Merge branch 'main' into mnoah1/test-logs

Author: mnoah1

.bazelrc

@@ -4,3 +4,21 @@ common --repository_cache=~/.cache/bazel-repo-cache
 # Resolve protoc from a registered toolchain (toolchains_protoc provides a
 # prebuilt binary) instead of compiling protoc from source. Introduced in Bazel 7.
 common --incompatible_enable_proto_toolchain_resolution
+
+# Hermetic execution: actions and tests run with a static environment instead
+# of inheriting the client's, so results are reproducible and cache correctly
+# across shells and machines.
+common --incompatible_strict_action_env
+
+# Stricter sandbox: sandboxed actions get no network access by default (each
+# runs in its own network namespace with only a private loopback). Tests that
+# talk to the Docker daemon and connect to its published host ports opt back
+# in with tags = ["requires-network"].
+common --sandbox_default_allow_network=false
+
+# Docker-based tests are hermetic (all inputs are declared Bazel data deps),
+# but a few environment knobs are deliberately passed through when set:
+# DOCKER_HOST selects a non-default Docker daemon; SKIP_CLEANUP=true keeps
+# containers running after a failure for inspection.
+test --test_env=DOCKER_HOST
+test --test_env=SKIP_CLEANUP

.github/workflows/ci.yml

@@ -36,7 +36,7 @@ jobs:
     if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           # This job executes untrusted PR code (make build/test/lint). Don't
           # leave the GITHUB_TOKEN in the workspace git config while it runs.
@@ -54,7 +54,7 @@ jobs:
     if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           # This job executes untrusted PR code (make build/test/lint). Don't
           # leave the GITHUB_TOKEN in the workspace git config while it runs.
@@ -75,7 +75,7 @@ jobs:
     if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           # This job executes untrusted PR code (make build/test/lint). Don't
           # leave the GITHUB_TOKEN in the workspace git config while it runs.
@@ -96,7 +96,7 @@ jobs:
     if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           # This job executes untrusted PR code (make build/test/lint). Don't
           # leave the GITHUB_TOKEN in the workspace git config while it runs.
@@ -111,7 +111,7 @@ jobs:
     if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           # This job executes untrusted PR code (make build/test/lint). Don't
           # leave the GITHUB_TOKEN in the workspace git config while it runs.
@@ -126,7 +126,7 @@ jobs:
     if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           # This job executes untrusted PR code (make build/test/lint). Don't
           # leave the GITHUB_TOKEN in the workspace git config while it runs.
@@ -144,7 +144,7 @@ jobs:
     if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           # This job executes untrusted PR code (make build/test/lint). Don't
           # leave the GITHUB_TOKEN in the workspace git config while it runs.
@@ -159,7 +159,7 @@ jobs:
     if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           # This job executes untrusted PR code (make build/test/lint). Don't
           # leave the GITHUB_TOKEN in the workspace git config while it runs.
@@ -174,7 +174,7 @@ jobs:
     if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           # This job executes untrusted PR code (make build/test/lint). Don't
           # leave the GITHUB_TOKEN in the workspace git config while it runs.
@@ -192,7 +192,7 @@ jobs:
     if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           # This job executes untrusted PR code (make build/test/lint). Don't
           # leave the GITHUB_TOKEN in the workspace git config while it runs.
@@ -216,7 +216,7 @@ jobs:
     if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           persist-credentials: false
       - name: actionlint

.github/workflows/rebase-stack.yml

@@ -82,13 +82,16 @@ permissions:
 jobs:
   rebase-stack:
     name: Rebase Stack
-    if: github.event.pull_request.merged == true
+    # DISABLED: this workflow is turned off in favor of GitHub's native stacked
+    # PR support. The file is kept (not removed) so it can be re-enabled by
+    # restoring the condition below to `github.event.pull_request.merged == true`.
+    if: false && github.event.pull_request.merged == true
     runs-on: ubuntu-latest
     # Scope the privileged PAT to a protected Environment restricted to `main`
     # so the secret cannot be used from any other ref/context.
     environment: stack-rebase
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           # Fetch full history so rebase --onto works correctly.
           fetch-depth: 0

.github/workflows/tag-go-pseudoversion.yml

@@ -24,7 +24,7 @@ jobs:
     name: Create and push pseudo-version tag
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0