.github/actions/setup-bazel/action.yaml

name: "Setup Bazel"
description: "Configure Bazel with caching for GitHub Actions workflows"

inputs:
  buildbuddy_api_key:
    description: "BuildBuddy API key to use"
    required: false
    default: ""
  buildbuddy_config:
    description: "BuildBuddy config to enable when buildbuddy_api_key is set"
    required: false
    default: ${{ github.event_name == 'pull_request' && 'buildbuddy_presubmit' || 'buildbuddy_postsubmit' }}

runs:
  using: "composite"
  steps:
    - name: Setup Bazel
      uses: bazel-contrib/setup-bazel@0.19.1
      with:
        bazelisk-cache: true
        disk-cache: true
        # Files hashed to compute the repository cache key. If only `true` is
        # passed, only MODULE.bazel/WORKSPACE* are hashed, so lockfile-only
        # updates would get a cache hit on the old key and skip saving newly
        # downloaded wheels.
        repository-cache: |
          - MODULE.bazel
          - dev/uv.lock
          - tools/publish/requirements_linux.txt
        bazelrc: |
          # .bazelrc enables --config=pyrefly by default; disable the pyrefly
          # output group here so operational workflows don't download the
          # pyrefly toolchain or type-check targets before running them.
          build --output_groups=-pyrefly
          build --//python/config_settings:py_pbs_distribution=install_only_stripped
          ${{ inputs.buildbuddy_api_key && format('common --config={0}', inputs.buildbuddy_config) || '' }}
          build --build_metadata=ROLE=CI
          build --build_metadata=VISIBILITY=PUBLIC
          build --build_metadata=RUN_ID=${{ github.run_id }}
          build --build_metadata=ACTOR=${{ github.actor }}
          build --build_metadata=COMMIT_SHA=${{ github.event.pull_request.head.sha || github.sha }}
          ${{ github.event.pull_request.number && format('build --build_metadata=PR_NUMBER={0}', github.event.pull_request.number) || '' }}
          ${{ (github.head_ref || github.ref_name) && format('build --build_metadata=BRANCH_NAME={0}', github.head_ref || github.ref_name) || '' }}
          build --build_metadata="BUILDBUDDY_LINKS=[GHA Run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})"

    # setup-bazel configures .bazelrc and restores caches. Download Bazelisk
    # and the Bazel binary here with retries, SHA-256 verification, and mirror
    # fallback instead of using setup-bazel's `bazelisk-version` input (which
    # queries api.github.com/repos/bazelbuild/bazelisk/releases without
    # retries) or leaving the Bazel download to the first build step.
    - name: Download Bazel
      shell: bash
      run: "${GITHUB_ACTION_PATH}/download_bazel.py"

    # Use github-script to write the key directly to user.bazelrc without
    # passing it via environment variables or CLI args, keeping it out of
    # process tables and child environments.
    - name: Write secret to user.bazelrc
      if: ${{ inputs.buildbuddy_api_key != '' }}
      uses: actions/github-script@v9
      with:
        script: |
          const fs = require('fs');
          fs.appendFileSync(
            'user.bazelrc',
            `common:${{ inputs.buildbuddy_config }} --remote_header=x-buildbuddy-api-key=${{ inputs.buildbuddy_api_key }}\n`,
          );