Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .adms/bazel/adms.mirror.cfg
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@ allow gnupg.org
allow lua.org
allow mirrors.edge.kernel.org
allow mirrors.kernel.org
allow repo.msys2.org
allow sourceware.org
allow sqlite.org

Expand Down
204 changes: 102 additions & 102 deletions .bazelrc
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

crlf dif

Original file line number Diff line number Diff line change
@@ -1,102 +1,102 @@
# Do not edit this file without a review from @DataDog/agent-build

# ADMS config ----------------------------------------------------------------------------------------------------------
# Ensure access to DataDog internal artifact repositories in CI
import %workspace%/.adms/adms.bazelrc

# Use --config=adms to use adms for upstream dependency caching.
# TOOD: rename dd-internal in the .adms tree to adms-internal. That
# will be easier to understand.
common:adms --config=dd-internal

# Startup options ------------------------------------------------------------------------------------------------------
startup --max_idle_secs=28800 # Keep the server alive for at most 8 hours of inactivity

# Common options -------------------------------------------------------------------------------------------------------
common --@rules_python//python/config_settings:bootstrap_impl=script # https://github.com/bazel-contrib/rules_python/blob/main/BZLMOD_SUPPORT.md
common --check_direct_dependencies=error # Escalate any bypassed `bazel_dep` to a resolution failure
common --enable_platform_specific_config # Supported OS identifiers are linux, macos, windows, freebsd, and openbsd
common --experimental_disk_cache_gc_max_size=30G # Cap applied whenever --disk_cache is also set, no-op otherwise. Override in user.bazelrc (50G good, 100G ideal)
common --experimental_proto_descriptor_sets_include_source_info # Preserve comments in generated pb.go
common --experimental_strict_repo_env # Do not leak uncontrolled environment variables into repository rules
common --experimental_ui_max_stdouterr_bytes=1073741819 # why?
common --http_timeout_scaling=3.0 # At least one attempt reaches 30s (3,6,12,24,30,30,30,30) instead of only 10s (1,2,4,8,10,10,10,10)
common --repo_env=DEPLOY_AGENT # Keep in sync with env_vars in MODULE.bazel
common --repo_env=FORCED_PACKAGE_COMPRESSION_LEVEL # Keep in sync with env_vars in MODULE.bazel
common --repo_env=GOCACHE # https://pkg.go.dev/cmd/go#hdr-Build_and_test_caching
common --repo_env=GOMODCACHE # https://wiki.archlinux.org/title/XDG_Base_Directory#Partial
common --repo_env=PACKAGE_VERSION # Keep in sync with env_vars in MODULE.bazel
common --repo_env=SIGN_MAC # Keep in sync with env_vars in MODULE.bazel
common --repo_env=XDG_CACHE_HOME # https://wiki.archlinux.org/title/XDG_Base_Directory
common --skip_incompatible_explicit_targets # Let target_compatible_with skip rather than fail
common --test_output=errors # Print test errors to console output instead of only capturing them in buried test.log
common --verbose_failures

# Lint config (static code analyzers) ----------------------------------------------------------------------------------
# Go -TODO(agent-build)
# Python -TODO(agent-build)
# Rust
common:lint --aspects=@rules_rust//rust:defs.bzl%rust_clippy_aspect --output_groups=+clippy_checks
common:lint --aspects=@rules_rust//rust:defs.bzl%rustfmt_aspect --output_groups=+rustfmt_checks

# Linux config ---------------------------------------------------------------------------------------------------------
common:linux --credential_helper=buildbarn-edge-cache.buildbarn.local-cluster.local-dc.fabric.dog=%workspace%/bazel/tools/credential-helper
common:linux --strategy=sandboxed

# macOS config ---------------------------------------------------------------------------------------------------------
common:macos --credential_helper=buildbarn-edge-cache.buildbarn.local-cluster.local-dc.fabric.dog=%workspace%/bazel/tools/credential-helper
common:macos --features=-macos_default_link_flags # https://github.com/bazelbuild/bazel/issues/23312
common:macos --macos_minimum_os=12.0 # Keep in sync with https://docs.datadoghq.com/agent/supported_platforms/?tab=macos
common:macos --strategy=sandboxed

# Windows config -------------------------------------------------------------------------------------------------------
common:windows --credential_helper=buildbarn-edge-cache.buildbarn.local-cluster.local-dc.fabric.dog=%workspace%/bazel/tools/credential-helper.bat
common:windows --strategy=standalone # Valid values are: [dynamic_worker, standalone, dynamic, remote, worker, local]
# rules_python 1.9.0 transitions enable_runfiles to `true` for every py_ target on Windows. Pre-setting it here makes
# that transition a no-op, so Bazel deduplicates python_win and avoids 2 concurrent MSBuild racing on shared resources.
common:windows --enable_runfiles
common:windows --repo_env=BAZEL_SH=C:/tools/msys64/usr/bin/bash.exe # for https://github.com/bazelbuild/bazel/pull/26927
common:windows --repo_env=PIP_CACHE_DIR # https://pip.pypa.io/en/stable/topics/caching/#default-paths
common:windows --repo_env=SYSTEMDRIVE # needed by vswhere to locate the VS installer instance database
common:windows --repo_env=SYSTEMROOT # used by COM to load system DLLs, needed by vswhere
common:windows --repo_env=USERPROFILE # used by MSYS2 bash to emulate HOME, needed by git to fetch repositories
common:windows --repo_env=VSTUDIO_ROOT # visual_studio(path_variable) in MODULE.bazel
common:windows --shell_executable=C:/tools/msys64/usr/bin/bash.exe

# Force the x86_64-pc-windows-gnu Rust toolchain (compact name for rust_windows_gnu_x86_64)
# to take priority over the default MSVC toolchain, since the CI cc_toolchain is MinGW/GCC.
common:windows --extra_toolchains=@rust_toolchains//:rw-2070622084

# Remote cache config --------------------------------------------------------------------------------------------------
# datadog-agent virtually isolates caching instance from its parent (which is remote-caching).
# If entry isn't found in datadog-agent, it will be searched in remote-caching.
common:cache --remote_cache=grpcs://buildbarn-frontend-datadog-agent.us1.ddbuild.io:443
common:cache --remote_instance_name=ci/datadog-agent
common:cache --remote_local_fallback # best-effort on transient connection errors (no such host)
common:cache --incompatible_remote_local_fallback_for_remote_cache # works only if --remote_local_fallback is also set
common:cache --remote_retries=1
common:cache --remote_timeout=60

# CI config ------------------------------------------------------------------------------------------------------------
common:ci --config=adms
common:ci --config=cache
common:ci --config=lint
# Opt-in override: only Linux CI runs in k8s and can reach the in-cluster edge cache.
# tools/bazel adds `--config=ci-edge-cache` when `uname -s = Linux`.
common:ci-edge-cache --remote_cache=grpc://buildbarn-edge-cache.buildbarn.local-cluster.local-dc.fabric.dog:443
common:ci --noexperimental_convenience_symlinks # not CI-suitable: "These symlinks are only for the user's convenience"

# Project/Language configs --------------------------------------------------------------------------------------
import %workspace%/bazel/configs/rust.bazelrc

# Global release config ------------------------------------------------------------------------------------------------
# This should aggregate all the release configs for all the languages with enabled optimizations,
# stripping, etc. It does not strictly mean that this build is the one to be released as a product.
# It just selects all the flags we should use on product builds. For example, we need to build with
# optimization and compress packages in CI so that we can run performance and size gates, even
# though we will never release that instance of the package to customers.
common:release --config=rust-release
common:release --//:release

# Local development options --------------------------------------------------------------------------------------------
try-import %workspace%/user.bazelrc
# Do not edit this file without a review from @DataDog/agent-build
# ADMS config ----------------------------------------------------------------------------------------------------------
# Ensure access to DataDog internal artifact repositories in CI
import %workspace%/.adms/adms.bazelrc
# Use --config=adms to use adms for upstream dependency caching.
# TOOD: rename dd-internal in the .adms tree to adms-internal. That
# will be easier to understand.
common:adms --config=dd-internal
# Startup options ------------------------------------------------------------------------------------------------------
startup --max_idle_secs=28800 # Keep the server alive for at most 8 hours of inactivity
# Common options -------------------------------------------------------------------------------------------------------
common --@rules_python//python/config_settings:bootstrap_impl=script # https://github.com/bazel-contrib/rules_python/blob/main/BZLMOD_SUPPORT.md
common --check_direct_dependencies=error # Escalate any bypassed `bazel_dep` to a resolution failure
common --enable_platform_specific_config # Supported OS identifiers are linux, macos, windows, freebsd, and openbsd
common --experimental_disk_cache_gc_max_size=30G # Cap applied whenever --disk_cache is also set, no-op otherwise. Override in user.bazelrc (50G good, 100G ideal)
common --experimental_proto_descriptor_sets_include_source_info # Preserve comments in generated pb.go
common --experimental_strict_repo_env # Do not leak uncontrolled environment variables into repository rules
common --experimental_ui_max_stdouterr_bytes=1073741819 # why?
common --http_timeout_scaling=3.0 # At least one attempt reaches 30s (3,6,12,24,30,30,30,30) instead of only 10s (1,2,4,8,10,10,10,10)
common --repo_env=DEPLOY_AGENT # Keep in sync with env_vars in MODULE.bazel
common --repo_env=FORCED_PACKAGE_COMPRESSION_LEVEL # Keep in sync with env_vars in MODULE.bazel
common --repo_env=GOCACHE # https://pkg.go.dev/cmd/go#hdr-Build_and_test_caching
common --repo_env=GOMODCACHE # https://wiki.archlinux.org/title/XDG_Base_Directory#Partial
common --repo_env=PACKAGE_VERSION # Keep in sync with env_vars in MODULE.bazel
common --repo_env=SIGN_MAC # Keep in sync with env_vars in MODULE.bazel
common --repo_env=XDG_CACHE_HOME # https://wiki.archlinux.org/title/XDG_Base_Directory
common --skip_incompatible_explicit_targets # Let target_compatible_with skip rather than fail
common --test_output=errors # Print test errors to console output instead of only capturing them in buried test.log
common --verbose_failures
# Lint config (static code analyzers) ----------------------------------------------------------------------------------
# Go -TODO(agent-build)
# Python -TODO(agent-build)
# Rust
common:lint --aspects=@rules_rust//rust:defs.bzl%rust_clippy_aspect --output_groups=+clippy_checks
common:lint --aspects=@rules_rust//rust:defs.bzl%rustfmt_aspect --output_groups=+rustfmt_checks
# Linux config ---------------------------------------------------------------------------------------------------------
common:linux --credential_helper=buildbarn-edge-cache.buildbarn.local-cluster.local-dc.fabric.dog=%workspace%/bazel/tools/credential-helper
common:linux --strategy=sandboxed
# macOS config ---------------------------------------------------------------------------------------------------------
common:macos --credential_helper=buildbarn-edge-cache.buildbarn.local-cluster.local-dc.fabric.dog=%workspace%/bazel/tools/credential-helper
common:macos --features=-macos_default_link_flags # https://github.com/bazelbuild/bazel/issues/23312
common:macos --macos_minimum_os=12.0 # Keep in sync with https://docs.datadoghq.com/agent/supported_platforms/?tab=macos
common:macos --strategy=sandboxed
# Windows config -------------------------------------------------------------------------------------------------------
common:windows --credential_helper=buildbarn-edge-cache.buildbarn.local-cluster.local-dc.fabric.dog=%workspace%/bazel/tools/credential-helper.bat
common:windows --strategy=standalone # Valid values are: [dynamic_worker, standalone, dynamic, remote, worker, local]
# rules_python 1.9.0 transitions enable_runfiles to `true` for every py_ target on Windows. Pre-setting it here makes
# that transition a no-op, so Bazel deduplicates python_win and avoids 2 concurrent MSBuild racing on shared resources.
common:windows --enable_runfiles
common:windows --repo_env=PIP_CACHE_DIR # https://pip.pypa.io/en/stable/topics/caching/#default-paths
common:windows --repo_env=SYSTEMDRIVE # needed by vswhere to locate the VS installer instance database
common:windows --repo_env=SYSTEMROOT # used by COM to load system DLLs, needed by vswhere
common:windows --repo_env=USERPROFILE # used by MSYS2 bash to emulate HOME, needed by git to fetch repositories
common:windows --repo_env=VSTUDIO_ROOT # visual_studio(path_variable) in MODULE.bazel
# Hermetic bash discovery for ctx.actions.run_shell / genrule / rules_foreign_cc.
common:windows --shell_executable=bazel/toolchains/msys2/bash_shim.exe
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Commit the Windows shell executable referenced by Bazel

This change points --shell_executable to bazel/toolchains/msys2/bash_shim.exe, but that file is not added anywhere in the commit (only bash_shim.c is). On Windows, any genrule/ctx.actions.run_shell/rules_foreign_cc action will try to launch this path and fail because the executable is missing, which blocks builds as soon as a shell action is needed.

Useful? React with 👍 / 👎.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Use an absolute value for --shell_executable

--shell_executable is documented by Bazel as an absolute path, but this change sets it to a relative path. That makes behavior dependent on the caller’s working directory and can break Windows builds when Bazel is launched from a subdirectory or wrapper that doesn’t run at the repo root, because the shim path won’t resolve and shell-backed actions won’t start.

Useful? React with 👍 / 👎.

# Force the x86_64-pc-windows-gnu Rust toolchain (compact name for rust_windows_gnu_x86_64)
# to take priority over the default MSVC toolchain, since the CI cc_toolchain is MinGW/GCC.
common:windows --extra_toolchains=@rust_toolchains//:rw-2070622084
# Remote cache config --------------------------------------------------------------------------------------------------
# datadog-agent virtually isolates caching instance from its parent (which is remote-caching).
# If entry isn't found in datadog-agent, it will be searched in remote-caching.
common:cache --remote_cache=grpcs://buildbarn-frontend-datadog-agent.us1.ddbuild.io:443
common:cache --remote_instance_name=ci/datadog-agent
common:cache --remote_local_fallback # best-effort on transient connection errors (no such host)
common:cache --incompatible_remote_local_fallback_for_remote_cache # works only if --remote_local_fallback is also set
common:cache --remote_retries=1
common:cache --remote_timeout=60
# CI config ------------------------------------------------------------------------------------------------------------
common:ci --config=adms
common:ci --config=cache
common:ci --config=lint
# Opt-in override: only Linux CI runs in k8s and can reach the in-cluster edge cache.
# tools/bazel adds `--config=ci-edge-cache` when `uname -s = Linux`.
common:ci-edge-cache --remote_cache=grpc://buildbarn-edge-cache.buildbarn.local-cluster.local-dc.fabric.dog:443
common:ci --noexperimental_convenience_symlinks # not CI-suitable: "These symlinks are only for the user's convenience"
# Project/Language configs --------------------------------------------------------------------------------------
import %workspace%/bazel/configs/rust.bazelrc
# Global release config ------------------------------------------------------------------------------------------------
# This should aggregate all the release configs for all the languages with enabled optimizations,
# stripping, etc. It does not strictly mean that this build is the one to be released as a product.
# It just selects all the flags we should use on product builds. For example, we need to build with
# optimization and compress packages in CI so that we can run performance and size gates, even
# though we will never release that instance of the package to customers.
common:release --config=rust-release
common:release --//:release
# Local development options --------------------------------------------------------------------------------------------
try-import %workspace%/user.bazelrc
131 changes: 66 additions & 65 deletions .gitattributes
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CRLF differences?

Original file line number Diff line number Diff line change
@@ -1,65 +1,66 @@
# Set batch file line endings to CRLF so that they can be executed on Windows
*.bat text eol=crlf
*.cmd text eol=crlf
*.bin binary

# Set go source line endings to LF on all platforms so gofmt can be used
*.go text=auto eol=lf
# Same for gopatch (does not handle CRLF line endings)
*.gopatch text eol=lf
# Same for go workspace files (root and testdata)
*go.work text eol=lf
go.sum -diff -merge linguist-generated=true
*.pb.go -diff -merge
*.pb.go linguist-generated=true
*.pb.gw.go -diff -merge
*.pb.gw.go linguist-generated=true
*_easyjson.go -diff -merge
*_easyjson.go linguist-generated=true
pkg/config/schema/*.yaml text eol=lf
pkg/config/schema/compressed/*.zstd binary -diff -merge linguist-generated=true
pkg/security/probe/constantfetch/btfhub/constants.json -diff -merge linguist-generated=true
pkg/security/seclwin/** -diff -merge linguist-generated=true
# CWS doc JSON is generated as LF on Linux; force LF on Windows too
# so Bazel's byte-exact diff_test doesn't trip on core.autocrlf-rewritten CRLF.
docs/cloud-workload-security/** text eol=lf
# Fixtures should have LF line endings because they are checked against OCI packages built on Linux
pkg/fleet/installer/fixtures/** text=auto eol=lf

# Fix `git diff` when running on the below file formats.
# Our windows build image uses MinGit which tries to use the astextplain diff algorithm (https://git-scm.com/docs/gitattributes#_setting_the_internal_diff_algorithm).
# The astextplain binary is not embedded in the docker image making the git diff command fail when one of the below file formats is in the diff.
# The error is:
# ```
# error: cannot spawn astexplain: No such files or directory
# fatal: unable to read files diff
# ```
# We're overriding the MinGit default gitattributes config to avoid using astextplain on the file formats below.
# The MinGit's gitconfig file still have the problematic config though it should not use it anymore:
# ```
# [diff "astextplain"]
# textconv = astextplain
# ```

*.doc diff
*.DOC diff
*.docx diff
*.DOCX diff
*.docm diff
*.DOCM diff
*.dot diff
*.DOT diff
*.dotx diff
*.DOTX diff
*.dotm diff
*.DOTM diff
*.pdf diff
*.PDF diff
*.rtf diff
*.RTF diff
*.ods diff
*.ODS diff
*.odf diff
*.ODF diff
*.odt diff
*.ODT diff
# Set batch file line endings to CRLF so that they can be executed on Windows
*.bat text eol=crlf
*.cmd text eol=crlf
*.bin binary
*.exe binary

# Set go source line endings to LF on all platforms so gofmt can be used
*.go text=auto eol=lf
# Same for gopatch (does not handle CRLF line endings)
*.gopatch text eol=lf
# Same for go workspace files (root and testdata)
*go.work text eol=lf
go.sum -diff -merge linguist-generated=true
*.pb.go -diff -merge
*.pb.go linguist-generated=true
*.pb.gw.go -diff -merge
*.pb.gw.go linguist-generated=true
*_easyjson.go -diff -merge
*_easyjson.go linguist-generated=true
pkg/config/schema/*.yaml text eol=lf
pkg/config/schema/compressed/*.zstd binary -diff -merge linguist-generated=true
pkg/security/probe/constantfetch/btfhub/constants.json -diff -merge linguist-generated=true
pkg/security/seclwin/** -diff -merge linguist-generated=true
# CWS doc JSON is generated as LF on Linux; force LF on Windows too
# so Bazel's byte-exact diff_test doesn't trip on core.autocrlf-rewritten CRLF.
docs/cloud-workload-security/** text eol=lf
# Fixtures should have LF line endings because they are checked against OCI packages built on Linux
pkg/fleet/installer/fixtures/** text=auto eol=lf

# Fix `git diff` when running on the below file formats.
# Our windows build image uses MinGit which tries to use the astextplain diff algorithm (https://git-scm.com/docs/gitattributes#_setting_the_internal_diff_algorithm).
# The astextplain binary is not embedded in the docker image making the git diff command fail when one of the below file formats is in the diff.
# The error is:
# ```
# error: cannot spawn astexplain: No such files or directory
# fatal: unable to read files diff
# ```
# We're overriding the MinGit default gitattributes config to avoid using astextplain on the file formats below.
# The MinGit's gitconfig file still have the problematic config though it should not use it anymore:
# ```
# [diff "astextplain"]
# textconv = astextplain
# ```

*.doc diff
*.DOC diff
*.docx diff
*.DOCX diff
*.docm diff
*.DOCM diff
*.dot diff
*.DOT diff
*.dotx diff
*.DOTX diff
*.dotm diff
*.DOTM diff
*.pdf diff
*.PDF diff
*.rtf diff
*.RTF diff
*.ods diff
*.ODS diff
*.odf diff
*.ODF diff
*.odt diff
*.ODT diff
Loading
Loading