Add --mnemonic_cache_salt flag for per-action cache invalidation

[oliviernotteghem]

Summary

Add --mnemonic_cache_salt flag to allow targeted cache invalidation for specific action types. This enables users to invalidate cache entries for actions with a particular mnemonic (e.g., Javac, KotlinCompile) without affecting other cached actions. It invalidates both action key and remote cache key, so essentially it forces action to re-execute and result is uploaded using a new remote cache key.

We believe this functionality is critical to mitigate possible cache poisoning issue for local users or on CI (that may happen if a rule is poorly written, etc.). This diff should be a conversation starter whether we want this ability in Bazel, or what could be a better design.

Usage

bazel build //foo:bar --mnemonic_cache_salt=Javac=V1 bazel build //foo:bar --mnemonic_cache_salt=Javac=V2 # Rebuilds only Javac actions bazel build //foo:bar --mnemonic_cache_salt=Javac=V2 --mnemonic_cache_salt=KotlinCompile=K1

Changes

New Flag (ExecutionOptions.java)

• Added --mnemonic_cache_salt option with allowMultiple=true
• Uses AssignmentConverter for Mnemonic=salt parsing
• Added getMnemonicCacheSalts() helper returning ImmutableMap<String, String>

Protocol Buffer (cache_salt.proto)

• Added mnemonic_salt field (tag 4) to CacheSalt message

Local Cache Integration (ActionCache.java, ActionCacheChecker.java)

• Entry.Builder accepts optional mnemonicSalt parameter
• computeDigest() includes mnemonic salt in fingerprint when non-null
• getTokenIfNeedToExecute() and related methods accept mnemonicCacheSalts map
• Salt lookup uses action.getMnemonic()

Remote Cache Integration (RemoteExecutionService.java)

• buildSalt() includes mnemonic salt in CacheSalt proto
• Changed from static to instance method to access executionOptions
• Looks up salt using spawn.getMnemonic()

Threading (SkyframeActionExecutor.java, SkyframeExecutor.java, SkyframeBuilder.java, ExecutionTool.java)

• mnemonicCacheSalts field added to SkyframeActionExecutor
• Passed through configure() from ExecutionOptions

Test Updates

• Updated ActionCacheCheckerTest.java with new mnemonicCacheSalts parameter
• Updated CompactPersistentActionCacheTest.java with new mnemonicSalt parameter
• Updated SequencedSkyframeExecutorTest.java with new parameters
• Updated TimestampBuilderTestCase.java with new parameter

RELNOTES: None

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[DavidANeil]

Could this be accomplished already with --modify_execution_info, since that is part of the cache key?

[oliviernotteghem]

Could this be accomplished already with --modify_execution_info, since that is part of the cache key?

I don't think so : --modify_execution_info is not consistently hashed, because it's not a semantic input. We can possibly find a way to use it for some actions, but we need something more determnitistic IMO.