build: migrate argument-comment-lint to a native Bazel aspect

## Summary

Add the Windows gnullvm stack-reserve flags to the `*-unit-tests-bin`
path in `codex_rust_crate()`.

## Why

This is the narrow code fix behind the earlier review comment on
[#16067](https://github.com/openai/codex/pull/16067). That comment was
stale relative to the workflow-only PR it landed on, but it pointed at a
real gap in `defs.bzl`.

Today, `codex_rust_crate()` already appends
`WINDOWS_GNULLVM_RUSTC_STACK_FLAGS` for:

- `rust_binary()` targets
- integration-test `rust_test()` targets

But the unit-test binary path still omitted those flags. That meant the
generated `*-unit-tests-bin` executables were not built the same way as
the rest of the Windows gnullvm executables in the macro.

## What Changed

- Added `WINDOWS_GNULLVM_RUSTC_STACK_FLAGS` to the `unit_test_binary`
`rust_test()` rule in `defs.bzl`
- Added a short comment explaining why unit-test binaries need the same
stack-reserve treatment as binaries and integration tests on Windows
gnullvm

## Testing

- `bazel query '//codex-rs/core:*'`
- `bazel query '//codex-rs/shell-command:*'`

Those queries load packages that exercise `codex_rust_crate()`,
including `*-unit-tests-bin` targets. The actual runtime effect is
Windows-specific, so the real end-to-end confirmation still comes from
Windows CI.

.bazelrc

@@ -77,6 +77,11 @@ build:clippy --aspects=@rules_rust//rust:defs.bzl%rust_clippy_aspect
 build:clippy --output_groups=+clippy_checks
 build:clippy --@rules_rust//rust/settings:clippy.toml=//codex-rs:clippy.toml
 
+# Shared config for Bazel-backed argument-comment-lint.
+build:argument-comment-lint --aspects=//tools/argument-comment-lint:lint_aspect.bzl%rust_argument_comment_lint_aspect
+build:argument-comment-lint --output_groups=argument_comment_lint_checks
+build:argument-comment-lint --@rules_rust//rust/toolchain/channel=nightly
+
 # Rearrange caches on Windows so they're on the same volume as the checkout.
 common:ci-windows --config=ci-bazel
 common:ci-windows --build_metadata=TAG_os=windows

.github/actions/setup-bazel-ci/action.yml

@@ -57,9 +57,11 @@ runs:
       if: runner.os == 'Windows'
       shell: pwsh
       run: |
-        # Use a very short path to reduce argv/path length issues, but avoid the
-        # drive root because some Windows test launchers mis-handle MANIFEST paths there.
-        "BAZEL_OUTPUT_USER_ROOT=D:\b" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+        # Use the shortest available drive to reduce argv/path length issues,
+        # but avoid the drive root because some Windows test launchers mis-handle
+        # MANIFEST paths there.
+        $bazelOutputUserRoot = if (Test-Path 'D:\') { 'D:\b' } else { 'C:\b' }
+        "BAZEL_OUTPUT_USER_ROOT=$bazelOutputUserRoot" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
 
     - name: Enable Git long paths (Windows)
       if: runner.os == 'Windows'

.github/workflows/bazel.yml

@@ -81,6 +81,7 @@ jobs:
             --use-node-test-env \
             -- \
             test \
+            --test_tag_filters=-argument-comment-lint \
             --test_verbose_timeout_warnings \
             --build_metadata=COMMIT_SHA=${GITHUB_SHA} \
             -- \
@@ -98,6 +99,7 @@ jobs:
           key: bazel-cache-${{ matrix.target }}-${{ hashFiles('MODULE.bazel', 'codex-rs/Cargo.lock', 'codex-rs/Cargo.toml') }}
 
   clippy:
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:

.github/workflows/rust-ci-full.yml

@@ -73,6 +73,7 @@ jobs:
   argument_comment_lint_prebuilt:
     name: Argument comment lint - ${{ matrix.name }}
     runs-on: ${{ matrix.runs_on || matrix.runner }}
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
@@ -88,29 +89,27 @@ jobs:
               labels: codex-windows-x64
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: ./.github/actions/setup-bazel-ci
+        with:
+          target: ${{ runner.os }}
+          install-test-prereqs: true
       - name: Install Linux sandbox build dependencies
         if: ${{ runner.os == 'Linux' }}
         shell: bash
         run: |
           sudo DEBIAN_FRONTEND=noninteractive apt-get update
           sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends pkg-config libcap-dev
-      - uses: dtolnay/rust-toolchain@a0b273b48ed29de4470960879e8381ff45632f26 # 1.93.0
-        with:
-          toolchain: nightly-2025-09-18
-          components: llvm-tools-preview, rustc-dev, rust-src
-      - uses: facebook/install-dotslash@1e4e7b3e07eaca387acb98f1d4720e0bee8dbb6a # v2
-      - name: Run argument comment lint on codex-rs
-        if: ${{ runner.os == 'macOS' }}
+      - name: Run argument comment lint on codex-rs via Bazel
         shell: bash
-        run: python3 ./tools/argument-comment-lint/run-prebuilt-linter.py
-      - name: Run argument comment lint on codex-rs (default targets only)
-        if: ${{ runner.os == 'Linux' }}
-        shell: bash
-        run: python3 ./tools/argument-comment-lint/run-prebuilt-linter.py -- --lib --bins
-      - name: Run argument comment lint on codex-rs
-        if: ${{ runner.os == 'Windows' }}
-        shell: bash
-        run: python ./tools/argument-comment-lint/run-prebuilt-linter.py
+        run: |
+          ./.github/scripts/run-bazel-ci.sh \
+            -- \
+            build \
+            --config=argument-comment-lint \
+            --keep_going \
+            --build_metadata=COMMIT_SHA=${GITHUB_SHA} \
+            -- \
+            //codex-rs/...
 
   # --- CI to validate on different os/targets --------------------------------
   lint_build:

.github/workflows/rust-ci.yml

@@ -93,9 +93,16 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: dtolnay/rust-toolchain@a0b273b48ed29de4470960879e8381ff45632f26 # 1.93.0
-        with:
-          toolchain: nightly-2025-09-18
-          components: llvm-tools-preview, rustc-dev, rust-src
+      - name: Install nightly argument-comment-lint toolchain
+        shell: bash
+        run: |
+          rustup toolchain install nightly-2025-09-18 \
+            --profile minimal \
+            --component llvm-tools-preview \
+            --component rustc-dev \
+            --component rust-src \
+            --no-self-update
+          rustup default nightly-2025-09-18
       - name: Cache cargo-dylint tooling
         id: cargo_dylint_cache
         uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
@@ -121,6 +128,7 @@ jobs:
   argument_comment_lint_prebuilt:
     name: Argument comment lint - ${{ matrix.name }}
     runs-on: ${{ matrix.runs_on || matrix.runner }}
+    timeout-minutes: ${{ matrix.timeout_minutes }}
     needs: changed
     if: ${{ needs.changed.outputs.argument_comment_lint == 'true' || needs.changed.outputs.workflows == 'true' }}
     strategy:
@@ -129,40 +137,57 @@ jobs:
         include:
           - name: Linux
             runner: ubuntu-24.04
+            timeout_minutes: 30
           - name: macOS
             runner: macos-15-xlarge
+            timeout_minutes: 30
           - name: Windows
             runner: windows-x64
+            timeout_minutes: 30
             runs_on:
               group: codex-runners
               labels: codex-windows-x64
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: ./.github/actions/setup-bazel-ci
+        with:
+          target: ${{ runner.os }}
+          install-test-prereqs: true
       - name: Install Linux sandbox build dependencies
         if: ${{ runner.os == 'Linux' }}
         shell: bash
         run: |
           sudo DEBIAN_FRONTEND=noninteractive apt-get update
           sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends pkg-config libcap-dev
-      - uses: dtolnay/rust-toolchain@a0b273b48ed29de4470960879e8381ff45632f26 # 1.93.0
-        with:
-          toolchain: nightly-2025-09-18
-          components: llvm-tools-preview, rustc-dev, rust-src
-      - uses: facebook/install-dotslash@1e4e7b3e07eaca387acb98f1d4720e0bee8dbb6a # v2
-      - name: Run argument comment lint on codex-rs
-        if: ${{ runner.os == 'macOS' }}
-        shell: bash
-        run: python3 ./tools/argument-comment-lint/run-prebuilt-linter.py
-      # Linux still uses the default-targets-only form for now, but PRs run the
-      # released linter on all three platforms so wrapper regressions surface pre-merge.
-      - name: Run argument comment lint on codex-rs (default targets only)
-        if: ${{ runner.os == 'Linux' }}
-        shell: bash
-        run: python3 ./tools/argument-comment-lint/run-prebuilt-linter.py -- --lib --bins
-      - name: Run argument comment lint on codex-rs
+      - name: Install nightly argument-comment-lint toolchain
         if: ${{ runner.os == 'Windows' }}
         shell: bash
-        run: python ./tools/argument-comment-lint/run-prebuilt-linter.py
+        run: |
+          rustup toolchain install nightly-2025-09-18 \
+            --profile minimal \
+            --component llvm-tools-preview \
+            --component rustc-dev \
+            --component rust-src \
+            --no-self-update
+          rustup default nightly-2025-09-18
+      - name: Run argument comment lint on codex-rs via Bazel
+        if: ${{ runner.os != 'Windows' }}
+        env:
+          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
+        shell: bash
+        run: |
+          ./.github/scripts/run-bazel-ci.sh \
+            -- \
+            build \
+            --config=argument-comment-lint \
+            --keep_going \
+            --build_metadata=COMMIT_SHA=${GITHUB_SHA} \
+            -- \
+            //codex-rs/...
+      - name: Run argument comment lint on codex-rs via packaged wrapper
+        if: ${{ runner.os == 'Windows' }}
+        shell: bash
+        run: python3 ./tools/argument-comment-lint/run-prebuilt-linter.py
 
   # --- Gatherer job that you mark as the ONLY required status -----------------
   results:

MODULE.bazel

@@ -87,6 +87,17 @@ rules_rust.patch(
 )
 use_repo(rules_rust, "rules_rust")
 
+nightly_rust = use_extension(
+    "@rules_rs//rs/experimental:rules_rust_reexported_extensions.bzl",
+    "rust",
+)
+nightly_rust.toolchain(
+    versions = ["nightly/2025-09-18"],
+    dev_components = True,
+    edition = "2024",
+)
+use_repo(nightly_rust, "rust_toolchains")
+
 toolchains = use_extension("@rules_rs//rs/experimental/toolchains:module_extension.bzl", "toolchains")
 toolchains.toolchain(
     edition = "2024",
@@ -95,6 +106,7 @@ toolchains.toolchain(
 use_repo(toolchains, "default_rust_toolchains")
 
 register_toolchains("@default_rust_toolchains//:all")
+register_toolchains("@rust_toolchains//:all")
 
 crate = use_extension("@rules_rs//rs:extensions.bzl", "crate")
 crate.from_cargo(
@@ -117,6 +129,24 @@ crate.from_cargo(
     ],
     use_experimental_platforms = True,
 )
+crate.from_cargo(
+    name = "argument_comment_lint_crates",
+    cargo_lock = "//tools/argument-comment-lint:Cargo.lock",
+    cargo_toml = "//tools/argument-comment-lint:Cargo.toml",
+    platform_triples = [
+        "aarch64-unknown-linux-gnu",
+        "aarch64-unknown-linux-musl",
+        "aarch64-apple-darwin",
+        "aarch64-pc-windows-msvc",
+        "aarch64-pc-windows-gnullvm",
+        "x86_64-unknown-linux-gnu",
+        "x86_64-unknown-linux-musl",
+        "x86_64-apple-darwin",
+        "x86_64-pc-windows-msvc",
+        "x86_64-pc-windows-gnullvm",
+    ],
+    use_experimental_platforms = True,
+)
 
 bazel_dep(name = "zstd", version = "1.5.7")
 
@@ -136,7 +166,14 @@ crate.annotation(
     ],
 )
 
+crate.annotation(
+    # The build script only validates embedded source/version metadata.
+    crate = "rustc_apfloat",
+    gen_build_script = "off",
+)
+
 inject_repo(crate, "zstd")
+use_repo(crate, "argument_comment_lint_crates")
 
 bazel_dep(name = "bzip2", version = "1.0.8.bcr.3")
 

codex-rs/BUILD.bazel

@@ -2,3 +2,17 @@ exports_files([
     "clippy.toml",
     "node-version.txt",
 ])
+
+filegroup(
+    name = "workspace-files",
+    srcs = glob(
+        [
+            "*",
+            ".cargo/**",
+        ],
+        exclude = [
+            "BUILD.bazel",
+        ],
+    ),
+    visibility = ["//visibility:public"],
+)

defs.bzl

@@ -57,6 +57,9 @@ def _workspace_root_test_impl(ctx):
     )
 
     runfiles = ctx.runfiles(files = [test_bin, workspace_root_marker]).merge(ctx.attr.test_bin[DefaultInfo].default_runfiles)
+    for data_dep in ctx.attr.data:
+        runfiles = runfiles.merge(ctx.runfiles(files = data_dep[DefaultInfo].files.to_list()))
+        runfiles = runfiles.merge(data_dep[DefaultInfo].default_runfiles)
 
     return [
         DefaultInfo(
@@ -73,6 +76,9 @@ workspace_root_test = rule(
     implementation = _workspace_root_test_impl,
     test = True,
     attrs = {
+        "data": attr.label_list(
+            allow_files = True,
+        ),
         "env": attr.string_dict(),
         "test_bin": attr.label(
             cfg = "target",
@@ -157,10 +163,29 @@ def codex_rust_crate(
         "INSTA_SNAPSHOT_PATH": "src",
     }
 
+    native.filegroup(
+        name = "package-files",
+        srcs = native.glob(
+            ["**"],
+            exclude = [
+                "**/BUILD.bazel",
+                "BUILD.bazel",
+                "target/**",
+            ],
+            allow_empty = True,
+        ),
+        visibility = ["//visibility:public"],
+    )
+
     rustc_env = {
         "BAZEL_PACKAGE": native.package_name(),
     } | rustc_env
 
+    manifest_relpath = native.package_name()
+    if manifest_relpath.startswith("codex-rs/"):
+        manifest_relpath = manifest_relpath[len("codex-rs/"):]
+    manifest_path = manifest_relpath + "/Cargo.toml"
+
     binaries = DEP_DATA.get(native.package_name())["binaries"]
 
     lib_srcs = crate_srcs or native.glob(["src/**/*.rs"], exclude = binaries.values(), allow_empty = True)
@@ -200,11 +225,14 @@ def codex_rust_crate(
             name = unit_test_binary,
             crate = name,
             deps = all_crate_deps(normal = True, normal_dev = True) + maybe_deps + deps_extra,
+            # Unit tests also compile to standalone Windows executables, so
+            # keep their stack reserve aligned with binaries and integration
+            # tests under gnullvm.
             # Bazel has emitted both `codex-rs/<crate>/...` and
             # `../codex-rs/<crate>/...` paths for `file!()`. Strip either
             # prefix so the workspace-root launcher sees Cargo-like metadata
             # such as `tui/src/...`.
-            rustc_flags = rustc_flags_extra + [
+            rustc_flags = rustc_flags_extra + WINDOWS_GNULLVM_RUSTC_STACK_FLAGS + [
                 "--remap-path-prefix=../codex-rs=",
                 "--remap-path-prefix=codex-rs=",
             ],

justfile

@@ -67,13 +67,17 @@ bazel-lock-check:
     ./scripts/check-module-bazel-lock.sh
 
 bazel-test:
-    bazel test //... --keep_going
+    bazel test --test_tag_filters=-argument-comment-lint //... --keep_going
 
 bazel-clippy:
     bazel build --config=clippy -- //codex-rs/... -//codex-rs/v8-poc:all
 
+[no-cd]
+bazel-argument-comment-lint:
+    bazel build --config=argument-comment-lint -- //codex-rs/...
+
 bazel-remote-test:
-    bazel test //... --config=remote --platforms=//:rbe --keep_going
+    bazel test --test_tag_filters=-argument-comment-lint //... --config=remote --platforms=//:rbe --keep_going
 
 build-for-release:
     bazel build //codex-rs/cli:release_binaries --config=remote
@@ -97,7 +101,11 @@ write-hooks-schema:
 # Run the argument-comment Dylint checks across codex-rs.
 [no-cd]
 argument-comment-lint *args:
-    ./tools/argument-comment-lint/run-prebuilt-linter.py "$@"
+    if [ "$#" -eq 0 ]; then \
+      bazel build --config=argument-comment-lint -- //codex-rs/...; \
+    else \
+      ./tools/argument-comment-lint/run-prebuilt-linter.py "$@"; \
+    fi
 
 [no-cd]
 argument-comment-lint-from-source *args:

tools/argument-comment-lint/BUILD.bazel

@@ -0,0 +1,32 @@
+load("@rules_rust//rust:defs.bzl", "rust_binary", "rust_library")
+
+exports_files(["lint_aspect.bzl"])
+
+rust_library(
+    name = "argument-comment-lint-lib",
+    crate_name = "argument_comment_lint",
+    crate_features = ["bazel_native"],
+    crate_root = "src/lib.rs",
+    srcs = [
+        "src/comment_parser.rs",
+        "src/lib.rs",
+    ],
+    edition = "2024",
+    deps = ["@argument_comment_lint_crates//:clippy_utils"],
+    tags = ["manual"],
+    visibility = ["//visibility:public"],
+)
+
+rust_binary(
+    name = "argument-comment-lint-driver",
+    crate_name = "argument_comment_lint_driver",
+    crate_root = "driver.rs",
+    srcs = ["driver.rs"],
+    edition = "2024",
+    deps = [
+        ":argument-comment-lint-lib",
+        "@zlib//:z",
+    ],
+    tags = ["manual"],
+    visibility = ["//visibility:public"],
+)

tools/argument-comment-lint/Cargo.toml

@@ -8,6 +8,9 @@ publish = false
 [lib]
 crate-type = ["cdylib"]
 
+[features]
+bazel_native = []
+
 [dependencies]
 clippy_utils = { git = "https://github.com/rust-lang/rust-clippy", rev = "20ce69b9a63bcd2756cd906fe0964d1e901e042a" }
 dylint_linting = "5.0.0"

tools/argument-comment-lint/README.md

@@ -85,9 +85,11 @@ rustup toolchain install nightly-2025-09-18 \
 
 The checked-in DotSlash file lives at `tools/argument-comment-lint/argument-comment-lint`.
 `run-prebuilt-linter.py` resolves that file via `dotslash` and is the path used by
-`just clippy`, `just argument-comment-lint`, and the Rust CI job. The
-source-build path remains available in `run.py` for people
-iterating on the lint crate itself.
+targeted package runs such as `just argument-comment-lint -p codex-core`.
+Repo-wide runs now go through a native Bazel aspect that invokes a custom
+`rustc_driver` and reuses Bazel-managed Rust dependency metadata instead of
+spawning `cargo dylint` once per crate. The source-build path remains available
+in `run.py` for people iterating on the lint crate itself.
 
 The Unix archive layout is:
 
@@ -126,15 +128,17 @@ If you are changing the lint crate itself, use the source-build wrapper:
 Run the lint against `codex-rs` from the repo root:
 
 ```bash
+just argument-comment-lint
+bazel build --config=argument-comment-lint -- //codex-rs/...
 ./tools/argument-comment-lint/run-prebuilt-linter.py -p codex-core
 just argument-comment-lint -p codex-core
 ```
 
-If no package selection is provided, `run-prebuilt-linter.py` defaults to checking the
-`codex-rs` workspace with `--workspace --no-deps`.
-For non-`--fix` runs, both wrappers also default the underlying Cargo
-invocation to `--all-targets` unless you explicitly narrow the target set, so
-workspace and package lint runs both cover test-only call sites by default.
+If no package selection is provided, `just argument-comment-lint` now defaults
+to the Bazel aspect path over `//codex-rs/...`. The Python wrappers remain the
+package-scoped escape hatch and still default the underlying Cargo invocation
+to `--all-targets` unless you explicitly narrow the target set, so targeted
+wrapper runs cover test-only call sites by default.
 
 Repo runs also promote `uncommented_anonymous_literal_argument` to an error by
 default:

tools/argument-comment-lint/driver.rs

@@ -0,0 +1,43 @@
+#![feature(rustc_private)]
+
+extern crate rustc_driver;
+extern crate rustc_interface;
+
+use std::env;
+use std::ffi::OsString;
+use std::path::Path;
+
+fn main() {
+    let mut callbacks = Callbacks;
+    let args = rustc_args(env::args_os().skip(1).collect());
+    rustc_driver::run_compiler(&args, &mut callbacks);
+}
+
+struct Callbacks;
+
+impl rustc_driver::Callbacks for Callbacks {
+    fn config(&mut self, config: &mut rustc_interface::Config) {
+        let previous = config.register_lints.take();
+        config.register_lints = Some(Box::new(move |sess, lint_store| {
+            if let Some(previous) = &previous {
+                previous(sess, lint_store);
+            }
+            argument_comment_lint::register_lints(sess, lint_store);
+        }));
+    }
+}
+
+fn rustc_args(args: Vec<OsString>) -> Vec<String> {
+    let mut rustc_args: Vec<String> = args
+        .into_iter()
+        .map(|arg| arg.to_string_lossy().into_owned())
+        .collect();
+    if rustc_args.first().is_none_or(|arg| !is_rustc(arg)) {
+        rustc_args.insert(0, "rustc".to_string());
+    }
+    rustc_args
+}
+
+fn is_rustc(arg: &str) -> bool {
+    Path::new(arg).file_stem().and_then(|stem| stem.to_str()) == Some("rustc")
+}

tools/argument-comment-lint/lint_aspect.bzl

@@ -0,0 +1,183 @@
+"""Bazel aspect for running argument-comment-lint on Rust targets."""
+
+load("@rules_rust//rust:defs.bzl", "rust_common")
+load("@rules_rust//rust/private:rust.bzl", "RUSTC_ATTRS")
+load(
+    "@rules_rust//rust/private:rustc.bzl",
+    "collect_deps",
+    "collect_inputs",
+    "construct_arguments",
+)
+load(
+    "@rules_rust//rust/private:utils.bzl",
+    "determine_output_hash",
+    "find_cc_toolchain",
+    "find_toolchain",
+)
+
+_STRICT_LINT_FLAGS = [
+    "-Duncommented-anonymous-literal-argument",
+    "-Aunknown-lints",
+]
+
+def _find_rustc_driver_library_dir(toolchain):
+    for file in toolchain.rustc_lib.to_list():
+        if file.basename.startswith("librustc_driver-") or file.basename.startswith("rustc_driver-"):
+            return file.dirname
+    return None
+
+def _set_driver_runtime_env(env, toolchain):
+    library_dir = _find_rustc_driver_library_dir(toolchain)
+    if not library_dir:
+        return
+
+    path = library_dir
+    if toolchain.target_os == "windows":
+        previous = env.get("PATH")
+        env["PATH"] = "{};{}".format(path, previous) if previous else path
+    elif toolchain.target_os == "macos":
+        previous = env.get("DYLD_LIBRARY_PATH")
+        env["DYLD_LIBRARY_PATH"] = "{}:{}".format(path, previous) if previous else path
+    else:
+        previous = env.get("LD_LIBRARY_PATH")
+        env["LD_LIBRARY_PATH"] = "{}:{}".format(path, previous) if previous else path
+
+def _get_argument_comment_lint_ready_crate_info(target, aspect_ctx):
+    if target.label.workspace_root.startswith("external"):
+        return None
+
+    if aspect_ctx:
+        ignore_tags = [
+            "no_argument_comment_lint",
+            "no-lint",
+            "no_lint",
+            "nolint",
+        ]
+        for tag in aspect_ctx.rule.attr.tags:
+            if tag.replace("-", "_").lower() in ignore_tags:
+                return None
+
+    if rust_common.crate_info in target:
+        return target[rust_common.crate_info]
+    if rust_common.test_crate_info in target:
+        return target[rust_common.test_crate_info].crate
+    return None
+
+def _rust_argument_comment_lint_aspect_impl(target, ctx):
+    if OutputGroupInfo in target and hasattr(target[OutputGroupInfo], "argument_comment_lint_checks"):
+        return []
+
+    crate_info = _get_argument_comment_lint_ready_crate_info(target, ctx)
+    if not crate_info:
+        return []
+
+    toolchain = find_toolchain(ctx)
+    cc_toolchain, feature_configuration = find_cc_toolchain(ctx)
+
+    dep_info, build_info, _ = collect_deps(
+        deps = crate_info.deps.to_list(),
+        proc_macro_deps = crate_info.proc_macro_deps.to_list(),
+        aliases = crate_info.aliases,
+    )
+
+    compile_inputs, out_dir, build_env_files, build_flags_files, linkstamp_outs, ambiguous_libs = collect_inputs(
+        ctx,
+        ctx.rule.file,
+        ctx.rule.files,
+        depset([]),
+        toolchain,
+        cc_toolchain,
+        feature_configuration,
+        crate_info,
+        dep_info,
+        build_info,
+        [],
+    )
+
+    success_marker = ctx.actions.declare_file(
+        ctx.label.name + ".argument_comment_lint.ok",
+        sibling = crate_info.output,
+    )
+
+    args, env = construct_arguments(
+        ctx = ctx,
+        attr = ctx.rule.attr,
+        file = ctx.file,
+        toolchain = toolchain,
+        tool_path = ctx.executable._driver.path,
+        cc_toolchain = cc_toolchain,
+        feature_configuration = feature_configuration,
+        crate_info = crate_info,
+        dep_info = dep_info,
+        linkstamp_outs = linkstamp_outs,
+        ambiguous_libs = ambiguous_libs,
+        output_hash = determine_output_hash(crate_info.root, ctx.label),
+        rust_flags = [],
+        out_dir = out_dir,
+        build_env_files = build_env_files,
+        build_flags_files = build_flags_files,
+        emit = ["dep-info", "metadata"],
+        skip_expanding_rustc_env = True,
+    )
+
+    if crate_info.is_test:
+        args.rustc_flags.add("--test")
+
+    args.process_wrapper_flags.add("--touch-file", success_marker)
+    args.rustc_flags.add_all(_STRICT_LINT_FLAGS)
+    _set_driver_runtime_env(env, toolchain)
+
+    driver_runfiles = ctx.attr._driver[DefaultInfo].default_runfiles.files
+    action_inputs = depset(
+        transitive = [
+            compile_inputs,
+            driver_runfiles,
+            toolchain.rustc_lib,
+        ],
+    )
+
+    ctx.actions.run(
+        executable = ctx.executable._process_wrapper,
+        inputs = action_inputs,
+        outputs = [success_marker],
+        env = env,
+        tools = [ctx.executable._driver],
+        execution_requirements = {
+            "no-sandbox": "1",
+        },
+        arguments = args.all,
+        mnemonic = "ArgumentCommentLint",
+        progress_message = "ArgumentCommentLint %{label}",
+        toolchain = "@rules_rust//rust:toolchain_type",
+    )
+
+    return [OutputGroupInfo(argument_comment_lint_checks = depset([success_marker]))]
+
+rust_argument_comment_lint_aspect = aspect(
+    implementation = _rust_argument_comment_lint_aspect_impl,
+    fragments = ["cpp"],
+    attrs = {
+        "_driver": attr.label(
+            default = Label("//tools/argument-comment-lint:argument-comment-lint-driver"),
+            executable = True,
+            cfg = "exec",
+        ),
+    } | RUSTC_ATTRS,
+    toolchains = [
+        str(Label("@rules_rust//rust:toolchain_type")),
+        config_common.toolchain_type("@bazel_tools//tools/cpp:toolchain_type", mandatory = False),
+    ],
+    required_providers = [
+        [rust_common.crate_info],
+        [rust_common.test_crate_info],
+    ],
+    doc = """\
+Runs argument-comment-lint on Rust targets using Bazel's Rust dependency graph.
+
+Example:
+
+```output
+$ bazel build --config=argument-comment-lint //codex-rs/...
+```
+""",
+)

tools/argument-comment-lint/src/lib.rs

@@ -31,6 +31,7 @@ use rustc_span::Span;
 use crate::comment_parser::parse_argument_comment;
 use crate::comment_parser::parse_argument_comment_prefix;
 
+#[cfg(not(feature = "bazel_native"))]
 dylint_linting::dylint_library!();
 
 #[unsafe(no_mangle)]

tools/argument-comment-lint/test_wrapper_common.py

@@ -83,6 +83,26 @@ class WrapperCommonTest(unittest.TestCase):
             ],
         )
 
+    def test_explicit_package_manifest_does_not_force_workspace(self) -> None:
+        parsed = wrapper_common.parse_wrapper_args(
+            [
+                "--manifest-path",
+                "/tmp/custom/Cargo.toml",
+            ]
+        )
+        final_args = wrapper_common.build_final_args(parsed, Path("/repo/codex-rs/Cargo.toml"))
+
+        self.assertEqual(
+            final_args,
+            [
+                "--no-deps",
+                "--manifest-path",
+                "/tmp/custom/Cargo.toml",
+                "--",
+                "--all-targets",
+            ],
+        )
+
 
 if __name__ == "__main__":
     unittest.main()

tools/argument-comment-lint/wrapper_common.py

@@ -107,7 +107,7 @@ def build_final_args(parsed: ParsedWrapperArgs, manifest_path: Path) -> list[str
 
     if not parsed.has_manifest_path:
         final_args.extend(["--manifest-path", str(manifest_path)])
-    if not parsed.has_package_selection:
+    if not parsed.has_package_selection and not parsed.has_manifest_path:
         final_args.append("--workspace")
     if not parsed.has_no_deps:
         final_args.append("--no-deps")
@@ -205,6 +205,9 @@ def ensure_source_prerequisites(env: MutableMapping[str, str]) -> None:
 
 
 def prefer_rustup_shims(env: MutableMapping[str, str]) -> None:
+    if env.get("CODEX_ARGUMENT_COMMENT_LINT_SKIP_RUSTUP_SHIMS") == "1":
+        return
+
     rustup = shutil.which("rustup", path=env.get("PATH"))
     if rustup is None:
         return