ci(bazel): glob-gate root on main too (drop the every-merge force)

[balajinvda]

Why

#311 forced the root row on every push to main to keep the remote cache warm. That was a workaround for the wrong hypothesis. The real reason root was always cold was that it never uploaded: root's .bazelrc --config=remote pinned --remote_upload_local_results=false, so even when root ran on a root-change merge it warmed nothing. That is fixed (force upload=true on main + .bazelrc consistency).

With the upload fix in place and the cache rings not evicting, root only needs to run when a ROOT_GLOB file changes: a later root PR reads the closure warmed by the last root-touching merge. Forcing root on every merge just spun up the ~7k-target build for docs- and helm-only merges that warm nothing new.

What changed

• Drop the is_main_push force in the detect job. Root is now purely glob-gated on merges, exactly as it already is on PRs — a docs- or helm-only change never triggers root.
• Keep the main-push upload (CACHE_UPLOAD), so root still warms the cache whenever it does run.
• Remove the now-unused REF env.

Testing

YAML parses; the detect run: block passes bash -n. A docs-only merge will no longer schedule the root row.

Issues

Relates to #283

References

Refines the warming approach from #311.

Dependencies

None

Summary by CodeRabbit

• Bug Fixes
  • Improved Bazel build selection by using event and commit context instead of passing branch refs into the detector step.
  • Refined root-subtree selection so root builds run only when a “run all” fallback occurs or when specific root-level files change.
  • Fixed edge cases where root-level *.bzl changes are now properly detected for triggering root builds.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 84c0fdcd-911e-4c52-a90b-220fc3a58f5d

📥 Commits

Reviewing files that changed from the base of the PR and between e77714b and fc63565.

📒 Files selected for processing (1)

• .github/workflows/bazel.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/bazel.yml

---

📝 Walkthrough

Walkthrough

The Bazel workflow no longer passes github.ref as REF. Root subtree selection now depends on run-all fallback conditions, matching ROOT_GLOBS, or changes to root-level .bzl files.

Changes

Bazel matrix detection

Layer / File(s)	Summary
Glob-gated root matrix selection .github/workflows/bazel.yml	The detect job removes the REF environment input and updates root selection to handle run-all fallbacks, configured root globs, and root-level .bzl changes instead of always selecting root on main pushes.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly reflects the main Bazel CI change: removing the forced root run and gating root on glob changes for main pushes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/root-glob-gated-only

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

.github/workflows/bazel.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/bazel.yml:
- Around line 152-162: Expand the root-gate matching around ROOT_GLOBS to
include WORKSPACE, WORKSPACE.bazel, go.work, go.work.bazel, and root-level *.bzl
changes, keeping behavior consistent with the full-build triggers in the
target-selection logic. Use a matcher that supports the literal root-level *.bzl
pattern, since the current fixed-prefix awk check cannot interpret it;
preferably reuse a canonical root-global matcher if one exists.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 5e83c395-8a76-49be-938b-fa5ca669add3

📥 Commits

Reviewing files that changed from the base of the PR and between d6c2206 and e77714b.

📒 Files selected for processing (1)

• .github/workflows/bazel.yml