From ca166177afe4df5fd52dc50006f22c01748aa73d Mon Sep 17 00:00:00 2001 From: Balaji Ganesan Date: Fri, 24 Jul 2026 10:13:01 -0700 Subject: [PATCH 1/2] ci(bazel): harden detect matching + cap matrix concurrency Two fixes for the change-aware detect job restored in #424: 1. Replace `printf ... | grep -q` with a here-string (`grep -q PATTERN <<<"$changed"`). Under `set -o pipefail`, grep -q closes the pipe on its first match and printf can take SIGPIPE (141); pipefail then makes the pipeline non-zero, so a real match reads as no-match and the subtree is silently dropped from the matrix. The here-string removes the pipe. (CodeRabbit finding on #424.) 2. Add max-parallel: 8 to the bazel matrix. A full matrix otherwise starts ~20 jobs at once and every runner pulls actions/checkout from codeload.github.com in the same instant, tripping GitHub's action download rate limit (HTTP 429 in Set up job). Batching keeps the burst under the limit; change-aware scheduling keeps most PRs below the cap. Co-authored-by: Balaji Ganesan --- .github/workflows/bazel.yml | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/.github/workflows/bazel.yml b/.github/workflows/bazel.yml index c37da195a..1e911d7be 100644 --- a/.github/workflows/bazel.yml +++ b/.github/workflows/bazel.yml @@ -183,7 +183,7 @@ jobs: # changeset is never under-tested. # # A change to this workflow itself revalidates everything. - if printf '%s\n' "$changed" | grep -q '^\.github/workflows/bazel\.yml$'; then + if grep -q '^\.github/workflows/bazel\.yml$' <<<"$changed"; then run_all=true fi @@ -193,7 +193,7 @@ jobs: if [ "$run_all" != "true" ]; then while IFS='|' read -r _id path _tests_skip component_kind _ci_lane; do component_kind="$(echo "$component_kind" | xargs)" - if [ "$component_kind" = "java-framework" ] && printf '%s\n' "$changed" | grep -q "^${path}/"; then + if [ "$component_kind" = "java-framework" ] && grep -q "^${path}/" <<<"$changed"; then java_framework_changed=true break fi @@ -266,9 +266,9 @@ jobs: # treats them as full-build triggers, so gate root on them # explicitly; otherwise a root-global .bzl change selects zero rows # and passes without running Bazel. - if [ "$hit" != "true" ] && printf '%s\n' "$changed" | grep -qE '^[^/]+\.bzl$'; then hit=true; fi + if [ "$hit" != "true" ] && grep -qE '^[^/]+\.bzl$' <<<"$changed"; then hit=true; fi else - if printf '%s\n' "$changed" | grep -q "^${path}/"; then hit=true; fi + if grep -q "^${path}/" <<<"$changed"; then hit=true; fi fi # A framework change schedules every registered Java service. if [ "$hit" != "true" ] && [ "$java_framework_changed" = "true" ] && [ "$component_kind" = "java-service" ]; then @@ -319,6 +319,12 @@ jobs: password: ${{ secrets.GITHUB_TOKEN }} strategy: fail-fast: false + # Cap concurrent rows. A full matrix otherwise starts ~20 jobs at once, + # and every runner pulls actions/checkout from codeload.github.com in the + # same instant, tripping GitHub's action-download rate limit (HTTP 429 in + # "Set up job"). Batching keeps the download burst under that limit; + # change-aware scheduling already keeps most PRs well below the cap. + max-parallel: 8 matrix: subtree: ${{ fromJSON(needs.detect.outputs.matrix) }} steps: From 830e395484229b57c58aa5e79d98a975e9292de4 Mon Sep 17 00:00:00 2001 From: Balaji Ganesan Date: Fri, 24 Jul 2026 10:19:48 -0700 Subject: [PATCH 2/2] ci(bazel): cap docker lane concurrency + rename the merge-gate job - Add max-parallel to the bazel-docker matrix so the docker-host rows do not add to the simultaneous actions/checkout burst (companion to the cap on the container bazel job). - Rename the aggregate gate job from "bazel verification" to "bazel required checks" so it is recognizable as the single status check to require for merge. Under change-aware scheduling the individual bazel () rows are dynamic and must not be required; this always-run rollup is the stable gate. Co-authored-by: Balaji Ganesan --- .github/workflows/bazel.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/bazel.yml b/.github/workflows/bazel.yml index 1e911d7be..d929f209a 100644 --- a/.github/workflows/bazel.yml +++ b/.github/workflows/bazel.yml @@ -669,6 +669,9 @@ jobs: runs-on: ubuntu-latest strategy: fail-fast: false + # Cap concurrency here too (see the bazel job) so the docker-host rows + # do not add to the simultaneous actions/checkout burst. + max-parallel: 4 matrix: subtree: ${{ fromJson(needs.detect.outputs.matrix_docker) }} steps: @@ -728,7 +731,7 @@ jobs: retention-days: 14 bazel-verification: - name: bazel verification + name: bazel required checks needs: [detect, bazel, bazel-docker] if: ${{ always() }} runs-on: ubuntu-latest