Implement non-official filtering options

.github/workflows/build.yaml

@@ -1,10 +1,6 @@
 name: build
 
 on:
-  push:
-    branches: ["main"]
-
-  pull_request:
   workflow_call:
     secrets:
       BUILDBUDDY_API_KEY:
@@ -29,8 +25,11 @@ jobs:
         env:
           BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
         run: |
-          bazel build --config release --config remote \
+          bazel build \
+            --config release \
+            --config remote \
             --remote_header=x-buildbuddy-api-key=$BUILDBUDDY_API_KEY \
+            --@libarchive//:use_mbedtls=true \
             //:for_all_platforms
           mv bazel-out/linux_amd64_musl-opt/bin/pkgutil pkgutil_linux_amd64
           mv bazel-out/linux_arm64_musl-opt/bin/pkgutil pkgutil_linux_arm64

.github/workflows/test.yml

@@ -0,0 +1,66 @@
+name: pkgutil-tests
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Test (${{ matrix.name }})
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: macos-arm64
+            runner: macos-latest
+          - name: linux-amd64
+            runner: ubuntu-latest
+          # - name: linux-arm64
+            # runner: ubuntu-24.04-arm64
+          # rules_zig doesn't work there :(
+          - name: windows-amd64
+            runner: windows-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Bazelisk
+        uses: bazel-contrib/setup-bazel@0.18.0
+        with:
+          # Avoid downloading Bazel every time.
+          bazelisk-cache: true
+          # Store build cache per workflow.
+          disk-cache: ${{ github.workflow }}
+          # Share repository cache between workflows.
+          repository-cache: true
+
+      - name: bazel build //:for_all_platforms
+        env:
+          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
+        shell: bash
+        run: |
+          bazel build \
+            --config release \
+            --config remote \
+            --remote_header=x-buildbuddy-api-key=$BUILDBUDDY_API_KEY \
+            --@libarchive//:use_mbedtls=true \
+            //:for_all_platforms
+
+      - name: bazel test //...
+        if: matrix.name != 'windows-amd64'
+        env:
+          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
+        shell: bash
+        run: |
+          bazel test --test_output=errors \
+            --config release \
+            --config remote \
+            --remote_header=x-buildbuddy-api-key=$BUILDBUDDY_API_KEY \
+            --@libarchive//:use_mbedtls=true \
+            //...

BUILD.bazel

@@ -34,7 +34,7 @@ cc_binary(
     platform_transition_binary(
         name = "for_" + platform.split(":")[1],
         binary = ":pkgutil",
-        tags = ["no-remote"] if platform == "@toolchains_llvm_bootstrapped//platforms:macos_arm64" else [],
+        tags = ["manual"] + ["no-remote"] if platform == "@toolchains_llvm_bootstrapped//platforms:macos_arm64" else [],
         target_platform = platform,
     )
     for platform in PLATFORMS
@@ -46,4 +46,5 @@ filegroup(
         ":for_" + platform.split(":")[1]
         for platform in PLATFORMS
     ],
+    tags = ["manual"],
 )

MODULE.bazel

@@ -11,6 +11,10 @@ bazel_dep(name = "libarchive", version = "3.8.1")
 bazel_dep(name = "toolchains_llvm_bootstrapped", version = "0.4.1")
 bazel_dep(name = "rules_cc", version = "0.2.14")
 
+bazel_dep(name = "bazel_skylib", version = "1.9.0", dev_dependency = True)
+bazel_dep(name = "rules_shell", version = "0.5.0", dev_dependency = True)
+bazel_dep(name = "rules_zig", version = "0.12.3", dev_dependency = True)
+
 register_toolchains(
     "@toolchains_llvm_bootstrapped//toolchain:all",
 )
@@ -45,3 +49,33 @@ single_version_override(
     module_name = "mbedtls",
     version = "3.6.0.bcr.1",
 )
+
+single_version_override(
+    module_name = "zlib",
+    version = "1.3.1.bcr.8",
+)
+
+## TESTS
+
+http_file = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_file")
+
+http_file(
+    name = "component_pkg",
+    urls = ["https://swcdn.apple.com/content/downloads/52/01/082-41241-A_0747ZN8FHV/dectd075r63pppkkzsb75qk61s0lfee22j/CLTools_macOSNMOS_SDK.pkg"],
+    downloaded_file_path = "component.pkg",
+    sha256 = "ba3453d62b3d2babf67f3a4a44e8073d6555c85f114856f4390a1f53bd76e24a",
+)
+
+http_file(
+    name = "product_pkg",
+    urls = ["https://www.python.org/ftp/python/3.14.3/python-3.14.3-macos11.pkg"],
+    downloaded_file_path = "product.pkg",
+    sha256 = "50b709f72cb5ed87d5882901923face981dd657569717761832c36db3bf08238",
+)
+
+archive_override(
+    module_name = "toolchains_llvm_bootstrapped",
+    urls = ["https://github.com/cerisier/toolchains_llvm_bootstrapped/archive/9799c1d0d976409451bbe5275e8d3d607e442956.tar.gz"],
+    strip_prefix = "toolchains_llvm_bootstrapped-9799c1d0d976409451bbe5275e8d3d607e442956",
+    integrity = "sha256-SJuGXePryLXuDemHsvfajLFMHT+vonxstVddkJlhbrg=",
+)