codex/.github/actions/prepare-bazel-ci/action.yml

name: prepare-bazel-ci
description: Prepare a Bazel CI job with shared setup, repository cache restore, and execution logs.
inputs:
  target:
    description: Target triple used for setup and cache namespacing.
    required: true
  cache-scope:
    description: Logical namespace used to keep concurrent Bazel jobs from reserving the same repository cache key.
    required: true
outputs:
  repository-cache-path:
    description: Filesystem path used for the Bazel repository cache.
    value: ${{ steps.configure_bazel_repository_cache.outputs.repository-cache-path }}
  repository-cache-key:
    description: Primary actions/cache key for the Bazel repository cache.
    value: ${{ steps.cache_bazel_repository_key.outputs.repository-cache-key }}
  repository-cache-hit:
    description: Whether the Bazel repository cache restore found an exact key match.
    value: ${{ steps.cache_bazel_repository_restore.outputs.cache-hit }}

runs:
  using: composite
  steps:
    - id: setup_ci
      uses: ./.github/actions/setup-ci

    - name: Authenticate the Bazel cache
      id: gcs
      if: >-
        github.repository == 'openai/codex' && github.ref_protected &&
        env.CODEX_BAZEL_GCS_BUCKET != '' && env.CODEX_BAZEL_GCS_WORKLOAD_IDENTITY_PROVIDER != '' &&
        ((github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')) ||
         (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/rust-v')))
      uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
      with:
        workload_identity_provider: ${{ env.CODEX_BAZEL_GCS_WORKLOAD_IDENTITY_PROVIDER }}
        export_environment_variables: false

    - name: Configure Bazel cache credentials
      if: ${{ always() && steps.gcs.outcome != 'skipped' }}
      shell: bash
      env:
        CREDENTIALS_FILE: ${{ steps.gcs.outputs.credentials_file_path }}
        AUTH_OUTCOME: ${{ steps.gcs.outcome }}
      run: |
        if [[ "$RUNNER_OS" == "Windows" ]]; then
          bazel_python=python
        else
          bazel_python=python3
        fi
        "$bazel_python" - <<'PYTHON'
        import os
        from pathlib import Path
        import shutil

        # auth creates the file in the checkout before it tests the token exchange.
        # Keep it out of Bazel inputs, even when authentication failed.
        if os.environ["CREDENTIALS_FILE"]:
            source = Path(os.environ["CREDENTIALS_FILE"])
            credentials = Path(os.environ["RUNNER_TEMP"]) / source.name
            shutil.move(source, credentials)
            credentials.chmod(0o600)
            with open(os.environ["GITHUB_ENV"], "a", encoding="utf-8") as env:
                print(f"GOOGLE_GHA_CREDS_PATH={credentials}", file=env)  # auth post-job cleanup
                if os.environ["AUTH_OUTCOME"] == "success":
                    print(f"CODEX_BAZEL_GCS_CREDENTIALS={credentials}", file=env)
                    print("Bazel GCS cache credentials configured.")
                else:
                    print("Bazel GCS cache authentication failed. Credentials were moved for cleanup.")
        else:
            print("Bazel GCS authentication did not produce a credentials file.")
        PYTHON

    - name: Report skipped Bazel cache authentication
      if: ${{ steps.gcs.outcome == 'skipped' }}
      shell: bash
      run: echo "Bazel GCS authentication skipped. Cache configuration is missing or this event is outside the allowed cache access policy."

    - name: Set up Bazel
      uses: bazel-contrib/setup-bazel@c5acdfb288317d0b5c0bbd7a396a3dc868bb0f86 # 0.19.0
      # Without an explicit Bazelisk version, setup-bazel leaves PATH unchanged
      # and Windows can use the runner's standalone Bazel, ignoring .bazelversion.
      with:
        bazelisk-version: 1.30.0
        # setup-bazel writes an explicit output_base, which otherwise overrides
        # BAZEL_OUTPUT_USER_ROOT and leaves Bazel's I/O-heavy trees on C:.
        output-base: ${{ steps.setup_ci.outputs.bazel-output-base }}

    - name: Configure Bazel repository cache
      id: configure_bazel_repository_cache
      shell: bash
      run: |
        echo "repository-cache-path=$BAZEL_REPOSITORY_CACHE" >> "$GITHUB_OUTPUT"

    - name: Expose MSVC SDK environment (Windows)
      if: runner.os == 'Windows'
      shell: pwsh
      run: |
        # Bazel exec-side Rust build scripts do not reliably inherit the MSVC developer
        # shell on GitHub-hosted Windows runners, so discover the latest VS install and
        # ask `VsDevCmd.bat` to materialize the x64/x64 compiler + SDK environment.
        $vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
        if (-not (Test-Path $vswhere)) {
          throw "vswhere.exe not found"
        }

        $installPath = & $vswhere -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath 2>$null
        if (-not $installPath) {
          throw "Could not locate a Visual Studio installation with VC tools"
        }

        $vsDevCmd = Join-Path $installPath 'Common7\Tools\VsDevCmd.bat'
        if (-not (Test-Path $vsDevCmd)) {
          throw "VsDevCmd.bat not found at $vsDevCmd"
        }

        # Keep the export surface explicit: these are the paths and SDK roots that the
        # MSVC toolchain probes need later when Bazel runs Windows exec-platform build
        # scripts such as `aws-lc-sys`.
        $varsToExport = @(
          'INCLUDE',
          'LIB',
          'LIBPATH',
          'PATH',
          'UCRTVersion',
          'UniversalCRTSdkDir',
          'VCINSTALLDIR',
          'VCToolsInstallDir',
          'WindowsLibPath',
          'WindowsSdkBinPath',
          'WindowsSdkDir',
          'WindowsSDKLibVersion',
          'WindowsSDKVersion'
        )

        # `VsDevCmd.bat` is a batch file, so invoke it under `cmd.exe`, suppress its
        # banner, then dump the resulting environment with `set`. Re-export only the
        # approved keys into `GITHUB_ENV` so later steps inherit the same MSVC context.
        $envLines = & cmd.exe /c ('"{0}" -no_logo -arch=x64 -host_arch=x64 >nul && set' -f $vsDevCmd)
        foreach ($line in $envLines) {
          if ($line -notmatch '^(.*?)=(.*)$') {
            continue
          }

          $name = $matches[1]
          $value = $matches[2]
          if ($varsToExport -contains $name) {
            "$name=$value" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
          }
        }

    - name: Compute cache-stable Windows Bazel PATH
      if: runner.os == 'Windows'
      shell: pwsh
      run: ./.github/scripts/compute-bazel-windows-path.ps1

    - name: Compute bazel repository cache key
      id: cache_bazel_repository_key
      shell: bash
      env:
        CACHE_SCOPE: ${{ inputs.cache-scope }}
        TARGET: ${{ inputs.target }}
        CACHE_HASH: ${{ hashFiles('MODULE.bazel', 'codex-rs/Cargo.lock', 'codex-rs/Cargo.toml') }}
      run: |
        echo "repository-cache-key=bazel-cache-${CACHE_SCOPE}-${TARGET}-${CACHE_HASH}" >> "${GITHUB_OUTPUT}"
        echo "repository-cache-restore-key=bazel-cache-${CACHE_SCOPE}-${TARGET}-" >> "${GITHUB_OUTPUT}"

    # Restore the Bazel repository cache explicitly so external dependencies
    # do not need to be re-downloaded on every CI run. Keep restore failures
    # non-fatal so transient cache-service errors degrade to a cold build
    # instead of failing the job.
    - name: Restore bazel repository cache
      id: cache_bazel_repository_restore
      continue-on-error: true
      uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
      with:
        path: ${{ steps.configure_bazel_repository_cache.outputs.repository-cache-path }}
        key: ${{ steps.cache_bazel_repository_key.outputs.repository-cache-key }}
        restore-keys: |
          ${{ steps.cache_bazel_repository_key.outputs.repository-cache-restore-key }}

    - name: Set up Bazel execution logs
      shell: bash
      run: |
        mkdir -p "${RUNNER_TEMP}/bazel-execution-logs"
        echo "CODEX_BAZEL_EXECUTION_LOG_COMPACT_DIR=${RUNNER_TEMP}/bazel-execution-logs" >> "${GITHUB_ENV}"