From b0ff7b129353712967ccdc1772efa323b931ace1 Mon Sep 17 00:00:00 2001 From: Zack Jackson <25274700+ScriptedAlchemy@users.noreply.github.com> Date: Mon, 9 Nov 2026 00:07:13 -0800 Subject: [PATCH 1/2] ci(bazel): stage the pinned rules_python archive on Windows --- .github/actions/setup-bazel/action.yml | 19 ++++++++----- .../setup-bazel/stage_linux_launchers.sh | 20 -------------- .../setup-bazel/stage_release_distfiles.sh | 27 +++++++++++++++++++ 3 files changed, 39 insertions(+), 27 deletions(-) delete mode 100644 .github/actions/setup-bazel/stage_linux_launchers.sh create mode 100644 .github/actions/setup-bazel/stage_release_distfiles.sh diff --git a/.github/actions/setup-bazel/action.yml b/.github/actions/setup-bazel/action.yml index 22f634ac0d..63e3a78636 100644 --- a/.github/actions/setup-bazel/action.yml +++ b/.github/actions/setup-bazel/action.yml @@ -222,14 +222,19 @@ runs: fi python3 "$GITHUB_ACTION_PATH/configure_fleet.py" - - name: Stage hermetic launchers from the GitHub release API - id: linux-launchers - if: runner.environment == 'github-hosted' && runner.os == 'Linux' && runner.arch == 'X64' + - name: Stage pinned Bazel inputs from the GitHub release API + id: release-distfiles + if: runner.environment == 'github-hosted' && (runner.os == 'Windows' || (runner.os == 'Linux' && runner.arch == 'X64')) shell: bash run: | - distdir=$(mktemp -d "$RUNNER_TEMP/hermetic-launcher.XXXXXXXX") - bash "$GITHUB_ACTION_PATH/stage_linux_launchers.sh" "$distdir" - printf 'bazelrc=common --distdir=%s\n' "$distdir" >> "$GITHUB_OUTPUT" + runner_temp=$RUNNER_TEMP + if [[ "$RUNNER_OS" == Windows ]]; then + # Git Bash and native Bazel both accept a drive-qualified slash path. + runner_temp=$(cygpath -m "$runner_temp") + fi + distdir=$(mktemp -d "$runner_temp/bazel-distfiles.XXXXXXXX") + bash "$GITHUB_ACTION_PATH/stage_release_distfiles.sh" "$distdir" + printf 'bazelrc=common --distdir="%s"\n' "$distdir" >> "$GITHUB_OUTPUT" - uses: bazel-contrib/setup-bazel@104e3eea9447cdaa4b00d0fb46191a3985d26ab3 # 0.19.1 with: @@ -239,7 +244,7 @@ runs: bazelrc: | common --repository_cache=${{ steps.disk-cache-config.outputs.repository-path }} build --disk_cache=${{ steps.fleet.outputs.enabled != 'true' && steps.disk-cache-config.outputs.path || '' }} - ${{ steps.linux-launchers.outputs.bazelrc }} + ${{ steps.release-distfiles.outputs.bazelrc }} cache-save: ${{ github.ref == 'refs/heads/master' && inputs.cache-save == 'true' }} # Windows build-script runfiles nest each vendored crate's sources # under its repository name twice; keep the output base short. diff --git a/.github/actions/setup-bazel/stage_linux_launchers.sh b/.github/actions/setup-bazel/stage_linux_launchers.sh deleted file mode 100644 index 6221a36e10..0000000000 --- a/.github/actions/setup-bazel/stage_linux_launchers.sh +++ /dev/null @@ -1,20 +0,0 @@ -#!/usr/bin/env bash -set -euo pipefail - -# These public API IDs identify the binaries-20261025 release used by -# hermetic_launcher. Bazel checks its upstream SHA-256 before accepting a -# distdir file and uses the original release URL when the file is absent. -distdir=${1:?expected a runner-private distdir} -api=https://api.github.com/repos/hermeticbuild/hermetic-launcher/releases/assets - -stage_asset() { - local id=$1 name=$2 - if ! curl --fail --silent --show-error --location --remove-on-error \ - --connect-timeout 5 --max-time 30 --header 'Accept: application/octet-stream' \ - --output "$distdir/$name" "$api/$id"; then - printf '::notice::Release API unavailable for %s; Bazel will use its configured source.\n' "$name" - fi -} - -stage_asset 674976726 finalize-stub-x86_64-linux -stage_asset 674976728 runfiles-stub-x86_64-linux diff --git a/.github/actions/setup-bazel/stage_release_distfiles.sh b/.github/actions/setup-bazel/stage_release_distfiles.sh new file mode 100644 index 0000000000..10e883584b --- /dev/null +++ b/.github/actions/setup-bazel/stage_release_distfiles.sh @@ -0,0 +1,27 @@ +#!/usr/bin/env bash +set -euo pipefail + +# Bazel accepts a staged file only when it matches the checksum in the +# dependency rule or registry and otherwise tries the configured source. +distdir=${1:?expected a runner-private distdir} + +stage_asset() { + local repo=$1 id=$2 name=$3 + if ! curl --fail --silent --show-error --location --remove-on-error \ + --connect-timeout 5 --max-time 30 --header 'Accept: application/octet-stream' \ + --output "$distdir/$name" "https://api.github.com/repos/$repo/releases/assets/$id"; then + printf '::notice::Release API unavailable for %s; Bazel will use its configured source.\n' "$name" + fi +} + +case "$RUNNER_OS" in + Linux) + # hermetic_launcher release binaries-20261025, for Linux x86-64 tools. + stage_asset hermeticbuild/hermetic-launcher 674976726 finalize-stub-x86_64-linux + stage_asset hermeticbuild/hermetic-launcher 674976728 runfiles-stub-x86_64-linux + ;; + Windows) + # rules_python 2.4.6, using the archive basename from its BCR source.json. + stage_asset bazel-contrib/rules_python 690529045 rules_python-2.4.6.tar.gz + ;; +esac From 7fba4db04983db42a8115130204c2c1af106dd36 Mon Sep 17 00:00:00 2001 From: Zack Jackson <25274700+ScriptedAlchemy@users.noreply.github.com> Date: Mon, 9 Nov 2026 00:14:24 -0800 Subject: [PATCH 2/2] ci(bazel): stage the shared rules archive on all hosted platforms --- .github/actions/setup-bazel/action.yml | 2 +- .../setup-bazel/stage_release_distfiles.sh | 19 ++++++++----------- 2 files changed, 9 insertions(+), 12 deletions(-) diff --git a/.github/actions/setup-bazel/action.yml b/.github/actions/setup-bazel/action.yml index 63e3a78636..ebb0660f36 100644 --- a/.github/actions/setup-bazel/action.yml +++ b/.github/actions/setup-bazel/action.yml @@ -224,7 +224,7 @@ runs: - name: Stage pinned Bazel inputs from the GitHub release API id: release-distfiles - if: runner.environment == 'github-hosted' && (runner.os == 'Windows' || (runner.os == 'Linux' && runner.arch == 'X64')) + if: runner.environment == 'github-hosted' shell: bash run: | runner_temp=$RUNNER_TEMP diff --git a/.github/actions/setup-bazel/stage_release_distfiles.sh b/.github/actions/setup-bazel/stage_release_distfiles.sh index 10e883584b..e7af107176 100644 --- a/.github/actions/setup-bazel/stage_release_distfiles.sh +++ b/.github/actions/setup-bazel/stage_release_distfiles.sh @@ -14,14 +14,11 @@ stage_asset() { fi } -case "$RUNNER_OS" in - Linux) - # hermetic_launcher release binaries-20261025, for Linux x86-64 tools. - stage_asset hermeticbuild/hermetic-launcher 674976726 finalize-stub-x86_64-linux - stage_asset hermeticbuild/hermetic-launcher 674976728 runfiles-stub-x86_64-linux - ;; - Windows) - # rules_python 2.4.6, using the archive basename from its BCR source.json. - stage_asset bazel-contrib/rules_python 690529045 rules_python-2.4.6.tar.gz - ;; -esac +# The same rules_python archive is required by Bazel on every host. +stage_asset bazel-contrib/rules_python 690529045 rules_python-2.4.6.tar.gz + +if [[ "$RUNNER_OS" == Linux && "$RUNNER_ARCH" == X64 ]]; then + # hermetic_launcher release binaries-20261025, for Linux x86-64 tools. + stage_asset hermeticbuild/hermetic-launcher 674976726 finalize-stub-x86_64-linux + stage_asset hermeticbuild/hermetic-launcher 674976728 runfiles-stub-x86_64-linux +fi