Add PRESUBMIT.py for infra/config

This adds a PRESUBMIT.py file for infra/config, which works with `git cl
presubmit` from depot_tools. The presubmit function checks that the
lucicfg generated output matches the changes to main.star and has no
validation errors.

Fixes the existing config file to make it conform to the presubmit
checks (e.g. formatting, docstrings).

Also adds a mention of depot_tools to CONTRIBUTING.md to make it clear
that depot_tools works on the boringssl repo.

Change-Id: I311cab911b80025db5c0d780f8959b58c033d81c
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/80627
Auto-Submit: Lily Chen <chlily@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>

CONTRIBUTING.md

@@ -49,6 +49,13 @@ version of it. (Use the `git rebase` or `git commit --amend` commands.)
 For more detailed instructions, see the
 [Gerrit User Guide](https://gerrit-review.googlesource.com/Documentation/intro-user.html).
 
+As an alternative to pushing to `refs/for/main`: if you have Chromium's
+`depot_tools` installed, you can simply run `git cl upload` to upload a change.
+This also has the advantage of automatically running any relevant `PRESUBMIT.py`
+checks. See [depot_tools
+documentation](https://commondatastorage.googleapis.com/chrome-infra-docs/flat/depot_tools/docs/html/depot_tools.html)
+for more info.
+
 ### Copyright headers
 New files contributed directly to BoringSSL should use the following copyright
 header, where `YEAR` is the year the file was added:

infra/config/PRESUBMIT.py

@@ -0,0 +1,24 @@
+# Copyright 2025 The BoringSSL Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Enforces consistency in lucicfg definitions for BoringSSL's CI and CQ.
+
+Run by the presubmit API in depot_tools, e.g. by running `git cl presubmit`.
+"""
+
+PRESUBMIT_VERSION = '2.0.0'
+
+def CheckLucicfgGenOutputMain(input_api, output_api):
+  return input_api.RunTests(input_api.canned_checks.CheckLucicfgGenOutput(
+      input_api, output_api, 'main.star'))

infra/config/main.star

@@ -130,6 +130,17 @@ def ci_builder(
         short_name = None,
         execution_timeout = None,
         properties = {}):
+    """Defines a CI builder.
+
+    Args:
+      name: The name to use for the builder.
+      host: The host to run on.
+      recipe: The recipe to run.
+      category: Category in which to display the builder in the console view.
+      short_name: The short name for the builder in the console view.
+      execution_timeout: Overrides the default timeout.
+      properties: Properties to pass to the recipe.
+    """
     dimensions = dict(host["dimensions"])
     dimensions["pool"] = "luci.flex.ci"
     caches = [swarming.cache("gocache"), swarming.cache("gopath")]
@@ -170,6 +181,17 @@ def cq_builder(
         cq_enabled = True,
         execution_timeout = None,
         properties = {}):
+    """Defines a CQ builder.
+
+    Args:
+      name: The name to use for the builder.
+      host: The host to run on.
+      recipe: The recipe to run.
+      cq_enabled: Whether the try builder is enabled by default. (If false,
+        the builder is includable_only.)
+      execution_timeout: Overrides the default timeout.
+      properties: Properties to pass to the recipe.
+    """
     dimensions = dict(host["dimensions"])
     dimensions["pool"] = "luci.flex.try"
     if execution_timeout == None:
@@ -220,6 +242,24 @@ def both_builders(
         cq_compile_only = None,
         execution_timeout = None,
         properties = {}):
+    """Defines both a CI builder and similarly-configured CQ builder.
+
+    Args:
+      name: The name to use for both builders.
+      host: The host to run on.
+      recipe: The recipe to run.
+      category: Category in which to display the builder in the console view.
+      short_name: The short name for the builder in the console view.
+      cq_enabled: Whether the try builder is enabled by default. (If false,
+        the builder is includable_only.)
+      cq_compile_only: If cq_compile_only is specified, we generate both a
+        disabled builder that matches the CI builder, and a compile-only
+        builder. The compile-only builder is controlled by cq_enabled.
+        cq_compile_only also specifies the host to run on, because the
+        compile-only builder usually has weaker requirements.
+      execution_timeout: Overrides the default timeout.
+      properties: Properties to pass to the recipe.
+    """
     ci_builder(
         name,
         host,
@@ -230,11 +270,6 @@ def both_builders(
         properties = properties,
     )
 
-    # If cq_compile_only is specified, we generate both a disabled builder that
-    # matches the CI builder, and a compile-only builder. The compile-only
-    # builder is controlled by cq_enabled. cq_compile_only also specifies the
-    # host to run on, because the compile-only builder usually has weaker
-    # requirements.
     cq_builder(
         name,
         host,
@@ -381,7 +416,6 @@ both_builders(
     },
 )
 
-
 # delocate works on aarch64. Test this by also building the static library mode
 # for android_aarch64_fips. Additionally, urandom_test doesn't work in shared
 # library builds, so this gives Android FIPS coverage for urandom_test.
@@ -794,6 +828,7 @@ both_builders(
         },
     },
 )
+
 # TODO(crbug.com/42290446): Enable on both CQ and CI.
 cq_builder(
     "linux_rust",