.bazelrc

# Bazel configuration for beads. Bazel is beads' build and test system: CI
# gates on the `bazel test` lanes in .github/workflows/bazel.yml, and
# `make test`/`make check` run the same commands (engdocs/TESTING.md
# "Building and Testing"). Plain `go build`/`go test` still work as an
# inner-loop convenience but are not what CI enforces. Where actions run is
# per machine, never committed here: contributors read the anonymous,
# read-only cache with --config=fork-cache (defined below); maintainers with
# an rbe-west client certificate execute remotely with --config=remote-exec.
# Make either the default with a `build --config=...` line in the gitignored
# .bazelrc.local. Bzlmod only; Bazel version is pinned in .bazelversion.
common --enable_bzlmod
common --color=no
# C/C++ (and so cgo, -race and the Go stdlib) builds only with MODULE.bazel's
# pinned LLVM toolchain: no host-detected local_config_cc to fall back to,
# which would key actions to the client's gcc and lld and fail remote links
# on workers without lld (scripts/bazel_hermetic_cc_test.go).
common --repo_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1

# The pinned remote-worker host in every action key: //platforms:rbe_worker's
# worker-env exec property is the sha256 of tools/rbe/worker-env.txt, and
# rbe-west's schedulers run an action only on a worker that measured that
# host (platforms/BUILD.bazel). Key-affecting, so unconditional: local,
# fork-cache and remote runs hash alike.
build --extra_execution_platforms=//platforms:rbe_worker

# ICU policy (engdocs/ICU-POLICY.md): build go-mysql-server with its pure-Go
# regex backend so no target links libicu. MODULE.bazel carries the matching
# gazelle_override for github.com/dolthub/go-mysql-server.
build --@rules_go//go/config:tags=gms_pure_go

# Keep the client PATH/env out of action keys.
build --incompatible_strict_action_env

test --test_output=errors
# Test environment isolation (the pr-core `go test` environment of
# scripts/ci/lib/test-env.sh): every test process runs under a wrapper that
# gives it a private HOME, XDG_CONFIG_HOME, DOLT_ROOT_PATH, empty global
# gitconfig and a short, per-process TMPDIR (unix-socket sun_path limit).
# Client HOME/TMPDIR are never forwarded, so no host value enters the action key.
test --run_under=//tools/bazel:test_env
test --test_env=BD_DISABLE_METRICS=1
test --test_env=BD_DISABLE_EVENT_FLUSH=1

# PR-core parity: the same test selection as scripts/ci/pr-core.sh (race,
# -short, skips, tag filters); the environment comes from the wrapper above.
test:prcore --@rules_go//go/config:race
test:prcore --test_arg=-test.short
# pr-core.sh's -parallel 4. Without it -test.parallel defaults to GOMAXPROCS,
# the executor's core count (192 on a farm worker), not a runner's 4.
test:prcore --test_arg=-test.parallel=4
test:prcore --test_arg=-test.skip=^TestEmbedded
test:prcore --test_env=BEADS_TEST_SKIP=dolt
# As in pr.yml's PR Core step: a root or non-POSIX executor fails
# TestAddExcludePatternsRefusesReadErrors instead of skipping it.
test:prcore --test_env=BEADS_TEST_REQUIRE_EXCLUDE_PERMISSION=1
# Every tag that belongs to another lane (scripts/bazel_policy_test.go
# bazelPRCoreExcludedTags). integration-only targets run zero tests outside
# --config=integration.
test:prcore --test_tag_filters=-dolt-server,-dolt-server-proxied,-dolt-server-integration,-dolt-server-cmd,-embedded,-manual,-integration-only

test:ci --config=prcore
test:ci --keep_going --test_summary=terse
# tools/bazel/equivalence.py compares the Go tests Bazel ran with the ones
# `go test` would run, from each target's test.xml. rules_go only lists passing
# tests in test.xml under -test.v, and --remote_download_minimal would leave
# test.xml on the remote side, so ask for both.
test:ci --test_env=GO_TEST_WRAP_TESTV=1
test:ci --remote_download_regex=.*/test\.xml$
# bazel.yml publishes the non-race bd as pr.yml's ci-build-artifacts.
test:ci --remote_download_regex=.*/bin/cmd/bd/bd_for_tests/bd$

# Embedded-Dolt tier: PR Risk's embedded jobs ("Test (Embedded Dolt Cmd
# N/20)", "Test (Embedded Dolt Storage N/5)", "Test (Embedded Dolt
# Conformance - core/audit)"), as the `embedded`-tagged variants of bd_test
# and embeddeddolt_test. Race like the jobs' binaries, no -short, no
# BEADS_TEST_SKIP; each variant sets BEADS_TEST_EMBEDDED_DOLT=1. The shard
# variants run the jobs' shard scripts, so every Bazel shard runs exactly the
# tests of the job with the same number.
# Only the variants and what they need are built (the same race configuration
# as --config=ci, so the two lanes share every compile).
test:embedded --@rules_go//go/config:race
test:embedded --test_tag_filters=embedded
test:embedded --build_tests_only
test:embedded --keep_going
test:embedded --test_summary=terse
# The variants are timeout = "eternal" because the jobs' Go timeouts are past
# "long"; rbe-west rejects any action timeout over 1200s, so eternal means
# 1200s here, and the effective limit of every variant is -test.timeout=19m
# (the storage and cmd shard jobs pass 20m, conformance core/audit 30m), so
# that Go's timeout, which dumps every goroutine, fires before Bazel's 1200s
# kill, which does not (see the BUILD targets).
test:embedded --test_timeout=-1,-1,-1,1200
# The jobs pass no -parallel: GOMAXPROCS on a 4-vCPU runner.
test:embedded --test_arg=-test.parallel=4
test:embedded --test_env=GO_TEST_WRAP_TESTV=1
test:embedded --remote_download_regex=.*/test\.xml$
# Since D2 step 1 this lane is the tier's only pre-merge run on same-repo PRs
# (pr-risk.yml's legacy jobs stand down). Its results are cached like every
# lane's: an unchanged test reuses its recorded PASS, and nightly re-executes
# everything (--config=fresh below).
# No whole-invocation retry on a remote cache eviction ("Lost inputs"):
# Bazel would re-run every test, and a test that failed in the first
# attempt but passes in the retry would report green, unlike the legacy
# jobs, which never retried. Evicted inputs fail the step instead; a
# visible "Re-run failed jobs" retries it.
test:embedded --experimental_remote_cache_eviction_retries=0
# The race configuration's nogo validations run once, in bazel.yml's `test`
# lane (`bazel test //... --config=ci`), which is a strict superset of every
# race-group lane's RunNogo/ValidateNogo keys. --norun_validations is a
# build-request option, not a configuration flag: it changes no action key
# (compile, link and nogo actions are shared with `test` through the action
# cache; test results are not, since each lane's test actions carry its own
# test env and args) and discards no analysis; it only skips re-running nogo's
# validation actions that the owner lane already runs on this configuration.
# scripts/nogo_lint_policy_test.go's TestNogoConfigurationsHaveOneValidatingLane
# pins `test` as this configuration's sole validating lane.
test:embedded --norun_validations

# Dolt-server lane: what pr.yml's retired container-backed jobs ("Test
# (storage domain + uow)" and "Contract corpus") ran, but every dolt
# sql-server is a child of the test process, started from the pinned dolt in
# the test wrapper's runfiles (BEADS_TEST_DOLT_SERVER=local, set by each
# dolt-server target), so the targets run on remote workers and need no
# docker. As those jobs: race (//cmd/bd/protocol's variant opts out, like its
# job), no -short, no BEADS_TEST_SKIP=dolt, -test.parallel=4, and the
# no--short twins of the job's other packages. Results are cacheable: every
# input (test binary, dolt, env) is in the action key, and a server that
# cannot start fails the target (BEADS_TEST_REQUIRE_DOLT_CONTAINER=1) instead
# of skipping. test.xml is downloaded for tools/bazel/equivalence.py --job,
# test.log for bazel.yml's failure artifact.
test:doltserver --@rules_go//go/config:race
test:doltserver --test_tag_filters=dolt-server
test:doltserver --build_tests_only
test:doltserver --keep_going
test:doltserver --test_env=GO_TEST_WRAP_TESTV=1
test:doltserver --test_arg=-test.parallel=4
# Locally (rbe=off, no executor): at most 4 test processes, the jobs' 4-vCPU
# runner shape; remote workers are not limited by it.
test:doltserver --local_test_jobs=4
test:doltserver --remote_download_regex=.*/test\.(log|xml)$
# Race-group nogo is owned by the `test` lane; see test:embedded's comment
# above.
test:doltserver --norun_validations

# Proxied-server tier: PR Risk's "Test (Proxied Dolt Cmd N/15)" jobs, as
# //cmd/bd:bd_proxied_test and //cmd/bd:bd_managed_local_test (the
# managed-local lifecycle in a loopback-only network namespace) (the
# dolt-server-proxied tag). Kept out of
# --config=doltserver because bazel.yml runs that lane locally too (forks,
# rbe=off), where 30 concurrent shards, each with a dolt sql-server busy on
# ~4 cores, do not fit regardless of any single shard's wall time; bazel.yml
# runs this one only with remote execution, in a job of its own
# (bazel-proxied). The build is
# --config=doltserver's: race, like PR Risk's /tmp/bd-cmd-test; the
# subprocess bd is the non-race bd_for_tests, like the jobs'. Each shard runs its job's
# shard script, whose -test.timeout=15m is past "long": the target is
# eternal, which rbe-west caps at 1200s.
test:doltserver-proxied --@rules_go//go/config:race
test:doltserver-proxied --test_tag_filters=dolt-server-proxied
test:doltserver-proxied --build_tests_only
test:doltserver-proxied --keep_going
test:doltserver-proxied --test_summary=terse
test:doltserver-proxied --test_timeout=-1,-1,-1,1200
test:doltserver-proxied --test_env=GO_TEST_WRAP_TESTV=1
# The jobs pass no -parallel: GOMAXPROCS (the target's 4, a runner's vCPUs).
test:doltserver-proxied --test_arg=-test.parallel=4
test:doltserver-proxied --local_test_jobs=4
test:doltserver-proxied --remote_download_regex=.*/test\.(log|xml)$
# Since D2 step 2 this lane is the tier's only pre-merge run on same-repo
# PRs. Results are cached like every lane's (nightly: --config=fresh).
# No whole-invocation retry on a remote cache eviction ("Lost inputs"):
# Bazel would re-run every test, and a test that failed in the first
# attempt but passes in the retry would report green, unlike the legacy
# jobs, which never retried. Evicted inputs fail the step instead; a
# visible "Re-run failed jobs" retries it.
test:doltserver-proxied --experimental_remote_cache_eviction_retries=0
# Race-group nogo is owned by the `test` lane; see test:embedded's comment
# above.
test:doltserver-proxied --norun_validations

# dolt-server + proxied union (item 5): bazel.yml's bazel-dolt-race job runs
# both tiers in one invocation in mode remote, in place of the bazel-doltserver
# and bazel-proxied lanes, which still run --config=doltserver and
# --config=doltserver-proxied in every other mode. Exactly the union of the two
# member configs' lines, with one tag filter naming both tiers
# (scripts/bazel_dolt_race_test.go). Every other flag is the same in both
# members or outside any action key for the other: the race build,
# -test.parallel=4 and GO_TEST_WRAP_TESTV=1 are common; the eternal timeout
# applies to no dolt-server target; the eviction retry count is what
# doltserver gets from --config=sole-run wherever it executes remotely;
# test_summary, local_test_jobs and remote_download_regex are not in any action
# key. So each member target's test action is unchanged (aquery: all 62
# TestRunner actions byte-identical), and whichever arm the mode picks shares
# cached results with the other. The member configs stay for those modes, make
# and developers.
test:dolt-race --@rules_go//go/config:race
test:dolt-race --test_tag_filters=dolt-server,dolt-server-proxied
test:dolt-race --build_tests_only
test:dolt-race --keep_going
test:dolt-race --test_summary=terse
test:dolt-race --test_timeout=-1,-1,-1,1200
test:dolt-race --test_env=GO_TEST_WRAP_TESTV=1
test:dolt-race --test_arg=-test.parallel=4
test:dolt-race --local_test_jobs=4
test:dolt-race --remote_download_regex=.*/test\.(log|xml)$
test:dolt-race --experimental_remote_cache_eviction_retries=0
# The union carries its members' --norun_validations line
# (TestBazelDoltRaceConfigIsMemberUnion needs no change: both members and the
# union carry the same line).
test:dolt-race --norun_validations

# Server-Dolt storage tier: PR Risk's "Test (Server Dolt Conformance)" and
# "Test (Server Dolt Full Suite N/16)" jobs, as
# //internal/storage/dolt:dolt_server_{conformance,full}_test
# (dolt-server-integration tag): the integration-tagged internal/storage/dolt
# tests, non-race like the jobs' binary, against a local dolt sql-server.
# The build flags are exactly --config=integration's (the tags, and race for
# everything the variants do not turn off), so the two lanes share every
# compile: the variants' race-off binary lands in the configuration
# --config=integration already builds the non-race //cmd/bd:bd_for_tests in.
# A per-target gotags transition would instead compile the whole graph a
# third time. No BEADS_TEST_SKIP, no -short; the full suite's
# BEADS_TEST_ENV_RUN_DOLT=1 is target env. Remote only in bazel.yml, in a
# job of its own (bazel-server-storage) that shares bazel-integration's
# compiles through the remote cache.
build:doltserver-integration --@rules_go//go/config:tags=gms_pure_go,integration
test:doltserver-integration --@rules_go//go/config:race
test:doltserver-integration --test_tag_filters=dolt-server-integration
test:doltserver-integration --build_tests_only
test:doltserver-integration --keep_going
test:doltserver-integration --test_summary=terse
test:doltserver-integration --test_timeout=-1,-1,-1,1200
test:doltserver-integration --test_env=GO_TEST_WRAP_TESTV=1
# The jobs pass no -parallel: GOMAXPROCS (the targets' 4, a runner's vCPUs).
test:doltserver-integration --test_arg=-test.parallel=4
test:doltserver-integration --local_test_jobs=4
test:doltserver-integration --remote_download_regex=.*/test\.(log|xml)$
# F5 S2 Variant A: this configuration (integration, doltserver-integration,
# doltserver-cmd -- the same fingerprint, race=true plus
# tags=gms_pure_go,integration) has no full-lane owner. Its nogo runs once,
# narrowly, in bazel.yml's bazel-integration job: a `bazel build
# --output_groups=nogo_fix` step over //internal/testutil/integration only
# (the configuration's non-test library; the 56 integration-tagged _test.go
# files this loses vet/lint coverage on are listed in
# tools/nogo/unvalidated_integration_tests.txt, f5-spec.md §3/§5 S2).
# --norun_validations is a build-request option, not a configuration flag:
# it changes no action key and discards no analysis; it only skips
# re-running nogo's validation actions, which bazel-integration's nogo-only
# step already runs for this configuration's library files.
# scripts/nogo_lint_policy_test.go's TestNogoConfigurationsHaveOneValidatingLane
# pins the nogo-only step as this configuration's sole validating lane.
test:doltserver-integration --norun_validations
# Since D2 step 2 this lane is the tier's only pre-merge run on same-repo
# PRs. Results are cached like every lane's (nightly: --config=fresh).
# No whole-invocation retry on a remote cache eviction ("Lost inputs"):
# Bazel would re-run every test, and a test that failed in the first
# attempt but passes in the retry would report green, unlike the legacy
# jobs, which never retried. Evicted inputs fail the step instead; a
# visible "Re-run failed jobs" retries it.
test:doltserver-integration --experimental_remote_cache_eviction_retries=0

# cmd/bd Dolt-server tier: //cmd/bd:bd_dolt_server_test (dolt-server-cmd
# tag), the whole integration-tagged cmd/bd suite against a hermetic dolt
# sql-server, i.e. the Dolt-gated cmd/bd tests every other lane skips
# (BEADS_TEST_SKIP=dolt in --config=prcore/ci and --config=integration), and //tests/regression:regression_test
# (the differential regression suite, formerly regression.yml, against the
# catalog-pinned baseline in @bd_releases). The build flags are exactly
# --config=integration's, so it compiles nothing bazel-integration does not
# (shared through the remote cache). bazel.yml runs it where it runs the
# integration lane (remote, or with the read-only cache in mode cache), in a
# job of its own (bazel-cmd-dolt), advisory until pr.yml's
# BAZEL_CMD_DOLT_REQUIRED says otherwise. No BEADS_TEST_SKIP, no -short.
# Results are cacheable, as in --config=doltserver: every input is in the
# action key, and a server that cannot start fails the target.
build:doltserver-cmd --@rules_go//go/config:tags=gms_pure_go,integration
test:doltserver-cmd --@rules_go//go/config:race
test:doltserver-cmd --test_tag_filters=dolt-server-cmd
test:doltserver-cmd --build_tests_only
test:doltserver-cmd --keep_going
test:doltserver-cmd --test_summary=terse
test:doltserver-cmd --test_timeout=-1,-1,-1,1200
# As in --config=integration: Go's own timeout fires first and dumps every
# goroutine to test.log, which Bazel's kill at 1200s does not. Item 5 A2: the
# -test.timeout=19m arg and the BEADS_TEST_REQUIRE_EXCLUDE_PERMISSION env moved
# onto //cmd/bd:bd_dolt_server_test's and //tests/regression:regression_test's
# own args/env (the rules), so --config=dolt-int below does not need them:
# without the move, server-storage's 15m Go timeout would become 19m under
# the union, and the env would leak into server-storage's targets. The final
# argv and environment Bazel assembles (target args, then -test.timeout=19m,
# then this config's own -test.parallel=4 test_arg; same env map either way)
# are unchanged, so the remote action digest -- what RBE's cache keys on --
# is unaffected and cached results should carry over. This IS a local
# actionKey change for these two targets' 46 actions: --test_env is part of
# the build configuration's own fingerprint, picked up by every target
# analyzed under that configuration, unlike a target's own env attribute,
# which only the target carries. To be confirmed in practice by the first
# merge group's tests_cached == tests_total in ci-analytics, not claimed here
# as already observed.
test:doltserver-cmd --test_arg=-test.parallel=4
test:doltserver-cmd --test_env=GO_TEST_WRAP_TESTV=1
test:doltserver-cmd --local_test_jobs=4
test:doltserver-cmd --remote_download_regex=.*/test\.(log|xml)$
# F5 S2 Variant A: same configuration as --config=integration /
# doltserver-integration above; see that block's comment for the owner
# (bazel-integration's nogo-only step over //internal/testutil/integration).
test:doltserver-cmd --norun_validations

# server-storage + cmd-dolt union (item 5 A2): bazel.yml's bazel-dolt-int job
# runs both tiers in one invocation in mode remote, in place of the
# bazel-server-storage and bazel-cmd-dolt jobs, which still run
# --config=doltserver-integration and --config=doltserver-cmd in every other
# mode (fork-ro, fork-rw, cache, local): there one client does both tiers'
# work with no in-flight deduplication, so a union would cost the sum of the
# tiers instead of the max. Exactly the union of the two member configs'
# lines above, with one tag filter naming both members' tags
# (scripts/bazel_dolt_int_test.go). Every other flag is the same in both
# members: the race build, tags=gms_pure_go,integration, keep_going,
# test_summary, the eternal 1200s timeout, GO_TEST_WRAP_TESTV=1,
# -test.parallel=4, local_test_jobs, remote_download_regex and
# norun_validations. So each member target's test action is unchanged in the
# sense that matters for caching (aquery: all 63 TestRunner actions' remote
# action digests are byte-identical, the key RBE's cache lookups use), though
# each action's local actionKey differs since these flags now reach the
# target via its own env/args rather than the member's build configuration.
# Cached results carry over both ways regardless.
# New for cmd-dolt here: --experimental_remote_cache_eviction_retries=0.
# server-storage already has it (above); cmd-dolt did not (it has no
# --config=sole-run of its own, unlike doltserver). Adding it to the union is
# stricter for cmd-dolt (no whole-invocation retry on a remote cache
# eviction) and policy-conformant with sole-run semantics; the eviction
# allowlist in pr_risk_bazel_coverage_test.go records the new line.
build:dolt-int --@rules_go//go/config:tags=gms_pure_go,integration
test:dolt-int --@rules_go//go/config:race
test:dolt-int --test_tag_filters=dolt-server-integration,dolt-server-cmd
test:dolt-int --build_tests_only
test:dolt-int --keep_going
test:dolt-int --test_summary=terse
test:dolt-int --test_timeout=-1,-1,-1,1200
test:dolt-int --test_env=GO_TEST_WRAP_TESTV=1
test:dolt-int --test_arg=-test.parallel=4
test:dolt-int --local_test_jobs=4
test:dolt-int --remote_download_regex=.*/test\.(log|xml)$
test:dolt-int --norun_validations
test:dolt-int --experimental_remote_cache_eviction_retries=0

# Integration lane: the `go test` main.yml's former "Main Linux integration"
# jobs ran on push (this lane replaced them, and nightly.yml's retired Full
# Test Suite, which ran the same `go test` over ./... in one job): every package
# built with -tags=integration,gms_pure_go, race, no -short, no -skip,
# BEADS_TEST_SKIP=dolt. The tag is set for the whole build, as `go test -tags`
# does, not per target: gazelle generates srcs/deps with integration files
# included (root BUILD.bazel `gazelle:build_tags`), rules_go drops them from
# every other configuration, and //internal/testutil/integration (integration
# files only) compiles to its real contents only here. A per-target `gotags`
# would not save the compile either: it transitions the whole dep graph.
build:integration --@rules_go//go/config:tags=gms_pure_go,integration
test:integration --@rules_go//go/config:race
test:integration --test_env=BEADS_TEST_SKIP=dolt
# The variants the PR-core lane leaves out stay out, except integration-only
# (targets with tests only under the tag): the jobs' BEADS_TEST_SKIP=dolt
# keeps every container- or server-backed test skipped, which is what the
# untagged base targets already do. scripts/bazel_policy_test.go derives the
# required exclusions from the PR-core list, so a new lane tag lands here too.
# pr-core-only targets (the historical-release suites: shell tests against
# the release-shaped bd, which the PR-core lane already runs) stay out too.
test:integration --test_tag_filters=-dolt-server,-dolt-server-proxied,-dolt-server-integration,-dolt-server-cmd,-embedded,-manual,-pr-core-only
test:integration --build_tests_only
test:integration --keep_going
test:integration --test_summary=terse
# The jobs pass no -p/-parallel: GOMAXPROCS on a 4-vCPU ubuntu-latest runner.
test:integration --test_arg=-test.parallel=4
# The jobs give each package binary -timeout=30m. rbe-west rejects an action
# timeout over 1200s, so every size gets 1200s, and Go's own -test.timeout (19m,
# after the 1200s rules_go derives from TEST_TIMEOUT: the last flag wins) fires
# first and dumps every goroutine to test.log, which Bazel's kill does not.
test:integration --test_timeout=1200
test:integration --test_arg=-test.timeout=19m
# The runner is not root, so TestAddExcludePatternsRefusesReadErrors runs
# there; make a root executor fail it rather than skip (as test:prcore does).
test:integration --test_env=BEADS_TEST_REQUIRE_EXCLUDE_PERMISSION=1
# -test.v in test.xml, as in test:ci, for tools/bazel/equivalence.py.
test:integration --test_env=GO_TEST_WRAP_TESTV=1
# ci and integration build into the same output directory (the tags flag
# does not change it), so they share bazel-testlogs: a lane's test.xml is
# overwritten by the other lane's next run of the same target. Run
# equivalence.py / check_testcases.py right after each lane's own
# `bazel test`, before the other lane runs (or give the lanes separate jobs).
test:integration --remote_download_regex=.*/test\.xml$
# F5 S2 Variant A: same configuration as --config=doltserver-integration /
# doltserver-cmd above; see that block's comment for the owner
# (bazel-integration's nogo-only step over //internal/testutil/integration).
# The 56 integration-tagged _test.go files this configuration no longer
# validates in any full lane are the accepted loss, listed in
# tools/nogo/unvalidated_integration_tests.txt.
test:integration --norun_validations

# Pure-Go lane: pr.yml's "Check pure-Go and js/wasm boundaries
# (CGO_ENABLED=0)" job. CGO is off for every Go target (rules_go drops
# cgo-constrained files like go build does; third_party/patches/
# gozstd_nocgo.patch lets dolt's store/nbs, an unused but declared dep,
# compile; its package init panics, so a pure binary that links it fails when
# run). bazel.yml builds bd and the job's pure test binaries, runs each of
# them once (the contamination check `go build` does at compile time) and runs
# its -short cmd/bd subset.
build:pure --@rules_go//go/config:pure
test:pure --test_arg=-test.short
# The job passes no -parallel: GOMAXPROCS on a 4-vCPU runner.
test:pure --test_arg=-test.parallel=4
test:pure --test_env=GO_TEST_WRAP_TESTV=1
test:pure --remote_download_regex=.*/test\.xml$

# js/wasm hook boundary (same job): build for GOOS=js GOARCH=wasm. Bazel
# cannot run the wasm test binary itself; bazel.yml runs it with the Go SDK's
# go_js_wasm_exec (node), like `go test -exec`. The test toolchain needs an
# exec platform matching the target platform, hence
# --use_target_platform_for_tests (no test action runs under this config).
build:js-wasm --platforms=@rules_go//go/toolchain:js_wasm
build:js-wasm --use_target_platform_for_tests
build:js-wasm --remote_download_outputs=toplevel

# nogo (//tools/nogo: go test's vet checks plus the golangci-lint linters
# .golangci.yml enables) runs beside every Go compile, so `bazel build`/
# `bazel test` fails on a finding -- in bazel.yml's one validating (owner)
# lane per configuration (since F5 S1: a race-group non-owner lane reuses
# its owner's nogo results instead of re-running them; see
# scripts/nogo_lint_policy_test.go's nogoConfigurations table).
# --config=nogo asks for the analysis alone (the nogo_fix output group;
# nothing is linked), in the race configuration bazel.yml's unit lane
# (test:ci) builds, so a local run reuses CI's remote cache. make lint,
# scripts/pr-lint and the pre-commit hook use it.
build:nogo --@rules_go//go/config:race
build:nogo --keep_going
build:nogo --output_groups=nogo_fix
# The same analyzers over the files only other platforms compile
# (//go:build windows, darwin, !linux ...): scripts/pr-lint builds
# //tools/bazel:release_cross, every go_library and go_binary split-transitioned
# to rules_go's non-cgo platforms, for its windows/amd64 and darwin/arm64
# passes (golangci-lint's former GOOS=windows/darwin legs). bazel.yml's pure
# lane builds the same target for every release platform, which validates
# nogo there too.
build:nogo-cross --keep_going
build:nogo-cross --output_groups=nogo_fix

# D2 step 3: bazel.yml's bazel-test, bazel-pure and bazel-doltserver lanes
# add this in the remote modes, where (on same-repo PRs and merge groups)
# they are the only pre-merge run of pr.yml's legacy PR Core,
# pure-Go/js-wasm, domain+uow and contract corpus jobs, which never retried.
# Like the retired PR Risk tiers' configs: no whole-invocation retry after
# a remote cache eviction ("Lost inputs"), whose exit code outranks a test
# failure, so a test that failed in the first attempt and passed in the
# retry would report green.
test:sole-run --experimental_remote_cache_eviction_retries=0

# Test result caching. Every lane caches its test results (read and write;
# Bazel's default): a test whose action key (test binary, runfiles, test env,
# platform) is unchanged reuses the PASS the farm recorded for it, on a PR
# (any attempt), a merge group or a push to main, so only what a change
# touched runs. Why that is safe:
#  - Identical key, identical test: these targets are hermetic (dolt and
#    every input are runfiles).
#  - A cached failure is never reused: Bazel treats a failed cached action
#    as a miss, so whatever failed re-runs.
#  - Only rbe-west's workers write the action cache (clients' writes are
#    refused), so a cached PASS is a real remote execution, not a client
#    upload.
#  - What is given up is re-sampling a nondeterministic (-race, timing)
#    test on unchanged inputs. nightly.yml passes fresh-test-results: true,
#    so bazel.yml appends this config last to every `bazel test` and the
#    whole suite re-executes once a night.
#  - No retries: --experimental_remote_cache_eviction_retries=0 (the
#    retired tiers' configs and sole-run) and no flaky attempts anywhere.
# Policy: scripts/ci_merge_queue_test.go.
test:fresh --nocache_test_results

# Read-only anonymous cache for fork PRs: rbe-west's rbe-cache endpoint serves
# action-cache and CAS reads only (writes and Execute are refused by the farm)
# and needs no credentials, so it is committed (scripts/bazel_policy_test.go
# allowlists exactly the two endpoint lines). bazel.yml's rbe job selects it
# (mode "cache") for fork pull requests; setup-bazel adds --config=fork-cache.
# Only non-key flags differ from trusted runs, so fork actions hash like the
# trusted ones and hit what trusted CI executed.
build:fork-cache --remote_cache=grpcs://rbe-cache.ops.gascity.com:8443
build:fork-cache --remote_instance_name=oss
build:fork-cache --remote_accept_cached
build:fork-cache --noremote_upload_local_results
# bazel.yml passes --build_event_json_file and --profile; with a remote cache
# Bazel would upload the files the build events reference (test logs, the
# profile) over ByteStream. Fork runs upload nothing.
build:fork-cache --experimental_build_event_upload_strategy=local
build:fork-cache --remote_download_minimal
# If the farm closes the endpoint (kill switch) GetCapabilities fails, and
# Bazel 9 then fails every action unless both of these are set.
build:fork-cache --remote_local_fallback
build:fork-cache --incompatible_remote_local_fallback_for_remote_cache
# Lookups are network-bound; local CPU work is still bounded by --local_resources.
build:fork-cache --jobs=64
# A slow (not closed) endpoint: each lookup gives up after 15s per attempt,
# and the failure-rate circuit breaker stops calling the endpoint once too
# many lookups fail (Bazel's default: 10% within 60s); the rest run locally.
build:fork-cache --remote_timeout=15
build:fork-cache --remote_retries=2
build:fork-cache --experimental_circuit_breaker_strategy=failure
# The farm admits 16 connections per source IP.
build:fork-cache --remote_max_connections=8
# No --remote_cache_compression here: setup-bazel's write-bazelrc.sh adds it
# for fork-cache while rbe-cache advertises zstd (cache-zstd-probe.sh), so the
# server decides and rollback needs no change here.

# Remote execution against any REAPI-compatible service. Only generic tuning
# lives here; the executor endpoint and TLS credentials are never committed.
# Developers put them in a gitignored user.bazelrc or .bazelrc.local; CI writes
# a generated rc outside the workspace and passes it with --bazelrc.
build:remote-exec --jobs=64
build:remote-exec --remote_download_minimal
build:remote-exec --remote_timeout=600
build:remote-exec --remote_retries=3
# Upload only remotely executed results. A locally executed action (a
# no-remote-exec test, whose result depends on the host) must not seed the
# shared cache that CI and every other developer read.
build:remote-exec --noremote_upload_local_results

try-import %workspace%/.bazelrc.local
try-import %workspace%/user.bazelrc