Add support for BuildBuddy RBE provider
  Specify GCP suffix explicitly in Bazel remote configuration
  Bazel: Optimize RBE execution
  Bazel: Clean up configuration options
  Update git submodules
  Bump SSHD version to 2.12.0

Change-Id: Icbf74bafd4a746f18f2a2b70c048fcce89690c2a
Release-Notes: skip
diff --git a/.bazelrc b/.bazelrc
index 6828f9e..1ba7582 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -3,31 +3,49 @@
 build --action_env=PATH
 build --disk_cache=~/.gerritcodereview/bazel-cache/cas
 
-# Builds using remotejdk_11, executes using remotejdk_11 or local_jdk
-build:java11 --java_language_version=11
-build:java11 --java_runtime_version=remotejdk_11
-build:java11 --tool_java_language_version=11
-build:java11 --tool_java_runtime_version=remotejdk_11
+# Define configuration using remotejdk_17, executes using remotejdk_17 or local_jdk
+build:build_shared --java_language_version=17
+build:build_shared --java_runtime_version=remotejdk_17
+build:build_shared --tool_java_language_version=17
+build:build_shared --tool_java_runtime_version=remotejdk_17
 
 # Builds using remotejdk_17, executes using remotejdk_17 or local_jdk
+# Avoid warnings for non default configurations:
+# build --config=build_shared
 build --java_language_version=17
 build --java_runtime_version=remotejdk_17
 build --tool_java_language_version=17
 build --tool_java_runtime_version=remotejdk_17
 
-# Builds and executes on RBE using remotejdk_11
-build:remote11 --java_language_version=11
-build:remote11 --java_runtime_version=remotejdk_11
-build:remote11 --tool_java_language_version=11
-build:remote11 --tool_java_runtime_version=remotejdk_11
-build:remote11 --config=remote_shared
+# Builds and executes on Google GCP RBE using remotejdk_17
+build:remote --config=config_gcp
+build:remote --config=build_shared
 
-# Builds and executes on RBE using remotejdk_17
-build:remote --java_language_version=17
-build:remote --java_runtime_version=remotejdk_17
-build:remote --tool_java_language_version=17
-build:remote --tool_java_runtime_version=remotejdk_17
-build:remote --config=remote_shared
+# Define remote configuration alias
+build:remote_gcp --config=remote
+
+# Builds and executes on BuildBuddy RBE using remotejdk_17
+build:remote_bb --config=config_bb
+build:remote_bb --config=build_shared
+
+# Define configuration using remotejdk_11, executes using remotejdk_11 or local_jdk
+build:build_java11_shared --java_language_version=11
+build:build_java11_shared --java_runtime_version=remotejdk_11
+build:build_java11_shared --tool_java_language_version=11
+build:build_java11_shared --tool_java_runtime_version=remotejdk_11
+
+build:java11 --config=build_java11_shared
+
+# Builds and executes on Google GCP RBE using remotejdk_11
+build:remote11 --config=config_gcp
+build:remote11 --config=build_java11_shared
+
+# Define remote11 configuration alias
+build:remote11_gcp --config=remote11
+
+# Builds and executes on BuildBuddy RBE using remotejdk_11
+build:remote11_bb --config=config_bb
+build:remote11_bb --config=build_java11_shared
 
 # Enable strict_action_env flag to. For more information on this feature see
 # https://groups.google.com/forum/#!topic/bazel-discuss/_VmRfMyyHBk.
diff --git a/Documentation/cmd-ls-projects.txt b/Documentation/cmd-ls-projects.txt
index ebd365a..72e7630 100644
--- a/Documentation/cmd-ls-projects.txt
+++ b/Documentation/cmd-ls-projects.txt
@@ -16,6 +16,10 @@
   [--limit <N>]
   [--prefix | -p <prefix>]
   [--has-acl-for GROUP]
+  [--match | -m]
+  [-r REGEX]
+  [--start | -S]
+  [--state | -s ]
 --
 
 == DESCRIPTION
@@ -58,6 +62,22 @@
 	Displays project inheritance in a tree-like format.
 	This option does not work together with the show-branch option.
 
+--match::
+-m
+  Match project substring
+
+-r::
+  Match project regex
+
+--start::
+-S::
+  Number of projects to skip
+
+--state::
+-s::
+  Filter by project state. [ACTIVE | READON_ONLY | HIDDEN]
+
+
 [NOTE]
 If the calling user does not meet any of the following criteria:
 
diff --git a/Documentation/dev-bazel.txt b/Documentation/dev-bazel.txt
index 314740e..53d9e6b 100644
--- a/Documentation/dev-bazel.txt
+++ b/Documentation/dev-bazel.txt
@@ -707,6 +707,21 @@
 ```
 
 
+== BuildBuddy Remote Build Support
+
+To utilize the BuildBuddy Remote Build Execution service, please consult the
+documentation available at the following link: https://www.buildbuddy.io[BuildBuddy].
+
+To use RBE, execute
+
+```
+bazelisk test --config=remote_bb \
+    --remote_instance_name=projects/${PROJECT}/instances/default_instance \
+    --remote_header=x-buildbuddy-api-key=YOUR_API_KEY \
+    javatests/...
+```
+
+
 GERRIT
 ------
 Part of link:index.html[Gerrit Code Review]
diff --git a/java/com/google/gerrit/sshd/SshDaemon.java b/java/com/google/gerrit/sshd/SshDaemon.java
index cc35a32..af7d22b 100644
--- a/java/com/google/gerrit/sshd/SshDaemon.java
+++ b/java/com/google/gerrit/sshd/SshDaemon.java
@@ -77,6 +77,7 @@
 import org.apache.sshd.common.forward.DefaultForwarderFactory;
 import org.apache.sshd.common.future.CloseFuture;
 import org.apache.sshd.common.future.SshFutureListener;
+import org.apache.sshd.common.global.KeepAliveHandler;
 import org.apache.sshd.common.io.AbstractIoServiceFactory;
 import org.apache.sshd.common.io.IoAcceptor;
 import org.apache.sshd.common.io.IoServiceFactory;
@@ -109,7 +110,6 @@
 import org.apache.sshd.server.command.CommandFactory;
 import org.apache.sshd.server.forward.ForwardingFilter;
 import org.apache.sshd.server.global.CancelTcpipForwardHandler;
-import org.apache.sshd.server.global.KeepAliveHandler;
 import org.apache.sshd.server.global.NoMoreSessionsHandler;
 import org.apache.sshd.server.global.TcpipForwardHandler;
 import org.apache.sshd.server.session.ServerSessionImpl;
diff --git a/plugins/delete-project b/plugins/delete-project
index 723264b..825dcb4 160000
--- a/plugins/delete-project
+++ b/plugins/delete-project
@@ -1 +1 @@
-Subproject commit 723264be4256494c45f5ba056e81be2ad25bbe7c
+Subproject commit 825dcb41a9abfc5892ef3b0f8e89b7ca25c8dfe1
diff --git a/tools/nongoogle.bzl b/tools/nongoogle.bzl
index 55b3185..cb200dc 100644
--- a/tools/nongoogle.bzl
+++ b/tools/nongoogle.bzl
@@ -67,18 +67,18 @@
         sha1 = "cb2f351bf4463751201f43bb99865235d5ba07ca",
     )
 
-    SSHD_VERS = "2.10.0"
+    SSHD_VERS = "2.12.0"
 
     maven_jar(
         name = "sshd-osgi",
         artifact = "org.apache.sshd:sshd-osgi:" + SSHD_VERS,
-        sha1 = "03677ac1da780b7bdb682da50b762d79ea0d940d",
+        sha1 = "32b8de1cbb722ba75bdf9898e0c41d42af00ce57",
     )
 
     maven_jar(
         name = "sshd-sftp",
         artifact = "org.apache.sshd:sshd-sftp:" + SSHD_VERS,
-        sha1 = "88707339ac0693d48df0ec1bafb84c78d792ed08",
+        sha1 = "0f96f00a07b186ea62838a6a4122e8f4cad44df6",
     )
 
     maven_jar(
@@ -96,7 +96,7 @@
     maven_jar(
         name = "sshd-mina",
         artifact = "org.apache.sshd:sshd-mina:" + SSHD_VERS,
-        sha1 = "b1f77377fbc517400e7665d0b2c83b58b41aa45d",
+        sha1 = "8b202f7d4c0d7b714fd0c93a1352af52aa031149",
     )
 
     maven_jar(
diff --git a/tools/remote-bazelrc b/tools/remote-bazelrc
index d634133..d8da574 100644
--- a/tools/remote-bazelrc
+++ b/tools/remote-bazelrc
@@ -27,6 +27,7 @@
 # for a remote machine to execute them.
 build:remote_shared --jobs=200
 build:remote_shared --disk_cache=
+build:remote_shared --remote_download_minimal
 
 # Set several flags related to specifying the platform, toolchain and java
 # properties.
@@ -42,24 +43,39 @@
 # machine exactly match the host machine.
 build:remote_shared --define=EXECUTOR=remote
 
-# Enable the remote cache so action results can be shared across machines,
-# developers, and workspaces.
-build:remote_shared --remote_cache=remotebuildexecution.googleapis.com
-
-# Enable remote execution so actions are performed on the remote systems.
-build:remote_shared --remote_executor=remotebuildexecution.googleapis.com
-
 # Set a higher timeout value, just in case.
 build:remote_shared --remote_timeout=3600
 
+# Configuration flags for remote settings in Google GCP RBE
+# Enable the remote cache so action results can be shared across machines,
+# developers, and workspaces.
+build:config_gcp --remote_cache=remotebuildexecution.googleapis.com
+
+# Enable remote execution so actions are performed on the remote systems.
+build:config_gcp --remote_executor=remotebuildexecution.googleapis.com
+
 # Enable authentication. This will pick up application default credentials by
 # default. You can use --auth_credentials=some_file.json to use a service
 # account credential instead.
-build:remote_shared --google_default_credentials
+build:config_gcp --google_default_credentials
+build:config_gcp --config=remote_shared
 
-# The following flags enable the remote cache so action results can be shared
-# across machines, developers, and workspaces.
-build:remote-cache --remote_cache=remotebuildexecution.googleapis.com
-build:remote-cache --tls_enabled=true
-build:remote-cache --remote_timeout=3600
-build:remote-cache --auth_enabled=true
+# Configuration flags for remote settings in BuildBuddy RBE
+# Enable the remote cache so action results can be shared across machines,
+# developers, and workspaces.
+build:config_bb --remote_cache=grpcs://remote.buildbuddy.io
+
+# Enable remote execution so actions are performed on the remote systems.
+build:config_bb --remote_executor=grpcs://remote.buildbuddy.io
+
+# The results from each Bazel command are viewable with BuildBuddy
+build:config_bb --bes_results_url=https://app.buildbuddy.io/invocation/
+
+# The results of a local build will be uploaded to the BuildBuddy server,
+# providing visibility and collaboration features for the build.
+build:config_bb --remote_upload_local_results
+
+# Define the Build Event Service (BES) backend to use for remote caching and
+# build event storage.
+build:config_bb --bes_backend=grpcs://remote.buildbuddy.io
+build:config_bb --config=remote_shared