build: migrate argument-comment-lint to a native Bazel aspect (#16106)

## Why `argument-comment-lint` had become a PR bottleneck because the repo-wide lane was still effectively running a `cargo dylint`-style flow across the workspace instead of reusing Bazel's Rust dependency graph. That kept the lint enforced, but it threw away the main benefit of moving this job under Bazel in the first place: metadata reuse and cacheable per-target analysis in the same shape as Clippy. This change moves the repo-wide lint onto a native Bazel Rust aspect so Linux and macOS can lint `codex-rs` without rebuilding the world crate-by-crate through the wrapper path. ## What Changed - add a nightly Rust toolchain with `rustc-dev` for Bazel and a dedicated crate-universe repo for `tools/argument-comment-lint` - add `tools/argument-comment-lint/driver.rs` and `tools/argument-comment-lint/lint_aspect.bzl` so Bazel can run the lint as a custom `rustc_driver` - switch repo-wide `just argument-comment-lint` and the Linux/macOS `rust-ci` lanes to `bazel build --config=argument-comment-lint //codex-rs/...` - keep the Python/DotSlash wrappers as the package-scoped fallback path and as the current Windows CI path - gate the Dylint entrypoint behind a `bazel_native` feature so the Bazel-native library avoids the `dylint_*` packaging stack - update the aspect runtime environment so the driver can locate `rustc_driver` correctly under remote execution - keep the dedicated `tools/argument-comment-lint` package tests and wrapper unit tests in CI so the source and packaged entrypoints remain covered ## Verification - `python3 -m unittest discover -s tools/argument-comment-lint -p 'test_*.py'` - `cargo test` in `tools/argument-comment-lint` - `bazel build //tools/argument-comment-lint:argument-comment-lint-driver --@rules_rust//rust/toolchain/channel=nightly` - `bazel build --config=argument-comment-lint //codex-rs/utils/path-utils:all` - `bazel build --config=argument-comment-lint //codex-rs/rollout:rollout` --- [//]: # (BEGIN SAPLING FOOTER) Stack created with [Sapling](https://sapling-scm.com). Best reviewed with [ReviewStack](https://reviewstack.dev/openai/codex/pull/16106). * #16120 * __->__ #16106
2026-07-01 00:31:56 +08:00 · 2026-03-28 12:41:56 -07:00
parent 65f631c3d6
commit fce0f76d57
18 changed files with 525 additions and 51 deletions
@@ -77,6 +77,11 @@ build:clippy --aspects=@rules_rust//rust:defs.bzl%rust_clippy_aspect
 build:clippy --output_groups=+clippy_checks
 build:clippy --@rules_rust//rust/settings:clippy.toml=//codex-rs:clippy.toml

+# Shared config for Bazel-backed argument-comment-lint.
+build:argument-comment-lint --aspects=//tools/argument-comment-lint:lint_aspect.bzl%rust_argument_comment_lint_aspect
+build:argument-comment-lint --output_groups=argument_comment_lint_checks
+build:argument-comment-lint --@rules_rust//rust/toolchain/channel=nightly
+
 # Rearrange caches on Windows so they're on the same volume as the checkout.
 common:ci-windows --config=ci-bazel
 common:ci-windows --build_metadata=TAG_os=windows
@@ -57,9 +57,11 @@ runs:
      if: runner.os == 'Windows'
      shell: pwsh
      run: |
-        # Use a very short path to reduce argv/path length issues, but avoid the
-        # drive root because some Windows test launchers mis-handle MANIFEST paths there.
-        "BAZEL_OUTPUT_USER_ROOT=D:\b" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+        # Use the shortest available drive to reduce argv/path length issues,
+        # but avoid the drive root because some Windows test launchers mis-handle
+        # MANIFEST paths there.
+        $bazelOutputUserRoot = if (Test-Path 'D:\') { 'D:\b' } else { 'C:\b' }
+        "BAZEL_OUTPUT_USER_ROOT=$bazelOutputUserRoot" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append

    - name: Enable Git long paths (Windows)
      if: runner.os == 'Windows'
@@ -81,6 +81,7 @@ jobs:
            --use-node-test-env \
            -- \
            test \
+            --test_tag_filters=-argument-comment-lint \
            --test_verbose_timeout_warnings \
            --build_metadata=COMMIT_SHA=${GITHUB_SHA} \
            -- \
@@ -98,6 +99,7 @@ jobs:
          key: bazel-cache-${{ matrix.target }}-${{ hashFiles('MODULE.bazel', 'codex-rs/Cargo.lock', 'codex-rs/Cargo.toml') }}

  clippy:
+    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
@@ -73,6 +73,7 @@ jobs:
  argument_comment_lint_prebuilt:
    name: Argument comment lint - ${{ matrix.name }}
    runs-on: ${{ matrix.runs_on || matrix.runner }}
+    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
@@ -88,29 +89,27 @@ jobs:
              labels: codex-windows-x64
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: ./.github/actions/setup-bazel-ci
+        with:
+          target: ${{ runner.os }}
+          install-test-prereqs: true
      - name: Install Linux sandbox build dependencies
        if: ${{ runner.os == 'Linux' }}
        shell: bash
        run: |
          sudo DEBIAN_FRONTEND=noninteractive apt-get update
          sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends pkg-config libcap-dev
-      - uses: dtolnay/rust-toolchain@a0b273b48ed29de4470960879e8381ff45632f26 # 1.93.0
-        with:
-          toolchain: nightly-2025-09-18
-          components: llvm-tools-preview, rustc-dev, rust-src
-      - uses: facebook/install-dotslash@1e4e7b3e07eaca387acb98f1d4720e0bee8dbb6a # v2
-      - name: Run argument comment lint on codex-rs
-        if: ${{ runner.os == 'macOS' }}
+      - name: Run argument comment lint on codex-rs via Bazel
        shell: bash
-        run: python3 ./tools/argument-comment-lint/run-prebuilt-linter.py
-      - name: Run argument comment lint on codex-rs (default targets only)
-        if: ${{ runner.os == 'Linux' }}
-        shell: bash
-        run: python3 ./tools/argument-comment-lint/run-prebuilt-linter.py -- --lib --bins
-      - name: Run argument comment lint on codex-rs
-        if: ${{ runner.os == 'Windows' }}
-        shell: bash
-        run: python ./tools/argument-comment-lint/run-prebuilt-linter.py
+        run: |
+          ./.github/scripts/run-bazel-ci.sh \
+            -- \
+            build \
+            --config=argument-comment-lint \
+            --keep_going \
+            --build_metadata=COMMIT_SHA=${GITHUB_SHA} \
+            -- \
+            //codex-rs/...

  # --- CI to validate on different os/targets --------------------------------
  lint_build:
@@ -93,9 +93,16 @@ jobs:
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: dtolnay/rust-toolchain@a0b273b48ed29de4470960879e8381ff45632f26 # 1.93.0
-        with:
-          toolchain: nightly-2025-09-18
-          components: llvm-tools-preview, rustc-dev, rust-src
+      - name: Install nightly argument-comment-lint toolchain
+        shell: bash
+        run: |
+          rustup toolchain install nightly-2025-09-18 \
+            --profile minimal \
+            --component llvm-tools-preview \
+            --component rustc-dev \
+            --component rust-src \
+            --no-self-update
+          rustup default nightly-2025-09-18
      - name: Cache cargo-dylint tooling
        id: cargo_dylint_cache
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
@@ -121,6 +128,7 @@ jobs:
  argument_comment_lint_prebuilt:
    name: Argument comment lint - ${{ matrix.name }}
    runs-on: ${{ matrix.runs_on || matrix.runner }}
+    timeout-minutes: ${{ matrix.timeout_minutes }}
    needs: changed
    if: ${{ needs.changed.outputs.argument_comment_lint == 'true' || needs.changed.outputs.workflows == 'true' }}
    strategy:
@@ -129,40 +137,57 @@ jobs:
        include:
          - name: Linux
            runner: ubuntu-24.04
+            timeout_minutes: 30
          - name: macOS
            runner: macos-15-xlarge
+            timeout_minutes: 30
          - name: Windows
            runner: windows-x64
+            timeout_minutes: 30
            runs_on:
              group: codex-runners
              labels: codex-windows-x64
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: ./.github/actions/setup-bazel-ci
+        with:
+          target: ${{ runner.os }}
+          install-test-prereqs: true
      - name: Install Linux sandbox build dependencies
        if: ${{ runner.os == 'Linux' }}
        shell: bash
        run: |
          sudo DEBIAN_FRONTEND=noninteractive apt-get update
          sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends pkg-config libcap-dev
-      - uses: dtolnay/rust-toolchain@a0b273b48ed29de4470960879e8381ff45632f26 # 1.93.0
-        with:
-          toolchain: nightly-2025-09-18
-          components: llvm-tools-preview, rustc-dev, rust-src
-      - uses: facebook/install-dotslash@1e4e7b3e07eaca387acb98f1d4720e0bee8dbb6a # v2
-      - name: Run argument comment lint on codex-rs
-        if: ${{ runner.os == 'macOS' }}
-        shell: bash
-        run: python3 ./tools/argument-comment-lint/run-prebuilt-linter.py
-      # Linux still uses the default-targets-only form for now, but PRs run the
-      # released linter on all three platforms so wrapper regressions surface pre-merge.
-      - name: Run argument comment lint on codex-rs (default targets only)
-        if: ${{ runner.os == 'Linux' }}
-        shell: bash
-        run: python3 ./tools/argument-comment-lint/run-prebuilt-linter.py -- --lib --bins
-      - name: Run argument comment lint on codex-rs
+      - name: Install nightly argument-comment-lint toolchain
        if: ${{ runner.os == 'Windows' }}
        shell: bash
-        run: python ./tools/argument-comment-lint/run-prebuilt-linter.py
+        run: |
+          rustup toolchain install nightly-2025-09-18 \
+            --profile minimal \
+            --component llvm-tools-preview \
+            --component rustc-dev \
+            --component rust-src \
+            --no-self-update
+          rustup default nightly-2025-09-18
+      - name: Run argument comment lint on codex-rs via Bazel
+        if: ${{ runner.os != 'Windows' }}
+        env:
+          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
+        shell: bash
+        run: |
+          ./.github/scripts/run-bazel-ci.sh \
+            -- \
+            build \
+            --config=argument-comment-lint \
+            --keep_going \
+            --build_metadata=COMMIT_SHA=${GITHUB_SHA} \
+            -- \
+            //codex-rs/...
+      - name: Run argument comment lint on codex-rs via packaged wrapper
+        if: ${{ runner.os == 'Windows' }}
+        shell: bash
+        run: python3 ./tools/argument-comment-lint/run-prebuilt-linter.py

  # --- Gatherer job that you mark as the ONLY required status -----------------
  results:
@@ -87,6 +87,17 @@ rules_rust.patch(
 )
 use_repo(rules_rust, "rules_rust")

+nightly_rust = use_extension(
+    "@rules_rs//rs/experimental:rules_rust_reexported_extensions.bzl",
+    "rust",
+)
+nightly_rust.toolchain(
+    versions = ["nightly/2025-09-18"],
+    dev_components = True,
+    edition = "2024",
+)
+use_repo(nightly_rust, "rust_toolchains")
+
 toolchains = use_extension("@rules_rs//rs/experimental/toolchains:module_extension.bzl", "toolchains")
 toolchains.toolchain(
    edition = "2024",
@@ -95,6 +106,7 @@ toolchains.toolchain(
 use_repo(toolchains, "default_rust_toolchains")

 register_toolchains("@default_rust_toolchains//:all")
+register_toolchains("@rust_toolchains//:all")

 crate = use_extension("@rules_rs//rs:extensions.bzl", "crate")
 crate.from_cargo(
@@ -117,6 +129,24 @@ crate.from_cargo(
    ],
    use_experimental_platforms = True,
 )
+crate.from_cargo(
+    name = "argument_comment_lint_crates",
+    cargo_lock = "//tools/argument-comment-lint:Cargo.lock",
+    cargo_toml = "//tools/argument-comment-lint:Cargo.toml",
+    platform_triples = [
+        "aarch64-unknown-linux-gnu",
+        "aarch64-unknown-linux-musl",
+        "aarch64-apple-darwin",
+        "aarch64-pc-windows-msvc",
+        "aarch64-pc-windows-gnullvm",
+        "x86_64-unknown-linux-gnu",
+        "x86_64-unknown-linux-musl",
+        "x86_64-apple-darwin",
+        "x86_64-pc-windows-msvc",
+        "x86_64-pc-windows-gnullvm",
+    ],
+    use_experimental_platforms = True,
+)

 bazel_dep(name = "zstd", version = "1.5.7")

@@ -136,7 +166,14 @@ crate.annotation(
    ],
 )

+crate.annotation(
+    # The build script only validates embedded source/version metadata.
+    crate = "rustc_apfloat",
+    gen_build_script = "off",
+)
+
 inject_repo(crate, "zstd")
+use_repo(crate, "argument_comment_lint_crates")

 bazel_dep(name = "bzip2", version = "1.0.8.bcr.3")

@@ -2,3 +2,17 @@ exports_files([
    "clippy.toml",
    "node-version.txt",
 ])
+
+filegroup(
+    name = "workspace-files",
+    srcs = glob(
+        [
+            "*",
+            ".cargo/**",
+        ],
+        exclude = [
+            "BUILD.bazel",
+        ],
+    ),
+    visibility = ["//visibility:public"],
+)
@@ -57,6 +57,9 @@ def _workspace_root_test_impl(ctx):
    )

    runfiles = ctx.runfiles(files = [test_bin, workspace_root_marker]).merge(ctx.attr.test_bin[DefaultInfo].default_runfiles)
+    for data_dep in ctx.attr.data:
+        runfiles = runfiles.merge(ctx.runfiles(files = data_dep[DefaultInfo].files.to_list()))
+        runfiles = runfiles.merge(data_dep[DefaultInfo].default_runfiles)

    return [
        DefaultInfo(
@@ -73,6 +76,9 @@ workspace_root_test = rule(
    implementation = _workspace_root_test_impl,
    test = True,
    attrs = {
+        "data": attr.label_list(
+            allow_files = True,
+        ),
        "env": attr.string_dict(),
        "test_bin": attr.label(
            cfg = "target",
@@ -157,10 +163,29 @@ def codex_rust_crate(
        "INSTA_SNAPSHOT_PATH": "src",
    }

+    native.filegroup(
+        name = "package-files",
+        srcs = native.glob(
+            ["**"],
+            exclude = [
+                "**/BUILD.bazel",
+                "BUILD.bazel",
+                "target/**",
+            ],
+            allow_empty = True,
+        ),
+        visibility = ["//visibility:public"],
+    )
+
    rustc_env = {
        "BAZEL_PACKAGE": native.package_name(),
    } | rustc_env

+    manifest_relpath = native.package_name()
+    if manifest_relpath.startswith("codex-rs/"):
+        manifest_relpath = manifest_relpath[len("codex-rs/"):]
+    manifest_path = manifest_relpath + "/Cargo.toml"
+
    binaries = DEP_DATA.get(native.package_name())["binaries"]

    lib_srcs = crate_srcs or native.glob(["src/**/*.rs"], exclude = binaries.values(), allow_empty = True)
@@ -67,13 +67,17 @@ bazel-lock-check:
    ./scripts/check-module-bazel-lock.sh

 bazel-test:
-    bazel test //... --keep_going
+    bazel test --test_tag_filters=-argument-comment-lint //... --keep_going

 bazel-clippy:
    bazel build --config=clippy -- //codex-rs/... -//codex-rs/v8-poc:all

+[no-cd]
+bazel-argument-comment-lint:
+    bazel build --config=argument-comment-lint -- //codex-rs/...
+
 bazel-remote-test:
-    bazel test //... --config=remote --platforms=//:rbe --keep_going
+    bazel test --test_tag_filters=-argument-comment-lint //... --config=remote --platforms=//:rbe --keep_going

 build-for-release:
    bazel build //codex-rs/cli:release_binaries --config=remote
@@ -97,7 +101,11 @@ write-hooks-schema:
 # Run the argument-comment Dylint checks across codex-rs.
 [no-cd]
 argument-comment-lint *args:
-    ./tools/argument-comment-lint/run-prebuilt-linter.py "$@"
+    if [ "$#" -eq 0 ]; then \
+      bazel build --config=argument-comment-lint -- //codex-rs/...; \
+    else \
+      ./tools/argument-comment-lint/run-prebuilt-linter.py "$@"; \
+    fi

 [no-cd]
 argument-comment-lint-from-source *args:
@@ -0,0 +1,32 @@
+load("@rules_rust//rust:defs.bzl", "rust_binary", "rust_library")
+
+exports_files(["lint_aspect.bzl"])
+
+rust_library(
+    name = "argument-comment-lint-lib",
+    crate_name = "argument_comment_lint",
+    crate_features = ["bazel_native"],
+    crate_root = "src/lib.rs",
+    srcs = [
+        "src/comment_parser.rs",
+        "src/lib.rs",
+    ],
+    edition = "2024",
+    deps = ["@argument_comment_lint_crates//:clippy_utils"],
+    tags = ["manual"],
+    visibility = ["//visibility:public"],
+)
+
+rust_binary(
+    name = "argument-comment-lint-driver",
+    crate_name = "argument_comment_lint_driver",
+    crate_root = "driver.rs",
+    srcs = ["driver.rs"],
+    edition = "2024",
+    deps = [
+        ":argument-comment-lint-lib",
+        "@zlib//:z",
+    ],
+    tags = ["manual"],
+    visibility = ["//visibility:public"],
+)
@@ -8,6 +8,9 @@ publish = false
 [lib]
 crate-type = ["cdylib"]

+[features]
+bazel_native = []
+
 [dependencies]
 clippy_utils = { git = "https://github.com/rust-lang/rust-clippy", rev = "20ce69b9a63bcd2756cd906fe0964d1e901e042a" }
 dylint_linting = "5.0.0"
@@ -85,9 +85,11 @@ rustup toolchain install nightly-2025-09-18 \

 The checked-in DotSlash file lives at `tools/argument-comment-lint/argument-comment-lint`.
 `run-prebuilt-linter.py` resolves that file via `dotslash` and is the path used by
-`just clippy`, `just argument-comment-lint`, and the Rust CI job. The
-source-build path remains available in `run.py` for people
-iterating on the lint crate itself.
+targeted package runs such as `just argument-comment-lint -p codex-core`.
+Repo-wide runs now go through a native Bazel aspect that invokes a custom
+`rustc_driver` and reuses Bazel-managed Rust dependency metadata instead of
+spawning `cargo dylint` once per crate. The source-build path remains available
+in `run.py` for people iterating on the lint crate itself.

 The Unix archive layout is:

@@ -126,15 +128,17 @@ If you are changing the lint crate itself, use the source-build wrapper:
 Run the lint against `codex-rs` from the repo root:

 ```bash
+just argument-comment-lint
+bazel build --config=argument-comment-lint -- //codex-rs/...
 ./tools/argument-comment-lint/run-prebuilt-linter.py -p codex-core
 just argument-comment-lint -p codex-core
 ```

-If no package selection is provided, `run-prebuilt-linter.py` defaults to checking the
-`codex-rs` workspace with `--workspace --no-deps`.
-For non-`--fix` runs, both wrappers also default the underlying Cargo
-invocation to `--all-targets` unless you explicitly narrow the target set, so
-workspace and package lint runs both cover test-only call sites by default.
+If no package selection is provided, `just argument-comment-lint` now defaults
+to the Bazel aspect path over `//codex-rs/...`. The Python wrappers remain the
+package-scoped escape hatch and still default the underlying Cargo invocation
+to `--all-targets` unless you explicitly narrow the target set, so targeted
+wrapper runs cover test-only call sites by default.

 Repo runs also promote `uncommented_anonymous_literal_argument` to an error by
 default:
@@ -0,0 +1,43 @@
+#![feature(rustc_private)]
+
+extern crate rustc_driver;
+extern crate rustc_interface;
+
+use std::env;
+use std::ffi::OsString;
+use std::path::Path;
+
+fn main() {
+    let mut callbacks = Callbacks;
+    let args = rustc_args(env::args_os().skip(1).collect());
+    rustc_driver::run_compiler(&args, &mut callbacks);
+}
+
+struct Callbacks;
+
+impl rustc_driver::Callbacks for Callbacks {
+    fn config(&mut self, config: &mut rustc_interface::Config) {
+        let previous = config.register_lints.take();
+        config.register_lints = Some(Box::new(move |sess, lint_store| {
+            if let Some(previous) = &previous {
+                previous(sess, lint_store);
+            }
+            argument_comment_lint::register_lints(sess, lint_store);
+        }));
+    }
+}
+
+fn rustc_args(args: Vec<OsString>) -> Vec<String> {
+    let mut rustc_args: Vec<String> = args
+        .into_iter()
+        .map(|arg| arg.to_string_lossy().into_owned())
+        .collect();
+    if rustc_args.first().is_none_or(|arg| !is_rustc(arg)) {
+        rustc_args.insert(0, "rustc".to_string());
+    }
+    rustc_args
+}
+
+fn is_rustc(arg: &str) -> bool {
+    Path::new(arg).file_stem().and_then(|stem| stem.to_str()) == Some("rustc")
+}
@@ -0,0 +1,187 @@
+"""Bazel aspect for running argument-comment-lint on Rust targets."""
+
+load("@rules_rust//rust:defs.bzl", "rust_common")
+load("@rules_rust//rust/private:rust.bzl", "RUSTC_ATTRS")
+load(
+    "@rules_rust//rust/private:rustc.bzl",
+    "collect_deps",
+    "collect_inputs",
+    "construct_arguments",
+)
+load(
+    "@rules_rust//rust/private:utils.bzl",
+    "determine_output_hash",
+    "find_cc_toolchain",
+    "find_toolchain",
+)
+
+_STRICT_LINT_FLAGS = [
+    "-Duncommented-anonymous-literal-argument",
+    "-Aunknown-lints",
+]
+
+def _find_rustc_driver_library(toolchain):
+    for file in toolchain.rustc_lib.to_list():
+        if file.basename.startswith("librustc_driver-") or file.basename.startswith("rustc_driver-"):
+            return file
+    return None
+
+def _prepend_runtime_path(env, key, path, separator):
+    previous = env.get(key)
+    env[key] = "{}{}{}".format(path, separator, previous) if previous else path
+
+def _set_driver_runtime_env(env, toolchain):
+    driver_library = _find_rustc_driver_library(toolchain)
+    if not driver_library:
+        return
+
+    library_dir = driver_library.dirname
+    if driver_library.basename.endswith(".dll"):
+        _prepend_runtime_path(env, "PATH", library_dir, ";")
+        return
+
+    # The lint driver runs in exec configuration. Under remote execution the
+    # exec OS can differ from the Rust target OS, so populate both Unix loader
+    # variables from the located driver library instead of keying off target_os.
+    _prepend_runtime_path(env, "LD_LIBRARY_PATH", library_dir, ":")
+    _prepend_runtime_path(env, "DYLD_LIBRARY_PATH", library_dir, ":")
+
+def _get_argument_comment_lint_ready_crate_info(target, aspect_ctx):
+    if target.label.workspace_root.startswith("external"):
+        return None
+
+    if aspect_ctx:
+        ignore_tags = [
+            "no_argument_comment_lint",
+            "no-lint",
+            "no_lint",
+            "nolint",
+        ]
+        for tag in aspect_ctx.rule.attr.tags:
+            if tag.replace("-", "_").lower() in ignore_tags:
+                return None
+
+    if rust_common.crate_info in target:
+        return target[rust_common.crate_info]
+    if rust_common.test_crate_info in target:
+        return target[rust_common.test_crate_info].crate
+    return None
+
+def _rust_argument_comment_lint_aspect_impl(target, ctx):
+    if OutputGroupInfo in target and hasattr(target[OutputGroupInfo], "argument_comment_lint_checks"):
+        return []
+
+    crate_info = _get_argument_comment_lint_ready_crate_info(target, ctx)
+    if not crate_info:
+        return []
+
+    toolchain = find_toolchain(ctx)
+    cc_toolchain, feature_configuration = find_cc_toolchain(ctx)
+
+    dep_info, build_info, _ = collect_deps(
+        deps = crate_info.deps.to_list(),
+        proc_macro_deps = crate_info.proc_macro_deps.to_list(),
+        aliases = crate_info.aliases,
+    )
+
+    compile_inputs, out_dir, build_env_files, build_flags_files, linkstamp_outs, ambiguous_libs = collect_inputs(
+        ctx,
+        ctx.rule.file,
+        ctx.rule.files,
+        depset([]),
+        toolchain,
+        cc_toolchain,
+        feature_configuration,
+        crate_info,
+        dep_info,
+        build_info,
+        [],
+    )
+
+    success_marker = ctx.actions.declare_file(
+        ctx.label.name + ".argument_comment_lint.ok",
+        sibling = crate_info.output,
+    )
+
+    args, env = construct_arguments(
+        ctx = ctx,
+        attr = ctx.rule.attr,
+        file = ctx.file,
+        toolchain = toolchain,
+        tool_path = ctx.executable._driver.path,
+        cc_toolchain = cc_toolchain,
+        feature_configuration = feature_configuration,
+        crate_info = crate_info,
+        dep_info = dep_info,
+        linkstamp_outs = linkstamp_outs,
+        ambiguous_libs = ambiguous_libs,
+        output_hash = determine_output_hash(crate_info.root, ctx.label),
+        rust_flags = [],
+        out_dir = out_dir,
+        build_env_files = build_env_files,
+        build_flags_files = build_flags_files,
+        emit = ["dep-info", "metadata"],
+        skip_expanding_rustc_env = True,
+    )
+
+    if crate_info.is_test:
+        args.rustc_flags.add("--test")
+
+    args.process_wrapper_flags.add("--touch-file", success_marker)
+    args.rustc_flags.add_all(_STRICT_LINT_FLAGS)
+    _set_driver_runtime_env(env, toolchain)
+
+    driver_runfiles = ctx.attr._driver[DefaultInfo].default_runfiles.files
+    action_inputs = depset(
+        transitive = [
+            compile_inputs,
+            driver_runfiles,
+            toolchain.rustc_lib,
+        ],
+    )
+
+    ctx.actions.run(
+        executable = ctx.executable._process_wrapper,
+        inputs = action_inputs,
+        outputs = [success_marker],
+        env = env,
+        tools = [ctx.executable._driver],
+        execution_requirements = {
+            "no-sandbox": "1",
+        },
+        arguments = args.all,
+        mnemonic = "ArgumentCommentLint",
+        progress_message = "ArgumentCommentLint %{label}",
+        toolchain = "@rules_rust//rust:toolchain_type",
+    )
+
+    return [OutputGroupInfo(argument_comment_lint_checks = depset([success_marker]))]
+
+rust_argument_comment_lint_aspect = aspect(
+    implementation = _rust_argument_comment_lint_aspect_impl,
+    fragments = ["cpp"],
+    attrs = {
+        "_driver": attr.label(
+            default = Label("//tools/argument-comment-lint:argument-comment-lint-driver"),
+            executable = True,
+            cfg = "exec",
+        ),
+    } | RUSTC_ATTRS,
+    toolchains = [
+        str(Label("@rules_rust//rust:toolchain_type")),
+        config_common.toolchain_type("@bazel_tools//tools/cpp:toolchain_type", mandatory = False),
+    ],
+    required_providers = [
+        [rust_common.crate_info],
+        [rust_common.test_crate_info],
+    ],
+    doc = """\
+Runs argument-comment-lint on Rust targets using Bazel's Rust dependency graph.
+
+Example:
+
+```output
+$ bazel build --config=argument-comment-lint //codex-rs/...
+```
+""",
+)
@@ -31,6 +31,7 @@ use rustc_span::Span;
 use crate::comment_parser::parse_argument_comment;
 use crate::comment_parser::parse_argument_comment_prefix;

+#[cfg(not(feature = "bazel_native"))]
 dylint_linting::dylint_library!();

 #[unsafe(no_mangle)]
@@ -83,6 +83,26 @@ class WrapperCommonTest(unittest.TestCase):
            ],
        )

+    def test_explicit_package_manifest_does_not_force_workspace(self) -> None:
+        parsed = wrapper_common.parse_wrapper_args(
+            [
+                "--manifest-path",
+                "/tmp/custom/Cargo.toml",
+            ]
+        )
+        final_args = wrapper_common.build_final_args(parsed, Path("/repo/codex-rs/Cargo.toml"))
+
+        self.assertEqual(
+            final_args,
+            [
+                "--no-deps",
+                "--manifest-path",
+                "/tmp/custom/Cargo.toml",
+                "--",
+                "--all-targets",
+            ],
+        )
+

 if __name__ == "__main__":
    unittest.main()
@@ -107,7 +107,7 @@ def build_final_args(parsed: ParsedWrapperArgs, manifest_path: Path) -> list[str

    if not parsed.has_manifest_path:
        final_args.extend(["--manifest-path", str(manifest_path)])
-    if not parsed.has_package_selection:
+    if not parsed.has_package_selection and not parsed.has_manifest_path:
        final_args.append("--workspace")
    if not parsed.has_no_deps:
        final_args.append("--no-deps")
@@ -205,6 +205,9 @@ def ensure_source_prerequisites(env: MutableMapping[str, str]) -> None:


 def prefer_rustup_shims(env: MutableMapping[str, str]) -> None:
+    if env.get("CODEX_ARGUMENT_COMMENT_LINT_SKIP_RUSTUP_SHIMS") == "1":
+        return
+
    rustup = shutil.which("rustup", path=env.get("PATH"))
    if rustup is None:
        return