Skip to content

Commit 4a45cc9

Browse files
balajinvdaclaude
balajinvda
and
claude
authored
chore(bazel): remove references to the decommissioned remote cache (#435)
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
1 parent 0e1dc27 commit 4a45cc9

11 files changed

Lines changed: 321 additions & 65 deletions

File tree

‎.github/workflows/bazel.yml‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,13 @@ jobs:
8282
- name: Check Java import boundaries
8383
run: bash tools/ci/check-java-import-boundaries
8484

85+
# Behavioral tests for the CI shell this workflow depends on. actionlint
86+
# covers syntax; these cover the decisions.
87+
- name: Test CI shell helpers
88+
run: |
89+
bash tools/ci/test-bazel-cache-upload-mode
90+
bash tools/ci/test-bazel-remote-probe
91+
8592
- name: Compute changed subtrees
8693
id: detect
8794
env:
@@ -430,14 +437,14 @@ jobs:
430437
if [ -n "$CACHE_TOKEN" ] && [ -n "$CACHE_ENDPOINT" ]; then
431438
printf '%s\n' "${{ vars.BAZEL_REMOTE_CACHE_CA }}" > "$RUNNER_TEMP/cache-ca.pem"
432439
echo "CACHE_READY=1" >> "$GITHUB_ENV"
433-
# Upload results only from main pushes; every other trigger
434-
# (PRs) is read-only so it can never poison the cache.
435-
if [ "$GITHUB_EVENT_NAME" = "push" ] && [ "$GITHUB_REF" = "refs/heads/main" ]; then
436-
upload=true
437-
fi
440+
# Who may write to the shared cache lives in a script so it is
441+
# testable and stated once; see tools/ci/bazel-cache-upload-mode
442+
# and its test for the rationale and the full event matrix.
443+
upload="$(bash "$GITHUB_WORKSPACE/tools/ci/bazel-cache-upload-mode")"
438444
echo "CACHE_UPLOAD=$upload" >> "$GITHUB_ENV"
439445
# Make the mode visible in the log so a missing warm-write is never
440-
# a silent guess: read-only PRs show upload=false, main pushes true.
446+
# a silent guess: read-only PRs show upload=false, merge-queue runs
447+
# and main pushes true.
441448
if [ "$upload" = "true" ]; then
442449
echo "remote cache ready: read-write (warming; upload=true)"
443450
else
@@ -808,7 +815,7 @@ jobs:
808815
printf '%s\n' "$CACHE_CA" > "$RUNNER_TEMP/cache-ca.pem"
809816
echo "CACHE_READY=1" >> "$GITHUB_ENV"
810817
upload=false
811-
if [ "$GITHUB_EVENT_NAME" = "push" ] && [ "$GITHUB_REF" = "refs/heads/main" ]; then upload=true; fi
818+
upload="$(bash "$GITHUB_WORKSPACE/tools/ci/bazel-cache-upload-mode")"
812819
echo "CACHE_UPLOAD=$upload" >> "$GITHUB_ENV"
813820
echo "remote cache ready (upload=$upload)"
814821
else

‎src/compute-plane-services/ess-agent/scripts/.bazel-remote-probe‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,37 +2,40 @@
22
# SPDX-FileCopyrightText: Copyright (c) NVIDIA CORPORATION & AFFILIATES. All rights reserved.
33
# SPDX-License-Identifier: Apache-2.0
44
#
5-
# Probe the nvcfbarn remote cache and export BAZEL_REMOTE_FLAGS with the
5+
# Probe the configured remote cache and export BAZEL_REMOTE_FLAGS with the
66
# right --remote_cache + --tls_certificate flags, or empty if the cache is
77
# unreachable / disabled. Source this file (do NOT execute it) so the
88
# exported var is visible in the parent shell.
99
#
1010
# Driven by four CI/CD variables; all default to safe values that fall back
1111
# to local-only cleanly:
1212
# NVCF_BAZEL_REMOTE "1" to enable, "0" to disable (default 1).
13-
# NVCF_BAZEL_REMOTE_HOST cache host (default nvcfbarn.nvidia.com).
13+
# NVCF_BAZEL_REMOTE_HOST cache host. Unset disables the cache (no default:
14+
# the previous default host was decommissioned).
1415
# NVCF_BAZEL_REMOTE_PORT cache port (443 for the TLS sidecar).
1516
# NVCF_BAZEL_REMOTE_TLS "1" to use grpcs:// + --tls_certificate (default 1).
1617
# BAZEL_REMOTE_CA_PEM File-type CI variable holding the cache's PEM cert.
1718
# Required when TLS=1.
1819

1920
BAZEL_REMOTE_FLAGS=""
20-
if [ "${NVCF_BAZEL_REMOTE:-1}" != "1" ]; then
21-
echo "[bazel-remote] NVCF_BAZEL_REMOTE=${NVCF_BAZEL_REMOTE:-unset}; remote cache disabled"
21+
if [ "${NVCF_BAZEL_REMOTE:-1}" != "1" ] || [ -z "${NVCF_BAZEL_REMOTE_HOST:-}" ]; then
22+
echo "[bazel-remote] remote cache disabled (NVCF_BAZEL_REMOTE=${NVCF_BAZEL_REMOTE:-unset}, NVCF_BAZEL_REMOTE_HOST=${NVCF_BAZEL_REMOTE_HOST:-unset}); building local-only"
2223
else
23-
host="${NVCF_BAZEL_REMOTE_HOST:-nvcfbarn.nvidia.com}"
24+
host="${NVCF_BAZEL_REMOTE_HOST}"
2425
port="${NVCF_BAZEL_REMOTE_PORT:-443}"
2526
tls="${NVCF_BAZEL_REMOTE_TLS:-1}"
26-
if [ "${tls}" = "1" ] && [ -z "${BAZEL_REMOTE_CA_PEM:-}" ]; then
27+
if [ "${tls}" = "1" ] && [ ! -r "${BAZEL_REMOTE_CA_PEM:-}" ]; then
2728
# TLS requires a CA pem. grpcurl can probe with `-insecure`, but
2829
# Bazel's own gRPC client cannot: with `grpcs://` and no
2930
# `--tls_certificate` it tries the system trust store, which does
30-
# not contain the nvcfbarn self-signed cert, and fails mid-build
31+
# not contain the cache's self-signed cert, and fails mid-build
3132
# with "General OpenSslEngine problem". Skip the cache cleanly
3233
# instead of greenlighting an unusable URL. Hit on
3334
# dns-cache/nvcf-unbound!41; set BAZEL_REMOTE_CA_PEM (file-type CI
34-
# variable) to enable.
35-
echo "[bazel-remote] grpcs://${host}:${port} requested but BAZEL_REMOTE_CA_PEM is unset; remote cache disabled. Set the file-type CI variable to enable."
35+
# variable) to enable. The test is -r, not -z: a variable set to a
36+
# path that does not exist would otherwise reach the `cp` below and
37+
# fail the job instead of cleanly declining the cache.
38+
echo "[bazel-remote] grpcs://${host}:${port} requested but BAZEL_REMOTE_CA_PEM is unset or unreadable (${BAZEL_REMOTE_CA_PEM:-unset}); remote cache disabled. Set the file-type CI variable to enable."
3639
elif [ "${tls}" = "1" ] && [ ! -r "${BAZEL_REMOTE_CA_PEM}" ]; then
3740
# Env var is set but the file is missing or unreadable. Treat it
3841
# the same as unset and degrade to local-only rather than failing

‎src/compute-plane-services/nvca/scripts/.bazel-remote-probe‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,39 @@
11
#!/usr/bin/env bash
22
#
3-
# Probe the nvcfbarn remote cache and export BAZEL_REMOTE_FLAGS with the
3+
# Probe the configured remote cache and export BAZEL_REMOTE_FLAGS with the
44
# right --remote_cache + --tls_certificate flags, or empty if the cache is
55
# unreachable / disabled. Source this file (do NOT execute it) so the
66
# exported var is visible in the parent shell.
77
#
88
# Driven by four CI/CD variables; all default to safe values that fall back
99
# to local-only cleanly:
1010
# NVCF_BAZEL_REMOTE "1" to enable, "0" to disable (default 1).
11-
# NVCF_BAZEL_REMOTE_HOST cache host (default nvcfbarn.nvidia.com).
11+
# NVCF_BAZEL_REMOTE_HOST cache host. Unset disables the cache (no default:
12+
# the previous default host was decommissioned).
1213
# NVCF_BAZEL_REMOTE_PORT cache port (443 for the TLS sidecar).
1314
# NVCF_BAZEL_REMOTE_TLS "1" to use grpcs:// + --tls_certificate (default 1).
1415
# BAZEL_REMOTE_CA_PEM File-type CI variable holding the cache's PEM cert.
1516
# Required when TLS=1.
1617

1718
BAZEL_REMOTE_FLAGS=""
18-
if [ "${NVCF_BAZEL_REMOTE:-1}" != "1" ]; then
19-
echo "[bazel-remote] NVCF_BAZEL_REMOTE=${NVCF_BAZEL_REMOTE:-unset}; remote cache disabled"
19+
if [ "${NVCF_BAZEL_REMOTE:-1}" != "1" ] || [ -z "${NVCF_BAZEL_REMOTE_HOST:-}" ]; then
20+
echo "[bazel-remote] remote cache disabled (NVCF_BAZEL_REMOTE=${NVCF_BAZEL_REMOTE:-unset}, NVCF_BAZEL_REMOTE_HOST=${NVCF_BAZEL_REMOTE_HOST:-unset}); building local-only"
2021
else
21-
host="${NVCF_BAZEL_REMOTE_HOST:-nvcfbarn.nvidia.com}"
22+
host="${NVCF_BAZEL_REMOTE_HOST}"
2223
port="${NVCF_BAZEL_REMOTE_PORT:-443}"
2324
tls="${NVCF_BAZEL_REMOTE_TLS:-1}"
24-
if [ "${tls}" = "1" ] && [ -z "${BAZEL_REMOTE_CA_PEM:-}" ]; then
25+
if [ "${tls}" = "1" ] && [ ! -r "${BAZEL_REMOTE_CA_PEM:-}" ]; then
2526
# TLS requires a CA pem. grpcurl can probe with `-insecure`, but
2627
# Bazel's own gRPC client cannot: with `grpcs://` and no
2728
# `--tls_certificate` it tries the system trust store, which does
28-
# not contain the nvcfbarn self-signed cert, and fails mid-build
29+
# not contain the cache's self-signed cert, and fails mid-build
2930
# with "General OpenSslEngine problem". Skip the cache cleanly
3031
# instead of greenlighting an unusable URL. Hit on
3132
# dns-cache/nvcf-unbound!41; set BAZEL_REMOTE_CA_PEM (file-type CI
32-
# variable) to enable.
33-
echo "[bazel-remote] grpcs://${host}:${port} requested but BAZEL_REMOTE_CA_PEM is unset; remote cache disabled. Set the file-type CI variable to enable."
33+
# variable) to enable. The test is -r, not -z: a variable set to a
34+
# path that does not exist would otherwise reach the `cp` below and
35+
# fail the job instead of cleanly declining the cache.
36+
echo "[bazel-remote] grpcs://${host}:${port} requested but BAZEL_REMOTE_CA_PEM is unset or unreadable (${BAZEL_REMOTE_CA_PEM:-unset}); remote cache disabled. Set the file-type CI variable to enable."
3437
else
3538
probe_args=(-d '{"instance_name":""}')
3639
cache_url="grpc://${host}:${port}"

‎src/control-plane-services/function-autoscaler/scripts/.bazel-remote-probe‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,37 +2,40 @@
22
# SPDX-FileCopyrightText: Copyright (c) NVIDIA CORPORATION & AFFILIATES. All rights reserved.
33
# SPDX-License-Identifier: Apache-2.0
44
#
5-
# Probe the nvcfbarn remote cache and export BAZEL_REMOTE_FLAGS with the
5+
# Probe the configured remote cache and export BAZEL_REMOTE_FLAGS with the
66
# right --remote_cache + --tls_certificate flags, or empty if the cache is
77
# unreachable / disabled. Source this file (do NOT execute it) so the
88
# exported var is visible in the parent shell.
99
#
1010
# Driven by four CI/CD variables; all default to safe values that fall back
1111
# to local-only cleanly:
1212
# NVCF_BAZEL_REMOTE "1" to enable, "0" to disable (default 1).
13-
# NVCF_BAZEL_REMOTE_HOST cache host (default nvcfbarn.nvidia.com).
13+
# NVCF_BAZEL_REMOTE_HOST cache host. Unset disables the cache (no default:
14+
# the previous default host was decommissioned).
1415
# NVCF_BAZEL_REMOTE_PORT cache port (443 for the TLS sidecar).
1516
# NVCF_BAZEL_REMOTE_TLS "1" to use grpcs:// + --tls_certificate (default 1).
1617
# BAZEL_REMOTE_CA_PEM File-type CI variable holding the cache's PEM cert.
1718
# Required when TLS=1.
1819

1920
BAZEL_REMOTE_FLAGS=""
20-
if [ "${NVCF_BAZEL_REMOTE:-1}" != "1" ]; then
21-
echo "[bazel-remote] NVCF_BAZEL_REMOTE=${NVCF_BAZEL_REMOTE:-unset}; remote cache disabled"
21+
if [ "${NVCF_BAZEL_REMOTE:-1}" != "1" ] || [ -z "${NVCF_BAZEL_REMOTE_HOST:-}" ]; then
22+
echo "[bazel-remote] remote cache disabled (NVCF_BAZEL_REMOTE=${NVCF_BAZEL_REMOTE:-unset}, NVCF_BAZEL_REMOTE_HOST=${NVCF_BAZEL_REMOTE_HOST:-unset}); building local-only"
2223
else
23-
host="${NVCF_BAZEL_REMOTE_HOST:-nvcfbarn.nvidia.com}"
24+
host="${NVCF_BAZEL_REMOTE_HOST}"
2425
port="${NVCF_BAZEL_REMOTE_PORT:-443}"
2526
tls="${NVCF_BAZEL_REMOTE_TLS:-1}"
26-
if [ "${tls}" = "1" ] && [ -z "${BAZEL_REMOTE_CA_PEM:-}" ]; then
27+
if [ "${tls}" = "1" ] && [ ! -r "${BAZEL_REMOTE_CA_PEM:-}" ]; then
2728
# TLS requires a CA pem. grpcurl can probe with `-insecure`, but
2829
# Bazel's own gRPC client cannot: with `grpcs://` and no
2930
# `--tls_certificate` it tries the system trust store, which does
30-
# not contain the nvcfbarn self-signed cert, and fails mid-build
31+
# not contain the cache's self-signed cert, and fails mid-build
3132
# with "General OpenSslEngine problem". Skip the cache cleanly
3233
# instead of greenlighting an unusable URL. Hit on
3334
# dns-cache/nvcf-unbound!41; set BAZEL_REMOTE_CA_PEM (file-type CI
34-
# variable) to enable.
35-
echo "[bazel-remote] grpcs://${host}:${port} requested but BAZEL_REMOTE_CA_PEM is unset; remote cache disabled. Set the file-type CI variable to enable."
35+
# variable) to enable. The test is -r, not -z: a variable set to a
36+
# path that does not exist would otherwise reach the `cp` below and
37+
# fail the job instead of cleanly declining the cache.
38+
echo "[bazel-remote] grpcs://${host}:${port} requested but BAZEL_REMOTE_CA_PEM is unset or unreadable (${BAZEL_REMOTE_CA_PEM:-unset}); remote cache disabled. Set the file-type CI variable to enable."
3639
elif [ "${tls}" = "1" ] && [ ! -r "${BAZEL_REMOTE_CA_PEM}" ]; then
3740
# Env var is set but the file is missing or unreadable. Treat it
3841
# the same as unset and degrade to local-only rather than failing

‎src/control-plane-services/helm-reval/scripts/.bazel-remote-probe‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,39 @@
11
#!/usr/bin/env bash
22
#
3-
# Probe the nvcfbarn remote cache and export BAZEL_REMOTE_FLAGS with the
3+
# Probe the configured remote cache and export BAZEL_REMOTE_FLAGS with the
44
# right --remote_cache + --tls_certificate flags, or empty if the cache is
55
# unreachable / disabled. Source this file (do NOT execute it) so the
66
# exported var is visible in the parent shell.
77
#
88
# Driven by four CI/CD variables; all default to safe values that fall back
99
# to local-only cleanly:
1010
# NVCF_BAZEL_REMOTE "1" to enable, "0" to disable (default 1).
11-
# NVCF_BAZEL_REMOTE_HOST cache host (default nvcfbarn.nvidia.com).
11+
# NVCF_BAZEL_REMOTE_HOST cache host. Unset disables the cache (no default:
12+
# the previous default host was decommissioned).
1213
# NVCF_BAZEL_REMOTE_PORT cache port (443 for the TLS sidecar).
1314
# NVCF_BAZEL_REMOTE_TLS "1" to use grpcs:// + --tls_certificate (default 1).
1415
# BAZEL_REMOTE_CA_PEM File-type CI variable holding the cache's PEM cert.
1516
# Required when TLS=1.
1617

1718
BAZEL_REMOTE_FLAGS=""
18-
if [ "${NVCF_BAZEL_REMOTE:-1}" != "1" ]; then
19-
echo "[bazel-remote] NVCF_BAZEL_REMOTE=${NVCF_BAZEL_REMOTE:-unset}; remote cache disabled"
19+
if [ "${NVCF_BAZEL_REMOTE:-1}" != "1" ] || [ -z "${NVCF_BAZEL_REMOTE_HOST:-}" ]; then
20+
echo "[bazel-remote] remote cache disabled (NVCF_BAZEL_REMOTE=${NVCF_BAZEL_REMOTE:-unset}, NVCF_BAZEL_REMOTE_HOST=${NVCF_BAZEL_REMOTE_HOST:-unset}); building local-only"
2021
else
21-
host="${NVCF_BAZEL_REMOTE_HOST:-nvcfbarn.nvidia.com}"
22+
host="${NVCF_BAZEL_REMOTE_HOST}"
2223
port="${NVCF_BAZEL_REMOTE_PORT:-443}"
2324
tls="${NVCF_BAZEL_REMOTE_TLS:-1}"
24-
if [ "${tls}" = "1" ] && [ -z "${BAZEL_REMOTE_CA_PEM:-}" ]; then
25+
if [ "${tls}" = "1" ] && [ ! -r "${BAZEL_REMOTE_CA_PEM:-}" ]; then
2526
# TLS requires a CA pem. grpcurl can probe with `-insecure`, but
2627
# Bazel's own gRPC client cannot: with `grpcs://` and no
2728
# `--tls_certificate` it tries the system trust store, which does
28-
# not contain the nvcfbarn self-signed cert, and fails mid-build
29+
# not contain the cache's self-signed cert, and fails mid-build
2930
# with "General OpenSslEngine problem". Skip the cache cleanly
3031
# instead of greenlighting an unusable URL. Hit on
3132
# dns-cache/nvcf-unbound!41; set BAZEL_REMOTE_CA_PEM (file-type CI
32-
# variable) to enable.
33-
echo "[bazel-remote] grpcs://${host}:${port} requested but BAZEL_REMOTE_CA_PEM is unset; remote cache disabled. Set the file-type CI variable to enable."
33+
# variable) to enable. The test is -r, not -z: a variable set to a
34+
# path that does not exist would otherwise reach the `cp` below and
35+
# fail the job instead of cleanly declining the cache.
36+
echo "[bazel-remote] grpcs://${host}:${port} requested but BAZEL_REMOTE_CA_PEM is unset or unreadable (${BAZEL_REMOTE_CA_PEM:-unset}); remote cache disabled. Set the file-type CI variable to enable."
3437
else
3538
probe_args=(-d '{"instance_name":""}')
3639
cache_url="grpc://${host}:${port}"

‎src/invocation-plane-services/grpc-proxy/proxy/geo/BUILD.bazel‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -74,10 +74,12 @@ go_test(
7474
local = True,
7575
# external: testcontainers spins up the localstack Docker container,
7676
# so the test's effective inputs (Docker daemon, localstack image
77-
# tag) live outside Bazel's hermetic action hash. `local = True`
78-
# forces local-only execution but does NOT bypass result caching;
79-
# the `external` tag is what stops nvcfbarn from pinning a green
80-
# forever. requires-docker is kept so callers can filter out
77+
# tag) live outside Bazel's hermetic action hash. `local = True` forces
78+
# local, unsandboxed execution and, measured on Bazel 9.1.1, also stops
79+
# the result being reused from the disk/remote cache. It does not disable
80+
# every cache: the `external` tag is what prevents Bazel reusing a
81+
# previously cached test result. requires-docker is kept so callers
82+
# can filter out
8183
# docker-needing tests with --test_tag_filters=-requires-docker.
8284
tags = [
8385
"external",

‎src/invocation-plane-services/http-invocation/scripts/.bazel-remote-probe‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,37 +2,40 @@
22
# SPDX-FileCopyrightText: Copyright (c) NVIDIA CORPORATION & AFFILIATES. All rights reserved.
33
# SPDX-License-Identifier: Apache-2.0
44
#
5-
# Probe the nvcfbarn remote cache and export BAZEL_REMOTE_FLAGS with the
5+
# Probe the configured remote cache and export BAZEL_REMOTE_FLAGS with the
66
# right --remote_cache + --tls_certificate flags, or empty if the cache is
77
# unreachable / disabled. Source this file (do NOT execute it) so the
88
# exported var is visible in the parent shell.
99
#
1010
# Driven by four CI/CD variables; all default to safe values that fall back
1111
# to local-only cleanly:
1212
# NVCF_BAZEL_REMOTE "1" to enable, "0" to disable (default 1).
13-
# NVCF_BAZEL_REMOTE_HOST cache host (default nvcfbarn.nvidia.com).
13+
# NVCF_BAZEL_REMOTE_HOST cache host. Unset disables the cache (no default:
14+
# the previous default host was decommissioned).
1415
# NVCF_BAZEL_REMOTE_PORT cache port (443 for the TLS sidecar).
1516
# NVCF_BAZEL_REMOTE_TLS "1" to use grpcs:// + --tls_certificate (default 1).
1617
# BAZEL_REMOTE_CA_PEM File-type CI variable holding the cache's PEM cert.
1718
# Required when TLS=1.
1819

1920
BAZEL_REMOTE_FLAGS=""
20-
if [ "${NVCF_BAZEL_REMOTE:-1}" != "1" ]; then
21-
echo "[bazel-remote] NVCF_BAZEL_REMOTE=${NVCF_BAZEL_REMOTE:-unset}; remote cache disabled"
21+
if [ "${NVCF_BAZEL_REMOTE:-1}" != "1" ] || [ -z "${NVCF_BAZEL_REMOTE_HOST:-}" ]; then
22+
echo "[bazel-remote] remote cache disabled (NVCF_BAZEL_REMOTE=${NVCF_BAZEL_REMOTE:-unset}, NVCF_BAZEL_REMOTE_HOST=${NVCF_BAZEL_REMOTE_HOST:-unset}); building local-only"
2223
else
23-
host="${NVCF_BAZEL_REMOTE_HOST:-nvcfbarn.nvidia.com}"
24+
host="${NVCF_BAZEL_REMOTE_HOST}"
2425
port="${NVCF_BAZEL_REMOTE_PORT:-443}"
2526
tls="${NVCF_BAZEL_REMOTE_TLS:-1}"
26-
if [ "${tls}" = "1" ] && [ -z "${BAZEL_REMOTE_CA_PEM:-}" ]; then
27+
if [ "${tls}" = "1" ] && [ ! -r "${BAZEL_REMOTE_CA_PEM:-}" ]; then
2728
# TLS requires a CA pem. grpcurl can probe with `-insecure`, but
2829
# Bazel's own gRPC client cannot: with `grpcs://` and no
2930
# `--tls_certificate` it tries the system trust store, which does
30-
# not contain the nvcfbarn self-signed cert, and fails mid-build
31+
# not contain the cache's self-signed cert, and fails mid-build
3132
# with "General OpenSslEngine problem". Skip the cache cleanly
3233
# instead of greenlighting an unusable URL. Hit on
3334
# dns-cache/nvcf-unbound!41; set BAZEL_REMOTE_CA_PEM (file-type CI
34-
# variable) to enable.
35-
echo "[bazel-remote] grpcs://${host}:${port} requested but BAZEL_REMOTE_CA_PEM is unset; remote cache disabled. Set the file-type CI variable to enable."
35+
# variable) to enable. The test is -r, not -z: a variable set to a
36+
# path that does not exist would otherwise reach the `cp` below and
37+
# fail the job instead of cleanly declining the cache.
38+
echo "[bazel-remote] grpcs://${host}:${port} requested but BAZEL_REMOTE_CA_PEM is unset or unreadable (${BAZEL_REMOTE_CA_PEM:-unset}); remote cache disabled. Set the file-type CI variable to enable."
3639
elif [ "${tls}" = "1" ] && [ ! -r "${BAZEL_REMOTE_CA_PEM}" ]; then
3740
# Env var is set but the file is missing or unreadable. Treat it
3841
# the same as unset and degrade to local-only rather than failing

0 commit comments

Comments
 (0)