Skip to content

ci: derive cache-stable Windows Bazel PATH#19161

Merged
bolinfest merged 6 commits intomainfrom
pr19161
Apr 23, 2026
Merged

ci: derive cache-stable Windows Bazel PATH#19161
bolinfest merged 6 commits intomainfrom
pr19161

Conversation

@bolinfest
Copy link
Copy Markdown
Collaborator

@bolinfest bolinfest commented Apr 23, 2026

Why

The BuildBuddy runs for PR #19086 and the later main build had the same source tree, but their Windows Bazel action and test cache keys did not line up. Comparing the downloaded execution logs showed the full GitHub-hosted Windows runner PATH had changed from apache-maven-3.9.14 to apache-maven-3.9.15.

This repo is not using Maven; the Maven entry was just ambient hosted-runner state. The problem was that Windows Bazel CI was still forwarding the whole runner PATH into Bazel via --action_env=PATH, --host_action_env=PATH, and --test_env=PATH, which made otherwise reusable cache entries sensitive to unrelated runner image churn.

After discussion with the Bazel and BuildBuddy folks, the better shape for this change was to stop asking Bazel to inherit the ambient Windows PATH and instead compute one explicit cache-stable PATH in the Windows setup action that already prepares the CI toolchain environment.

What

  • remove Windows PATH passthrough from .bazelrc
  • export CODEX_BAZEL_WINDOWS_PATH from .github/actions/setup-bazel-ci/action.yml
  • move the PATH derivation logic into .github/scripts/compute-bazel-windows-path.ps1 so the allow-list is easier to review and document
  • keep only the Windows tool locations these Bazel jobs actually need: MSVC and SDK paths, Git, PowerShell, Node, DotSlash, and the standard Windows system directories
  • update .github/scripts/run-bazel-ci.sh to require that explicit value and forward it to Bazel action, host action, and test environments
  • log the derived CODEX_BAZEL_WINDOWS_PATH in the setup step to simplify cache-key debugging

Windows %PATH%

On the Windows CI jobs for this PR, note the %CODEX_BAZEL_WINDOWS_PATH% we derive is quite long, and many of the path entries have version numbers, so upgrading any of them would result in a full rebuild because the change to %PATH% would invalidate the existing cache entries:

Derived CODEX_BAZEL_WINDOWS_PATH entries:
  C:\Program Files\PowerShell\7
  C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Tools\MSVC\14.44.35207\bin\HostX64\x64
  C:\Program Files\Microsoft Visual Studio\2022\Enterprise\Common7\IDE\VC\VCPackages
  C:\Program Files\Microsoft Visual Studio\2022\Enterprise\Common7\IDE\CommonExtensions\Microsoft\TestWindow
  C:\Program Files\Microsoft Visual Studio\2022\Enterprise\Common7\IDE\CommonExtensions\Microsoft\TeamFoundation\Team Explorer
  C:\Program Files\Microsoft Visual Studio\2022\Enterprise\MSBuild\Current\bin\Roslyn
  C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\x64\
  C:\Program Files\Microsoft Visual Studio\2022\Enterprise\Common7\IDE\CommonExtensions\Microsoft\FSharp\Tools
  C:\Program Files\Microsoft Visual Studio\2022\Enterprise\Team Tools\DiagnosticsHub\Collector
  C:\Program Files\Microsoft Visual Studio\2022\Enterprise\Common7\IDE\Extensions\Microsoft\CodeCoverage.Console
  C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Tools\Llvm\x64\bin
  C:\Program Files (x86)\Windows Kits\10\bin\10.0.26100.0\\x64
  C:\Program Files (x86)\Windows Kits\10\bin\\x64
  C:\Program Files\Microsoft Visual Studio\2022\Enterprise\\MSBuild\Current\Bin\amd64
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319
  C:\Program Files\Microsoft Visual Studio\2022\Enterprise\Common7\IDE\
  C:\Program Files\Microsoft Visual Studio\2022\Enterprise\Common7\Tools\
  C:\Program Files\Git\bin
  C:\hostedtoolcache\windows\Python\3.12.10\x64\Scripts
  C:\hostedtoolcache\windows\Python\3.12.10\x64
  C:\Program Files\Microsoft SDKs\Azure\CLI2\wbin
  C:\Windows\system32
  C:\Windows
  C:\Windows\System32\Wbem
  C:\Windows\System32\WindowsPowerShell\v1.0\
  C:\Windows\System32\OpenSSH\
  C:\Program Files\PowerShell\7\
  C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\
  C:\Program Files\Microsoft SDKs\Service Fabric\Tools\ServiceFabricLocalClusterManager
  C:\Program Files\Git\cmd
  C:\Program Files\Git\mingw64\bin
  C:\Program Files\Git\usr\bin
  C:\Program Files\Microsoft Visual Studio\2022\Enterprise\Common7\IDE\CommonExtensions\Microsoft\CMake\CMake\bin
  C:\Program Files\Microsoft Visual Studio\2022\Enterprise\Common7\IDE\CommonExtensions\Microsoft\CMake\Ninja
  C:\Program Files\Microsoft Visual Studio\2022\Enterprise\Common7\IDE\VC\Linux\bin\ConnectionManagerExe
  C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\vcpkg
  C:\Program Files\nodejs
  C:\Users\runneradmin\AppData\Local\Microsoft\WindowsApps

Verification

  • bash -n .github/scripts/run-bazel-ci.sh
  • ruby -e 'require "yaml"; YAML.load_file(ARGV[0])' .github/actions/setup-bazel-ci/action.yml
  • PowerShell parse check for .github/scripts/compute-bazel-windows-path.ps1
  • simulated a representative Windows PATH in PowerShell; the allow-list retained MSVC, Git, PowerShell, Node, Windows, and DotSlash entries while dropping Maven

Copy link
Copy Markdown
Contributor

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 48948ea9e8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread .github/scripts/run-bazel-ci.sh Outdated
Comment on lines +332 to +334
IFS=';' read -r -a windows_path_entries <<< "${PATH}"
for path_entry in "${windows_path_entries[@]}"; do
case "${path_entry}" in
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Convert Bash PATH before Windows allow-list filtering

On Windows CI this wrapper is invoked with shell: bash (.github/workflows/bazel.yml), so PATH is provided in MSYS format (colon-delimited /c/... entries), which is why the script already has to convert which node output via cygpath -w earlier. Splitting PATH on ; and matching only C:\... patterns means the allow-list will typically stay empty, so the new cache-stable PATH branch is skipped and Bazel still receives the full volatile PATH, defeating the cache-stabilization change. Convert PATH to Windows form first (or match MSYS-form paths) before filtering.

Useful? React with 👍 / 👎.

Comment thread .github/scripts/run-bazel-ci.sh Outdated
Comment on lines +358 to +360
elif [[ -n "${PATH:-}" ]]; then
post_config_bazel_args+=("--action_env=PATH" "--host_action_env=PATH" "--test_env=PATH")
fi
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think you want to remove this part, since this shouldn't apply to non-windows platforms

@bolinfest bolinfest changed the title ci: stabilize Windows Bazel PATH inputs ci: compute Windows Bazel PATH in setup action Apr 23, 2026
@bolinfest bolinfest requested review from keith and zbarsky-openai and removed request for keith April 23, 2026 19:13
@bolinfest bolinfest changed the title ci: compute Windows Bazel PATH in setup action ci: derive cache-stable Windows Bazel PATH Apr 23, 2026
@bolinfest bolinfest enabled auto-merge (squash) April 23, 2026 19:54
Copy link
Copy Markdown

@keith keith left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@bolinfest bolinfest merged commit a9f75e5 into main Apr 23, 2026
33 of 37 checks passed
@bolinfest bolinfest deleted the pr19161 branch April 23, 2026 22:28
@github-actions github-actions Bot locked and limited conversation to collaborators Apr 23, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants