From 94d1d007f657557c79c6ab617882a59f97c8b1fd Mon Sep 17 00:00:00 2001
From: Michael Bolin <mbolin@openai.com>
Date: Wed, 1 Apr 2026 09:14:36 -0700
Subject: [PATCH] bazel: lint rust_test targets in clippy workflow

---
 .github/workflows/README.md          |  6 +++---
 .github/workflows/bazel.yml          | 12 +++++++-----
 justfile                             |  3 ++-
 scripts/list-bazel-clippy-targets.sh | 16 ++++++++++++++++
 4 files changed, 28 insertions(+), 9 deletions(-)
 create mode 100755 scripts/list-bazel-clippy-targets.sh

diff --git a/.github/workflows/README.md b/.github/workflows/README.md
index e7bad82677..d14817f002 100644
--- a/.github/workflows/README.md
+++ b/.github/workflows/README.md
@@ -5,15 +5,15 @@ The workflows in this directory are split so that pull requests get fast, review
 ## Pull Requests
 
 - `bazel.yml` is the main pre-merge verification path for Rust code.
-  It runs Bazel `test` and Bazel `clippy` on the supported Bazel targets.
+  It runs Bazel `test` and Bazel `clippy` on the supported Bazel targets,
+  including the generated Rust test binaries needed to lint inline `#[cfg(test)]`
+  code.
 - `rust-ci.yml` keeps the Cargo-native PR checks intentionally small:
   - `cargo fmt --check`
   - `cargo shear`
   - `argument-comment-lint` on Linux, macOS, and Windows
   - `tools/argument-comment-lint` package tests when the lint or its workflow wiring changes
 
-The PR workflow still keeps the Linux lint lane on the default-targets-only invocation for now, but the released linter runs on Linux, macOS, and Windows before merge.
-
 ## Post-Merge On `main`
 
 - `bazel.yml` also runs on pushes to `main`.
diff --git a/.github/workflows/bazel.yml b/.github/workflows/bazel.yml
index a6c9277b61..77c9a93145 100644
--- a/.github/workflows/bazel.yml
+++ b/.github/workflows/bazel.yml
@@ -126,13 +126,16 @@ jobs:
         with:
           target: ${{ matrix.target }}
 
-      - name: bazel build --config=clippy //codex-rs/...
+      - name: bazel build --config=clippy lint targets
         env:
           BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
         shell: bash
         run: |
-          # Keep the initial Bazel clippy scope on codex-rs and out of the
-          # V8 proof-of-concept target for now.
+          bazel_targets=()
+          while IFS= read -r target; do
+            bazel_targets+=("${target}")
+          done < <(./scripts/list-bazel-clippy-targets.sh)
+
           ./.github/scripts/run-bazel-ci.sh \
             -- \
             build \
@@ -140,8 +143,7 @@ jobs:
             --build_metadata=COMMIT_SHA=${GITHUB_SHA} \
             --build_metadata=TAG_job=clippy \
             -- \
-            //codex-rs/... \
-            -//codex-rs/v8-poc:all
+            "${bazel_targets[@]}"
 
       # Save bazel repository cache explicitly; make non-fatal so cache uploading
       # never fails the overall job. Only save when key wasn't hit.
diff --git a/justfile b/justfile
index 1a1295020f..d2fe132906 100644
--- a/justfile
+++ b/justfile
@@ -69,8 +69,9 @@ bazel-lock-check:
 bazel-test:
     bazel test --test_tag_filters=-argument-comment-lint //... --keep_going
 
+[no-cd]
 bazel-clippy:
-    bazel build --config=clippy -- //codex-rs/... -//codex-rs/v8-poc:all
+    bazel build --config=clippy -- $(./scripts/list-bazel-clippy-targets.sh)
 
 [no-cd]
 bazel-argument-comment-lint:
diff --git a/scripts/list-bazel-clippy-targets.sh b/scripts/list-bazel-clippy-targets.sh
new file mode 100755
index 0000000000..bc36794e90
--- /dev/null
+++ b/scripts/list-bazel-clippy-targets.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "${repo_root}"
+
+printf '%s\n' \
+  "//codex-rs/..." \
+  "-//codex-rs/v8-poc:all"
+
+# `--config=clippy` on the `workspace_root_test` wrappers does not lint the
+# underlying `rust_test` binaries. Add the internal manual `*-unit-tests-bin`
+# targets explicitly so inline `#[cfg(test)]` code is linted like
+# `cargo clippy --tests`.
+bazel query 'kind("rust_test rule", attr(tags, "manual", //codex-rs/... except //codex-rs/v8-poc/...))'