build(bazel): converge every subtree on Bazel 9.1.1 - #525
Merged
Conversation
Phase 3 of docs/dev/bazel-consolidation.md. Fourteen subtrees were on
Bazel 8.6.0 while the root and the four workers were on 9.1.1. Nested
modules on a different Bazel version than the root cannot be folded into
it, so this gates every migration that follows.
Two things had to change to make 9.1.1 work.
sh_test is no longer a native global. Eight subtrees used it without
loading it, which worked on 8.6.0 and cannot on 9. They now declare
rules_shell and load the symbol, matching what the root already does.
The protoc toolchain was the harder half, and the fix removes the
problem rather than re-pinning it. Every subtree paired
toolchains_protoc with an explicit protoc version, and protobuf's
authenticity check requires protoc to match the protobuf module exactly:
grep -q "^libprotoc ${RELEASE_VERSION}" # RELEASE_VERSION = v33.4
protobuf 33.4 therefore demands protoc 33.4, and toolchains_protoc 0.6.1
only ships up to v33.0. No pin value satisfies both: v29.0 mismatches,
v33.0 mismatches, and v33.4 is not in its dictionary. The pairing is
unsatisfiable, not misconfigured.
protobuf already ships prebuilt protoc for all nine platforms and
registers the toolchain itself, so it can simply provide protoc. Drop
toolchains_protoc and the ten per-subtree version pins with it. The
protoc version is now derived from the protobuf module instead of
restated next to it, so the two cannot disagree again. This is the same
shape as declaring the Go toolchain once and deriving it everywhere.
Root is deliberately untouched. It carries the same stale pairing and
only escapes the check because nothing in its graph triggers validation
today. Changing it has a wider blast radius than changing subtrees that
were already off-version, so it follows separately once this has proven
itself.
Verified locally on 9.1.1: ratelimiter builds clean (2203 actions), and
nvca builds clean (2133 actions), which is the heavy-proto case with a
vendored tree. stargate fails on a Cap'n Proto build script, but it fails
identically on its original 8.6.0 state, so that is pre-existing and
unrelated. The remaining eleven are validated by the per-subtree CI
matrix, which builds each independently.
Co-authored-by: Balaji Ganesan <bganesan@nvidia.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
📝 WalkthroughWalkthroughBazel version pins are upgraded to 9.1.1 across services. Shell tests explicitly use ChangesBazel 9 migration
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/invocation-plane-services/grpc-proxy/.bazelversion`:
- Line 1: Update the grpc-proxy Bazel version reference in README.md to 9.1.1,
replacing the outdated 8.6.0 pin while preserving the surrounding documentation.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: cf07c3f5-887e-4376-a427-b3714dea055c
⛔ Files ignored due to path filters (2)
src/compute-plane-services/nvca/MODULE.bazel.lockis excluded by!**/*.lock,!**/MODULE.bazel.locksrc/libraries/rust/stargate/MODULE.bazel.lockis excluded by!**/*.lock,!**/MODULE.bazel.lock
📒 Files selected for processing (38)
src/compute-plane-services/byoo-otel-collector/.bazelversionsrc/compute-plane-services/byoo-otel-collector/BUILD.bazelsrc/compute-plane-services/byoo-otel-collector/MODULE.bazelsrc/compute-plane-services/ess-agent/.bazelversionsrc/compute-plane-services/ess-agent/BUILD.bazelsrc/compute-plane-services/ess-agent/MODULE.bazelsrc/compute-plane-services/image-credential-helper/.bazelversionsrc/compute-plane-services/image-credential-helper/MODULE.bazelsrc/compute-plane-services/image-credential-helper/cmd/image-credential-helper/BUILD.bazelsrc/compute-plane-services/nvca/.bazelversionsrc/compute-plane-services/nvca/MODULE.bazelsrc/compute-plane-services/nvcf-unbound/.bazelversionsrc/compute-plane-services/nvcf-unbound/MODULE.bazelsrc/compute-plane-services/nvcf-unbound/cmd/webhook/BUILD.bazelsrc/control-plane-services/function-autoscaler/.bazelversionsrc/control-plane-services/function-autoscaler/MODULE.bazelsrc/control-plane-services/helm-reval/.bazelversionsrc/control-plane-services/helm-reval/MODULE.bazelsrc/control-plane-services/helm-reval/cmd/reval-service/BUILD.bazelsrc/control-plane-services/nats-auth-callout/.bazelversionsrc/control-plane-services/nats-auth-callout/MODULE.bazelsrc/control-plane-services/nats-auth-callout/cmd/nvcf-nats-auth-callout-service/BUILD.bazelsrc/invocation-plane-services/grpc-proxy/.bazelversionsrc/invocation-plane-services/grpc-proxy/MODULE.bazelsrc/invocation-plane-services/http-invocation/.bazelversionsrc/invocation-plane-services/http-invocation/MODULE.bazelsrc/invocation-plane-services/llm-api-gateway/.bazelversionsrc/invocation-plane-services/llm-api-gateway/MODULE.bazelsrc/invocation-plane-services/ratelimiter/.bazelversionsrc/invocation-plane-services/ratelimiter/MODULE.bazelsrc/invocation-plane-services/vanity-gateway/.bazelversionsrc/invocation-plane-services/vanity-gateway/BUILD.bazelsrc/invocation-plane-services/vanity-gateway/MODULE.bazelsrc/libraries/rust/stargate/.bazelversionsrc/libraries/rust/stargate/MODULE.bazelsrc/libraries/rust/stargate/crates/pylon/BUILD.bazelsrc/libraries/rust/stargate/crates/stargate-k8s-router/BUILD.bazelsrc/libraries/rust/stargate/crates/stargate/BUILD.bazel
💤 Files with no reviewable changes (2)
- src/control-plane-services/function-autoscaler/MODULE.bazel
- src/invocation-plane-services/http-invocation/MODULE.bazel
Two CI failures from the previous commit. http-invocation kept a third reference to the protoc extension, use_repo(protoc, "com_google_protobuf"), which the scripted edit did not match: it handled the bazel_dep and the protoc.toolchain call but not use_repo. Removing the extension left that line pointing at an undefined name, so the module failed to load. The service already declares protobuf directly for its cargo_build_script, so the use_repo was redundant once protobuf provides protoc; the surrounding comment described the old toolchains_protoc arrangement and is corrected. Rescanned every module for protoc references including use_repo forms. http-invocation was the only one, and it now builds clean locally. This commit also bumps the byoo collector version. Changing its .bazelversion and MODULE.bazel trips check-byoo-otel-collector-version, which requires a bump whenever anything under byoo-otel-collector/ changes. 0.157.2 is the value #506 was opening to set, for the same underlying reason: #444 changed collector files while its own bump was neutralised by a rebase, leaving two builds sharing 0.157.1. Folding it here keeps a single PR touching VERSION rather than two that would conflict; #506 is superseded. Co-authored-by: Balaji Ganesan <bganesan@nvidia.com> Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
kristinapathak
approved these changes
Jul 29, 2026
This was referenced Jul 29, 2026
Contributor
Author
|
🎉 This PR is included in version nvcf-function-autoscaler-v1.18.9 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
4 tasks
Contributor
Author
|
🎉 This PR is included in version nvcf-helm-reval-api-v0.4.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This was referenced Jul 31, 2026
Contributor
Author
|
🎉 This PR is included in version nvcf-grpc-proxy-v1.31.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
Contributor
Author
|
🎉 This PR is included in version nvcf-ratelimiter-v1.16.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
Contributor
Author
|
🎉 This PR is included in version nvcf-invocation-service-v0.9.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
Contributor
Author
|
🎉 This PR is included in version stargate-v0.7.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
Contributor
Author
|
🎉 This PR is included in version nvcf-llm-api-gateway-v0.11.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
Contributor
Author
|
🎉 This PR is included in version nvcf-ai-api-gateway-service-v1.30.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
Contributor
Author
|
🎉 This PR is included in version nvcf-unbound-v0.11.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
Contributor
Author
|
🎉 This PR is included in version nvcf-ess-agent-v1.4.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
Contributor
Author
|
🎉 This PR is included in version nvcf-image-credential-helper-v0.11.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Phase 3 of
docs/dev/bazel-consolidation.md(#445).Fourteen subtrees were on Bazel 8.6.0 while the root and the four worker services were already on 9.1.1. A nested module on a different Bazel version than the root cannot be folded into it, so this gates every migration that follows.
What changed
sh_testis no longer a native global in Bazel 9. Eight subtrees used it without loading it — fine on 8.6.0, impossible on 9. They now declarerules_shelland load the symbol, matching the root.The protoc toolchain is the interesting half, and the fix removes the coupling instead of re-pinning it.
Every subtree paired
toolchains_protocwith an explicit protoc version. protobuf's authenticity check requires an exact match against the protobuf module:So
protobuf@33.4demands protoc 33.4, andtoolchains_protoc@0.6.1ships only up to v33.0:v29.0(what every subtree had)v33.0(what root has)v33.4(what protobuf wants)key "v33.4" not found in dictionaryThe pairing is unsatisfiable, not misconfigured.
protobuf already ships prebuilt protoc for all nine platforms and registers the toolchain itself, so it can just provide protoc:
That deletes ten per-subtree version pins. The protoc version is now derived from the protobuf module rather than restated beside it, so the two cannot drift apart again — the same shape as declaring the Go toolchain once and deriving it everywhere (#473).
toolchains_protocdeps removedrules_shelldeps addedsh_testloads addedThe change removes more than it adds.
Customer Release Notes
Not customer visible.
Plan Summary
Not applicable.
Usage
Not applicable.
Testing
Built locally on 9.1.1:
ratelimiter— clean, 2203 actionsnvca— clean, 2133 actions (the heavy-proto case, vendored tree)stargate— fails on a Cap'n Proto build script, but fails identically on its original 8.6.0 state, so it is pre-existing and unrelated to this changeThe remaining eleven are validated by the per-subtree CI matrix, which builds each module independently, so any failure names its subtree directly.
Notes
Root is deliberately untouched. It carries the same stale
toolchains_protoc+v33.0pairing againstprotobuf@33.4and only escapes the authenticity check because nothing in its graph triggers validation today. That is a latent disagreement, not a healthy configuration, but changing root has a far wider blast radius than changing subtrees that were already off-version. It follows as a separate change once this pattern has proven itself in CI.References
None
Related Merge Requests/Pull Requests
Phase 2: #484, #491. Toolchain single-source precedent: #473. Plan: #445.
Dependencies
Removes
toolchains_protocfrom ten modules. Addsprotobuf33.4 (already in the resolved graph) andrules_shell0.8.0 (already used by the root).Summary by CodeRabbit
sh_testimplementation.byoo-otel-collectorrecorded version.