From 5a96bef9e92f4e30fb2f3effd8692e5534d3e032 Mon Sep 17 00:00:00 2001
From: Claudio Bley <claudio.bley@tweag.io>
Date: Tue, 6 Dec 2022 10:19:26 +0100
Subject: [PATCH 1/5] Remove rules_sass which is no longer needed

The rules were formerly used by skydoc.
---
 WORKSPACE | 15 ---------------
 1 file changed, 15 deletions(-)

diff --git a/WORKSPACE b/WORKSPACE
index 403247014..f367fcca3 100755
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -489,21 +489,6 @@ haskell_package_repository_dummy(
     name = "haskell_package_repository_dummy",
 )
 
-http_archive(
-    name = "io_bazel_rules_sass",
-    sha256 = "53b42e9dc1c12d18716518a3810780a0131cd513a6d5c828e1eb3fbd30cc0ba6",
-    strip_prefix = "rules_sass-1.44.0",
-    urls = ["https://github.com/bazelbuild/rules_sass/archive/1.44.0.tar.gz"],
-)
-
-load("@io_bazel_rules_sass//:package.bzl", "rules_sass_dependencies")
-
-rules_sass_dependencies()
-
-load("@io_bazel_rules_sass//:defs.bzl", "sass_repositories")
-
-sass_repositories()
-
 http_archive(
     name = "io_bazel_stardoc",
     sha256 = "c9794dcc8026a30ff67cf7cf91ebe245ca294b20b071845d12c192afe243ad72",

From fcc1404c318f75b05320e943b3e8fa85ac9a200a Mon Sep 17 00:00:00 2001
From: Claudio Bley <claudio.bley@tweag.io>
Date: Tue, 6 Dec 2022 10:34:11 +0100
Subject: [PATCH 2/5] Ensure build metadata for Buildbuddy is populated

Inside a pure nix shell, the `GITHUB_*` environment variables are not set and Buildbuddy
cannot determine metadata automatically.

See https://www.buildbuddy.io/docs/guide-metadata/
---
 .github/workflows/workflow.yaml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/.github/workflows/workflow.yaml b/.github/workflows/workflow.yaml
index eec9f5da4..ce07ebebc 100644
--- a/.github/workflows/workflow.yaml
+++ b/.github/workflows/workflow.yaml
@@ -44,6 +44,10 @@ jobs:
           cat >.bazelrc.local <<EOF
           common --config=ci
           build --config=$BUILD_CONFIG
+          build --build_metadata=REPO_URL=${GITHUB_REPOSITORY}
+          build --build_metadata=BRANCH_NAME=${GITHUB_REF_NAME}
+          build --build_metadata=COMMIT_SHA=${GITHUB_SHA}
+          build --build_metadata=ROLE=CI
           build --remote_header=x-buildbuddy-api-key="$BUILDBUDDY_API_KEY"
           EOF
           cat >~/.netrc <<EOF
@@ -96,6 +100,10 @@ jobs:
           cat >.bazelrc.local <<EOF
           common --config=ci
           build --config=linux-nixpkgs
+          build --build_metadata=REPO_URL=${GITHUB_REPOSITORY}
+          build --build_metadata=BRANCH_NAME=${GITHUB_REF_NAME}
+          build --build_metadata=COMMIT_SHA=${GITHUB_SHA}
+          build --build_metadata=ROLE=CI
           build $cache_setting
           EOF
           ln -sr .bazelrc.local examples/arm/.bazelrc.local
@@ -159,6 +167,10 @@ jobs:
           cat >.bazelrc.local <<EOF
           common --config=ci
           build --config=$BUILD_CONFIG
+          build --build_metadata=REPO_URL=${GITHUB_REPOSITORY}
+          build --build_metadata=BRANCH_NAME=${GITHUB_REF_NAME}
+          build --build_metadata=COMMIT_SHA=${GITHUB_SHA}
+          build --build_metadata=ROLE=CI
           build $cache_setting
           EOF
           cat >~/.netrc <<EOF

From 73c964c004cef394a0d2227efa618bc353787dff Mon Sep 17 00:00:00 2001
From: Claudio Bley <claudio.bley@tweag.io>
Date: Tue, 6 Dec 2022 10:39:59 +0100
Subject: [PATCH 3/5] Use the generated Bazel config for run-start-script

This enables taking advantage of Buildbuddy's cache.
---
 tests/run-start-script.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tests/run-start-script.sh b/tests/run-start-script.sh
index f6053a2c2..026860423 100755
--- a/tests/run-start-script.sh
+++ b/tests/run-start-script.sh
@@ -34,6 +34,8 @@ case "$OSTYPE" in
     ;;
 esac
 
+cp "${pwd}/.bazelrc.local" .
+
 NIX_PATH=nixpkgs="$pwd/nixpkgs/default.nix" \
   bazel run \
   --config=ci "${OSCONFIG[@]}" \

From 3ef802393eca1041c1005b3fabc31cf52243bff6 Mon Sep 17 00:00:00 2001
From: Claudio Bley <claudio.bley@tweag.io>
Date: Tue, 6 Dec 2022 10:43:19 +0100
Subject: [PATCH 4/5] Skip writing to the remote cache with no API key

For PRs from forks (and also dependabot) access to the repository secrets is not
permitted, so the API key for Buildbuddy ends up as empty.

This would lead to an error:
```
WARNING: BES was not properly closed
ERROR: The Build Event Protocol upload failed: Not retrying publishBuildEvents, no more attempts left: status='Status{code=UNAUTHENTICATED, description=failed to parse AP
```
---
 .github/workflows/workflow.yaml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/workflow.yaml b/.github/workflows/workflow.yaml
index ce07ebebc..a207dfa6d 100644
--- a/.github/workflows/workflow.yaml
+++ b/.github/workflows/workflow.yaml
@@ -41,6 +41,11 @@ jobs:
             macOS) BUILD_CONFIG=ci-macos-nixpkgs;;
             Linux) BUILD_CONFIG=ci-linux-nixpkgs;;
           esac
+          if [ -z "$BUILDBUDDY_API_KEY" ]; then
+              cache_setting='--noremote_upload_local_results'
+          else
+              cache_setting="--remote_header=x-buildbuddy-api-key=$BUILDBUDDY_API_KEY"
+          fi
           cat >.bazelrc.local <<EOF
           common --config=ci
           build --config=$BUILD_CONFIG
@@ -48,7 +53,7 @@ jobs:
           build --build_metadata=BRANCH_NAME=${GITHUB_REF_NAME}
           build --build_metadata=COMMIT_SHA=${GITHUB_SHA}
           build --build_metadata=ROLE=CI
-          build --remote_header=x-buildbuddy-api-key="$BUILDBUDDY_API_KEY"
+          build $cache_setting
           EOF
           cat >~/.netrc <<EOF
           machine api.github.com

From bfdf5296cd70e8b63543a4c5f71cba8dad994be8 Mon Sep 17 00:00:00 2001
From: Claudio Bley <claudio.bley@tweag.io>
Date: Tue, 6 Dec 2022 11:21:18 +0100
Subject: [PATCH 5/5] Generate common Bazel CI settings using a helper script

---
 .github/workflows/bazelrc-config.sh | 18 +++++++++++++
 .github/workflows/patch-test.yaml   |  4 +--
 .github/workflows/workflow.yaml     | 39 +++++------------------------
 tests/run-start-script.sh           |  2 +-
 4 files changed, 27 insertions(+), 36 deletions(-)
 create mode 100755 .github/workflows/bazelrc-config.sh

diff --git a/.github/workflows/bazelrc-config.sh b/.github/workflows/bazelrc-config.sh
new file mode 100755
index 000000000..d7713634a
--- /dev/null
+++ b/.github/workflows/bazelrc-config.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+set -e -o pipefail -o nounset
+
+if [ -z "$BUILDBUDDY_API_KEY" ]; then
+    cache_setting='--noremote_upload_local_results'
+else
+    cache_setting="--remote_header=x-buildbuddy-api-key=$BUILDBUDDY_API_KEY"
+fi
+
+cat <<EOF
+common --config=ci
+build --build_metadata=REPO_URL=${GITHUB_REPOSITORY}
+build --build_metadata=BRANCH_NAME=${GITHUB_REF_NAME}
+build --build_metadata=COMMIT_SHA=${GITHUB_SHA}
+build:ci --build_metadata=ROLE=CI
+build $cache_setting
+EOF
diff --git a/.github/workflows/patch-test.yaml b/.github/workflows/patch-test.yaml
index 87b184bb4..e41b86f89 100644
--- a/.github/workflows/patch-test.yaml
+++ b/.github/workflows/patch-test.yaml
@@ -54,10 +54,10 @@ jobs:
             Linux) BUILD_CONFIG=ci-linux-bindist;;
             Windows) BUILD_CONFIG=ci-windows-bindist;;
           esac
+          .github/workflows/bazelrc-config.sh >.bazelrc.ci
           cat >.bazelrc.local <<EOF
-          common --config=ci
           build --config=$BUILD_CONFIG
-          build --remote_header=x-buildbuddy-api-key="$BUILDBUDDY_API_KEY"
+          import %workspace%/.bazelrc.ci
           EOF
           cat >~/.netrc <<EOF
           machine api.github.com
diff --git a/.github/workflows/workflow.yaml b/.github/workflows/workflow.yaml
index a207dfa6d..01a286594 100644
--- a/.github/workflows/workflow.yaml
+++ b/.github/workflows/workflow.yaml
@@ -41,19 +41,10 @@ jobs:
             macOS) BUILD_CONFIG=ci-macos-nixpkgs;;
             Linux) BUILD_CONFIG=ci-linux-nixpkgs;;
           esac
-          if [ -z "$BUILDBUDDY_API_KEY" ]; then
-              cache_setting='--noremote_upload_local_results'
-          else
-              cache_setting="--remote_header=x-buildbuddy-api-key=$BUILDBUDDY_API_KEY"
-          fi
+          .github/workflows/bazelrc-config.sh >.bazelrc.ci
           cat >.bazelrc.local <<EOF
-          common --config=ci
           build --config=$BUILD_CONFIG
-          build --build_metadata=REPO_URL=${GITHUB_REPOSITORY}
-          build --build_metadata=BRANCH_NAME=${GITHUB_REF_NAME}
-          build --build_metadata=COMMIT_SHA=${GITHUB_SHA}
-          build --build_metadata=ROLE=CI
-          build $cache_setting
+          import %workspace%/.bazelrc.ci
           EOF
           cat >~/.netrc <<EOF
           machine api.github.com
@@ -97,19 +88,10 @@ jobs:
           # Avoid failures of the form `deadline exceeded after 14999958197ns DEADLINE_EXCEEDED`.
           # See https://github.com/tweag/rules_haskell/issues/1498 and https://github.com/tweag/rules_haskell/pull/1692.
           sudo sysctl -w net.ipv4.tcp_keepalive_time=60
-          if [ -z "$BUILDBUDDY_API_KEY" ]; then
-              cache_setting='--noremote_upload_local_results'
-          else
-              cache_setting="--remote_header=x-buildbuddy-api-key=$BUILDBUDDY_API_KEY"
-          fi
+          .github/workflows/bazelrc-config.sh >.bazelrc.ci
           cat >.bazelrc.local <<EOF
-          common --config=ci
           build --config=linux-nixpkgs
-          build --build_metadata=REPO_URL=${GITHUB_REPOSITORY}
-          build --build_metadata=BRANCH_NAME=${GITHUB_REF_NAME}
-          build --build_metadata=COMMIT_SHA=${GITHUB_SHA}
-          build --build_metadata=ROLE=CI
-          build $cache_setting
+          import %workspace%/.bazelrc.ci
           EOF
           ln -sr .bazelrc.local examples/arm/.bazelrc.local
           cat >~/.netrc <<EOF
@@ -164,19 +146,10 @@ jobs:
             Linux) BUILD_CONFIG=ci-linux-bindist;;
             Windows) BUILD_CONFIG=ci-windows-bindist;;
           esac
-          if [ -z "$BUILDBUDDY_API_KEY" ]; then
-              cache_setting='--noremote_upload_local_results'
-          else
-              cache_setting="--remote_header=x-buildbuddy-api-key=$BUILDBUDDY_API_KEY"
-          fi
+          .github/workflows/bazelrc-config.sh >.bazelrc.ci
           cat >.bazelrc.local <<EOF
-          common --config=ci
           build --config=$BUILD_CONFIG
-          build --build_metadata=REPO_URL=${GITHUB_REPOSITORY}
-          build --build_metadata=BRANCH_NAME=${GITHUB_REF_NAME}
-          build --build_metadata=COMMIT_SHA=${GITHUB_SHA}
-          build --build_metadata=ROLE=CI
-          build $cache_setting
+          import %workspace%/.bazelrc.ci
           EOF
           cat >~/.netrc <<EOF
           machine api.github.com
diff --git a/tests/run-start-script.sh b/tests/run-start-script.sh
index 026860423..3072eaeb9 100755
--- a/tests/run-start-script.sh
+++ b/tests/run-start-script.sh
@@ -34,7 +34,7 @@ case "$OSTYPE" in
     ;;
 esac
 
-cp "${pwd}/.bazelrc.local" .
+cp "${pwd}/.bazelrc.ci" .bazelrc.local
 
 NIX_PATH=nixpkgs="$pwd/nixpkgs/default.nix" \
   bazel run \