From 67193039b551b1dc69bf7457aa61db7923340f2d Mon Sep 17 00:00:00 2001 From: Richard Levasseur Date: Wed, 21 Oct 2026 10:48:25 -0700 Subject: [PATCH 1/3] workflow: enable BuildBuddy BES and remote cache on macOS and Windows BuildBuddy's managed cloud pool only provides Linux executors. When remote execution was enabled on macOS and Windows runners, actions lacked OS exec_properties and defaulted to Linux workers, where macOS and Windows tools failed to execute. Restricting BuildBuddy to Linux runners avoided those failures, but also disabled Build Event Service (BES) reporting and remote caching on macOS and Windows. Enable the BuildBuddy configuration across all OSes in the setup-bazel action, and clear `--remote_executor` for `macos` and `windows` in `buildbuddy.bazelrc` so macOS and Windows builds run actions locally while still uploading BES results and using the remote cache. --- .github/actions/setup-bazel/action.yaml | 5 ++--- BUILD.bazel | 1 + buildbuddy.bazelrc | 5 +++++ tests/workflows/BUILD.bazel | 1 + tests/workflows/setup_bazel_test.py | 25 +++++++++++++++++++++---- 5 files changed, 30 insertions(+), 7 deletions(-) diff --git a/.github/actions/setup-bazel/action.yaml b/.github/actions/setup-bazel/action.yaml index 2938ca3515..6e7e49e291 100644 --- a/.github/actions/setup-bazel/action.yaml +++ b/.github/actions/setup-bazel/action.yaml @@ -36,8 +36,7 @@ runs: # pyrefly toolchain or type-check targets before running them. build --output_groups=-pyrefly build --//python/config_settings:py_pbs_distribution=install_only_stripped - # BuildBuddy RBE workers are Linux x86_64; only enable on Linux. - ${{ runner.os == 'Linux' && inputs.buildbuddy_api_key && format('common --config={0}', inputs.buildbuddy_config) || '' }} + ${{ inputs.buildbuddy_api_key && format('common --config={0}', inputs.buildbuddy_config) || '' }} # setup-bazel only configures Bazelisk and restores caches; the Bazel # binary itself is downloaded by Bazelisk on first invocation. Because @@ -51,7 +50,7 @@ runs: # passing it via environment variables or CLI args, keeping it out of # process tables and child environments. - name: Write secret to user.bazelrc - if: ${{ runner.os == 'Linux' && inputs.buildbuddy_api_key != '' }} + if: ${{ inputs.buildbuddy_api_key != '' }} uses: actions/github-script@v7 with: script: | diff --git a/BUILD.bazel b/BUILD.bazel index 1e555d5123..8595d395a8 100644 --- a/BUILD.bazel +++ b/BUILD.bazel @@ -62,6 +62,7 @@ exports_files( [ ".bazelversion", "MODULE.bazel", + "buildbuddy.bazelrc", ], visibility = ["//tests:__subpackages__"], ) diff --git a/buildbuddy.bazelrc b/buildbuddy.bazelrc index 4c031775d7..2a36c4fc0b 100644 --- a/buildbuddy.bazelrc +++ b/buildbuddy.bazelrc @@ -9,6 +9,11 @@ common:_buildbuddy_base --remote_cache=grpcs://rules-python.buildbuddy.io common:_buildbuddy_base --remote_timeout=10m common:_buildbuddy_base --remote_executor=grpcs://rules-python.buildbuddy.io +# BuildBuddy's managed cloud pool only has Linux executors; disable remote +# execution on macOS and Windows while keeping BES and remote caching enabled. +common:macos --remote_executor= +common:windows --remote_executor= + # For PR presubmit runs. # Requires a BuildBuddy CAS-only API key. common:buildbuddy_presubmit --config=_buildbuddy_base diff --git a/tests/workflows/BUILD.bazel b/tests/workflows/BUILD.bazel index ab5573a249..e5b35003b6 100644 --- a/tests/workflows/BUILD.bazel +++ b/tests/workflows/BUILD.bazel @@ -82,6 +82,7 @@ pytest_test( name = "setup_bazel_test", srcs = ["setup_bazel_test.py"], data = [ + "//:buildbuddy.bazelrc", "//.github/actions/setup-bazel:all_files", ], target_compatible_with = NOT_WINDOWS, diff --git a/tests/workflows/setup_bazel_test.py b/tests/workflows/setup_bazel_test.py index 335c53e0ca..1a4a848693 100644 --- a/tests/workflows/setup_bazel_test.py +++ b/tests/workflows/setup_bazel_test.py @@ -40,16 +40,33 @@ def test_action_yaml_invokes_executable_download_script(): assert any("download_bazel.sh" in step.get("run", "") for step in steps) -def test_action_yaml_enables_buildbuddy_only_on_linux(): - """Verifies setup-bazel action.yaml only enables BuildBuddy on Linux.""" +def test_action_yaml_enables_buildbuddy_on_all_os(): + """Verifies setup-bazel action.yaml enables BuildBuddy across all OSes.""" action = yaml.safe_load((_action_dir() / "action.yaml").read_text(encoding="utf-8")) steps = action["runs"]["steps"] setup_step = next(s for s in steps if s.get("name") == "Setup Bazel") - assert "runner.os == 'Linux'" in setup_step["with"]["bazelrc"] + assert "inputs.buildbuddy_api_key" in setup_step["with"]["bazelrc"] + assert "runner.os" not in setup_step["with"]["bazelrc"] secret_step = next( s for s in steps if s.get("name") == "Write secret to user.bazelrc" ) - assert "runner.os == 'Linux'" in secret_step["if"] + assert secret_step["if"] == "${{ inputs.buildbuddy_api_key != '' }}" + + +def test_buildbuddy_bazelrc_disables_remote_executor_on_macos_and_windows(): + """Verifies buildbuddy.bazelrc disables remote_executor on macOS and Windows.""" + bazelrc_path = runfiles.CreateOrRaise().root() / "rules_python/buildbuddy.bazelrc" + lines = [ + line.strip() + for line in bazelrc_path.read_text(encoding="utf-8").splitlines() + if line.strip() and not line.strip().startswith("#") + ] + assert ( + "common:_buildbuddy_base --remote_executor=grpcs://rules-python.buildbuddy.io" + in lines + ) + assert "common:macos --remote_executor=" in lines + assert "common:windows --remote_executor=" in lines def test_download_bazel_succeeds_first_try(tmp_path: Path): From f2b7feacc5d32408df5c7b4928ad03ea27cecce1 Mon Sep 17 00:00:00 2001 From: Richard Levasseur Date: Wed, 21 Oct 2026 19:10:09 -0700 Subject: [PATCH 2/3] workflow: re-apply --enable_platform_specific_config in _buildbuddy_base Because setup-bazel writes `common --config=buildbuddy_presubmit` to `~/.bazelrc`, which Bazel evaluates at a higher rc file priority than `%workspace%/.bazelrc`, options expanded from `_buildbuddy_base` had higher priority than `common:macos` and `common:windows` expanded from `.bazelrc`'s top-level `--enable_platform_specific_config`. Re-apply `--enable_platform_specific_config` inside `_buildbuddy_base` after `--remote_executor` so `common:macos --remote_executor=` and `common:windows --remote_executor=` inherit the higher priority and override `--remote_executor`. --- buildbuddy.bazelrc | 6 ++++++ tests/workflows/setup_bazel_test.py | 7 +++++-- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/buildbuddy.bazelrc b/buildbuddy.bazelrc index 2a36c4fc0b..1061135312 100644 --- a/buildbuddy.bazelrc +++ b/buildbuddy.bazelrc @@ -8,6 +8,12 @@ build:_buildbuddy_base --bes_backend=grpcs://rules-python.buildbuddy.io common:_buildbuddy_base --remote_cache=grpcs://rules-python.buildbuddy.io common:_buildbuddy_base --remote_timeout=10m common:_buildbuddy_base --remote_executor=grpcs://rules-python.buildbuddy.io +# Re-apply `--enable_platform_specific_config` after setting `--remote_executor` +# so `common:macos` and `common:windows` below inherit the priority of +# `--config=buildbuddy_*` (e.g. when set in `~/.bazelrc` by `setup-bazel`, +# which has higher priority than `.bazelrc`'s top-level +# `--enable_platform_specific_config`). +common:_buildbuddy_base --enable_platform_specific_config # BuildBuddy's managed cloud pool only has Linux executors; disable remote # execution on macOS and Windows while keeping BES and remote caching enabled. diff --git a/tests/workflows/setup_bazel_test.py b/tests/workflows/setup_bazel_test.py index 1a4a848693..099e234a15 100644 --- a/tests/workflows/setup_bazel_test.py +++ b/tests/workflows/setup_bazel_test.py @@ -61,10 +61,13 @@ def test_buildbuddy_bazelrc_disables_remote_executor_on_macos_and_windows(): for line in bazelrc_path.read_text(encoding="utf-8").splitlines() if line.strip() and not line.strip().startswith("#") ] - assert ( + executor_line = ( "common:_buildbuddy_base --remote_executor=grpcs://rules-python.buildbuddy.io" - in lines ) + platform_config_line = "common:_buildbuddy_base --enable_platform_specific_config" + assert executor_line in lines + assert platform_config_line in lines + assert lines.index(executor_line) < lines.index(platform_config_line) assert "common:macos --remote_executor=" in lines assert "common:windows --remote_executor=" in lines From 65ff401a7e10bbb9a4d788c7375e4530cd23e625 Mon Sep 17 00:00:00 2001 From: Richard Levasseur Date: Wed, 21 Oct 2026 23:13:43 -0700 Subject: [PATCH 3/3] workflow: move macos and windows remote_executor overrides to .bazelrc Keep `buildbuddy.bazelrc` scoped to BuildBuddy config definitions and place the `common:macos --remote_executor=` and `common:windows --remote_executor=` platform overrides in `.bazelrc`. --- .bazelrc | 5 +++++ BUILD.bazel | 1 + buildbuddy.bazelrc | 7 +------ tests/workflows/BUILD.bazel | 1 + tests/workflows/setup_bazel_test.py | 28 +++++++++++++++++++--------- 5 files changed, 27 insertions(+), 15 deletions(-) diff --git a/.bazelrc b/.bazelrc index ffe7f45f25..a5b9664ce6 100644 --- a/.bazelrc +++ b/.bazelrc @@ -87,6 +87,11 @@ build:macos --host_copt=-Wno-deprecated-declarations build:macos --host_copt=-Wno-stringop-overread build:macos --host_copt=-Wno-sign-compare +# BuildBuddy's managed cloud pool only has Linux executors; disable remote +# execution on macOS and Windows while keeping BES and remote caching enabled. +common:macos --remote_executor= +common:windows --remote_executor= + import %workspace%/specialized_configs.bazelrc import %workspace%/buildbuddy.bazelrc diff --git a/BUILD.bazel b/BUILD.bazel index 8595d395a8..71cdb82325 100644 --- a/BUILD.bazel +++ b/BUILD.bazel @@ -60,6 +60,7 @@ exports_files([ exports_files( [ + ".bazelrc", ".bazelversion", "MODULE.bazel", "buildbuddy.bazelrc", diff --git a/buildbuddy.bazelrc b/buildbuddy.bazelrc index 1061135312..861e70e2cd 100644 --- a/buildbuddy.bazelrc +++ b/buildbuddy.bazelrc @@ -9,17 +9,12 @@ common:_buildbuddy_base --remote_cache=grpcs://rules-python.buildbuddy.io common:_buildbuddy_base --remote_timeout=10m common:_buildbuddy_base --remote_executor=grpcs://rules-python.buildbuddy.io # Re-apply `--enable_platform_specific_config` after setting `--remote_executor` -# so `common:macos` and `common:windows` below inherit the priority of +# so `common:macos` and `common:windows` in `.bazelrc` inherit the priority of # `--config=buildbuddy_*` (e.g. when set in `~/.bazelrc` by `setup-bazel`, # which has higher priority than `.bazelrc`'s top-level # `--enable_platform_specific_config`). common:_buildbuddy_base --enable_platform_specific_config -# BuildBuddy's managed cloud pool only has Linux executors; disable remote -# execution on macOS and Windows while keeping BES and remote caching enabled. -common:macos --remote_executor= -common:windows --remote_executor= - # For PR presubmit runs. # Requires a BuildBuddy CAS-only API key. common:buildbuddy_presubmit --config=_buildbuddy_base diff --git a/tests/workflows/BUILD.bazel b/tests/workflows/BUILD.bazel index e5b35003b6..41f0927fbf 100644 --- a/tests/workflows/BUILD.bazel +++ b/tests/workflows/BUILD.bazel @@ -82,6 +82,7 @@ pytest_test( name = "setup_bazel_test", srcs = ["setup_bazel_test.py"], data = [ + "//:.bazelrc", "//:buildbuddy.bazelrc", "//.github/actions/setup-bazel:all_files", ], diff --git a/tests/workflows/setup_bazel_test.py b/tests/workflows/setup_bazel_test.py index 099e234a15..ba04a964c4 100644 --- a/tests/workflows/setup_bazel_test.py +++ b/tests/workflows/setup_bazel_test.py @@ -54,22 +54,32 @@ def test_action_yaml_enables_buildbuddy_on_all_os(): def test_buildbuddy_bazelrc_disables_remote_executor_on_macos_and_windows(): - """Verifies buildbuddy.bazelrc disables remote_executor on macOS and Windows.""" - bazelrc_path = runfiles.CreateOrRaise().root() / "rules_python/buildbuddy.bazelrc" - lines = [ + """Verifies .bazelrc and buildbuddy.bazelrc disable remote_executor on macOS and Windows.""" + rf = runfiles.CreateOrRaise() + buildbuddy_path = rf.root() / "rules_python/buildbuddy.bazelrc" + buildbuddy_lines = [ line.strip() - for line in bazelrc_path.read_text(encoding="utf-8").splitlines() + for line in buildbuddy_path.read_text(encoding="utf-8").splitlines() if line.strip() and not line.strip().startswith("#") ] executor_line = ( "common:_buildbuddy_base --remote_executor=grpcs://rules-python.buildbuddy.io" ) platform_config_line = "common:_buildbuddy_base --enable_platform_specific_config" - assert executor_line in lines - assert platform_config_line in lines - assert lines.index(executor_line) < lines.index(platform_config_line) - assert "common:macos --remote_executor=" in lines - assert "common:windows --remote_executor=" in lines + assert executor_line in buildbuddy_lines + assert platform_config_line in buildbuddy_lines + assert buildbuddy_lines.index(executor_line) < buildbuddy_lines.index( + platform_config_line + ) + + bazelrc_path = rf.root() / "rules_python/.bazelrc" + bazelrc_lines = [ + line.strip() + for line in bazelrc_path.read_text(encoding="utf-8").splitlines() + if line.strip() and not line.strip().startswith("#") + ] + assert "common:macos --remote_executor=" in bazelrc_lines + assert "common:windows --remote_executor=" in bazelrc_lines def test_download_bazel_succeeds_first_try(tmp_path: Path):