From 80d0d7d0ae0ef2a5a4e9e409fc92b6723ca91e1e Mon Sep 17 00:00:00 2001 From: Martin Kuntz Jacobsen Date: Mon, 9 Nov 2026 12:30:27 +0100 Subject: [PATCH] evidence: lock_refresh regenerates MODULE.bazel.lock on the platform (part of #9754) Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Xut2hwESun1HL2eSVd1d5B --- .github/workflows/README.md | 2 +- .github/workflows/evidence.yml | 13 +++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/.github/workflows/README.md b/.github/workflows/README.md index d43be7fad..85f95b4d9 100644 --- a/.github/workflows/README.md +++ b/.github/workflows/README.md @@ -7,7 +7,7 @@ - `ci.yml`: this repository's own `ci` gate. A failed Windows preflight build uploads `rmeta-diagnostics-` (#4850). - `issue-labels.yml`: daily warning for open issues older than one day, except pinned ones, that have no P0 to P3 label. Writes a job summary. Runs on `ubuntu-slim`. A second job warns about labels named in `CONTRIBUTING.md` or issue template front matter that do not exist in the repository (#6643). -- `evidence.yml`: native evidence on hosted runners, dispatched per run. The `evidence-` artifact holds `evidence.log` and each test's log, XML and undeclared outputs. Set `platforms` to `["macos_arm64"]` for Apple runs. Set `android` to boot an emulator and run the Rust Android device scenarios on `linux_x86_64`. Set `qualify` on `windows_x86_64` to run `//cc/context:qualify` for llvm and msvc. Set `relocate` (test or build) to rerun the task under a fresh `--output_base` with the disk cache off and remote cache hits refused; the second run logs to `relocated.log`, and `bazel-testlogs` then points at the relocated base. With `task=build` it also hashes every output of `scope` in both bases, writes `match` or `differ ` lines to `determinism.txt`, copies each differing file into `determinism/first/` and `determinism/relocated/`, and fails when any differ. The first build may hit the remote cache and the relocated one cannot, so a `first` copy can come from the cache. Set `release_cell` to build and qualify the platform's release cell first with `tools/ci/release_cell.sh`, the script `release-cells.yml` runs, uncached and without RBE; the files land in `release-cell/` of the artifact. +- `evidence.yml`: native evidence on hosted runners, dispatched per run. The `evidence-` artifact holds `evidence.log` and each test's log, XML and undeclared outputs. Set `platforms` to `["macos_arm64"]` for Apple runs. Set `android` to boot an emulator and run the Rust Android device scenarios on `linux_x86_64`. Set `qualify` on `windows_x86_64` to run `//cc/context:qualify` for llvm and msvc. Set `relocate` (test or build) to rerun the task under a fresh `--output_base` with the disk cache off and remote cache hits refused; the second run logs to `relocated.log`, and `bazel-testlogs` then points at the relocated base. With `task=build` it also hashes every output of `scope` in both bases, writes `match` or `differ ` lines to `determinism.txt`, copies each differing file into `determinism/first/` and `determinism/relocated/`, and fails when any differ. The first build may hit the remote cache and the relocated one cannot, so a `first` copy can come from the cache. Set `lock_refresh` to regenerate `MODULE.bazel.lock` on the platform before the scope task and fail when it differs from the checkout; the refreshed lock and `lock.diff` land in `lock/` of the artifact, so a lock entry that only changes on Windows can be copied back. Set `release_cell` to build and qualify the platform's release cell first with `tools/ci/release_cell.sh`, the script `release-cells.yml` runs, uncached and without RBE; the files land in `release-cell/` of the artifact. - `evidence-command.yml`: a comment on an issue or pull request whose first line starts with `/evidence`, from an owner, member or collaborator, dispatches `evidence.yml` and replies with the run URL. On a pull request it runs on the PR branch, otherwise on `main`. Arguments are `platforms=`, `task=`, `scope=`, `test_timeout=`, `displays=`, `android=`, `qualify=`, `relocate=` and `release_cell=`, for example `/evidence platforms=["macos_arm64"] task=test scope=//haskell/...`. `evidence.yml` validates them and a rejected run fails there. - `dx-update.yml`: weekly `tools/dx update --pr` for dependency updates. `dx init` writes the same file. Where `lock-refresh.yml` exists, it then dispatches that workflow for each open `dx-update/` branch whose `MODULE.bazel.lock` changes the `rules_python` `python` or `rules_go` `go_sdk` entries. - `pin-android-maven.yml`: dispatch-only. Runs `REPIN=1 bazel run @rules_android_maven//:pin` on `ubuntu-latest` and uploads `rules_android_maven_install.json` as an artifact to commit after a rules_android or rules_flutter bump, so the lock is not resolved through Coursier on a throttled network (#7184). diff --git a/.github/workflows/evidence.yml b/.github/workflows/evidence.yml index 19da51b69..a430bee92 100644 --- a/.github/workflows/evidence.yml +++ b/.github/workflows/evidence.yml @@ -41,6 +41,11 @@ on: type: boolean required: false default: false + lock_refresh: + description: "Regenerate MODULE.bazel.lock on the platform and fail when it differs; the refreshed lock and diff land in lock/ of the artifact." + type: boolean + required: false + default: false release_cell: description: "Build and qualify the dx release cell of each platform with the script release-cells.yml runs, uncached, before the scope task." type: boolean @@ -223,6 +228,14 @@ jobs: done bazel run --noshow_progress "${flags[@]}" //tools/testing/hermetic:appcontainer_run -- \ --backend user --ensure-host-denies "${denies[@]}" + - name: Regenerate MODULE.bazel.lock + if: ${{ inputs.lock_refresh }} + run: | + out="$RUNNER_TEMP/evidence/lock" + mkdir -p "$out" + bazel mod deps --lockfile_mode=update 2>&1 | tee "$out/mod-deps.log" + cp MODULE.bazel.lock "$out/MODULE.bazel.lock" + git diff --exit-code MODULE.bazel.lock > "$out/lock.diff" || { cat "$out/lock.diff"; exit 1; } - name: Run evidence task env: DX_SCOPE: ${{ steps.inputs.outputs.scope }}