Isolate Bazel build commit metadata from Rust compilation inputs (#43304)

## Why

Stamped Rust binaries consume workspace status files containing build user,
host, and timestamp values. These unrelated values prevent remote cache reuse
when building the same commit across developers and CI workers.

## What changed

Generate a compiler environment file containing only `STABLE_GIT_COMMIT` through
a small stamped template action. Use it for `codex`, `codex-tui`, and
`codex-voice-host`, with Rust binary stamping disabled so their build metadata
input changes only when the embedded commit changes.

Rename the crate macro option from `stamped_binaries` to
`binaries_with_build_commit` and add `bazel_lib` for template expansion.

GitOrigin-RevId: 21d0f2e3df97670a4c2cdbc3d1972cd14cc5b439

MODULE.bazel

@@ -1,5 +1,6 @@
 module(name = "codex")
 
+bazel_dep(name = "bazel_lib", version = "3.2.2")
 bazel_dep(name = "bazel_skylib", version = "1.9.0")
 bazel_dep(name = "platforms", version = "1.0.0")
 

bazel/build-info/BUILD.bazel

@@ -0,0 +1,12 @@
+load("@bazel_lib//lib:expand_template.bzl", "expand_template")
+
+# Isolate workspace status in a cheap action whose output changes only when
+# the embedded commit changes. Rust compiler actions consume only this file.
+expand_template(
+    name = "build-commit-env",
+    out = "build-commit.env",
+    stamp = 1,
+    stamp_substitutions = {"{BUILD_COMMIT}": "{{STABLE_GIT_COMMIT}}"},
+    template = ["STABLE_GIT_COMMIT={BUILD_COMMIT}"],
+    visibility = ["//codex-rs:__subpackages__"],
+)

codex-rs/cli/BUILD.bazel

@@ -4,12 +4,12 @@ load("//bazel/rules:e2e_benchmark.bzl", "codex_e2e_benchmark")
 
 codex_rust_crate(
     name = "cli",
+    binaries_with_build_commit = ["codex"],
     crate_name = "codex_cli",
     extra_binaries = [
         "//codex-rs/bwrap:bwrap",
     ],
     rustc_flags_extra = MACOS_WEBRTC_RUSTC_LINK_FLAGS,
-    stamped_binaries = ["codex"],
     test_data_extra = glob(["src/**/snapshots/**"]),
 )
 

codex-rs/tui/BUILD.bazel

@@ -2,6 +2,7 @@ load("//:defs.bzl", "MACOS_WEBRTC_RUSTC_LINK_FLAGS", "codex_rust_crate")
 
 codex_rust_crate(
     name = "tui",
+    binaries_with_build_commit = ["codex-tui"],
     compile_data = glob([
         "assets/**",
         "frames/**",
@@ -12,7 +13,6 @@ codex_rust_crate(
     ],
     integration_compile_data_extra = ["src/test_backend.rs"],
     rustc_flags_extra = MACOS_WEBRTC_RUSTC_LINK_FLAGS,
-    stamped_binaries = ["codex-tui"],
     test_data_extra = glob([
         "src/**/*.rs",
         "src/**/snapshots/**",

codex-rs/voice-host/BUILD.bazel

@@ -2,8 +2,8 @@ load("//:defs.bzl", "codex_rust_crate")
 
 codex_rust_crate(
     name = "voice-host",
+    binaries_with_build_commit = ["codex-voice-host"],
     crate_name = "codex_voice_host",
     crate_srcs = [],
-    stamped_binaries = ["codex-voice-host"],
     unit_test_args = ["--test-threads=1"],
 )

defs.bzl

@@ -195,7 +195,7 @@ def codex_rust_crate(
         lib_data_extra = [],
         rustc_flags_extra = [],
         binary_rustc_flags_extra = {},
-        stamped_binaries = [],
+        binaries_with_build_commit = [],
         rustc_env = {},
         rustc_env_files = [],
         deps_extra = [],
@@ -240,9 +240,9 @@ def codex_rust_crate(
         lib_data_extra: Extra runtime data for the library target.
         binary_rustc_flags_extra: Mapping from binary names to extra rustc
             flags for those binary targets.
-        stamped_binaries: Binary names that read STABLE_GIT_COMMIT at compile
-            time. Other binaries omit workspace status inputs so Git revisions
-            and build timestamps do not invalidate their cached compilations.
+        binaries_with_build_commit: Binary names that embed STABLE_GIT_COMMIT from the
+            generated build-commit environment file. Other workspace status is
+            excluded from their compilation inputs.
         rustc_env: Extra rustc_env entries to merge with defaults.
         rustc_env_files: Generated compiler environment files for the library target.
         deps_extra: Extra normal deps beyond @crates resolution.
@@ -407,10 +407,16 @@ def codex_rust_crate(
             # generated rust_binary instead of leaking it to sibling binaries.
             compile_data = binary_compile_data_extra.get(binary, []),
             rustc_flags = rustc_flags_extra + binary_rustc_flags_extra.get(binary, []) + WINDOWS_RUSTC_LINK_FLAGS,
-            # Only consumers of build identity need workspace status inputs.
-            rustc_env = {"STABLE_GIT_COMMIT": "{STABLE_GIT_COMMIT}"} if binary in stamped_binaries else {},
+            # Keep stamp = 0: rules_rust otherwise makes stable-status.txt and
+            # volatile-status.txt compiler inputs, even though we only consume
+            # STABLE_GIT_COMMIT. BUILD_USER and BUILD_HOST vary across developers
+            # and CI workers, while BUILD_TIMESTAMP varies across builds; these
+            # unrelated values prevent remote cache reuse for the same commit.
+            # Isolate status inputs in build-commit-env's cheap action so its
+            # output, and hence this compiler input, changes only with the commit.
+            rustc_env_files = ["//bazel/build-info:build-commit-env"] if binary in binaries_with_build_commit else [],
             srcs = native.glob(["src/**/*.rs"]),
-            stamp = 1 if binary in stamped_binaries else 0,
+            stamp = 0,
             visibility = ["//visibility:public"],
         )