chore(bazel): remove references to the decommissioned remote cache#435
Open
balajinvda wants to merge 4 commits into
Open
chore(bazel): remove references to the decommissioned remote cache#435balajinvda wants to merge 4 commits into
balajinvda wants to merge 4 commits into
Conversation
The internal Buildbarn host was retired, but it was still referenced in nine files. The per-service .bazel-remote-probe scripts defaulted NVCF_BAZEL_REMOTE_HOST to it, so an unset variable pointed the probe at a dead host rather than cleanly disabling the cache. - Probe scripts (6): no default host. An unset NVCF_BAZEL_REMOTE_HOST now disables the cache and builds local-only, which is the safe fallback the scripts already document. No new endpoint is hardcoded in its place; the caller supplies it, matching the root .bazelrc. - nvsnap/.bazelrc: drop the dead endpoint from the :remote profile; the profile keeps only policy and tuning flags. - byoo README, grpc-proxy geo BUILD.bazel: comment references. While in the geo BUILD.bazel comment, corrected a factual error: it claimed does NOT bypass result caching. It does. is the union of no-sandbox, no-remote-exec and no-cache. The same misconception is what kept byoo-otel-collector recompiling on every CI run. Co-authored-by: Balaji Ganesan <bganesan@nvidia.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (7)
🚧 Files skipped from review as they are similar to previous changes (6)
📝 WalkthroughWalkthroughRemote-cache probes across service components now require an explicit host alongside the enable flag. The hardcoded nvsnap endpoint was removed, Bazel cache behavior documentation was updated, and a CI test validates probe behavior across configured and disabled scenarios. ChangesRemote Cache Configuration
Estimated code review effort: 3 (Moderate) | ~20 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/compute-plane-services/ess-agent/scripts/.bazel-remote-probe`:
- Around line 20-31: Add a reusable source-level behavioral test with a stubbed
grpcurl that exercises the shared remote-cache gate for an unset host, disabled
remote caching, and a configured host, then run it against all six
.bazel-remote-probe scripts:
src/compute-plane-services/ess-agent/scripts/.bazel-remote-probe (20-31),
src/compute-plane-services/nvca/scripts/.bazel-remote-probe (19-29),
src/control-plane-services/function-autoscaler/scripts/.bazel-remote-probe
(20-31), src/control-plane-services/helm-reval/scripts/.bazel-remote-probe
(18-29),
src/invocation-plane-services/http-invocation/scripts/.bazel-remote-probe
(20-31), and
src/invocation-plane-services/llm-api-gateway/scripts/.bazel-remote-probe
(20-31). Verify each probe’s host and remote-enabled gate produces the expected
behavior, and run the repository-native test runner.</code>
In `@src/invocation-plane-services/grpc-proxy/proxy/geo/BUILD.bazel`:
- Around line 77-80: Correct the comment describing local = True in the relevant
Bazel test configuration: state that it forces local unsandboxed execution and
disables remote execution, but does not disable all caching. Keep the
explanation that the external tag prevents Bazel from reusing cached test
results, and retain the requires-docker note.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 5a518dbf-60c3-427f-9e52-5eac44c08098
📒 Files selected for processing (9)
src/compute-plane-services/byoo-otel-collector/README.mdsrc/compute-plane-services/ess-agent/scripts/.bazel-remote-probesrc/compute-plane-services/nvca/scripts/.bazel-remote-probesrc/compute-plane-services/nvsnap/.bazelrcsrc/control-plane-services/function-autoscaler/scripts/.bazel-remote-probesrc/control-plane-services/helm-reval/scripts/.bazel-remote-probesrc/invocation-plane-services/grpc-proxy/proxy/geo/BUILD.bazelsrc/invocation-plane-services/http-invocation/scripts/.bazel-remote-probesrc/invocation-plane-services/llm-api-gateway/scripts/.bazel-remote-probe
The byoo-otel-collector subtree has a version gate that requires bumping its VERSION file whenever ANY file under the subtree changes, with no exemption for documentation. Bumping the collector's version to fix a one-word comment would cut a spurious release, so leave that reference for the next byoo change that bumps VERSION for a real reason. All functional references are still removed; the remaining one is a single prose mention in a README. Co-authored-by: Balaji Ganesan <bganesan@nvidia.com>
Two review findings. Behavioral tests. bash -n only checks syntax, and this PR changed what the probes decide, not just how they parse. Add tools/ci/test-bazel-remote-probe: it sources every subtree probe with a stubbed grpcurl (no network) and asserts the enable/disable decision across four cases: host unset, remote explicitly off, host configured, and TLS requested without a CA pem. Six probes, four cases each. The host-unset case deliberately sets NVCF_BAZEL_REMOTE_TLS=0. Without that it was vacuous: with TLS on, an unset CA pem also disables the cache, so the case passed even with the old default host restored. Verified by reintroducing the old default on one probe, confirming the test then fails, and restoring it. Comment accuracy. The geo BUILD.bazel comment equated with disabling all caching. Measured on Bazel 9.1.1 with a scratch workspace: a genrule re-executes after a clean against a warm disk cache while an otherwise identical no-sandbox + no-remote-exec genrule reports a disk cache hit. So does stop disk/remote reuse, but it is not a blanket no-cache: the tag is what prevents reusing a cached test result. Comment now says exactly that. Co-authored-by: Balaji Ganesan <bganesan@nvidia.com>
balajinvda
added a commit
that referenced
this pull request
Jul 25, 2026
The README still described the genrule as using local = True and claimed remote-cache reuse via the decommissioned internal cache. Both are now wrong: the tags are no-sandbox + no-remote-exec, the action is cache-eligible, and the host Go toolchain is bound into the action key via --action_env so a compiler bump cannot serve stale binaries. VERSION 0.157.0 -> 0.157.1. The subtree has a gate requiring a VERSION bump whenever any file under it changes, and this PR necessarily changes otelcol/BUILD.bazel. Patch-level only, so the major/minor stays in lockstep with the collector version in otel-collector-build.yaml, which the gate also cross-checks. The produced binary is unchanged in content; only how it is built and cached changes. This also clears the last reference to the retired cache host, which #435 had to leave in place precisely because that PR could not justify a VERSION bump for a comment-only edit. Co-authored-by: Balaji Ganesan <bganesan@nvidia.com>
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tools/ci/test-bazel-remote-probe`:
- Around line 31-35: Update the probe execution in the test script so
source/runtime failures are not suppressed: remove the unconditional success
fallback and preserve the command’s non-zero exit status while retaining the
intentional empty-output behavior for disabled configurations. Ensure check()
can distinguish a failed probe from a valid disabled result and reports the
failure.
- Around line 69-77: Add probe coverage in the test script for both CA-path
branches: add a readable CA with TLS enabled and assert the output includes the
corresponding --tls_certificate flag, then add a configured but nonexistent CA
path and assert the probe is disabled. Keep the existing tls-no-ca case and use
the established check/probe conventions and environment variables.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 5889ab5f-8610-48c3-9178-41cbc9c3247c
📒 Files selected for processing (2)
src/invocation-plane-services/grpc-proxy/proxy/geo/BUILD.bazeltools/ci/test-bazel-remote-probe
🚧 Files skipped from review as they are similar to previous changes (1)
- src/invocation-plane-services/grpc-proxy/proxy/geo/BUILD.bazel
Two review findings, and the first exposed a real defect in the probes. The test discarded stderr and forced success, so a probe that CRASHED was indistinguishable from one that deliberately disabled the cache, and every disabled-case assertion would pass on a broken script. It now captures the exit status separately and fails on any non-zero exit, printing the probe's stderr. That immediately surfaced a bug: the probes guarded the TLS path with -z BAZEL_REMOTE_CA_PEM, which only catches an unset variable. A variable set to a path that does not exist fell through to the below and failed the job instead of cleanly declining the cache. The guard is now -r, covering unset and unreadable alike, and the message reports the offending path. Added the two missing cases: TLS with a readable CA pem (the success path that emits --tls_certificate, previously uncovered, asserted to produce both grpcs:// and the certificate flag so a silent downgrade to plaintext cannot pass), and TLS with an unreadable CA path. Six probes, six cases. Every assertion is backed by a negative control, each verified to fail when the defect is reintroduced: dead default host restored, CA guard reverted to -z, TLS downgraded to plaintext, and a probe that exits non-zero. Co-authored-by: Balaji Ganesan <bganesan@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The internal Buildbarn host was retired, but nine files still referenced it. The important one is not cosmetic: the per-service
.bazel-remote-probescripts defaultedNVCF_BAZEL_REMOTE_HOSTto that host, so an unset variable pointed the probe at a dead endpoint instead of cleanly disabling the cache.What changed
NVCF_BAZEL_REMOTE_HOSTnow disables the cache and builds local-only, which is the safe fallback these scripts already document. No replacement endpoint is hardcoded; the caller supplies it, matching the root.bazelrc.nvsnap/.bazelrc: drop the dead endpoint from the:remoteprofile, leaving only policy and tuning flags.byoo-otel-collector/README.mdandgrpc-proxy/proxy/geo/BUILD.bazel: comment references.There are now zero references to the retired host in the repository.
While editing the geo
BUILD.bazelcomment, corrected a factual error. It claimedlocal = True"does NOT bypass result caching". It does:localis the union ofno-sandbox,no-remote-exec, andno-cache. That same misconception is what kept byoo-otel-collector recompiling on every CI run instead of hitting the remote cache. Only the comment changed here; the target's tags are untouched.Customer Release Notes
Not customer visible.
Testing
All six probe scripts pass
bash -n. The behavior change is fail-safe by construction: previously an unset host produced a probe against a dead endpoint, now it produces a local-only build.Notes
Not included, deliberately. This branch originally also synced every subtree
.bazelversionto the root's 9.1.1. Local validation showed that is a migration, not a file edit, so it was dropped:nats-auth-callout(Go) on 9.1.1:name 'sh_test' is not defined. Bazel 9 removedsh_testfrom the built-in globals; it needs an explicitload()plus arules_shelldependency.ratelimiter(Rust) on 9.1.1:protoc version does not match protobuf Bazel module.Two of two sampled subtrees fail, for two different reasons, so converging the 15 subtrees currently on 8.6.0 up to the root's 9.1.1 needs per-subtree work and belongs in its own tracked effort. The separate float bug (four worker subtrees carrying no
.bazelversionat all, so their release builds resolve whatever bazelisk considers latest) is fixed in #433.References
Follows the root-level cleanup in #399.
Related Merge Requests/Pull Requests
#433 (pins the four worker subtrees that ship no
.bazelversion).Dependencies
None.
Summary by CodeRabbit
Bug Fixes
Tests
.bazel-remote-probescripts across host/TLS/CA scenarios and asserts the resultingBAZEL_REMOTE_FLAGS.