From a9f75e5cda2d6ff469a859baf8d2f50b9b04944a Mon Sep 17 00:00:00 2001 From: Michael Bolin Date: Thu, 23 Apr 2026 15:28:00 -0700 Subject: [PATCH] ci: derive cache-stable Windows Bazel PATH (#19161) ## Why The BuildBuddy runs for PR #19086 and the later `main` build had the same source tree, but their Windows Bazel action and test cache keys did not line up. Comparing the downloaded execution logs showed the full GitHub-hosted Windows runner `PATH` had changed from `apache-maven-3.9.14` to `apache-maven-3.9.15`. This repo is not using Maven; the Maven entry was just ambient hosted-runner state. The problem was that Windows Bazel CI was still forwarding the whole runner `PATH` into Bazel via `--action_env=PATH`, `--host_action_env=PATH`, and `--test_env=PATH`, which made otherwise reusable cache entries sensitive to unrelated runner image churn. After discussion with the Bazel and BuildBuddy folks, the better shape for this change was to stop asking Bazel to inherit the ambient Windows `PATH` and instead compute one explicit cache-stable `PATH` in the Windows setup action that already prepares the CI toolchain environment. ## What - remove Windows `PATH` passthrough from `.bazelrc` - export `CODEX_BAZEL_WINDOWS_PATH` from `.github/actions/setup-bazel-ci/action.yml` - move the PATH derivation logic into `.github/scripts/compute-bazel-windows-path.ps1` so the allow-list is easier to review and document - keep only the Windows tool locations these Bazel jobs actually need: MSVC and SDK paths, Git, PowerShell, Node, DotSlash, and the standard Windows system directories - update `.github/scripts/run-bazel-ci.sh` to require that explicit value and forward it to Bazel action, host action, and test environments - log the derived `CODEX_BAZEL_WINDOWS_PATH` in the setup step to simplify cache-key debugging ## Verification - `bash -n .github/scripts/run-bazel-ci.sh` - `ruby -e 'require "yaml"; YAML.load_file(ARGV[0])' .github/actions/setup-bazel-ci/action.yml` - PowerShell parse check for `.github/scripts/compute-bazel-windows-path.ps1` - simulated a representative Windows `PATH` in PowerShell; the allow-list retained MSVC, Git, PowerShell, Node, Windows, and DotSlash entries while dropping Maven --- .bazelrc | 1 - .github/actions/setup-bazel-ci/action.yml | 5 + .../scripts/compute-bazel-windows-path.ps1 | 105 ++++++++++++++++++ .github/scripts/run-bazel-ci.sh | 12 +- 4 files changed, 121 insertions(+), 2 deletions(-) create mode 100644 .github/scripts/compute-bazel-windows-path.ps1 diff --git a/.bazelrc b/.bazelrc index 30d9ad9d3..76f81ade4 100644 --- a/.bazelrc +++ b/.bazelrc @@ -29,7 +29,6 @@ common:linux --test_env=PATH=/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin common:macos --test_env=PATH=/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin # Pass through some env vars Windows needs to use powershell? -common:windows --test_env=PATH common:windows --test_env=SYSTEMROOT common:windows --test_env=COMSPEC common:windows --test_env=WINDIR diff --git a/.github/actions/setup-bazel-ci/action.yml b/.github/actions/setup-bazel-ci/action.yml index 7c605c60b..008e87c49 100644 --- a/.github/actions/setup-bazel-ci/action.yml +++ b/.github/actions/setup-bazel-ci/action.yml @@ -122,6 +122,11 @@ runs: } } + - name: Compute cache-stable Windows Bazel PATH + if: runner.os == 'Windows' + shell: pwsh + run: ./.github/scripts/compute-bazel-windows-path.ps1 + - name: Enable Git long paths (Windows) if: runner.os == 'Windows' shell: pwsh diff --git a/.github/scripts/compute-bazel-windows-path.ps1 b/.github/scripts/compute-bazel-windows-path.ps1 new file mode 100644 index 000000000..6b6bbe046 --- /dev/null +++ b/.github/scripts/compute-bazel-windows-path.ps1 @@ -0,0 +1,105 @@ +<# +BuildBuddy cache keys include the action and test environment, so Bazel should +not inherit the full hosted-runner PATH on Windows. That PATH includes volatile +tool entries, such as Maven, that can change independently of this repo and +cause avoidable cache misses. + +This script derives a smaller, cache-stable PATH that keeps the Windows +toolchain entries Bazel-backed CI tasks need: MSVC and Windows SDK paths, Git, +PowerShell, Node, Python, DotSlash, and the standard Windows system +directories. +`setup-bazel-ci` runs this after exporting the MSVC environment, and the script +publishes the result via `GITHUB_ENV` as `CODEX_BAZEL_WINDOWS_PATH` so later +steps can pass that explicit PATH to Bazel. +#> + +$stablePathEntries = New-Object System.Collections.Generic.List[string] +$seenEntries = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase) +$windowsAppsPath = if ([string]::IsNullOrWhiteSpace($env:LOCALAPPDATA)) { + $null +} else { + "$($env:LOCALAPPDATA)\Microsoft\WindowsApps" +} +$windowsDir = if ($env:WINDIR) { + $env:WINDIR +} elseif ($env:SystemRoot) { + $env:SystemRoot +} else { + $null +} + +function Add-StablePathEntry { + param([string]$PathEntry) + + if ([string]::IsNullOrWhiteSpace($PathEntry)) { + return + } + + if ($seenEntries.Add($PathEntry)) { + [void]$stablePathEntries.Add($PathEntry) + } +} + +foreach ($pathEntry in ($env:PATH -split ';')) { + if ([string]::IsNullOrWhiteSpace($pathEntry)) { + continue + } + + if ( + $pathEntry -like '*Microsoft Visual Studio*' -or + $pathEntry -like '*Windows Kits*' -or + $pathEntry -like '*Microsoft SDKs*' -or + $pathEntry -like 'C:\Program Files\Git\*' -or + $pathEntry -like 'C:\Program Files\PowerShell\*' -or + $pathEntry -like 'C:\hostedtoolcache\windows\node\*' -or + $pathEntry -like 'C:\hostedtoolcache\windows\Python\*' -or + $pathEntry -eq 'D:\a\_temp\install-dotslash\bin' -or + ($windowsDir -and ($pathEntry -eq $windowsDir -or $pathEntry -like "${windowsDir}\*")) + ) { + Add-StablePathEntry $pathEntry + } +} + +$gitCommand = Get-Command git -ErrorAction SilentlyContinue +if ($gitCommand) { + Add-StablePathEntry (Split-Path $gitCommand.Source -Parent) +} + +$nodeCommand = Get-Command node -ErrorAction SilentlyContinue +if ($nodeCommand) { + Add-StablePathEntry (Split-Path $nodeCommand.Source -Parent) +} + +$python3Command = Get-Command python3 -ErrorAction SilentlyContinue +if ($python3Command) { + Add-StablePathEntry (Split-Path $python3Command.Source -Parent) +} + +$pythonCommand = Get-Command python -ErrorAction SilentlyContinue +if ($pythonCommand) { + Add-StablePathEntry (Split-Path $pythonCommand.Source -Parent) +} + +$pwshCommand = Get-Command pwsh -ErrorAction SilentlyContinue +if ($pwshCommand) { + Add-StablePathEntry (Split-Path $pwshCommand.Source -Parent) +} + +if ($windowsAppsPath) { + Add-StablePathEntry $windowsAppsPath +} + +if ($stablePathEntries.Count -eq 0) { + throw 'Failed to derive cache-stable Windows PATH.' +} + +if ([string]::IsNullOrWhiteSpace($env:GITHUB_ENV)) { + throw 'GITHUB_ENV must be set.' +} + +$stablePath = $stablePathEntries -join ';' +Write-Host 'Derived CODEX_BAZEL_WINDOWS_PATH entries:' +foreach ($pathEntry in $stablePathEntries) { + Write-Host " $pathEntry" +} +"CODEX_BAZEL_WINDOWS_PATH=$stablePath" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append diff --git a/.github/scripts/run-bazel-ci.sh b/.github/scripts/run-bazel-ci.sh index e5376a812..cf2d4ce34 100755 --- a/.github/scripts/run-bazel-ci.sh +++ b/.github/scripts/run-bazel-ci.sh @@ -306,7 +306,6 @@ if [[ "${RUNNER_OS:-}" == "Windows" ]]; then INCLUDE LIB LIBPATH - PATH UCRTVersion UniversalCRTSdkDir VCINSTALLDIR @@ -323,6 +322,17 @@ if [[ "${RUNNER_OS:-}" == "Windows" ]]; then post_config_bazel_args+=("--action_env=${env_var}" "--host_action_env=${env_var}") fi done + + if [[ -z "${CODEX_BAZEL_WINDOWS_PATH:-}" ]]; then + echo "CODEX_BAZEL_WINDOWS_PATH must be set for Windows Bazel CI." >&2 + exit 1 + fi + + post_config_bazel_args+=( + "--action_env=PATH=${CODEX_BAZEL_WINDOWS_PATH}" + "--host_action_env=PATH=${CODEX_BAZEL_WINDOWS_PATH}" + "--test_env=PATH=${CODEX_BAZEL_WINDOWS_PATH}" + ) fi bazel_console_log="$(mktemp)"