Updates/bazel cicd errors #2232
No reviewers
Labels
No labels
1week
2weeks
Failed compliance check
IP cameras
NATS
Possible security concern
Review effort 1/5
Review effort 2/5
Review effort 3/5
Review effort 4/5
Review effort 5/5
UI
aardvark
accessibility
amd64
api
arm64
auth
back-end
bgp
blog
bug
build
checkers
ci-cd
cleanup
cnpg
codex
core
dependencies
device-management
documentation
duplicate
dusk
ebpf
enhancement
eta 1d
eta 1hr
eta 3d
eta 3hr
feature
fieldsurvey
github_actions
go
good first issue
help wanted
invalid
javascript
k8s
log-collector
mapper
mtr
needs-triage
netflow
network-sweep
observability
oracle
otel
plug-in
proton
python
question
reddit
redhat
research
rperf
rperf-checker
rust
sdk
security
serviceradar-agent
serviceradar-agent-gateway
serviceradar-web
serviceradar-web-ng
siem
snmp
sysmon
topology
ubiquiti
wasm
wontfix
zen-engine
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
carverauto/serviceradar!2232
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "refs/pull/2232/head"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Imported from GitHub pull request.
Original GitHub pull request: #1652
Original author: @mfreeman451
Original URL: https://github.com/carverauto/serviceradar/pull/1652
Original created: 2025-09-22T03:41:06Z
Original updated: 2025-12-08T06:55:35Z
Original head: carverauto/serviceradar:updates/bazel_cicd_errors
Original base: main
Original merged: 2025-09-23T16:18:20Z by @mfreeman451
PR Type
Other
Description
Replace Bazel Bootstrap workflow with comprehensive CI workflow
Add BuildBuddy remote build configuration and API integration
Configure CI profile with remote execution settings
Diagram Walkthrough
File Walkthrough
.bazelrc
Configure BuildBuddy remote execution for CI.bazelrc
bazel-bootstrap.yml
Remove old Bootstrap workflow.github/workflows/bazel-bootstrap.yml
main.yml
Add new CI workflow with BuildBuddy.github/workflows/main.yml
Imported GitHub PR comment.
Original author: @qodo-code-review[bot]
Original URL: https://github.com/carverauto/serviceradar/pull/1652#issuecomment-3316659148
Original created: 2025-09-22T03:41:31Z
PR Reviewer Guide 🔍
Here are some key observations to aid the review process:
Supply chain integrity:
The workflow downloads and executes a binary (Bazelisk) directly from GitHub releases without checksum verification or signature validation, which could be risky if the release is tampered with. Consider verifying a published SHA256 or using a vetted action or package manager.
Sensitive information exposure: The BuildBuddy API key is injected into --remote_header; if Bazel emits full command lines or remote headers in error output, it could leak. Ensure GitHub Actions masking is in place and Bazel logs do not print header values.
Version Pinning
The Bazelisk download uses a hardcoded URL without checksum verification. Consider pinning via a specific commit SHA for the action or verifying the binary checksum to ensure supply-chain integrity.
Secret Handling
The BuildBuddy API key is passed via --remote_header; ensure it is masked in logs and not echoed. Consider using a bazelrc with build:ci --remote_header=... read from envexpansion or GitHub Actions mask to avoid accidental exposure in verbose logs.
BES/Remote Config
Ensure bes_results_url and bes_backend align with remote execution settings; missing --bes_results_url often needs a trailing token or project scoping. Validate that --config=remote layering doesn’t override/duplicate BES settings causing conflicts.
Imported GitHub PR review comment.
Original author: @github-advanced-security[bot]
Original URL: https://github.com/carverauto/serviceradar/pull/1652#discussion_r2366651581
Original created: 2025-09-22T03:41:59Z
Original path: .github/workflows/main.yml
Original line: 43
Workflow does not contain permissions
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {{contents: read}}
Show more details
Imported GitHub PR comment.
Original author: @qodo-code-review[bot]
Original URL: https://github.com/carverauto/serviceradar/pull/1652#issuecomment-3316660368
Original created: 2025-09-22T03:42:28Z
PR Code Suggestions ✨
Latest suggestions up to
c8e0030Restore missing filegroup target
Restore the
filegroupnamedopenssl_src_runfiles_patchin theBUILD.bazelfile,as it is referenced by this name in
MODULE.bazeland its removal will cause abuild failure.
third_party/rust_patches/BUILD.bazel [3]
Suggestion importance[1-10]: 9
__
Why: The suggestion correctly identifies that removing the
filegrouptarget will break the build, asMODULE.bazelreferences it by its name, not just as a file. This is a critical fix to prevent build failures.Select correct macOS toolchain by arch
Modify the toolchain selection logic for macOS to check
mctx.os.archand selectthe appropriate toolchain for both
arm64andx86_64architectures, preventingbuild failures on Intel-based Macs.
third_party/vendor/tools_opam/extensions/opam.bzl [107-116]
Suggestion importance[1-10]: 8
__
Why: The suggestion correctly points out that hardcoding the macOS toolchain to
arm64will cause build failures on Intel-based macOS systems. Adding architecture detection makes the build process more robust and portable.Handle missing HOME safely
Safeguard against a missing
HOMEenvironment variable by providing a fallbackpath to prevent potential runtime errors and non-hermetic writes.
third_party/vendor/tools_opam/extensions/opam.bzl [122-130]
Suggestion importance[1-10]: 7
__
Why: The suggestion correctly points out that
mctx.getenv("HOME")can beNone, which would cause a runtime error. Adding a fallback improves the robustness of the script in hermetic environments.Previous suggestions
✅ Suggestions up to commit
22a5372Simplify and improve CI workflow maintainability
Improve the CI workflow's maintainability by using the
bazel-contrib/setup-bazelaction instead of manually installing Bazelisk. Centralize the BuildBuddy API
key configuration by generating a
.bazelrc.remotefile from secrets rather thanpassing it on each command line.
Examples:
.github/workflows/main.yml [17-31]
Solution Walkthrough:
Before:
After:
Suggestion importance[1-10]: 8
__
Why: The suggestion correctly identifies that manually installing Bazelisk and passing the API key on the command line is brittle; using a setup action and a
.bazelrc.remotefile is a more robust and maintainable approach for the CI workflow.✅
Avoid redundant builds in CISuggestion Impact:
The separate "Build" step invoking `bazel build` was removed, leaving only the test step to handle the build via `bazel test`.code diff:
Remove the redundant
Buildstep from the CI workflow, asbazel testalreadyperforms a build, which will make the CI process more efficient.
.github/workflows/main.yml [24-40]
Suggestion importance[1-10]: 7
__
Why: The suggestion correctly points out that
bazel testincludes a build phase, making the separatebazel buildstep redundant and inefficient, even with caching. Removing it simplifies the workflow and improves CI performance.Improve bazelisk installation and script robustness
Improve the
bazeliskinstallation script by addingset -efor robustness andmoving the binary to
/usr/local/binto make it available in the systemPATH..github/workflows/main.yml [17-22]
Suggestion importance[1-10]: 6
__
Why: The suggestion correctly improves the robustness of the installation script with
set -eand enhances maintainability by installing the binary to a standardPATHdirectory, simplifying future commands.Imported GitHub PR comment.
Original author: @qodo-code-review[bot]
Original URL: https://github.com/carverauto/serviceradar/pull/1652#issuecomment-3322509213
Original created: 2025-09-23T05:42:20Z
CI Feedback 🧐
(Feedback updated until commit
github.com/carverauto/serviceradar@4e0d86f6da)A test triggered by this PR failed. Here is an AI-generated analysis of the failure:
Action: build
Failed stage: Test [❌]
Failure summary:
Bazel analysis failed due to an opam toolchain setup error, which cascaded into no
buildable/testable targets:
- In
external/tools_opam+/extensions/opam/opam_toolchain_xdg.bzl:242:17,the module extension
@@tools_opam+//extensions:opam.bzl%opamfailed while creating the opam switch5.1.0.- The command
["/home/runner/.local/share/obazl/opam/2.3.0/bin/opam", "switch", "create","5.1.0", "5.1.0", "--root=/home/runner/.local/share/obazl/opam/2.3.0/root"]exited with rc=31.-
Opam error while compiling
ocaml-base-compiler.5.1.0(
~/.local/share/obazl/opam/2.3.0/root/5.1.0/.opam-switch/build/ocaml-base-compiler.5.1.0):bwrap:loopback: Failed RTM_NEWADDR: Operation not permitted(likely sandbox/network namespace permissionissue on the GitHub runner).
- As a result, many Bazel targets reported "error evaluating module
extension @@tools_opam+//extensions:opam.bzl%opam" and were not analyzed.
- Bazel then reported "No
test targets were found, yet testing was requested" and the action exited with code 1.
Relevant error logs: