MODULE.bzlmod migration progress tracking PR

ci/install-bazelisk.yml

@@ -0,0 +1,59 @@
+# Copyright (c) 2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+# Installs Bazelisk to $HOME/.local/bin and prepends that directory to PATH for
+# the remaining steps of the job. The concrete Bazel version Bazelisk launches
+# is selected by sdk/.bazelversion (`7.x` at the time of writing), so this
+# template only pins Bazelisk itself.
+#
+# Bazelisk caches downloaded Bazel binaries under $HOME/.cache/bazelisk, which
+# is preserved across runs on the persistent self-hosted agents but will need a
+# cache strategy if/when these jobs move to ephemeral containers.
+
+parameters:
+  - name: version
+    type: string
+    default: '1.29.0'
+  - name: sha256_linux_amd64
+    type: string
+    default: '5a408715e932c0250d28bd84555f12edbf70117de42f9181691c736eacc4a992'
+  - name: sha256_linux_arm64
+    type: string
+    default: 'e20e8b0f4f240091b7a55bf17b9398bd4f40ee70ae0208dff95dd4c445fb4010'
+
+steps:
+  - bash: |
+      set -euo pipefail
+
+      VERSION='${{ parameters.version }}'
+      BIN_DIR="$HOME/.local/bin"
+      mkdir -p "$BIN_DIR"
+
+      arch="$(uname -m)"
+      case "$arch" in
+        x86_64|amd64)
+          asset='bazelisk-linux-amd64'
+          expected_sha='${{ parameters.sha256_linux_amd64 }}'
+          ;;
+        aarch64|arm64)
+          asset='bazelisk-linux-arm64'
+          expected_sha='${{ parameters.sha256_linux_arm64 }}'
+          ;;
+        *)
+          echo "Unsupported architecture: $arch" >&2
+          exit 1
+          ;;
+      esac
+
+      url="https://github.com/bazelbuild/bazelisk/releases/download/v${VERSION}/${asset}"
+      tmp="$(mktemp)"
+      trap 'rm -f "$tmp"' EXIT
+
+      curl -sSfL "$url" -o "$tmp"
+      echo "${expected_sha}  ${tmp}" | sha256sum -c -
+
+      install -m 0755 "$tmp" "$BIN_DIR/bazel"
+      ln -sf "$BIN_DIR/bazel" "$BIN_DIR/bazelisk"
+
+      echo "##vso[task.prependpath]$BIN_DIR"
+    displayName: 'Install Bazelisk ${{ parameters.version }}'

ci/prs.yml

@@ -40,7 +40,7 @@ jobs:
 # required for collect_build_data
 - job: release
   condition: false
-  
+
 - job: notify_release_pr
   displayName: "Notify Slack about release PR"
   condition: and(not(canceled()),
@@ -49,9 +49,9 @@ jobs:
                  eq(dependencies.check_for_release.outputs['out.is_release'], 'true'))
   dependsOn:
     - git_sha
-    - collect_build_data
+    # - collect_build_data
     - check_for_release
-    - platform_independence_test
+    # - platform_independence_test
   pool:
     name: 'ubuntu_20_04'
     demands: assignment -equals default
@@ -105,7 +105,7 @@ jobs:
                  eq(variables['System.PullRequest.IsFork'], 'False'))
   dependsOn:
     - git_sha
-    - collect_build_data
+    # - collect_build_data
     - check_for_release
   pool:
     name: 'ubuntu_20_04'
@@ -160,4 +160,3 @@ jobs:
     env:
       AZURE_DEVOPS_EXT_PAT: $(System.AccessToken)
     displayName: "Trigger self-service compatibility test"
-

sdk/.bazelrc

@@ -1,4 +1,9 @@
-common --noenable_bzlmod
+common --enable_bzlmod
+common --noenable_workspace
+# Apply build:linux / build:darwin / build:windows automatically based on host OS,
+# so platform-specific flags (including BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1) take
+# effect even when --config=linux is not passed explicitly.
+common --enable_platform_specific_config
 
 # Bazel distributed cache, can be temporarily disabled by passing the following
 # flag: --noremote_accept_cached
@@ -7,7 +12,6 @@ build:linux --remote_cache=https://bazel-cache.da-ext.net/202405/ubuntu
 # Don't push local build results to the remote cache.
 build --remote_upload_local_results=false
 # Do still push local build results to the local disk cache.
-build --incompatible_remote_results_ignore_disk=true
 # Enable the disk cache in addition to the http cache.
 build:linux --disk_cache=.bazel-cache/disk
 build:darwin --disk_cache=.bazel-cache/disk
@@ -23,28 +27,25 @@ sync:darwin --repository_cache=.bazel-cache/repo
 
 test:oracle --repo_env DAML_ORACLE_TESTING=true --test_env ORACLE_USERNAME --test_env ORACLE_PORT --test_env ORACLE_PWD
 
-# set c++ compilation version to 14 (requiered for abseil)
-build --cxxopt=-std=c++14
-build --host_cxxopt=-std=c++14
+# set c++ compilation version to 14 (requiered for abseil) -> 17 for new version
+build --cxxopt=-std=c++17
+build --host_cxxopt=-std=c++17
 
 # Improve remote cache hit rate by exluding environment variables from the
 # sandbox that are not whitelisted using --action_env.
 # This will become the default in a future Bazel release.
-build --experimental_strict_action_env
+build --incompatible_strict_action_env
 
 # Drop the heap size of Bazel to 3 GB and force TLS 1.2.
 # With TLS 1.3, we run into the following error on Darwin.
 # > No subject alternative DNS name matching github-releases.githubusercontent.com found.
 # It looks like this is a result of SNI being broken on TLS 1.3 which results
 # in us getting a certificate for githubassets.com instead.
-startup --host_jvm_args=-Xms3g --host_jvm_args=-Xmx3g --host_jvm_args=-Djdk.tls.client.protocols=TLSv1.2
+# Heap bumped to 8 GB max (from 3 GB) to avoid OOM during full //... builds (~23k actions) under bzlmod.
+startup --host_jvm_args=-Xms4g --host_jvm_args=-Xmx8g --host_jvm_args=-Djdk.tls.client.protocols=TLSv1.2
 
 # Limit the number of parallel actions spawned by Bazel to the number of
-# physical CPUs. (Assuming a CPU with hyperthreading enabled)
-build --loading_phase_threads="HOST_CPUS*.5"
-fetch --loading_phase_threads="HOST_CPUS*.5"
-query --loading_phase_threads="HOST_CPUS*.5"
-sync --loading_phase_threads="HOST_CPUS*.5"
+# physical CPUs. (Assuming a CPU with hyp,5"
 build --local_resources=cpu="HOST_CPUS*.5"
 
 # Enable sandboxing and caching for exclusive tests
@@ -68,17 +69,23 @@ test --strategy=Scalac=worker
 #  https://github.com/grpc/grpc/pull/13929/files
 build --copt -DGRPC_BAZEL_BUILD
 
+# build --java_language_version=17
+# build:linux --java_runtime_version=nixpkgs_java_17
+# build:linux --tool_java_runtime_version=nixpkgs_java_17
+# build:darwin --java_runtime_version=nixpkgs_java_17
+# build:darwin --tool_java_runtime_version=nixpkgs_java_17
+# build:windows --java_runtime_version=17
+# build:windows --tool_java_runtime_version=17
+# build --tool_java_language_version=17
+
 build --java_language_version=17
-build:linux --java_runtime_version=nixpkgs_java_17
-build:linux --tool_java_runtime_version=nixpkgs_java_17
-build:darwin --java_runtime_version=nixpkgs_java_17
-build:darwin --tool_java_runtime_version=nixpkgs_java_17
-build:windows --java_runtime_version=17
-build:windows --tool_java_runtime_version=17
 build --tool_java_language_version=17
 
+build --java_runtime_version=remotejdk_17
+build --tool_java_runtime_version=remotejdk_17
+
 # Propagate locales and the java home to the test environment.
-build --test_env=LANG=en_US.utf8 --test_env=LOCALE_ARCHIVE --test_env=JAVA_HOME
+build --test_env=LANG=C.UTF-8 --test_env=LOCALE_ARCHIVE --test_env=JAVA_HOME
 
 # Disable c-ares support in grpc. We don't need a faster DNS library
 # since we're only connecting to localhost.
@@ -96,14 +103,25 @@ build --action_env=GIT_SSL_CAINFO
 build:linux --action_env=LOCALE_ARCHIVE
 build:windows --action_env=JAVA_HOME
 
-# Tell bazel to use the nixpkgs Haskell toolchain on Linux and Darwin
-build:linux --host_platform=@io_tweag_rules_nixpkgs//nixpkgs/platforms:host
-build:darwin --host_platform=@io_tweag_rules_nixpkgs//nixpkgs/platforms:host
-# and GHC's gcc on Windows
+# GHC's gcc on Windows
 build:windows --crosstool_top=@rules_haskell_ghc_windows_amd64//:cc_toolchain
 build:windows --remote_accept_cached=true
 build:windows --jobs=4
 
+# Tell @local_config_cc to skip host compiler detection. Our hermetic GCC
+# toolchain registered in MODULE.bazel wins toolchain resolution for all
+# modern C/C++ rules. @local_config_cc becomes a dummy repo; any target
+# still referencing it directly will need to migrate to toolchain resolution.
+build:linux --repo_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
+
+# rules_haskell 1.0 still calls ctx.resolve_tools (disallowed by default on
+# Bazel 8); re-enable until the proper patch lands (see migration plan, Phase 7).
+build --noincompatible_disallow_ctx_resolve_tools
+
+# `script` bootstrap = bash py_binary launchers that exec the hermetic
+# interpreter from runfiles; the default `system_python` stub needs host python3.
+build --@rules_python//python/config_settings:bootstrap_impl=script
+
 # Instruct bazel to globally use this flag for compiling protobuf files.
 # We need the source info for generating proto docs. By default proto_library strips
 # source information and doesn't provide an option to turn this flag on.
@@ -124,4 +142,59 @@ test:windows --test_env=ComSpec
 # to not compile them with optimizations.
 build -c opt
 
+# ----------------------------------------------------------------------------
+# Silence noisy diagnostics from third-party dependencies.
+#
+# These are all upstream issues in grpc/protobuf/pigz; without these flags a
+# full //... build emits ~4000 warning lines that drown out anything from our
+# own code. Suppressing here keeps build logs readable without hiding warnings
+# that would surface in first-party code (per_file_copt is scoped by regex,
+# host_copt only affects exec-config compiles which build third-party tools).
+#
+# Why two flag families per warning:
+#   --per_file_copt    -> applied to compiles in the *target* configuration
+#   --host_copt        -> applied to compiles in the *exec/host* configuration
+#                         (the "[for tool]" actions). --per_file_copt does NOT
+#                         cover those, so without --host_copt about half the
+#                         warnings still come through.
+#
+# What each suppression covers (counts from a sample full build):
+#   -Wattributes              ~3258 lines, gRPC promise headers (loop.h,
+#                             promise_factory.h, try_seq.h, call_state.h)
+#   -Wtrigraphs                ~528 lines, gRPC function_signature.h macro
+#                             "???()" interpreted as a trigraph
+#   -Wreturn-type               ~62 lines, gRPC channelz.h non-exhaustive
+#                             switch with no terminal return
+#   -Wdeprecated-declarations  ~117 lines, protobuf calling its own deprecated
+#                             FieldOptions::weak() accessor (mostly via
+#                             generated _virtual_includes/.../helpers.h)
+#   -Wunused-variable / -Wunused-but-set-variable   ~42 lines, vendored pigz
+#                             try.h macros and pigz.c locals
+#   javac -Xlint:-options,-path  ~14 lines, rules_scala bootstrap actions:
+#                             obsolete --source/--target 8 and a missing
+#                             scala-{library,reflect}.jar entry on the
+#                             classpath of the rules_scala helper jars
+#
+# Intentionally NOT suppressed:
+#   javac [removal] in protobuf~/UnsafeUtil.java (AccessController) — this
+#   is a JDK 17+ deprecation-for-removal warning we want to keep visible so
+#   we get advance notice when the JDK actually drops the API. Add ",-removal"
+#   to the javacopt lines below to silence it if needed.
+# ----------------------------------------------------------------------------
+build --per_file_copt=external/grpc.*\.(cc|cpp|cxx|c)$@-Wno-attributes,-Wno-trigraphs,-Wno-return-type
+build --per_file_copt=external/pigz.*\.(c|cc)$@-Wno-unused-variable,-Wno-unused-but-set-variable
+build --per_file_copt=external/protobuf.*\.(cc|cpp|cxx|c)$@-Wno-deprecated-declarations
+build --javacopt=-Xlint:-options,-path
+
+build --host_copt=-Wno-unknown-warning-option
+build --host_copt=-Wno-attributes
+build --host_copt=-Wno-trigraphs
+build --host_copt=-Wno-return-type
+build --host_copt=-Wno-unused-variable
+build --host_copt=-Wno-unused-but-set-variable
+build --host_copt=-Wno-deprecated-declarations
+build --host_javacopt=-Xlint:-options,-path
+
+build:linux --linkopt=-no-pie
+
 try-import %workspace%/.bazelrc.local

sdk/.bazelversion

@@ -0,0 +1 @@
+8.x

sdk/.bzlregression/issues/001_libm_libmvec_sysroot_divergence.md

@@ -0,0 +1,59 @@
+# 001 - libm/libmvec sysroot divergence (local vs container)
+
+## Summary
+
+Container builds fail during C/C++ link steps with:
+
+- `ld: cannot find /lib64/libm.so.6`
+- `ld: cannot find /lib64/libmvec.so.1`
+
+while equivalent local builds can pass.
+
+The issue reproduces in tool-link targets (for example, protobuf and pigz link actions) and is not tied to one user target.
+
+## What we found
+
+1. The toolchain is Bootlin-based and includes glibc linker scripts in sysroot.
+2. Some linker scripts reference absolute paths such as `/lib64/libm.so.6` and `/lib64/libmvec.so.1`.
+3. In sandboxed/container execution, these absolute paths may resolve against host/container root instead of the intended sysroot, depending on linker/script resolution context.
+4. Local environment can mask the problem if host paths happen to exist; container environment exposes it.
+5. This creates local/container divergence and violates hermeticity expectations.
+
+## Why this is a regression risk
+
+- Any fix that depends on host filesystem presence (`/lib64/...`) is environment-sensitive.
+- Environment-sensitive behavior can pass on one machine and fail on another.
+- The failure appears in external/tool actions, so target-by-target fixes are fragile.
+
+## Recommended fix approach (when resuming)
+
+### 1) Establish a minimal reproducible failing link action
+
+- Use one stable container-scoped target that triggers the link failure.
+- Capture exact linker argv with `--verbose_failures` and sandbox diagnostics.
+
+### 2) Make toolchain linker script handling deterministic
+
+- Normalize relevant glibc linker scripts in the fetched toolchain sysroot so absolute references are sysroot-aware (for example `=/...` semantics), implemented idempotently.
+- Ensure rewrite is deterministic and does not double-prefix on repeated fetches.
+
+### 3) Force consistent sysroot injection on all linker paths
+
+- Ensure both `gcc`-driven and direct `ld`-driven paths get the same absolute sysroot.
+- Keep this in the toolchain layer (wrappers/tool paths), not in individual targets.
+
+### 4) Remove host-conditional behavior
+
+- Avoid logic that changes behavior based on host path existence.
+- A hermetic toolchain should behave the same in local and container contexts.
+
+### 5) Add a regression guard
+
+- Add a small validation check that fails if unresolved absolute `libm/libmvec` linker-script paths reappear.
+
+### 6) Validate with 4-step gate
+
+1. Local scoped build (green)
+2. Local full build (green)
+3. Container scoped build (no `libm/libmvec` missing signature)
+4. Container full build (no `libm/libmvec` missing signature)