impl(rest): use PQC algorithm when available

.bazelignore

@@ -1,5 +1,7 @@
 build-out/
-ci/
+ci/bzlmod_tests/consumer-test
+ci/verify_current_targets
+ci/verify_deprecated_targets
 cmake-out/
 cmake-build-debug/
 cmake-build-coverage/

ci/cloudbuild/builds/showcase.sh

@@ -0,0 +1,89 @@
+#!/bin/bash
+#
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -euo pipefail
+
+source "$(dirname "$0")/../../lib/init.sh"
+source module ci/cloudbuild/builds/lib/bazel.sh
+source module ci/cloudbuild/builds/lib/cloudcxxrc.sh
+source module ci/lib/io.sh
+
+export CC=clang
+export CXX=clang++
+
+mapfile -t args < <(bazel::common_args)
+
+io::log_h1 "Running Showcase PQC tests with Bazel"
+
+cp ci/showcase/BUILD.bazel.in ci/showcase/BUILD.bazel
+
+SHOWCASE_VERSION="${SHOWCASE_VERSION:-main}"
+SHOWCASE_DIR="ci/showcase/googleapis/gapic-showcase"
+if [[ ! -f "${SHOWCASE_DIR}/go.mod" ]]; then
+  io::log_h2 "Downloading googleapis/gapic-showcase (${SHOWCASE_VERSION}) tarball into ${SHOWCASE_DIR}"
+  mkdir -p "${SHOWCASE_DIR}"
+  curl -fsSL "https://github.com/googleapis/gapic-showcase/archive/${SHOWCASE_VERSION}.tar.gz" |
+    tar -C "${SHOWCASE_DIR}" -xzf - --strip-components=1
+fi
+
+bazel_output_base="$(bazel info output_base)"
+protobuf_proto_path="${bazel_output_base}/external/protobuf+/src"
+googleapis_proto_path="${bazel_output_base}/external/googleapis+"
+
+io::log_h2 "Running C++ codegen generator for gapic-showcase echo.proto"
+bazel run --action_env=GOOGLE_CLOUD_CPP_ENABLE_CLOG=yes \
+  //generator:google-cloud-cpp-codegen -- \
+  --protobuf_proto_path="${protobuf_proto_path}" \
+  --googleapis_proto_path="${googleapis_proto_path}" \
+  --golden_proto_path="${PROJECT_ROOT}/${SHOWCASE_DIR}/schema" \
+  --output_path="${PROJECT_ROOT}/ci/showcase" \
+  --check_comment_substitutions=false \
+  --config_file="${PROJECT_ROOT}/ci/showcase/showcase_config.textproto"
+
+io::log_h2 "Building gapic-showcase server binary"
+mkdir -p "${PROJECT_ROOT}/ci/showcase/bin"
+(
+  cd "${PROJECT_ROOT}/${SHOWCASE_DIR}"
+  go build -o "${PROJECT_ROOT}/ci/showcase/bin/gapic-showcase" ./cmd/gapic-showcase
+)
+
+SHOWCASE_PORT="${SHOWCASE_PORT:-7469}"
+SHOWCASE_CA_CERT="${PROJECT_ROOT}/ci/showcase/showcase.pem"
+rm -f "${SHOWCASE_CA_CERT}"
+
+io::log_h2 "Starting gapic-showcase server on port ${SHOWCASE_PORT} with TLS"
+"${PROJECT_ROOT}/ci/showcase/bin/gapic-showcase" run \
+  --port=":${SHOWCASE_PORT}" \
+  --tls \
+  --ca-cert-output-file="${SHOWCASE_CA_CERT}" >/dev/null 2>&1 &
+showcase_pid=$!
+
+# Ensure server is shut down on script exit
+trap 'kill "${showcase_pid}" || true' EXIT
+
+# Wait up to 15 seconds for CA cert file to be created and server to be listening
+for _ in $(seq 1 30); do
+  if [[ -r "${SHOWCASE_CA_CERT}" ]] && curl --insecure -s "https://localhost:${SHOWCASE_PORT}" >/dev/null 2>&1; then
+    break
+  fi
+  sleep 0.5
+done
+
+io::log_h2 "Running showcase tests"
+bazel test --test_env=SHOWCASE_PORT="${SHOWCASE_PORT}" \
+  --test_env=SHOWCASE_CA_CERT="${SHOWCASE_CA_CERT}" \
+  --test_output=errors \
+  //ci/showcase:rest_pqc_test

ci/cloudbuild/triggers/showcase-ci.yaml

@@ -0,0 +1,28 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+filename: ci/cloudbuild/cloudbuild.yaml
+github:
+  name: google-cloud-cpp
+  owner: googleapis
+  push:
+    branch: main
+includeBuildLogs: INCLUDE_BUILD_LOGS_WITH_STATUS
+name: showcase-ci
+substitutions:
+  _BUILD_NAME: showcase
+  _DISTRO: fedora-latest-bazel
+  _TRIGGER_TYPE: ci
+tags:
+- ci

ci/cloudbuild/triggers/showcase-pr.yaml

@@ -0,0 +1,29 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+filename: ci/cloudbuild/cloudbuild.yaml
+github:
+  name: google-cloud-cpp
+  owner: googleapis
+  pullRequest:
+    branch: main
+    commentControl: COMMENTS_ENABLED_FOR_EXTERNAL_CONTRIBUTORS_ONLY
+includeBuildLogs: INCLUDE_BUILD_LOGS_WITH_STATUS
+name: showcase-pr
+substitutions:
+  _BUILD_NAME: showcase
+  _DISTRO: fedora-latest-bazel
+  _TRIGGER_TYPE: pr
+tags:
+- pr

ci/showcase/.bazelignore

@@ -0,0 +1 @@
+bazel-*

ci/showcase/.bazelrc

@@ -0,0 +1,33 @@
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Use host-OS-specific config lines from bazelrc files.
+build --enable_platform_specific_config=true
+
+# The project requires C++ >= 17.
+build:linux --cxxopt=-std=c++17
+build:macos --cxxopt=-std=c++17
+# Protobuf and gRPC require C++17 to compile the "host"
+# targets, such as protoc and the grpc plugin.
+build:linux --host_cxxopt=-std=c++17
+build:macos --host_cxxopt=-std=c++17
+
+# Do not create the convenience links. They are inconvenient when the build
+# runs inside a docker image or if one builds a quickstart and then builds
+# the project separately.
+build --experimental_convenience_symlinks=ignore
+
+# TODO(#13311) - remove once gRPC works with Bazel v7 or when gRPC stops using
+#     `apple_rules`.
+common:macos --repo_env=BAZEL_NO_APPLE_CPP_TOOLCHAIN=1

ci/showcase/.bazelversion

@@ -0,0 +1 @@
+8.7.0

ci/showcase/.gitignore

@@ -0,0 +1,7 @@
+# Ignore downloaded gapic-showcase tarball contents when running locally.
+googleapis/gapic-showcase/
+# Ignore dynamically generated C++ library files when running locally.
+google/showcase/
+# Ignore compiled binaries and certificates when running locally.
+bin/
+showcase.pem

ci/showcase/BUILD.bazel.in

@@ -0,0 +1,113 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+load("@com_google_protobuf//bazel:cc_proto_library.bzl", "cc_proto_library")
+load("@com_google_protobuf//bazel:proto_library.bzl", "proto_library")
+load("@grpc//bazel:cc_grpc_library.bzl", "cc_grpc_library")
+
+package(default_visibility = ["//visibility:private"])
+
+licenses(["notice"])
+
+proto_library(
+    name = "showcase_echo_proto",
+    srcs = ["googleapis/gapic-showcase/schema/google/showcase/v1beta1/echo.proto"],
+    strip_import_prefix = "googleapis/gapic-showcase/schema",
+    deps = [
+        "@com_google_protobuf//:any_proto",
+        "@com_google_protobuf//:duration_proto",
+        "@com_google_protobuf//:timestamp_proto",
+        "@googleapis//google/api:annotations_proto",
+        "@googleapis//google/api:client_proto",
+        "@googleapis//google/api:field_behavior_proto",
+        "@googleapis//google/api:field_info_proto",
+        "@googleapis//google/api:routing_proto",
+        "@googleapis//google/longrunning:operations_proto",
+        "@googleapis//google/rpc:status_proto",
+    ],
+)
+
+cc_proto_library(
+    name = "showcase_echo_cc_proto",
+    deps = [":showcase_echo_proto"],
+)
+
+cc_grpc_library(
+    name = "showcase_echo_cc_grpc",
+    srcs = [":showcase_echo_proto"],
+    grpc_only = True,
+    deps = [":showcase_echo_cc_proto"],
+)
+
+filegroup(
+    name = "echo_srcs",
+    srcs = glob([
+        "google/showcase/v1beta1/internal/*_sources.cc",
+    ]),
+)
+
+filegroup(
+    name = "echo_hdrs",
+    srcs = glob(
+        include = [
+            "google/showcase/v1beta1/*.cc",
+            "google/showcase/v1beta1/*.h",
+            "google/showcase/v1beta1/internal/*.cc",
+            "google/showcase/v1beta1/internal/*.h",
+        ],
+        exclude = [
+            "google/showcase/v1beta1/internal/*_sources.cc",
+        ],
+    ),
+)
+
+cc_library(
+    name = "showcase_echo_client",
+    srcs = [":echo_srcs"],
+    hdrs = [":echo_hdrs"],
+    copts = [
+        "-Ici/showcase",
+        "-I$(BINDIR)/ci/showcase",
+    ],
+    includes = ["."],
+    strip_include_prefix = "",
+    deps = [
+        ":showcase_echo_cc_grpc",
+        ":showcase_echo_cc_proto",
+        "//:common",
+        "//:grpc_utils",
+        "//google/cloud:google_cloud_cpp_rest_internal",
+        "//google/cloud:google_cloud_cpp_rest_protobuf_internal",
+        "@abseil-cpp//absl/strings",
+        "@googleapis//google/longrunning:longrunning_cc_grpc",
+    ],
+)
+
+cc_test(
+    name = "rest_pqc_test",
+    srcs = ["rest_pqc_test.cc"],
+    copts = [
+        "-Ici/showcase",
+        "-I$(BINDIR)/ci/showcase",
+    ],
+    tags = ["integration-test"],
+    deps = [
+        ":showcase_echo_client",
+        "//:common",
+        "//google/cloud:google_cloud_cpp_rest_internal",
+        "//google/cloud/testing_util:google_cloud_cpp_testing_private",
+        "//google/cloud/testing_util:google_cloud_cpp_testing_rest_private",
+        "@googletest//:gtest_main",
+    ],
+)