From 231c8abd2f4f7e3e14aa3e54bcf8136435e6f2f3 Mon Sep 17 00:00:00 2001 From: Dmitriy Kovalenko Date: Sat, 31 Oct 2026 22:39:57 +0000 Subject: [PATCH] Make Bazel checks advisory and pause Bazel release artifacts (#58717) ## Why The BuildBuddy key is revoked. Temporarily keep Bazel-dependent checks from blocking CI and release only Cargo artifacts. ## What changed - Remove Bazel from the `blocking-ci` required dependencies. - Make the Bazel-backed argument comment lint and SDK jobs advisory, and stop requiring the lint job to succeed in the Rust CI results check. - Restrict release build and packaging matrices to Cargo, including Windows and provisioned macOS packages, and exclude Bazel binaries and symbols from release artifact downloads. GitOrigin-RevId: 2c0d23471bbd0ab2eb4d90d318b518d0b33db97f --- .github/workflows/blocking-ci.yml | 3 ++- .github/workflows/rust-ci.yml | 7 ++++--- .../workflows/rust-release-provisioned-macos.yml | 6 +++--- .github/workflows/rust-release-windows.yml | 8 ++++---- .github/workflows/rust-release.yml | 14 +++++++------- .github/workflows/sdk.yml | 3 +++ 6 files changed, 23 insertions(+), 18 deletions(-) diff --git a/.github/workflows/blocking-ci.yml b/.github/workflows/blocking-ci.yml index c6f00555a3..f1c4d764bb 100644 --- a/.github/workflows/blocking-ci.yml +++ b/.github/workflows/blocking-ci.yml @@ -50,8 +50,9 @@ jobs: # Without `always()`, GitHub skips this job after a failed dependency and a # required check can appear successful instead of reporting the failure. if: ${{ always() }} + # Bazel is advisory while the BuildBuddy key is revoked. Restore its dependency + # once the suite can run without BuildBuddy. needs: - - bazel - blob-size-policy - cargo-deny - codespell diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 101b126107..84cef8b9a1 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -163,6 +163,9 @@ jobs: argument_comment_lint_prebuilt: name: Argument comment lint - ${{ matrix.name }} + # This job runs through Bazel and is advisory while the BuildBuddy key is + # revoked. Restore blocking behavior once it can run without BuildBuddy. + continue-on-error: true runs-on: ${{ matrix.runs_on || matrix.runner }} timeout-minutes: ${{ matrix.timeout_minutes }} needs: changed @@ -248,9 +251,7 @@ jobs: [[ '${{ needs.argument_comment_lint_package.result }}' == 'success' ]] || { echo 'argument_comment_lint_package failed'; exit 1; } fi - if [[ "${NEEDS_CHANGED_OUTPUTS_ARGUMENT_COMMENT_LINT}" == 'true' || "${NEEDS_CHANGED_OUTPUTS_WORKFLOWS}" == 'true' ]]; then - [[ '${{ needs.argument_comment_lint_prebuilt.result }}' == 'success' ]] || { echo 'argument_comment_lint_prebuilt failed'; exit 1; } - fi + # The Bazel-backed argument-comment lint job is temporarily advisory. if [[ "${NEEDS_CHANGED_OUTPUTS_CODEX}" == 'true' || "${NEEDS_CHANGED_OUTPUTS_WORKFLOWS}" == 'true' ]]; then [[ '${{ needs.general.result }}' == 'success' ]] || { echo 'general failed'; exit 1; } diff --git a/.github/workflows/rust-release-provisioned-macos.yml b/.github/workflows/rust-release-provisioned-macos.yml index 9f306e8375..0db264243c 100644 --- a/.github/workflows/rust-release-provisioned-macos.yml +++ b/.github/workflows/rust-release-provisioned-macos.yml @@ -1,4 +1,4 @@ -# Verified Cargo and Bazel side packages, published by rust-release.yml when enabled. +# Verified Cargo side packages, published by rust-release.yml when enabled. # The legacy CLI, npm, installer and DMG packages are unchanged. # Required secrets in the codesigning environment: # - CODEX_CLI_PROVISIONING_PROFILE_BASE64: profile approved for public distribution. @@ -32,7 +32,7 @@ jobs: strategy: fail-fast: false matrix: - build-system: [cargo, bazel] + build-system: [cargo] # Bazel releases are disabled while the BuildBuddy key is revoked. target: [aarch64-apple-darwin, x86_64-apple-darwin] env: TARGET: ${{ matrix.target }} @@ -131,7 +131,7 @@ jobs: strategy: fail-fast: false matrix: - build-system: [cargo, bazel] + build-system: [cargo] # Bazel releases are disabled while the BuildBuddy key is revoked. target: [aarch64-apple-darwin, x86_64-apple-darwin] include: - target: aarch64-apple-darwin diff --git a/.github/workflows/rust-release-windows.yml b/.github/workflows/rust-release-windows.yml index 058ed9feb3..6cab126aa8 100644 --- a/.github/workflows/rust-release-windows.yml +++ b/.github/workflows/rust-release-windows.yml @@ -9,7 +9,7 @@ env: jobs: build-windows-binaries: name: Build Windows binaries - ${{ matrix.runner }} - ${{ matrix.target }} - ${{ matrix.bundle }} - ${{ matrix.build-system }} - # Desktop consumers require successful Cargo and Bazel release artifacts. + # Release Cargo artifacts only while Bazel releases are disabled. runs-on: ${{ matrix.runs_on }} environment: name: bazel @@ -29,7 +29,7 @@ jobs: strategy: fail-fast: false matrix: - build-system: [cargo, bazel] + build-system: [cargo] # Bazel releases are disabled while the BuildBuddy key is revoked. target: - x86_64-pc-windows-msvc - aarch64-pc-windows-msvc @@ -321,7 +321,7 @@ jobs: strategy: fail-fast: false matrix: - build-system: [cargo, bazel] + build-system: [cargo] # Bazel releases are disabled while the BuildBuddy key is revoked. target: - aarch64-pc-windows-msvc - x86_64-pc-windows-msvc @@ -385,7 +385,7 @@ jobs: strategy: fail-fast: false matrix: - build-system: [cargo, bazel] + build-system: [cargo] # Bazel releases are disabled while the BuildBuddy key is revoked. target: - x86_64-pc-windows-msvc - aarch64-pc-windows-msvc diff --git a/.github/workflows/rust-release.yml b/.github/workflows/rust-release.yml index 267fc3dd85..ba5311142f 100644 --- a/.github/workflows/rust-release.yml +++ b/.github/workflows/rust-release.yml @@ -59,7 +59,7 @@ jobs: build: needs: tag-check name: Build - ${{ matrix.runner }} - ${{ matrix.target }} - ${{ matrix.bundle }} - ${{ matrix.build-system }} - # Desktop consumers require successful Cargo and Bazel release artifacts. + # Release Cargo artifacts only while Bazel releases are disabled. runs-on: ${{ matrix.runner }} environment: name: bazel @@ -83,7 +83,7 @@ jobs: strategy: fail-fast: false matrix: - build-system: [cargo, bazel] + build-system: [cargo] # Bazel releases are disabled while the BuildBuddy key is revoked. target: - aarch64-apple-darwin - x86_64-apple-darwin @@ -651,7 +651,7 @@ jobs: strategy: fail-fast: false matrix: - build-system: [cargo, bazel] + build-system: [cargo] # Bazel releases are disabled while the BuildBuddy key is revoked. target: - aarch64-apple-darwin - x86_64-apple-darwin @@ -895,7 +895,7 @@ jobs: strategy: fail-fast: false matrix: - build-system: [cargo, bazel] + build-system: [cargo] # Bazel releases are disabled while the BuildBuddy key is revoked. target: - aarch64-apple-darwin - x86_64-apple-darwin @@ -1183,7 +1183,7 @@ jobs: strategy: fail-fast: false matrix: - build-system: [cargo, bazel] + build-system: [cargo] # Bazel releases are disabled while the BuildBuddy key is revoked. target: - aarch64-apple-darwin - x86_64-apple-darwin @@ -1286,7 +1286,7 @@ jobs: strategy: fail-fast: false matrix: - build-system: [cargo, bazel] + build-system: [cargo] # Bazel releases are disabled while the BuildBuddy key is revoked. target: - aarch64-apple-darwin - x86_64-apple-darwin @@ -1676,7 +1676,7 @@ jobs: uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: path: dist - pattern: "{{aarch64,x86_64}-{apple-darwin{,-app-server},unknown-linux-musl{,-app-server},pc-windows-msvc}{,-bazel},*-symbols{,-bazel},argument-comment-lint-*,python-runtime-wheel-*,npm-packages}" + pattern: "{{aarch64,x86_64}-{apple-darwin{,-app-server},unknown-linux-musl{,-app-server},pc-windows-msvc},*-symbols,argument-comment-lint-*,python-runtime-wheel-*,npm-packages}" - name: Download verified provisioned macOS packages if: vars.CODEX_PROVISIONED_MACOS_CANDIDATE == 'true' diff --git a/.github/workflows/sdk.yml b/.github/workflows/sdk.yml index 8a764dbf03..cc42db2d65 100644 --- a/.github/workflows/sdk.yml +++ b/.github/workflows/sdk.yml @@ -36,6 +36,9 @@ jobs: ' sdks: + # This job builds its CLI with Bazel. Keep it advisory while the BuildBuddy + # key is revoked; restore blocking behavior once it can run without BuildBuddy. + continue-on-error: true runs-on: group: ${{ github.event.repository.name }}-runners labels: ${{ github.event.repository.name }}-linux-x64