Repository navigation
ci: offload frontend and policy checks to Bazel workers - #4387
Conversation
|
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
There was a problem hiding this comment.
Note
Newer findings are available below. Devin Review posted a newer report on this PR, in addition to the findings presented here.
Devin Review found 1 potential issue.
1 flag not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)
1f74428 to
92ca35e
Compare
There was a problem hiding this comment.
Devin Review found 1 new potential issue.
1 flag not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)
| cache-key: ci-dashboard | ||
| tailscale-client-id: >- | ||
| ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) | ||
| && ((github.actor_id == '25274700' && vars.TS_BAZEL_CLIENT_ID) | ||
| || (github.actor_id == '158243242' && vars.TS_BAZEL_BOT_CLIENT_ID)) || '' }} |
There was a problem hiding this comment.
🟡 Hosted dashboard cache never warms
On hosted-only runs, dashboard restores the ci-dashboard action cache but never saves its new Bazel outputs. No other job saves that cache key, so later runs repeatedly miss these outputs.
Learn more
The shared setup action restores the job's named Bazel disk cache when the Tailscale client ID is empty. It does not save that cache after the build; other Bazel jobs explicitly use actions/cache/save with steps.bazel.outputs.disk-cache-path and disk-cache-key. This job introduces a distinct ci-dashboard key but lacks a matching save step, so master cannot populate the cache restored by later hosted-only jobs.
Example: A hosted master dashboard build populates its local action cache and completes. A later fork PR restores ci-dashboard, finds no saved master entry, and repeats those actions.
Recommended fix: Add a master-only, always-on save step to dashboard, following the other Bazel jobs and using the bazel step's output path and key. Keep it conditional on the key being nonempty so fleet runs do not attempt a disk-cache save.
Was this helpful? React with 👍 or 👎 to provide feedback.
1 participant
Frontend CI ran tests and typechecks directly on hosted runners even when private Bazel workers were available. Route the Dashboard job through Bazel and the existing restricted Tailscale identity; reuse remote test results across Dashboard and Linux workspace jobs. Move five existing policy-test targets onto the same execution path.
Add Bazel typecheck and adapter targets, declare React's peer types in the shared npm store, and let the adapter fixture use the declared Node executable with its filtered child environment. Check dashboard determinism with two separate builds and file hashes. Keep the committed extension bundle comparison in its canonical pnpm layout because bundler module IDs depend on that layout. Fork and unrecognized-actor runs retain hosted-only execution.
Validation: actionlint and diff checks pass. Linux remote-only validation exercised frontend and policy targets with local fallback disabled; portability failures were corrected and focused reruns passed. Hosted CI validation is pending.