[bazel] Improve job reliability and ensure jobs are time-bound (#5925)

Author: maru-ava

.bazelversion

@@ -1 +1 @@
-8.0.1
+8.8.0

.github/actions/setup-bazel/configure-bazelrc.sh

@@ -9,7 +9,23 @@ common --repo_env=GO_REPOSITORY_USE_HOST_MODCACHE=1
 common --repo_env=GOMODCACHE=${GO_MOD_CACHE_DIR}
 EOF
 
-if [[ "${BAZEL_REMOTE_CACHE_ENABLED:-true}" == "true" && -n "${BAZEL_REMOTE_CACHE_URL:-}" && -n "${BAZEL_REMOTE_CACHE_AUTH_HEADER:-}" ]]; then
+BAZEL_REMOTE_CACHE_ENABLED="${BAZEL_REMOTE_CACHE_ENABLED:-true}"
+BAZEL_REMOTE_CACHE_URL="${BAZEL_REMOTE_CACHE_URL:-}"
+BAZEL_REMOTE_CACHE_AUTH_HEADER="${BAZEL_REMOTE_CACHE_AUTH_HEADER:-}"
+
+if [[ "$BAZEL_REMOTE_CACHE_ENABLED" == "true" && -z "$BAZEL_REMOTE_CACHE_AUTH_HEADER" ]]; then
+  echo "::warning::Bazel remote cache is enabled but BAZEL_REMOTE_CACHE_AUTH_HEADER is empty; continuing without the remote cache."
+fi
+
+if [[ "$BAZEL_REMOTE_CACHE_ENABLED" == "true" && -n "$BAZEL_REMOTE_CACHE_URL" && -n "$BAZEL_REMOTE_CACHE_AUTH_HEADER" ]]; then
+  case "$BAZEL_REMOTE_CACHE_URL" in
+    grpcs://*) ;;
+    *)
+      echo "error: BAZEL_REMOTE_CACHE_URL must use the grpcs:// scheme; see docs/bazel.md#why-the-remote-cache-uses-grpc" >&2
+      exit 1
+      ;;
+  esac
+
   cat >> "$HOME/.bazelrc" <<EOF
 # CI-only remote cache
 build --remote_cache=${BAZEL_REMOTE_CACHE_URL}

.github/workflows/bazel-ci-scheduled.yml

@@ -40,6 +40,11 @@ jobs:
       platform_name: ${{ matrix.platform_name }}
       runner: ${{ matrix.runner }}
       run_race_shuffle_unit_tests: ${{ matrix.run_race_shuffle_unit_tests }}
+      # Scheduled jobs run broader tests without the remote action cache.
+      setup_timeout_minutes: 20
+      unit_timeout_minutes: 60
+      e2e_timeout_minutes: 60
+      required_timeout_minutes: 10
       # Run this daily validation without remote action or test results.
       enable_remote_cache: false
     secrets: inherit

.github/workflows/bazel-ci-smoke.yml

@@ -28,6 +28,7 @@ jobs:
       - unit-smoke
       - e2e-smoke
     runs-on: ${{ inputs.runner }}
+    timeout-minutes: 5
     steps:
       - name: Fail unless all needed jobs succeeded
         shell: bash
@@ -51,6 +52,7 @@ jobs:
   # Prepare Bazel CI for this platform before the smoke tests run.
   setup:
     runs-on: ${{ inputs.runner }}
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v5
       - uses: ./.github/actions/setup-bazel
@@ -64,6 +66,7 @@ jobs:
   unit-smoke:
     needs: setup
     runs-on: ${{ inputs.runner }}
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v5
       - name: Run Bazel unit-test smoke test
@@ -74,6 +77,7 @@ jobs:
   e2e-smoke:
     needs: setup
     runs-on: ${{ inputs.runner }}
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v5
       - name: Run E2E smoke test with Bazel-built binary

.github/workflows/bazel-ci.yml

@@ -21,6 +21,26 @@ on:
         required: false
         type: boolean
         default: true
+      setup_timeout_minutes:
+        description: 'Timeout for the setup job'
+        required: false
+        type: number
+        default: 10
+      unit_timeout_minutes:
+        description: 'Timeout for the unit-test job'
+        required: false
+        type: number
+        default: 30
+      e2e_timeout_minutes:
+        description: 'Timeout for the E2E job'
+        required: false
+        type: number
+        default: 30
+      required_timeout_minutes:
+        description: 'Timeout for the aggregate required job'
+        required: false
+        type: number
+        default: 5
 
 env:
   BAZEL_CI_ENFORCE_DEPENDENCY_LIST: 1
@@ -40,6 +60,7 @@ jobs:
       - unit
       - e2e
     runs-on: ${{ inputs.runner }}
+    timeout-minutes: ${{ inputs.required_timeout_minutes }}
     steps:
       - name: Fail unless all needed jobs succeeded
         shell: bash
@@ -67,6 +88,7 @@ jobs:
   # missing dependencies on its own.
   setup:
     runs-on: ${{ inputs.runner }}
+    timeout-minutes: ${{ inputs.setup_timeout_minutes }}
     steps:
       - uses: actions/checkout@v5
       - uses: ./.github/actions/setup-bazel
@@ -80,6 +102,7 @@ jobs:
   unit:
     needs: setup
     runs-on: ${{ inputs.runner }}
+    timeout-minutes: ${{ inputs.unit_timeout_minutes }}
     steps:
       - uses: actions/checkout@v5
       - name: Run unit tests with Bazel
@@ -90,6 +113,7 @@ jobs:
   e2e:
     needs: setup
     runs-on: ${{ inputs.runner }}
+    timeout-minutes: ${{ inputs.e2e_timeout_minutes }}
     steps:
       - uses: actions/checkout@v5
       - name: Run E2E smoke test with Bazel-built binary