From 290404feb7fc95d8b348ee435f8d9fdf149ce57a Mon Sep 17 00:00:00 2001 From: Drew Newberry Date: Mon, 10 Aug 2026 17:44:48 -0700 Subject: [PATCH] refactor(bazel): move test guest rules under bzl Signed-off-by: Drew Newberry --- MODULE.bazel | 2 +- MODULE.bazel.lock | 12 +++++----- architecture/build.md | 24 +++++++++---------- {nix => bzl}/test-guest/BUILD.bazel | 0 {nix => bzl}/test-guest/README.md | 20 ++++++++-------- {nix => bzl}/test-guest/build-image.sh | 0 {nix => bzl}/test-guest/catalog.bzl | 0 .../test-guest/configuration/docker.yml | 0 .../test-guest/configuration/podman.yml | 0 .../test-guest/configuration/selinux.yml | 0 {nix => bzl}/test-guest/extensions.bzl | 0 .../test-guest/host-tools.BUILD.bazel | 0 {nix => bzl}/test-guest/host-tools.nix | 0 {nix => bzl}/test-guest/image-seal.sh | 0 {nix => bzl}/test-guest/nixpkgs.nix | 0 {nix => bzl}/test-guest/run.sh | 4 ++-- .../test-guest/test-guest.MODULE.bazel | 12 +++++----- {nix => bzl}/test-guest/test_guest.bzl | 6 ++--- e2e/run.sh | 2 +- 19 files changed, 40 insertions(+), 42 deletions(-) rename {nix => bzl}/test-guest/BUILD.bazel (100%) rename {nix => bzl}/test-guest/README.md (93%) rename {nix => bzl}/test-guest/build-image.sh (100%) rename {nix => bzl}/test-guest/catalog.bzl (100%) rename {nix => bzl}/test-guest/configuration/docker.yml (100%) rename {nix => bzl}/test-guest/configuration/podman.yml (100%) rename {nix => bzl}/test-guest/configuration/selinux.yml (100%) rename {nix => bzl}/test-guest/extensions.bzl (100%) rename {nix => bzl}/test-guest/host-tools.BUILD.bazel (100%) rename {nix => bzl}/test-guest/host-tools.nix (100%) rename {nix => bzl}/test-guest/image-seal.sh (100%) rename {nix => bzl}/test-guest/nixpkgs.nix (100%) rename {nix => bzl}/test-guest/run.sh (99%) rename {nix => bzl}/test-guest/test-guest.MODULE.bazel (76%) rename {nix => bzl}/test-guest/test_guest.bzl (98%) diff --git a/MODULE.bazel b/MODULE.bazel index 5b21b5983..6e64f5449 100644 --- a/MODULE.bazel +++ b/MODULE.bazel @@ -59,7 +59,7 @@ exports_files([ include("//bazel/annotations:aws-lc-sys.MODULE.bazel") include("//bazel/annotations:z3-sys.MODULE.bazel") include("//bazel/annotations:zstd-sys.MODULE.bazel") -include("//nix/test-guest:test-guest.MODULE.bazel") +include("//bzl/test-guest:test-guest.MODULE.bazel") z3_repository = use_repo_rule("//third_party/z3:repositories.bzl", "z3_repository") diff --git a/MODULE.bazel.lock b/MODULE.bazel.lock index 394699532..50e5afd1f 100644 --- a/MODULE.bazel.lock +++ b/MODULE.bazel.lock @@ -364,7 +364,7 @@ "@@rules_nixpkgs_core+//extensions:package.bzl%nix_pkg": { "general": { "bzlTransitiveDigest": "2alEQC7q9PgrArc8ZeI662VmDHLGfuswqnzBJvVDnmg=", - "usagesDigest": "fl4aParJMb0nPCq6frFoa6jNrTkzN3pIXtOS+jtCE9o=", + "usagesDigest": "GMnvOnFYwW4oMFhsUdj25RAeRBLVnU9Itk5tNi71YBs=", "recordedInputs": [ "REPO_MAPPING:,openshell_nixpkgs rules_nixpkgs_core++nix_repo+openshell_nixpkgs", "REPO_MAPPING:rules_nixpkgs_core+,bazel_skylib bazel_skylib+" @@ -375,14 +375,14 @@ "attributes": { "unmangled_name": "test_guest_host_tools", "attribute_path": "bazelHostTools", - "nix_file": "@@//nix/test-guest:host-tools.nix", + "nix_file": "@@//bzl/test-guest:host-tools.nix", "nix_file_deps": { - "@@//nix/test-guest:run.sh": "'@@//nix/test-guest:run.sh'" + "@@//bzl/test-guest:run.sh": "'@@//bzl/test-guest:run.sh'" }, "nix_file_content": "", "repository": "@@rules_nixpkgs_core++nix_repo+openshell_nixpkgs//:openshell_nixpkgs", "repositories": {}, - "build_file": "@@//nix/test-guest:host-tools.BUILD.bazel", + "build_file": "@@//bzl/test-guest:host-tools.BUILD.bazel", "build_file_content": "", "nixopts": [], "quiet": false, @@ -403,7 +403,7 @@ "@@rules_nixpkgs_core+//extensions:repository.bzl%nix_repo": { "general": { "bzlTransitiveDigest": "dTTtWNdwe7E4j77oKh1mHI1qtdxfaVSGSZa1oPf2QjU=", - "usagesDigest": "AfE65A51oA1/OZrxKwzTys8xTdDXCUyt3dmnbsZnA0E=", + "usagesDigest": "bqUszMUoRUj7FHpInNBJFrGKU8e9C2CfkzSQtVuUlYY=", "recordedInputs": [ "REPO_MAPPING:rules_nixpkgs_core+,bazel_skylib bazel_skylib+" ], @@ -412,7 +412,7 @@ "repoRuleId": "@@rules_nixpkgs_core+//:nixpkgs.bzl%_nixpkgs_local_repository", "attributes": { "unmangled_name": "openshell_nixpkgs", - "nix_file": "@@//nix/test-guest:nixpkgs.nix", + "nix_file": "@@//bzl/test-guest:nixpkgs.nix", "nix_file_deps": [ "@@//:flake.lock" ] diff --git a/architecture/build.md b/architecture/build.md index 47fb4a668..cb7656648 100644 --- a/architecture/build.md +++ b/architecture/build.md @@ -155,20 +155,18 @@ do not infer from kube context. ## Disposable Test Guests -The Nix test guest harness under `nix/test-guest` boots native-architecture cloud images -through QEMU for package, release, and E2E validation. A prepared cache entry is -captured after the exact ordered Ansible configuration list and before -test-specific packages, copied binaries, forwarded ports, or commands. +The Bazel test guest harness under `bzl/test-guest` boots native-architecture cloud images +through QEMU for package, release, and E2E validation. A prepared QCOW2 is +emitted as a cacheable Bazel output after the exact ordered Ansible +configuration list and before test-specific packages, copied binaries, +forwarded ports, or commands. -Prepared disks are flattened, sanitized QCOW2 images. The local cache keeps them -read-only and each test receives a fresh writable overlay and cloud-init -identity. The optional shared cache stores the compressed standalone disk and -its compatibility metadata as a custom OCI artifact. Normal test runs ensure -the exact local entry exists, invoking the cache builder automatically on a -miss before booting a disposable overlay. The separate cache app owns OCI -pulls and explicit publication. OCI pulls require a trusted manifest digest -and retain that provenance with the local entry; mutable tags are used only -for explicit publication. +Prepared disks are flattened, sanitized QCOW2 images with deterministic +compatibility metadata. Bazel stores both outputs in its local or remote action +cache. Run and test targets consume the prepared disk read-only and give each +guest a fresh writable overlay and cloud-init identity. Image construction +executes locally because it needs host virtualization, but its declared outputs +remain eligible for remote cache upload and download. ## Python Wheel Packaging diff --git a/nix/test-guest/BUILD.bazel b/bzl/test-guest/BUILD.bazel similarity index 100% rename from nix/test-guest/BUILD.bazel rename to bzl/test-guest/BUILD.bazel diff --git a/nix/test-guest/README.md b/bzl/test-guest/README.md similarity index 93% rename from nix/test-guest/README.md rename to bzl/test-guest/README.md index c40d4cfbc..16a375032 100644 --- a/nix/test-guest/README.md +++ b/bzl/test-guest/README.md @@ -27,14 +27,14 @@ Linux hosts, and a slower TCG fallback on Linux when KVM is unavailable. Build a prepared Fedora image with Podman: ```shell -bazel build //nix/test-guest:fedora_podman_image +bazel build //bzl/test-guest:fedora_podman_image ``` The target produces cacheable Bazel outputs: ```text -bazel-bin/nix/test-guest/fedora_podman_image.qcow2 -bazel-bin/nix/test-guest/fedora_podman_image.metadata.json +bazel-bin/bzl/test-guest/fedora_podman_image.qcow2 +bazel-bin/bzl/test-guest/fedora_podman_image.metadata.json ``` The image action boots the pinned cloud image, applies its declared Ansible @@ -46,13 +46,13 @@ compressed QCOW2, and validates a fresh boot from that output. Run an interactive guest backed by the prepared image: ```shell -bazel run //nix/test-guest:fedora_podman +bazel run //bzl/test-guest:fedora_podman ``` Arguments after the Bazel separator are passed to the guest runner: ```shell -bazel run //nix/test-guest:ubuntu_docker -- \ +bazel run //bzl/test-guest:ubuntu_docker -- \ --copy ./openshell:/usr/local/bin/openshell \ -- openshell --version ``` @@ -65,7 +65,7 @@ creates a fresh writable overlay; the prepared Bazel output remains unchanged. The representative smoke test consumes the same prepared image provider: ```shell -bazel test //nix/test-guest:fedora_podman_smoke +bazel test //bzl/test-guest:fedora_podman_smoke ``` Image and VM test actions execute locally because they require networking and @@ -86,7 +86,7 @@ Append `_image` to a variant to build its QCOW2 directly. Query the package to see every generated target: ```shell -bazel query //nix/test-guest:all +bazel query //bzl/test-guest:all ``` Ubuntu 24.04 provides Podman 4 without the `pasta` helper required by OpenShell @@ -111,7 +111,7 @@ packages. Strict reproducibility requires pinned distro repository snapshots. Install a repository-built package: ```shell -bazel run //nix/test-guest:ubuntu_docker -- \ +bazel run //bzl/test-guest:ubuntu_docker -- \ --install artifacts/openshell_0.0.0-local_arm64.deb \ -- openshell --version ``` @@ -122,7 +122,7 @@ packages. Package architecture must match the host and guest architecture. Copy executables without packaging them: ```shell -bazel run //nix/test-guest:fedora_podman -- \ +bazel run //bzl/test-guest:fedora_podman -- \ --copy ./openshell:/usr/local/bin/openshell \ -- openshell --version ``` @@ -151,7 +151,7 @@ must correspond to a supported target suffix, such as `rocky_docker_selinux`. ## Directory structure ```text -nix/test-guest/ +bzl/test-guest/ ├── README.md ├── BUILD.bazel ├── catalog.bzl diff --git a/nix/test-guest/build-image.sh b/bzl/test-guest/build-image.sh similarity index 100% rename from nix/test-guest/build-image.sh rename to bzl/test-guest/build-image.sh diff --git a/nix/test-guest/catalog.bzl b/bzl/test-guest/catalog.bzl similarity index 100% rename from nix/test-guest/catalog.bzl rename to bzl/test-guest/catalog.bzl diff --git a/nix/test-guest/configuration/docker.yml b/bzl/test-guest/configuration/docker.yml similarity index 100% rename from nix/test-guest/configuration/docker.yml rename to bzl/test-guest/configuration/docker.yml diff --git a/nix/test-guest/configuration/podman.yml b/bzl/test-guest/configuration/podman.yml similarity index 100% rename from nix/test-guest/configuration/podman.yml rename to bzl/test-guest/configuration/podman.yml diff --git a/nix/test-guest/configuration/selinux.yml b/bzl/test-guest/configuration/selinux.yml similarity index 100% rename from nix/test-guest/configuration/selinux.yml rename to bzl/test-guest/configuration/selinux.yml diff --git a/nix/test-guest/extensions.bzl b/bzl/test-guest/extensions.bzl similarity index 100% rename from nix/test-guest/extensions.bzl rename to bzl/test-guest/extensions.bzl diff --git a/nix/test-guest/host-tools.BUILD.bazel b/bzl/test-guest/host-tools.BUILD.bazel similarity index 100% rename from nix/test-guest/host-tools.BUILD.bazel rename to bzl/test-guest/host-tools.BUILD.bazel diff --git a/nix/test-guest/host-tools.nix b/bzl/test-guest/host-tools.nix similarity index 100% rename from nix/test-guest/host-tools.nix rename to bzl/test-guest/host-tools.nix diff --git a/nix/test-guest/image-seal.sh b/bzl/test-guest/image-seal.sh similarity index 100% rename from nix/test-guest/image-seal.sh rename to bzl/test-guest/image-seal.sh diff --git a/nix/test-guest/nixpkgs.nix b/bzl/test-guest/nixpkgs.nix similarity index 100% rename from nix/test-guest/nixpkgs.nix rename to bzl/test-guest/nixpkgs.nix diff --git a/nix/test-guest/run.sh b/bzl/test-guest/run.sh similarity index 99% rename from nix/test-guest/run.sh rename to bzl/test-guest/run.sh index ac1875e5e..2f54d086c 100644 --- a/nix/test-guest/run.sh +++ b/bzl/test-guest/run.sh @@ -9,7 +9,7 @@ set -Eeuo pipefail usage() { cat <<'EOF' Usage: - bazel run //nix/test-guest:VARIANT -- [OPTIONS] [-- COMMAND...] + bazel run //bzl/test-guest:VARIANT -- [OPTIONS] [-- COMMAND...] Options: --install PATH Install a .deb or .rpm package; repeatable @@ -25,7 +25,7 @@ EOF } if [ "${OPENSHELL_TEST_GUEST_RUNTIME:-}" != 1 ]; then - echo "run this script through a //nix/test-guest Bazel target" >&2 + echo "run this script through a //bzl/test-guest Bazel target" >&2 exit 2 fi diff --git a/nix/test-guest/test-guest.MODULE.bazel b/bzl/test-guest/test-guest.MODULE.bazel similarity index 76% rename from nix/test-guest/test-guest.MODULE.bazel rename to bzl/test-guest/test-guest.MODULE.bazel index b3ace6357..2d923abaa 100644 --- a/nix/test-guest/test-guest.MODULE.bazel +++ b/bzl/test-guest/test-guest.MODULE.bazel @@ -9,7 +9,7 @@ nix_repo = use_extension( ) nix_repo.file( name = "openshell_nixpkgs", - file = "//nix/test-guest:nixpkgs.nix", + file = "//bzl/test-guest:nixpkgs.nix", file_deps = ["//:flake.lock"], ) use_repo(nix_repo, "openshell_nixpkgs") @@ -21,16 +21,16 @@ nix_pkg = use_extension( nix_pkg.file( name = "test_guest_host_tools", attr = "bazelHostTools", - build_file = "//nix/test-guest:host-tools.BUILD.bazel", - file = "//nix/test-guest:host-tools.nix", + build_file = "//bzl/test-guest:host-tools.BUILD.bazel", + file = "//bzl/test-guest:host-tools.nix", file_deps = [ - "//nix/test-guest:run.sh", + "//bzl/test-guest:run.sh", ], repo = "@openshell_nixpkgs", ) use_repo(nix_pkg, "test_guest_host_tools") -test_guest_images = use_extension("//nix/test-guest:extensions.bzl", "test_guest_images") +test_guest_images = use_extension("//bzl/test-guest:extensions.bzl", "test_guest_images") use_repo( test_guest_images, "test_guest_centos_aarch64", @@ -43,4 +43,4 @@ use_repo( "test_guest_ubuntu_x86_64", ) -register_toolchains("//nix/test-guest:nix_host_tools_toolchain") +register_toolchains("//bzl/test-guest:nix_host_tools_toolchain") diff --git a/nix/test-guest/test_guest.bzl b/bzl/test-guest/test_guest.bzl similarity index 98% rename from nix/test-guest/test_guest.bzl rename to bzl/test-guest/test_guest.bzl index 6cb2ca4ce..046d6f887 100644 --- a/nix/test-guest/test_guest.bzl +++ b/bzl/test-guest/test_guest.bzl @@ -3,7 +3,7 @@ load("@rules_shell//shell:sh_binary.bzl", "sh_binary") load("@rules_shell//shell:sh_test.bzl", "sh_test") -_HOST_TOOLS_TOOLCHAIN = "//nix/test-guest:host_tools_toolchain_type" +_HOST_TOOLS_TOOLCHAIN = "//bzl/test-guest:host_tools_toolchain_type" TestGuestBaseImageInfo = provider( fields = { @@ -168,11 +168,11 @@ test_guest_image = rule( "generation": attr.int(default = 1), "_builder": attr.label( allow_single_file = True, - default = "//nix/test-guest:build-image.sh", + default = "//bzl/test-guest:build-image.sh", ), "_seal": attr.label( allow_single_file = True, - default = "//nix/test-guest:image-seal.sh", + default = "//bzl/test-guest:image-seal.sh", ), }, toolchains = [_HOST_TOOLS_TOOLCHAIN], diff --git a/e2e/run.sh b/e2e/run.sh index 3f39e8929..bd6a8560e 100755 --- a/e2e/run.sh +++ b/e2e/run.sh @@ -163,7 +163,7 @@ if [ "${mode}" = vm ]; then for configuration in "${with_configurations[@]}"; do vm_target_name+=_${configuration} done - vm_bazel_target="//nix/test-guest:${vm_target_name}" + vm_bazel_target="//bzl/test-guest:${vm_target_name}" if ! (cd "${ROOT}" && bazel query "${vm_bazel_target}" >/dev/null); then die "unsupported Bazel test-guest combination: ${vm_target_name}" fi