.bazelrc

# Global Bazel configuration for the ServiceRadar monorepo.
# Keep this file minimal and import developer- or environment-specific overrides
# via the optional .bazelrc.local and .bazelrc.remote files.

startup --max_idle_secs=60

common --announce_rc
common --experimental_convenience_symlinks=clean
common --color=yes
common --curses=yes
common --repository_cache=third_party/bazel-repo-cache
common --repo_contents_cache=
common --disk_cache=third_party/bazel-disk-cache
common --distdir=third_party/distdir
# Allow platform-specific build:* sections (linux/macos/windows).
common --enable_platform_specific_config

build --keep_going
build --jobs=auto
build --show_timestamps
build --action_env=SRQL_TEST_DATABASE_URL
build --action_env=SRQL_TEST_ADMIN_URL
build --action_env=SRQL_TEST_DATABASE_CA_CERT
build --action_env=NATS_URL
build --action_env=NATS_SERVER_NAME
build --action_env=NATS_CA_FILE
build --action_env=NATS_CERT_FILE
build --action_env=NATS_KEY_FILE
build --action_env=NATS_CA_B64
build --action_env=NATS_CERT_B64
build --action_env=NATS_KEY_B64
build --action_env=NEXT_PRIVATE_SKIP_TURBOPACK=1
build --action_env=TURBOPACK=
build --action_env=NEXT_SKIP_TURBO=1

# System OpenSSL — scoped to Linux hosts (these are Linux paths). On Linux, both the
# Erlang/OTP + Elixir crypto builds AND Rust's libpq/openssl-sys use system OpenSSL.
# `build:linux` is auto-applied on Linux via `--enable_platform_specific_config` (above),
# so local Linux builds get it too (not just CI). On macOS these vars are absent, so
# Rust's openssl-sys builds a vendored, from-source OpenSSL (portable); an Elixir Bazel
# build on macOS would need a build:macos OpenSSL path (e.g. Homebrew). CI/RBE from a
# macOS host is covered by the build:remote_base OpenSSL vars below (host os = macOS, so
# build:linux does not apply there). See openspec migrate-bazel-rust-crate-vendoring (D6).
build:linux --action_env=OPENSSL_DIR=/usr
build:linux --action_env=OPENSSL_LIB_DIR=/usr/lib/x86_64-linux-gnu
build:linux --action_env=OPENSSL_INCLUDE_DIR=/usr/include
build:linux --action_env=AARCH64_UNKNOWN_LINUX_GNU_OPENSSL_DIR=/usr
build:linux --action_env=AARCH64_UNKNOWN_LINUX_GNU_OPENSSL_LIB_DIR=/usr/lib/aarch64-linux-gnu
build:linux --action_env=AARCH64_UNKNOWN_LINUX_GNU_OPENSSL_INCLUDE_DIR=/usr/include/aarch64-linux-gnu
build:linux --repo_env=OPENSSL_DIR=/usr
build:linux --repo_env=OPENSSL_LIB_DIR=/usr/lib/x86_64-linux-gnu
build:linux --repo_env=OPENSSL_INCLUDE_DIR=/usr/include

build --action_env=CC_aarch64_unknown_linux_gnu=/usr/bin/aarch64-linux-gnu-gcc
build --action_env=CXX_aarch64_unknown_linux_gnu=/usr/bin/aarch64-linux-gnu-g++
build --action_env=AR_aarch64_unknown_linux_gnu=/usr/bin/aarch64-linux-gnu-ar
build --action_env=CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=/usr/bin/aarch64-linux-gnu-gcc
build --action_env=PKG_CONFIG_SYSROOT_DIR_aarch64_unknown_linux_gnu=/
build --action_env=PKG_CONFIG_PATH_aarch64_unknown_linux_gnu=/usr/lib/postgresql/18/lib/pkgconfig:/usr/lib/aarch64-linux-gnu/pkgconfig:/usr/lib/pkgconfig:/usr/share/pkgconfig

# RULES_ERLANG
build --repo_env=RULES_ERLANG_SKIP_SYSTEM=1
build --repo_env=RULES_ELIXIR_SKIP_SYSTEM=1

# Use hermetic Python toolchain from rules_python extension (MODULE.bazel)
# instead of system Python for cross-platform compatibility with remote cache
# Avoid GitHub fallback for Go module fetches in repo rules.
build --repo_env=GOPROXY=https://proxy.golang.org
build --repo_env=NEXT_SKIP_TURBO=1
build --repo_env=NEXT_PRIVATE_SKIP_TURBOPACK=1
build --repo_env=TURBOPACK=
build --java_runtime_version=local_jdk
build --tool_java_runtime_version=local_jdk
build --@io_bazel_rules_go//go/config:pure

# Standard test ergonomics: show failing logs and retry known flaky tests once.
test --test_output=errors
test --test_strategy=standalone
test --remote_executor=
test --action_env=SRQL_TEST_DATABASE_URL
test --action_env=SRQL_TEST_ADMIN_URL
test --action_env=SRQL_TEST_DATABASE_CA_CERT
test --test_env=PATH
test --test_env=CNPG_HOST
test --test_env=CNPG_PORT
test --test_env=CNPG_DATABASE
test --test_env=CNPG_USERNAME
test --test_env=CNPG_PASSWORD
test --test_env=CNPG_SSL_MODE
test --test_env=CNPG_CERT_DIR
test --test_env=TEST_CNPG_HOST
test --test_env=TEST_CNPG_PORT
test --test_env=TEST_CNPG_DATABASE
test --test_env=TEST_CNPG_USERNAME
test --test_env=TEST_CNPG_PASSWORD
test --test_env=SRQL_TEST_DATABASE_CA_CERT
test --action_env=NATS_URL
test --action_env=NATS_SERVER_NAME
test --action_env=NATS_CA_FILE
test --action_env=NATS_CERT_FILE
test --action_env=NATS_KEY_FILE
test --action_env=NATS_CA_B64
test --action_env=NATS_CERT_B64
test --action_env=NATS_KEY_B64
test --@io_bazel_rules_go//go/config:pure
test --flaky_test_attempts=2

# Allow developers to extend configuration locally (ignored in version control).
try-import %workspace%/.bazelrc.local

# Remote caching/execution settings live here; provide BuildBuddy endpoints in
# .bazelrc.remote (kept out of version control until credentials are ready).
try-import %workspace%/.bazelrc.remote

# Metadata for buildbuddy
build --workspace_status_command=$(pwd)/scripts/workspace_status.sh

# Disable remote execution/caching when explicitly requested.
build:no_remote --remote_executor=
build:no_remote --remote_cache=
build:no_remote --remote_upload_local_results=false
build:no_remote --remote_download_minimal
build:no_remote --bes_backend=
build:no_remote --bes_results_url=

# CI profile can layer on top of the remote config without re-declaring values.
build:ci --keep_going --build_tag_filters=-manual
build:ci --noenable_platform_specific_config
build:ci --config=remote_base
build:ci --build_metadata=ROLE=CI
build:ci --bes_results_url=https://carverauto.buildbuddy.io/invocation/
build:ci --bes_backend=grpcs://carverauto.buildbuddy.io
build:ci --remote_cache=grpcs://carverauto.buildbuddy.io
build:ci --remote_timeout=15m
build:ci --strategy=ExpandTemplate=local
build:ci --strategy=NpmPackageExtract=local
build:ci --strategy=CopyDirectory=local

# CI tests should avoid manual-only targets and preserve detailed output.
test:ci --test_tag_filters=-manual --test_output=errors

# Remote execution profile settings shared by CI and --config=remote.
# NOTE: aggregate `bazel run` targets backed by rules_multirun (like //:push)
# fail locally on macOS when using remote execution because host Python tools
# may be resolved for Linux. Use `./scripts/push_all_images.sh` locally, or
# push from CI/Linux where the aggregate target works as intended.
build:remote_base --remote_executor=grpcs://remote.buildbuddy.io
build:remote_base --host_platform=//build/rbe:rbe_platform
build:remote_base --platforms=//build/rbe:rbe_platform
build:remote_base --crosstool_top=@buildbuddy_toolchain//:toolchain
build:remote_base --extra_toolchains=@buildbuddy_toolchain//:cc_toolchain
build:remote_base --extra_execution_platforms=//build/rbe:rbe_platform
# Note: EL9 platform with ZFS support is available via --config=el9
# Do NOT add EL9 to extra_execution_platforms here, as it causes glibc mismatches
# for other targets. Use --config=el9 explicitly for ZFS builds.
build:remote_base --repo_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
build:remote_base --copt=-Wno-use-after-free
build:remote_base --java_language_version=11
build:remote_base --tool_java_language_version=11
build:remote_base --java_runtime_version=remotejdk_11
build:remote_base --tool_java_runtime_version=remotejdk_11
build:remote_base --define=EXECUTOR=remote
build:remote_base --incompatible_strict_action_env
build:remote_base --remote_download_minimal
build:remote_base --remote_upload_local_results
build:remote_base --jobs=100
build:remote_base --strategy=ExpandTemplate=local
build:remote_base --strategy=NpmPackageExtract=local
build:remote_base --strategy=CopyDirectory=local
build:remote_base --action_env=OPENSSL_DIR=/usr
build:remote_base --action_env=OPENSSL_LIB_DIR=/usr/lib/x86_64-linux-gnu
build:remote_base --action_env=OPENSSL_INCLUDE_DIR=/usr/include
build:remote_base --action_env=NEXT_PRIVATE_SKIP_TURBOPACK=1
build:remote_base --action_env=TURBOPACK=
build:remote_base --action_env=NEXT_SKIP_TURBO=1
# Firecracker task sizing defaults (overridable per target/platform).
build:remote_base --remote_default_exec_properties=EstimatedCPU=4
build:remote_base --remote_default_exec_properties=EstimatedMemory=8Gi
test:remote --copt=-Wno-use-after-free
test:remote --action_env=OPENSSL_DIR=/usr
test:remote --action_env=OPENSSL_LIB_DIR=/usr/lib/x86_64-linux-gnu
test:remote --action_env=OPENSSL_INCLUDE_DIR=/usr/include
test:remote --action_env=NEXT_PRIVATE_SKIP_TURBOPACK=1
test:remote --action_env=TURBOPACK=
test:remote --action_env=NEXT_SKIP_TURBO=1

# Remote execution profile (opt-in via --config=remote).
build:remote --config=remote_base
build:remote --noenable_platform_specific_config
build:remote --remote_cache=grpcs://remote.buildbuddy.io
build:remote --remote_timeout=10m

# Remote image publish profile.
# rules_oci push flows need descriptor/config artifacts available locally; using
# minimal downloads can fail later with "Lost inputs no longer available remotely"
# when BuildBuddy evicts intermediate CAS entries before the local push step runs.
build:remote_push --config=remote
build:remote_push --noenable_platform_specific_config
build:remote_push --remote_download_outputs=all
run:remote_push --config=remote
run:remote_push --noenable_platform_specific_config
run:remote_push --remote_download_outputs=all

# Enable clang-tidy diagnostics via --config=clang-tidy
build:clang-tidy --features=clang_tidy
test:clang-tidy --features=clang_tidy

# OCaml toolchain generated via tools_opam is macOS-hosted, which cannot run on
# Linux remote executors. Force OCaml compilation/linking actions to run locally
# until a hermetic Linux toolchain is available.
#build:remote --strategy=CompileOCamlModule=local
#build:remote --strategy=CompileOCamlLibrary=local
#build:remote --strategy=CompileOCamlArchive=local
#build:remote --strategy=OcamlPack=local
#build:remote --strategy=OcamlLink=local

build --build_metadata=REPO_URL=git@github.com:carverauto/serviceradar.git

build:darwin_pkg --platforms=//build/platforms:darwin_exec
build:darwin_pkg --host_platform=//build/platforms:darwin_exec
build:darwin_pkg --extra_execution_platforms=//build/platforms:darwin_exec
build:darwin_pkg --action_env=DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer
build:darwin_pkg --action_env=PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin:/opt/homebrew/bin:/usr/local/go/bin
build:darwin_pkg --action_env=PKG_SIGN_IDENTITY
build:darwin_pkg --action_env=PKG_NOTARIZE_PROFILE
build:darwin_pkg --action_env=PKG_VERSION
build:darwin_pkg --action_env=PKG_IDENTIFIER
build:darwin_pkg --action_env=PKG_DISABLE_TIMESTAMP=0
build:darwin_pkg --action_env=XCODE_VERSION_OVERRIDE=26.0
build:darwin_pkg --remote_default_exec_properties=OSFamily=MacOS
build:darwin_pkg --repo_env=PATH=/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/opt/homebrew/bin
build:darwin_pkg --repo_env=BAZEL=/usr/local/bin/bazel
build:darwin_pkg --repo_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
build:darwin_pkg --config=no_remote

# macOS local builds must keep exec tools on Darwin when remote execution is disabled.
# Usage: bazel build --config=darwin_local <targets>
build:darwin_local --host_platform=//build/platforms:darwin_arm64
build:darwin_local --extra_execution_platforms=//build/platforms:darwin_arm64
build:darwin_local --extra_toolchains=@local_config_cc_toolchains//:all
build:darwin_local --copt=-Wno-unused-command-line-argument
build:darwin_local --host_copt=-Wno-unused-command-line-argument
build:darwin_local --linkopt=-Wno-unused-command-line-argument
build:darwin_local --strategy=CppCompile=local
build:darwin_local --strategy=CppLink=local
# Ensure rules_pkg tar uses host Python on macOS
build:darwin_local --action_env=RULES_PKG_PYTHON=/usr/bin/python3

# Plain local Bazel tests on Apple Silicon also need Darwin exec tools; otherwise
# registered Linux exec platforms can be selected for generated protobuf tools.
build:macos --config=darwin_local
test:macos --config=darwin_local

# EL9-compatible builds using Oracle Linux 9 RBE executor (glibc 2.34)
# Use this for RPM packages targeting RHEL/AlmaLinux/Rocky/Oracle Linux 9
# Note: We duplicate remote_base settings here instead of inheriting, to ensure
# the EL9 platform takes precedence over the default rbe_platform
build:el9 --remote_executor=grpcs://remote.buildbuddy.io
build:el9 --noenable_platform_specific_config
build:el9 --host_platform=//build/platforms:rbe_linux_el9
build:el9 --platforms=//build/platforms:rbe_linux_el9
build:el9 --extra_execution_platforms=//build/platforms:rbe_linux_el9
build:el9 --crosstool_top=@buildbuddy_toolchain//:toolchain
build:el9 --extra_toolchains=@buildbuddy_toolchain//:cc_toolchain
build:el9 --repo_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
build:el9 --copt=-Wno-use-after-free
build:el9 --java_language_version=11
build:el9 --tool_java_language_version=11
build:el9 --java_runtime_version=remotejdk_11
build:el9 --tool_java_runtime_version=remotejdk_11
build:el9 --define=EXECUTOR=remote
build:el9 --incompatible_strict_action_env
# Native-addons / EL9 publish path (rustc+ld, large pure-Go links).
build:el9 --remote_default_exec_properties=EstimatedCPU=4
build:el9 --remote_default_exec_properties=EstimatedMemory=8Gi
build:el9 --remote_download_outputs=all
build:el9 --remote_upload_local_results
build:el9 --jobs=100
build:el9 --strategy=ExpandTemplate=local
build:el9 --strategy=NpmPackageExtract=local
build:el9 --strategy=CopyDirectory=local
build:el9 --action_env=OPENSSL_DIR=/usr
build:el9 --action_env=OPENSSL_LIB_DIR=/usr/lib64
build:el9 --action_env=OPENSSL_INCLUDE_DIR=/usr/include
build:el9 --action_env=PKG_CONFIG_PATH=/usr/lib64/pkgconfig:/usr/pgsql-16/lib/pkgconfig
build:el9 --remote_cache=grpcs://remote.buildbuddy.io
build:el9 --remote_timeout=10m
# Use remote_default_exec_properties to force the EL9 container for all remote actions
build:el9 --remote_default_exec_properties=container-image=docker://ghcr.io/carverauto/serviceradar/rbe-executor-el9:v1.0.23