.github/actions/setup-bazel/action.yaml

name: "Setup Bazel"
description: "Configure Bazel with caching for GitHub Actions workflows"

inputs:
  buildbuddy_api_key:
    description: "BuildBuddy API key to use"
    required: false
    default: ""
  buildbuddy_config:
    description: "BuildBuddy config to enable when buildbuddy_api_key is set"
    required: false
    default: ${{ github.event_name == 'pull_request' && 'buildbuddy_presubmit' || 'buildbuddy_postsubmit' }}

runs:
  using: "composite"
  steps:
    - name: Setup Bazel
      uses: bazel-contrib/setup-bazel@0.19.1
      with:
        # Windows images have a fixed-version `bazel` on PATH, and Bazelisk
        # < 1.29.0 has no windows-arm64 build.
        bazelisk-version: 1.29.0
        bazelisk-cache: true
        disk-cache: true
        # Files hashed to compute the repository cache key. If only `true` is
        # passed, only MODULE.bazel/WORKSPACE* are hashed, so lockfile-only
        # updates would get a cache hit on the old key and skip saving newly
        # downloaded wheels.
        repository-cache: |
          - MODULE.bazel
          - dev/uv.lock
          - tools/publish/requirements_linux.txt
        bazelrc: |
          # .bazelrc enables --config=pyrefly by default; disable the pyrefly
          # output group here so operational workflows don't download the
          # pyrefly toolchain or type-check targets before running them.
          build --output_groups=-pyrefly
          build --//python/config_settings:py_pbs_distribution=install_only_stripped
          ${{ inputs.buildbuddy_api_key && format('common --config={0}', inputs.buildbuddy_config) || '' }}

    # setup-bazel only configures Bazelisk and restores caches; the Bazel
    # binary itself is downloaded by Bazelisk on first invocation. Because
    # Bazelisk does not retry mid-stream download failures, trigger and retry
    # the download upfront via `bazel --version`.
    - name: Download Bazel
      shell: bash
      run: "${GITHUB_ACTION_PATH}/download_bazel.sh"

    # Use github-script to write the key directly to user.bazelrc without
    # passing it via environment variables or CLI args, keeping it out of
    # process tables and child environments.
    - name: Write secret to user.bazelrc
      if: ${{ inputs.buildbuddy_api_key != '' }}
      uses: actions/github-script@v9
      with:
        script: |
          const fs = require('fs');
          fs.appendFileSync(
            'user.bazelrc',
            `common:${{ inputs.buildbuddy_config }} --remote_header=x-buildbuddy-api-key=${{ inputs.buildbuddy_api_key }}\n`,
          );