feat(build): prototype Bazel build system

.bazelrc

@@ -0,0 +1 @@
+build --@rules_rs//rs/private/prost:compile_well_known_types=false

.bazelversion

@@ -0,0 +1 @@
+9.1.0

.github/workflows/branch-checks.yml

@@ -139,6 +139,31 @@ jobs:
           fi
           exit 0
 
+  bazel:
+    name: Bazel (${{ matrix.runner }})
+    needs: pr_metadata
+    if: needs.pr_metadata.outputs.should_run == 'true'
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: [ubuntu-24.04, ubuntu-24.04-arm, macos-15]
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Bazel
+        uses: bazel-contrib/setup-bazel@c5acdfb288317d0b5c0bbd7a396a3dc868bb0f86 # v0.19.0
+        with:
+          bazelisk-cache: true
+          disk-cache: ${{ github.workflow }}-${{ matrix.runner }}
+          repository-cache: true
+
+      - name: Build
+        run: bazel build //...
+
+      - name: Test
+        run: bazel test --test_output=errors //...
+
   python:
     name: Python (${{ matrix.runner }})
     needs: pr_metadata

.gitignore

@@ -230,3 +230,6 @@ scripts/lint-mermaid/node_modules/
 # Nix
 /result
 /result-*
+
+# Bazel
+bazel-*

MODULE.bazel

@@ -0,0 +1,60 @@
+bazel_dep(name = "rules_rs", version = "0.0.96")
+bazel_dep(name = "llvm", version = "0.8.11")
+bazel_dep(name = "platforms", version = "1.1.0")
+bazel_dep(name = "rules_proto", version = "7.1.0")
+bazel_dep(name = "protobuf", version = "34.0.bcr.1")
+
+include("//bazel/annotations:aws-lc-sys.MODULE.bazel")
+include("//bazel/annotations:zstd-sys.MODULE.bazel")
+
+osx = use_extension("@llvm//extensions:osx.bzl", "osx")
+osx.frameworks(
+    names = [
+        "CFNetwork",
+        "CoreFoundation",
+        "CoreServices",
+        "DiskArbitration",
+        "Foundation",
+        "IOKit",
+        "Kernel",
+        "OSLog",
+        "Security",
+        "SystemConfiguration",
+    ],
+)
+
+workspace_version_repository = use_repo_rule("//bazel:cargo_version.bzl", "workspace_version_repository")
+
+workspace_version_repository(
+    name = "workspace_version",
+    manifest = "//:Cargo.toml",
+)
+
+toolchains = use_extension("@rules_rs//rs/toolchains:module_extension.bzl", "toolchains")
+toolchains.toolchain(
+    edition = "2024",
+    version = "1.95.0",
+)
+use_repo(toolchains, "default_rust_toolchains")
+
+rules_rust = use_extension("@rules_rs//rs:rules_rust.bzl", "rules_rust")
+use_repo(rules_rust, "rules_rust")
+
+register_toolchains(
+    "@default_rust_toolchains//:all",
+    "@llvm//toolchain:all",
+    "@rules_rust//extensions/prost:default_prost_toolchain",
+)
+
+crate = use_extension("@rules_rs//rs:extensions.bzl", "crate")
+crate.from_cargo(
+    name = "crates",
+    cargo_lock = "//:Cargo.lock",
+    cargo_toml = "//:Cargo.toml",
+    platform_triples = [
+        "aarch64-apple-darwin",
+        "aarch64-unknown-linux-gnu",
+        "x86_64-unknown-linux-gnu",
+    ],
+)
+use_repo(crate, "crates")

bazel/BUILD.bazel

@@ -0,0 +1 @@
+exports_files(["cargo_version.bzl"])

bazel/annotations/BUILD.bazel

@@ -0,0 +1,4 @@
+exports_files([
+    "aws-lc-sys.MODULE.bazel",
+    "zstd-sys.MODULE.bazel",
+])

bazel/annotations/aws-lc-sys.MODULE.bazel

@@ -0,0 +1,22 @@
+bazel_dep(name = "aws-lc", version = "5.1.0")
+
+rules_rust_bindgen = use_extension("@rules_rs//rs:rules_rust_bindgen.bzl", "rules_rust_bindgen")
+use_repo(rules_rust_bindgen, "rules_rust_bindgen")
+
+register_toolchains("@rules_rust_bindgen//:all")
+
+crate = use_extension("@rules_rs//rs:extensions.bzl", "crate")
+crate.annotation(
+    crate = "aws-lc-rs",
+    gen_build_script = "off",
+)
+crate.annotation(
+    additive_build_file = "@rules_rs//3rd_party/aws-lc-sys:additive.BUILD.bazel",
+    crate = "aws-lc-sys",
+    extra_aliased_targets = {"aws_lc_sys_build_info": "aws_lc_sys_build_info"},
+    gen_build_script = "off",
+    rustc_flags = ["--cfg=use_bindgen_pregenerated"],
+    deps = ["@crates//:aws_lc_sys_build_info"],
+)
+
+inject_repo(crate, "aws-lc")

bazel/annotations/zstd-sys.MODULE.bazel

@@ -0,0 +1,8 @@
+bazel_dep(name = "zstd", version = "1.5.7.bcr.1")
+
+crate = use_extension("@rules_rs//rs:extensions.bzl", "crate")
+crate.annotation(
+    crate = "zstd-sys",
+    gen_build_script = "off",
+    deps = ["@zstd"],
+)

bazel/cargo_version.bzl

@@ -0,0 +1,33 @@
+def _workspace_version_repository_impl(repository_ctx):
+    in_workspace_package = False
+
+    for raw_line in repository_ctx.read(repository_ctx.attr.manifest).splitlines():
+        line = raw_line.strip()
+
+        if line.startswith("["):
+            in_workspace_package = line == "[workspace.package]"
+            continue
+
+        if not in_workspace_package or not line.startswith("version"):
+            continue
+
+        value = line.split("=", 1)[1].strip()
+        if not value.startswith('"') or value.find('"', 1) == -1:
+            fail("workspace package version must be a quoted string")
+
+        version = value[1:value.find('"', 1)]
+        repository_ctx.file("BUILD.bazel", 'exports_files(["version.bzl"])\n')
+        repository_ctx.file("version.bzl", 'WORKSPACE_VERSION = "{}"\n'.format(version))
+        return
+
+    fail("workspace package version not found in {}".format(repository_ctx.attr.manifest))
+
+workspace_version_repository = repository_rule(
+    implementation = _workspace_version_repository_impl,
+    attrs = {
+        "manifest": attr.label(
+            allow_single_file = True,
+            mandatory = True,
+        ),
+    },
+)

crates/openshell-bootstrap/BUILD.bazel

@@ -0,0 +1,17 @@
+load("@crates//:defs.bzl", "aliases", "all_crate_deps")
+load("@rules_rs//rs:rust_library.bzl", "rust_library")
+load("@rules_rs//rs:rust_test.bzl", "rust_test")
+
+rust_library(
+    name = "openshell-bootstrap",
+    srcs = glob(["src/**/*.rs"]),
+    aliases = aliases(),
+    visibility = ["//visibility:public"],
+    deps = all_crate_deps(normal = True),
+)
+
+rust_test(
+    name = "openshell-bootstrap_test",
+    crate = ":openshell-bootstrap",
+    deps = all_crate_deps(normal_dev = True),
+)

crates/openshell-cli/BUILD.bazel

@@ -0,0 +1,105 @@
+load("@crates//:defs.bzl", "aliases", "all_crate_deps")
+load("@rules_rs//rs:rust_binary.bzl", "rust_binary")
+load("@rules_rs//rs:rust_library.bzl", "rust_library")
+load("@rules_rs//rs:rust_test.bzl", "rust_test")
+load("@workspace_version//:version.bzl", "WORKSPACE_VERSION")
+
+rust_library(
+    name = "openshell-cli",
+    srcs = glob(["src/**/*.rs"], exclude = ["src/main.rs"]),
+    aliases = aliases(),
+    version = WORKSPACE_VERSION,
+    deps = all_crate_deps(normal = True),
+)
+
+rust_binary(
+    name = "openshell",
+    srcs = ["src/main.rs"],
+    aliases = aliases(),
+    visibility = ["//visibility:public"],
+    version = WORKSPACE_VERSION,
+    deps = all_crate_deps(normal = True) + [":openshell-cli"],
+)
+
+rust_binary(
+    name = "fake-forward-process",
+    srcs = ["tests/fixtures/fake_forward.rs"],
+    crate_root = "tests/fixtures/fake_forward.rs",
+    testonly = True,
+)
+
+rust_test(
+    name = "openshell-cli_lib_test",
+    crate = ":openshell-cli",
+    tags = ["no-sandbox"],
+    deps = all_crate_deps(normal_dev = True),
+)
+
+rust_test(
+    name = "openshell-cli_bin_test",
+    srcs = ["src/main.rs"],
+    aliases = aliases(),
+    version = WORKSPACE_VERSION,
+    deps = all_crate_deps(normal = True, normal_dev = True) + [":openshell-cli"],
+)
+
+rust_test(
+    name = "ensure_providers_integration_test",
+    srcs = [
+        "tests/ensure_providers_integration.rs",
+        "tests/helpers/mod.rs",
+    ],
+    aliases = aliases(),
+    crate_root = "tests/ensure_providers_integration.rs",
+    deps = all_crate_deps(normal = True, normal_dev = True) + [":openshell-cli"],
+)
+
+rust_test(
+    name = "mtls_integration_test",
+    srcs = [
+        "tests/helpers/mod.rs",
+        "tests/mtls_integration.rs",
+    ],
+    aliases = aliases(),
+    crate_root = "tests/mtls_integration.rs",
+    deps = all_crate_deps(normal = True, normal_dev = True) + [":openshell-cli"],
+)
+
+rust_test(
+    name = "provider_commands_integration_test",
+    srcs = [
+        "tests/helpers/mod.rs",
+        "tests/provider_commands_integration.rs",
+    ],
+    aliases = aliases(),
+    crate_root = "tests/provider_commands_integration.rs",
+    deps = all_crate_deps(normal = True, normal_dev = True) + [":openshell-cli"],
+)
+
+rust_test(
+    name = "sandbox_create_lifecycle_integration_test",
+    srcs = [
+        "tests/helpers/mod.rs",
+        "tests/fixtures/fake_forward.rs",
+        "tests/sandbox_create_lifecycle_integration.rs",
+    ],
+    aliases = aliases(),
+    crate_root = "tests/sandbox_create_lifecycle_integration.rs",
+    data = [":fake-forward-process"],
+    tags = ["no-sandbox"],
+    deps = all_crate_deps(normal = True, normal_dev = True) + [":openshell-cli"],
+    env = {
+        "OPENSHELL_TEST_FAKE_FORWARD_PATH": "$(rootpath :fake-forward-process)",
+    },
+)
+
+rust_test(
+    name = "sandbox_name_fallback_integration_test",
+    srcs = [
+        "tests/helpers/mod.rs",
+        "tests/sandbox_name_fallback_integration.rs",
+    ],
+    aliases = aliases(),
+    crate_root = "tests/sandbox_name_fallback_integration.rs",
+    deps = all_crate_deps(normal = True, normal_dev = True) + [":openshell-cli"],
+)

crates/openshell-cli/src/run.rs

@@ -9738,7 +9738,21 @@ mod tests {
         assert_eq!(message, "sandbox provisioning timed out after 120s");
     }
 
-    fn init_git_repo(path: &Path) {
+    struct GitTestGuard {
+        _lock: std::sync::MutexGuard<'static, ()>,
+    }
+
+    impl GitTestGuard {
+        fn new() -> Self {
+            let lock = TEST_ENV_LOCK
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner);
+            Self { _lock: lock }
+        }
+    }
+
+    fn init_git_repo(path: &Path) -> GitTestGuard {
+        let guard = GitTestGuard::new();
         let mut command = Command::new("git");
         super::scrub_git_env(&mut command);
         let status = command
@@ -9747,14 +9761,15 @@ mod tests {
             .status()
             .expect("git init");
         assert!(status.success(), "git init should succeed");
+        guard
     }
 
     #[test]
     fn git_sync_files_scopes_single_file_to_requested_path() {
         let tmpdir = tempfile::tempdir().expect("create tmpdir");
         let repo = tmpdir.path().join("repo");
         fs::create_dir_all(repo.join("nested")).expect("create repo");
-        init_git_repo(&repo);
+        let _git = init_git_repo(&repo);
 
         fs::write(repo.join("tracked.txt"), "tracked").expect("write tracked.txt");
         fs::write(repo.join("nested/other.txt"), "other").expect("write other.txt");
@@ -9773,7 +9788,7 @@ mod tests {
         let tmpdir = tempfile::tempdir().expect("create tmpdir");
         let repo = tmpdir.path().join("repo");
         fs::create_dir_all(repo.join("nested/inner")).expect("create repo");
-        init_git_repo(&repo);
+        let _git = init_git_repo(&repo);
 
         fs::write(repo.join("nested/file.txt"), "file").expect("write file.txt");
         fs::write(repo.join("nested/inner/child.txt"), "child").expect("write child.txt");
@@ -9808,7 +9823,7 @@ mod tests {
         let tmpdir = tempfile::tempdir().expect("create tmpdir");
         let repo = tmpdir.path().join("repo");
         fs::create_dir_all(&repo).expect("create repo");
-        init_git_repo(&repo);
+        let _git = init_git_repo(&repo);
         let missing = repo.join("missing");
 
         let err = sandbox_upload_plan(&missing, true).expect_err("missing path should error");
@@ -9825,7 +9840,7 @@ mod tests {
         let tmpdir = tempfile::tempdir().expect("create tmpdir");
         let repo = tmpdir.path().join("repo");
         fs::create_dir_all(repo.join("real-dir")).expect("create repo");
-        init_git_repo(&repo);
+        let _git = init_git_repo(&repo);
         fs::write(repo.join("real-dir/file.txt"), "file").expect("write file.txt");
         std::os::unix::fs::symlink("real-dir", repo.join("link-dir")).expect("create symlink");
 
@@ -9853,7 +9868,7 @@ mod tests {
         let tmpdir = tempfile::tempdir().expect("create tmpdir");
         let repo = tmpdir.path().join("repo");
         fs::create_dir_all(repo.join("runs")).expect("create repo");
-        init_git_repo(&repo);
+        let _git = init_git_repo(&repo);
         fs::write(repo.join(".gitignore"), "runs/\n").expect("write .gitignore");
         fs::write(repo.join("runs/test.json"), r#"{"key":"value"}"#).expect("write test.json");
 
@@ -9869,13 +9884,10 @@ mod tests {
 
     #[test]
     fn git_sync_files_ignores_inherited_git_env() {
-        let _lock = TEST_ENV_LOCK
-            .lock()
-            .unwrap_or_else(std::sync::PoisonError::into_inner);
         let tmpdir = tempfile::tempdir().expect("create tmpdir");
         let repo = tmpdir.path().join("repo");
         fs::create_dir_all(repo.join("nested")).expect("create repo");
-        init_git_repo(&repo);
+        let _git = init_git_repo(&repo);
 
         fs::write(repo.join("nested/file.txt"), "file").expect("write file.txt");
         fs::write(repo.join("top.txt"), "top").expect("write top.txt");