ci(bazel): shallow checkout for non-root matrix rows#429
Open
balajinvda wants to merge 5 commits into
Open
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughBazel workflows now use the ChangesBazel CI configuration
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant Operator
participant image-push-manual.yml
participant Bazel
Operator->>image-push-manual.yml: Provide service_path
image-push-manual.yml->>Bazel: Resolve module layout and working directory
image-push-manual.yml->>Bazel: Query scoped oci_image_index targets
Bazel-->>image-push-manual.yml: Return image targets
image-push-manual.yml-->>Operator: Build and push multi-arch images
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
balajinvda
force-pushed
the
ci/bazel-shallow-checkout
branch
from
July 24, 2026 20:41
0692055 to
e8c0c0a
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@BAZEL.md`:
- Around line 432-433: Update the Bazel toolchain documentation near the “Every
workflow” statement to limit the claim to containerized Bazel jobs, reflecting
that the bazel-docker job runs on ubuntu-latest and installs Bazelisk
independently.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 6b66742f-fd7a-4400-b982-a40a67a725c8
📒 Files selected for processing (4)
.github/workflows/bazel.yml.github/workflows/chart-push-manual.yml.github/workflows/image-push-manual.ymlBAZEL.md
Only the root row (path '.') diffs a PR against its base and needs full history; every other container row and both docker-host rows build their whole scope regardless. Use fetch-depth 1 for those to skip a full-history clone on ~19 jobs per full matrix. detect keeps fetch-depth 0. Co-authored-by: Balaji Ganesan <bganesan@nvidia.com>
The bazel-ci image was hardcoded in four places and had already drifted to three different versions: bazel.yml on 0.13.0, image-push-manual.yml and chart-push-manual.yml on 0.8.0, and BAZEL.md documenting 0.12.0. The release path building shipping images on a different toolchain than CI validates with is a correctness problem, not just untidiness. Source the container from the BAZEL_CI_IMAGE repository variable so the image is bumped in one place. Each workflow keeps the current pin as a || fallback so CI still runs when the variable is unavailable, for example on a fork. It must be vars, not env: GitHub Actions evaluates job-level container.image before the workflow-level env: context is reliably available, which is why the previous note told maintainers to keep the tag literal. The vars context does not have that ordering problem, so the value can now be centralized. Co-authored-by: Balaji Ganesan <bganesan@nvidia.com>
…ding The manual image-push workflow carried a hardcoded choice list of 11 service paths, so every new service needed a workflow edit before its image could be pushed for pre-merge testing. cloud-tasks, for example, was not selectable. GitHub Actions cannot populate a choice input dynamically, so drop the list: service_path is a free-form path, and the workflow discovers what to build. It also assumed every subtree is its own Bazel module: it ran bazel from inside the subtree and queried //... . That is false for services in the repo-root module (the Java services), where the query finds nothing. The workflow now derives the layout from whether the subtree owns a MODULE.bazel, querying from the subtree with //... or from the root with a path-scoped pattern. Both were verified against a standalone module (grpc-proxy resolves //:image_index) and a root-module service (cloud-tasks resolves //src/control-plane-services/cloud-tasks/nvct-service:nvct-service-oss-image_index). An unknown path now fails with the list of subtrees owning a Bazel module, which replaces the discoverability the dropdown provided. Co-authored-by: Balaji Ganesan <bganesan@nvidia.com>
balajinvda
force-pushed
the
ci/bazel-shallow-checkout
branch
from
July 25, 2026 02:58
e8c0c0a to
7f6df99
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/image-push-manual.yml:
- Line 149: Update the query handling around the indexes population so the bazel
query invoked by the workflow preserves and propagates failures instead of
hiding them behind mapfile process substitution. Run bazel query directly before
reading its output, while retaining the existing parsing and empty-result
behavior for successful queries.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 6445b402-fe05-4c65-b70b-58f305cda000
📒 Files selected for processing (4)
.github/workflows/bazel.yml.github/workflows/chart-push-manual.yml.github/workflows/image-push-manual.ymlBAZEL.md
🚧 Files skipped from review as they are similar to previous changes (3)
- .github/workflows/chart-push-manual.yml
- .github/workflows/bazel.yml
- BAZEL.md
The repo-name rule only stripped an _image suffix, so a target using hyphens
fell through to the default branch and got both the service prefix and the
suffix left on. byoo-otel-collector-image became
byoo-otel-collector-byoo-otel-collector-image, and cloud-tasks would have
pushed nvct-service-oss as cloud-tasks-nvct-service-oss-image.
The tree uses the separator to mean two different things:
image the service's sole image; repo is the service
<component>_image a sub-component; repo is <service>-<component>
<image-name>-image the target already carries the full image name; use it
as-is without the service prefix
Add the hyphenated case. Verified against every image target in the tree: the
11 services currently selectable are unchanged, and byoo-otel-collector (2
targets) and cloud-tasks are corrected. byoo was latent because it is not in
the old hardcoded list; making the input free-form would have exposed it.
Co-authored-by: Balaji Ganesan <bganesan@nvidia.com>
The target discovery used mapfile with process substitution, so only stdout reached mapfile and the query's exit status was discarded. A failing query (a BUILD error, an unloadable package, a bad scope) produced an empty array and was then misreported as "no oci_image_index targets under <path>", pointing the operator at the wrong problem. Run the query directly, check its status, and build the array explicitly. The array is built in a loop rather than from a here-string because a here-string of empty output yields one empty element instead of an empty array, which would defeat the existing no-targets check. Verified all four cases: failing query surfaces the error, empty result gives 0 targets, single and multiple results parse correctly. Co-authored-by: Balaji Ganesan <bganesan@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Every full-matrix bazel run clones full git history (
fetch-depth: 0) on ~20 jobs, but only the root row actually uses history (it diffs a PR against its base to compute affected targets). Every other container row and both docker-host rows build their whole scope regardless, so the full-history clone is wasted per-job overhead.This is the first, safe pass of a broader CI-efficiency effort (see plan below). It's kept as one PR; the remaining levers land as follow-up commits here.
What changed
bazelmatrix:fetch-depth: ${{ matrix.subtree.path != '.' && 1 || 0 }}— full history only for the root row (path '.'), shallow for all others. Written non-root-first because GHA treats0as falsy, so a naivecond && 0 || 1ternary would always return 1.bazel-dockermatrix:fetch-depth: 1(docker-host rows never build the root scope).detectkeepsfetch-depth: 0(needs history for change detection).Planned follow-ups (same PR, as separate commits)
setup-java+bazeliskinstall and run in-container (needs--network host+ socket mount for the fixed-port Testcontainers tests; validated on this PR's CI).--jobs=1/ making the collector genrule output remote-cacheable (Go SDK + module download are already handled).Customer Release Notes
Not customer visible (CI-only).
Testing
The workflow change forces a full matrix (it edits
bazel.yml), so this PR's own run validates the shallow checkout across every row.References
Efficiency review follow-up. bazel-ci image already carries docker + Go 1.25.6 + JDK 25 (no image change needed).
Summary by CodeRabbit
Performance
CI Improvements
Documentation