Repository navigation
ci(bazel): stage Linux launcher binaries from the release API - #4837
Conversation
|
# Conflicts: # .github/actions/setup-bazel/action.yml
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
There was a problem hiding this comment.
Devin Review found 1 potential issue.
1 flag not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)
| if ! curl --proto '=https' --proto-redir '=https' --header @- --fail --silent --show-error --location --remove-on-error \ | ||
| --connect-timeout 5 --max-time 30 --header 'Accept: application/octet-stream' \ | ||
| --output "$distdir/$name" "$api/$id" <<< "$api_header"; then | ||
| printf '::notice::Release API unavailable for %s; Bazel will use its configured source.\n' "$name" | ||
| fi |
There was a problem hiding this comment.
🟡 Launcher staging has no regression tests
The new stage_asset behavior has no committed tests for successful downloads or failed API requests. A broken fallback can merge without a check that partial files disappear.
Learn more
The contribution rules require test coverage for new behavior. This script has no committed tests, although it now controls whether Linux CI can fetch its launcher binaries. The failure path must leave the distribution directory free of partial downloads so Bazel can use its original URL.
Example: Stub curl to write half of runfiles-stub-x86_64-linux and return a failure. After stage_asset runs, the file must not remain in the distribution directory, and the script must allow the other asset to be attempted.
Recommended fix: Add a focused shell test using a stubbed curl on PATH that verifies both successful filenames and the partial-download failure path. Run it through a Bazel test target, without relying on live GitHub requests.
Was this helpful? React with 👍 or 👎 to provide feedback.
At
1827ffbc44, the fixed public API requests use the hosted job token. The Linux fleet job previously received HTTP 403 for both anonymous API requests and HTTP 504 on the two original release URLs. Real curl TLS tests exercised both filenames with a disposable token and with no token; the API origin alone received the Authorization header and both cross-origin redirects completed. ShellCheck and actionlint passed.Linux CI dependency fetch
The Linux fleet, Clippy, Dashboard and repository gate jobs repeatedly received HTTP 504 from GitHub's release-download endpoint for one or both x86_64 hermetic launcher stubs. These jobs stopped during Bazel repository resolution before the affected tests or lints executed. Frontend job on #4801 · Clippy on #4810
The shared setup action now stages the two public binaries from the upstream GitHub release API in a runner-private Bazel distribution directory on GitHub-hosted Linux x64. It uses their immutable release asset IDs and anonymous requests. Bazel checks the SHA-256 from the upstream hermetic_launcher rule for each file. When the API is unavailable, the original Bazel download path remains available. The two IDs refer to the binaries-20261025 release.
Verification
With an empty Bazel repository cache, the normal fetch failed when the release-download address was redirected to a closed local port. Under that same condition, the production staging script downloaded both binaries from GitHub and Bazel fetched both repositories successfully. I checked the two resulting files against the upstream SHA-256 digests. A second cold-cache fetch given invalid staged bytes failed with the release route unavailable. ShellCheck, composite-action YAML parsing, and actionlint of the calling workflow passed.
With the release API unavailable, the staging script removed partial files and returned control to the default fetch. Hosted Linux verification is pending.
The hosted Linux repository gates passed. The job ran the staging step and its Bazel invocations received the runner-private distribution directory. Its repository cache was warm. The cold-cache verification above exercised the fallback independently.
At
2f533c434ethe hosted Linux fleet passed all 183 Bazel targets, including 66 that executed. Hosted Dashboard and Clippy also passed. At5b08f9069cthe branch incorporates the merged Bazel dependency-cache changes. The composite supplies both the new repository cache path and its runner-private distdir. The two-file diff adds the alternative GitHub release API route for the two pinned Linux x86_64 artifacts. Actionlint, ShellCheck and composite YAML parsing passed on the reconciled tree.Draft shared CI prerequisite for independent review. Feature and model merge holds remain in effect.