openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-05 20:10:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Run Bazel CI locally without BuildBuddy credentials (#59055)

Browse Source 
## What changed

- Remove automatic BuildBuddy configuration and credential forwarding from Bazel CI, release, SDK, and voice builds. Strip remote execution CI configs in the shared wrapper while retaining explicit remote configurations for local use.
- Use native Windows host tools and audio dependencies for Windows Bazel actions, forwarding the required toolchain and environment settings.
- Initialize message-board MCP servers through a per-session `OnceCell` so server startup does not hold the shared registry lock across an await.
- Expose the message-board test helper to the core Bazel package and update the runtime-auth test call for the `reauth` argument.

GitOrigin-RevId: 5d5c1f4d71fa841090dea8eec8006380981fb65b
This commit is contained in:
Dmitriy Kovalenko
2026-11-03 04:08:59 +00:00
committed by copyberry
parent fbf5f0d3a7
commit 3f958ac2fe
25 changed files with 136 additions and 550 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/bazel.yml
+29 -36
View File
@@ -17,9 +17,7 @@ jobs:
test:
# PRs use the sharded Windows cross-compiled test jobs below. Post-merge
# pushes to main also run the native Windows test job for broader Windows
# signal without putting PR latency back on the critical path. When
# Code-mode unit tests run on every Bazel target. When authenticated RBE
# is available, the Windows-cross shards exercise the source-built V8 path.
# signal without putting PR latency back on the critical path.
timeout-minutes: 30
strategy:
fail-fast: false
@@ -72,8 +70,6 @@ jobs:
- name: Check MODULE.bazel.lock is up to date
if: matrix.os == 'ubuntu-24.04' && matrix.target == 'x86_64-unknown-linux-gnu'
env:
BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
shell: bash
run: ./scripts/check-module-bazel-lock.sh
@@ -86,8 +82,6 @@ jobs:
echo "CODEX_COMPAT_RELEASES=$releases" >> "$GITHUB_ENV"
- name: bazel test //...
env:
BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
shell: bash
run: |
bazel_targets=(
@@ -139,9 +133,7 @@ jobs:
uses: ./.github/actions/check-clean-worktree
test-windows-shard:
# Split the Windows Bazel test leg across separate Windows hosts. Jobs with
# BuildBuddy credentials use Linux RBE for build actions; test execution
# remains on a Windows runner.
# Build and test Windows shards on separate Windows runners.
timeout-minutes: 30
strategy:
fail-fast: false
@@ -164,7 +156,7 @@ jobs:
with:
persist-credentials: false
- name: Test BuildBuddy Bazel wrapper
- name: Test Bazel command wrapper
if: matrix.shard == 1
shell: pwsh
run: python .github/scripts/test_run_bazel_with_buildbuddy.py
@@ -184,11 +176,16 @@ jobs:
# the PR-blocking critical path after the useful test work is done.
cache-scope: bazel-test
- name: Prepare native Windows audio dependencies
if: runner.os == 'Windows'
uses: ./third_party/voice/cargo-ci/windows-setup
with:
target: x86_64-pc-windows-msvc
- name: bazel test shard
env:
BAZEL_TEST_SHARD: ${{ matrix.shard }}
BAZEL_TEST_SHARD_COUNT: 4
BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
shell: bash
run: |
set -euo pipefail
@@ -283,9 +280,13 @@ jobs:
target: x86_64-pc-windows-msvc
cache-scope: bazel-${{ github.job }}
- name: Prepare native Windows audio dependencies
if: runner.os == 'Windows'
uses: ./third_party/voice/cargo-ci/windows-setup
with:
target: x86_64-pc-windows-msvc
- name: bazel test //...
env:
BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
shell: bash
run: |
bazel_targets=(
@@ -376,6 +377,12 @@ jobs:
target: ${{ matrix.target }}
cache-scope: bazel-${{ github.job }}
- name: Prepare native Windows audio dependencies
if: runner.os == 'Windows'
uses: ./third_party/voice/cargo-ci/windows-setup
with:
target: x86_64-pc-windows-msvc
- name: Resolve app-server/exec-server compatibility releases
if: runner.os == 'Linux'
env:
@@ -385,8 +392,6 @@ jobs:
echo "CODEX_COMPAT_RELEASES=$releases" >> "$GITHUB_ENV"
- name: bazel build --config=clippy lint targets
env:
BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
shell: bash
run: |
bazel_clippy_args=(
@@ -397,19 +402,9 @@ jobs:
bazel_wrapper_args=()
bazel_target_list_args=()
if [[ "${RUNNER_OS}" == "Windows" ]]; then
# Keep this aligned with the fast Windows Bazel test job: use
# Linux RBE for clippy build actions while targeting Windows
# gnullvm. Fork/community PRs without the BuildBuddy secret fall
# back inside `run-bazel-ci.sh` to the previous local Windows MSVC
# host-platform shape.
bazel_wrapper_args+=(--windows-cross-compile)
bazel_target_list_args+=(--windows-cross-compile)
if [[ -z "${BUILDBUDDY_API_KEY:-}" ]]; then
# The fork fallback can see incompatible explicit Windows-cross
# internal test binaries in the generated target list. Preserve
# the old local-fallback behavior there.
bazel_clippy_args+=(--skip_incompatible_explicit_targets)
fi
bazel_clippy_args+=(--skip_incompatible_explicit_targets)
fi
bazel_target_lines="$(./scripts/list-bazel-clippy-targets.sh "${bazel_target_list_args[@]}")"
@@ -483,6 +478,12 @@ jobs:
target: ${{ matrix.target }}
cache-scope: bazel-${{ github.job }}
- name: Prepare native Windows audio dependencies
if: runner.os == 'Windows'
uses: ./third_party/voice/cargo-ci/windows-setup
with:
target: x86_64-pc-windows-msvc
- name: Resolve app-server/exec-server compatibility releases
if: runner.os == 'Linux'
env:
@@ -492,8 +493,6 @@ jobs:
echo "CODEX_COMPAT_RELEASES=$releases" >> "$GITHUB_ENV"
- name: bazel build verify-release-build targets
env:
BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
shell: bash
run: |
# This job exists to compile Rust code behind
@@ -504,11 +503,7 @@ jobs:
# Rust debug assertions explicitly.
bazel_wrapper_args=()
if [[ "${RUNNER_OS}" == "Windows" ]]; then
# This is build-only signal, so use the same Linux-RBE
# cross-compile path as the fast Windows test and clippy jobs.
# Fork/community PRs without the BuildBuddy secret fall back
# inside `run-bazel-ci.sh` to the previous local Windows MSVC
# host-platform shape.
# Use the same native host toolchain as the Windows test shards.
bazel_wrapper_args+=(--windows-cross-compile)
fi
@@ -537,8 +532,6 @@ jobs:
- name: Verify Bazel builds bwrap
if: runner.os == 'Linux'
env:
BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
shell: bash
run: |
./.github/scripts/run-bazel-ci.sh \
.github/workflows/rust-ci.yml
-1
View File
@@ -212,7 +212,6 @@ jobs:
uses: ./.github/actions/run-argument-comment-lint
with:
target: ${{ runner.os }}
buildbuddy-api-key: ${{ secrets.BUILDBUDDY_API_KEY }}
- name: Check for a clean worktree
if: always() && !cancelled() && steps.argument_comment_lint_gate.outputs.run == 'true'
.github/workflows/rust-release-windows.yml
-3
View File
@@ -124,8 +124,6 @@ jobs:
- name: Build Bazel release binaries and symbols
if: ${{ matrix.build-system == 'bazel' }}
uses: ./.github/actions/build-bazel-release
env:
BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
with:
target: ${{ matrix.target }}
bundle: ${{ matrix.bundle }}
@@ -253,7 +251,6 @@ jobs:
ARCH: ${{ matrix.arch }}
VOICE_ARCH: ${{ matrix.arch }}
# Use local Bazel while BuildBuddy credentials are unavailable.
BUILDBUDDY_API_KEY: ""
run: |
(cd codex-rs && cargo update --workspace)
python .github/scripts/watch_voice_bazel.py "$(cygpath -w "$BASH")" ./.github/scripts/run-bazel-ci.sh \
.github/workflows/rust-release.yml
-4
View File
@@ -277,8 +277,6 @@ jobs:
- name: Build Bazel release binaries and symbols
if: ${{ matrix.build-system == 'bazel' }}
uses: ./.github/actions/build-bazel-release
env:
BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
with:
target: ${{ matrix.target }}
bundle: ${{ matrix.bundle }}
@@ -327,7 +325,6 @@ jobs:
env:
APP_TARGET: ${{ matrix.target }}
# Use local Bazel while BuildBuddy credentials are unavailable.
BUILDBUDDY_API_KEY: ""
run: |
set -euo pipefail
cd "$GITHUB_WORKSPACE"
@@ -607,7 +604,6 @@ jobs:
TARGET: ${{ matrix.target }}
PREFIX: ${{ matrix.prefix }}
# Use local Bazel while BuildBuddy credentials are unavailable.
BUILDBUDDY_API_KEY: ""
run: |
set -euo pipefail
# Release tags bump Cargo.toml without rewriting the workspace lockfile.
.github/workflows/rusty-v8-release.yml
-2
View File
@@ -168,7 +168,6 @@ jobs:
- name: Build Bazel V8 release pair
env:
BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
PLATFORM: ${{ matrix.platform }}
SANDBOX: ${{ matrix.sandbox }}
TARGET: ${{ matrix.target }}
@@ -200,7 +199,6 @@ jobs:
- name: Stage release pair
env:
BAZEL_CONFIG: ${{ matrix.bazel_config }}
BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
PLATFORM: ${{ matrix.platform }}
SANDBOX: ${{ matrix.sandbox }}
TARGET: ${{ matrix.target }}
.github/workflows/sdk.yml
-2
View File
@@ -79,8 +79,6 @@ jobs:
- name: Build codex and the code-mode host with Bazel
id: build_bazel
env:
BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
shell: bash
run: |
set -euo pipefail
.github/workflows/v8-canary.yml
-2
View File
@@ -181,7 +181,6 @@ jobs:
- name: Build Bazel V8 release pair
env:
BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
PLATFORM: ${{ matrix.platform }}
SANDBOX: ${{ matrix.sandbox }}
TARGET: ${{ matrix.target }}
@@ -211,7 +210,6 @@ jobs:
- name: Stage release pair
env:
BAZEL_CONFIG: ${{ matrix.bazel_config }}
BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
PLATFORM: ${{ matrix.platform }}
SANDBOX: ${{ matrix.sandbox }}
TARGET: ${{ matrix.target }}