codex/.github/workflows/bazel.yml

name: Bazel

# Note this workflow was originally derived from:
# https://github.com/cerisier/toolchains_llvm_bootstrapped/blob/main/.github/workflows/ci.yaml

on:
  pull_request: {}
  push:
    branches:
      - main
  workflow_dispatch:

concurrency:
  # Cancel previous actions from the same PR or branch except 'main' branch.
  # See https://docs.github.com/en/actions/using-jobs/using-concurrency and https://docs.github.com/en/actions/learn-github-actions/contexts for more info.
  group: concurrency-group::${{ github.workflow }}::${{ github.event.pull_request.number > 0 && format('pr-{0}', github.event.pull_request.number) || github.ref_name }}${{ github.ref_name == 'main' && format('::{0}', github.run_id) || ''}}
  cancel-in-progress: ${{ github.ref_name != 'main' }}
jobs:
  test:
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        include:
          # macOS
          - os: macos-15-xlarge
            target: aarch64-apple-darwin
          - os: macos-15-xlarge
            target: x86_64-apple-darwin

          # Linux
          - os: ubuntu-24.04
            target: x86_64-unknown-linux-gnu
          - os: ubuntu-24.04
            target: x86_64-unknown-linux-musl
          # 2026-02-27 Bazel tests have been flaky on arm in CI.
          # Disable until we can investigate and stabilize them.
          # - os: ubuntu-24.04-arm
          #   target: aarch64-unknown-linux-musl
          # - os: ubuntu-24.04-arm
          #   target: aarch64-unknown-linux-gnu

          # Windows
          - os: windows-latest
            target: x86_64-pc-windows-gnullvm
    runs-on: ${{ matrix.os }}

    # Configure a human readable name for each job
    name: Local Bazel build on ${{ matrix.os }} for ${{ matrix.target }}

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Check rusty_v8 MODULE.bazel checksums
        if: matrix.os == 'ubuntu-24.04' && matrix.target == 'x86_64-unknown-linux-gnu'
        shell: bash
        run: |
          python3 .github/scripts/rusty_v8_bazel.py check-module-bazel
          python3 -m unittest discover -s .github/scripts -p test_rusty_v8_bazel.py

      - name: Set up Bazel CI
        id: setup_bazel
        uses: ./.github/actions/setup-bazel-ci
        with:
          target: ${{ matrix.target }}
          install-test-prereqs: "true"

      # Restore the Bazel repository cache explicitly so external dependencies
      # do not need to be re-downloaded on every CI run. Keep restore failures
      # non-fatal so transient cache-service errors degrade to a cold build
      # instead of failing the job.
      - name: Restore bazel repository cache
        id: cache_bazel_repository_restore
        continue-on-error: true
        uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
        with:
          path: ${{ steps.setup_bazel.outputs.repository-cache-path }}
          key: bazel-cache-${{ matrix.target }}-${{ hashFiles('MODULE.bazel', 'codex-rs/Cargo.lock', 'codex-rs/Cargo.toml') }}
          restore-keys: |
            bazel-cache-${{ matrix.target }}

      - name: Check MODULE.bazel.lock is up to date
        if: matrix.os == 'ubuntu-24.04' && matrix.target == 'x86_64-unknown-linux-gnu'
        shell: bash
        run: ./scripts/check-module-bazel-lock.sh

      - name: Set up Bazel execution logs
        shell: bash
        run: |
          mkdir -p "${RUNNER_TEMP}/bazel-execution-logs"
          echo "CODEX_BAZEL_EXECUTION_LOG_COMPACT_DIR=${RUNNER_TEMP}/bazel-execution-logs" >> "${GITHUB_ENV}"

      - name: bazel test //...
        env:
          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
        shell: bash
        run: |
          bazel_targets=(
            //...
            # Keep standalone V8 library targets out of the ordinary Bazel CI
            # path. V8 consumers under `//codex-rs/...` still participate
            # transitively through `//...`.
            -//third_party/v8:all
          )

          bazel_wrapper_args=(
            --print-failed-test-logs
            --use-node-test-env
          )
          if [[ "${RUNNER_OS}" == "Windows" ]]; then
            bazel_wrapper_args+=(--windows-msvc-host-platform)
          fi

          ./.github/scripts/run-bazel-ci.sh \
            "${bazel_wrapper_args[@]}" \
            -- \
            test \
            --test_tag_filters=-argument-comment-lint \
            --test_verbose_timeout_warnings \
            --build_metadata=COMMIT_SHA=${GITHUB_SHA} \
            -- \
            "${bazel_targets[@]}"

      - name: Upload Bazel execution logs
        if: always() && !cancelled()
        continue-on-error: true
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
        with:
          name: bazel-execution-logs-test-${{ matrix.target }}
          path: ${{ runner.temp }}/bazel-execution-logs
          if-no-files-found: ignore

      # Save bazel repository cache explicitly; make non-fatal so cache uploading
      # never fails the overall job. Only save when key wasn't hit.
      - name: Save bazel repository cache
        if: always() && !cancelled() && steps.cache_bazel_repository_restore.outputs.cache-hit != 'true'
        continue-on-error: true
        uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
        with:
          path: ${{ steps.setup_bazel.outputs.repository-cache-path }}
          key: bazel-cache-${{ matrix.target }}-${{ hashFiles('MODULE.bazel', 'codex-rs/Cargo.lock', 'codex-rs/Cargo.toml') }}

  clippy:
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        include:
          # Keep Linux lint coverage on x64 and add the arm64 macOS path that
          # the Bazel test job already exercises. Add Windows gnullvm as well
          # so PRs get Bazel-native lint signal on the same Windows toolchain
          # that the Bazel test job uses.
          - os: ubuntu-24.04
            target: x86_64-unknown-linux-gnu
          - os: macos-15-xlarge
            target: aarch64-apple-darwin
          - os: windows-latest
            target: x86_64-pc-windows-gnullvm
    runs-on: ${{ matrix.os }}
    name: Bazel clippy on ${{ matrix.os }} for ${{ matrix.target }}

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Set up Bazel CI
        id: setup_bazel
        uses: ./.github/actions/setup-bazel-ci
        with:
          target: ${{ matrix.target }}

      # Restore the Bazel repository cache explicitly so external dependencies
      # do not need to be re-downloaded on every CI run. Keep restore failures
      # non-fatal so transient cache-service errors degrade to a cold build
      # instead of failing the job.
      - name: Restore bazel repository cache
        id: cache_bazel_repository_restore
        continue-on-error: true
        uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
        with:
          path: ${{ steps.setup_bazel.outputs.repository-cache-path }}
          key: bazel-cache-${{ matrix.target }}-${{ hashFiles('MODULE.bazel', 'codex-rs/Cargo.lock', 'codex-rs/Cargo.toml') }}
          restore-keys: |
            bazel-cache-${{ matrix.target }}

      - name: Set up Bazel execution logs
        shell: bash
        run: |
          mkdir -p "${RUNNER_TEMP}/bazel-execution-logs"
          echo "CODEX_BAZEL_EXECUTION_LOG_COMPACT_DIR=${RUNNER_TEMP}/bazel-execution-logs" >> "${GITHUB_ENV}"

      - name: bazel build --config=clippy lint targets
        env:
          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
        shell: bash
        run: |
          bazel_clippy_args=(
            --config=clippy
            --build_metadata=COMMIT_SHA=${GITHUB_SHA}
            --build_metadata=TAG_job=clippy
          )
          if [[ "${RUNNER_OS}" == "Windows" ]]; then
            # Some explicit targets pulled in through //codex-rs/... are
            # intentionally incompatible with `//:local_windows`, but the lint
            # aspect still traverses their compatible Rust deps.
            bazel_clippy_args+=(--skip_incompatible_explicit_targets)
          fi

          bazel_target_lines="$(./scripts/list-bazel-clippy-targets.sh)"
          bazel_targets=()
          while IFS= read -r target; do
            bazel_targets+=("${target}")
          done <<< "${bazel_target_lines}"

          ./.github/scripts/run-bazel-ci.sh \
            -- \
            build \
            "${bazel_clippy_args[@]}" \
            -- \
            "${bazel_targets[@]}"

      - name: Upload Bazel execution logs
        if: always() && !cancelled()
        continue-on-error: true
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
        with:
          name: bazel-execution-logs-clippy-${{ matrix.target }}
          path: ${{ runner.temp }}/bazel-execution-logs
          if-no-files-found: ignore

      # Save bazel repository cache explicitly; make non-fatal so cache uploading
      # never fails the overall job. Only save when key wasn't hit.
      - name: Save bazel repository cache
        if: always() && !cancelled()
        continue-on-error: true
        uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
        with:
          path: ${{ steps.setup_bazel.outputs.repository-cache-path }}
          key: bazel-cache-${{ matrix.target }}-${{ hashFiles('MODULE.bazel', 'codex-rs/Cargo.lock', 'codex-rs/Cargo.toml') }}