From 436f42f2e0292cfa966e39fb2c7b2fc1531363cc Mon Sep 17 00:00:00 2001
From: starr-openai <starr@openai.com>
Date: Thu, 28 May 2026 22:41:24 -0700
Subject: [PATCH] bazel: keep local remote cache uploads read only

---
 .bazelrc | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.bazelrc b/.bazelrc
index 6357eb83e4..7c03efe649 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -41,6 +41,9 @@ common --test_output=errors
 common --bes_results_url=https://app.buildbuddy.io/invocation/
 common --bes_backend=grpcs://remote.buildbuddy.io
 common --remote_cache=grpcs://remote.buildbuddy.io
+# Local builds should read shared cache entries but not publish machine-specific
+# local action results into the shared cache.
+common --noremote_upload_local_results
 common --remote_download_toplevel
 common --nobuild_runfile_links
 common --remote_timeout=3600
@@ -56,6 +59,7 @@ common --jobs=30
 
 common:remote --extra_execution_platforms=//:rbe
 common:remote --remote_executor=grpcs://remote.buildbuddy.io
+common:remote --remote_upload_local_results
 common:remote --jobs=800
 # TODO(team): Evaluate if this actually helps, zbarsky is not sure, everything seems bottlenecked on `core` either way.
 # Enable pipelined compilation since we are not bound by local CPU count.