.github/actions/setup-bazel/action.yaml

name: "Setup Bazel"
description: "Configure Bazel with caching for GitHub Actions workflows"

inputs:
  buildbuddy_api_key:
    description: "BuildBuddy API key to use"
    required: false
    default: ""
  buildbuddy_config:
    description: "BuildBuddy config to enable when buildbuddy_api_key is set"
    required: false
    default: ${{ github.event_name == 'pull_request' && 'buildbuddy_presubmit' || 'buildbuddy_postsubmit' }}

runs:
  using: "composite"
  steps:
    - name: Sanitize branch name
      id: sanitize_branch
      shell: bash
      env:
        RAW_BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
      # ${var//[^...]/} strips characters outside the safe ref set [a-zA-Z0-9._/-].
      run: printf 'branch_name=%s\n' "${RAW_BRANCH_NAME//[^a-zA-Z0-9._\/-]/}" >> "$GITHUB_OUTPUT"

    - name: Setup Bazel
      uses: bazel-contrib/setup-bazel@0.19.1
      with:
        bazelisk-cache: true
        disk-cache: true
        # Files hashed to compute the repository cache key. If only `true` is
        # passed, only MODULE.bazel/WORKSPACE* are hashed, so lockfile-only
        # updates would get a cache hit on the old key and skip saving newly
        # downloaded wheels.
        repository-cache: |
          - MODULE.bazel
          - dev/uv.lock
          - tools/publish/requirements_linux.txt
        bazelrc: |
          # .bazelrc enables --config=pyrefly by default; disable the pyrefly
          # output group here so operational workflows don't download the
          # pyrefly toolchain or type-check targets before running them.
          build --output_groups=-pyrefly
          build --//python/config_settings:py_pbs_distribution=install_only_stripped
          ${{ inputs.buildbuddy_api_key && format('common --config={0}', inputs.buildbuddy_config) || '' }}
          build --build_metadata=ROLE=CI
          build --build_metadata=VISIBILITY=PUBLIC
          build --build_metadata=RUN_ID=${{ github.run_id }}
          build --build_metadata=ACTOR=${{ github.actor }}
          build --build_metadata=COMMIT_SHA=${{ github.event.pull_request.head.sha || github.sha }}
          ${{ github.event.pull_request.number && format('build --build_metadata=PR_NUMBER={0}', github.event.pull_request.number) || '' }}
          build --build_metadata=BRANCH_NAME=${{ steps.sanitize_branch.outputs.branch_name }}
          build --build_metadata="BUILDBUDDY_LINKS=[GHA Run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})"

    # setup-bazel configures .bazelrc and restores caches. Download Bazelisk
    # and the Bazel binary here with retries, SHA-256 verification, and mirror
    # fallback instead of using setup-bazel's `bazelisk-version` input (which
    # queries api.github.com/repos/bazelbuild/bazelisk/releases without
    # retries) or leaving the Bazel download to the first build step.
    - name: Download Bazel
      shell: bash
      run: "${GITHUB_ACTION_PATH}/download_bazel.py"

    # Use github-script with step-scoped env vars to write the key directly to
    # user.bazelrc without passing it via CLI args, job-wide environment
    # variables, or JS template interpolations.
    - name: Write secret to user.bazelrc
      if: ${{ inputs.buildbuddy_api_key != '' }}
      uses: actions/github-script@v9
      env:
        BUILDBUDDY_API_KEY: ${{ inputs.buildbuddy_api_key }}
        BUILDBUDDY_CONFIG: ${{ inputs.buildbuddy_config }}
      with:
        script: |
          const fs = require('fs');
          fs.appendFileSync(
            'user.bazelrc',
            `common:${process.env.BUILDBUDDY_CONFIG} --remote_header=x-buildbuddy-api-key=${process.env.BUILDBUDDY_API_KEY}\n`,
          );