Merge branch 'main' into preetam/speculation-entities

Author: behinddwalls

.bazelrc

@@ -4,3 +4,21 @@ common --repository_cache=~/.cache/bazel-repo-cache
 # Resolve protoc from a registered toolchain (toolchains_protoc provides a
 # prebuilt binary) instead of compiling protoc from source. Introduced in Bazel 7.
 common --incompatible_enable_proto_toolchain_resolution
+
+# Hermetic execution: actions and tests run with a static environment instead
+# of inheriting the client's, so results are reproducible and cache correctly
+# across shells and machines.
+common --incompatible_strict_action_env
+
+# Stricter sandbox: sandboxed actions get no network access by default (each
+# runs in its own network namespace with only a private loopback). Tests that
+# talk to the Docker daemon and connect to its published host ports opt back
+# in with tags = ["requires-network"].
+common --sandbox_default_allow_network=false
+
+# Docker-based tests are hermetic (all inputs are declared Bazel data deps),
+# but a few environment knobs are deliberately passed through when set:
+# DOCKER_HOST selects a non-default Docker daemon; SKIP_CLEANUP=true keeps
+# containers running after a failure for inspection.
+test --test_env=DOCKER_HOST
+test --test_env=SKIP_CLEANUP

.github/workflows/rebase-stack.yml

@@ -82,7 +82,10 @@ permissions:
 jobs:
   rebase-stack:
     name: Rebase Stack
-    if: github.event.pull_request.merged == true
+    # DISABLED: this workflow is turned off in favor of GitHub's native stacked
+    # PR support. The file is kept (not removed) so it can be re-enabled by
+    # restoring the condition below to `github.event.pull_request.merged == true`.
+    if: false && github.event.pull_request.merged == true
     runs-on: ubuntu-latest
     # Scope the privileged PAT to a protected Environment restricted to `main`
     # so the secret cannot be used from any other ref/context.

AGENTS.md

@@ -304,11 +304,12 @@ deps = [
 - **Avoid asserting on error messages** — assert on error type or check the error with `require.Error`, do not `assert.Contains(t, err.Error(), message)`
 - **No change detector tests** — don't assert on default values, internal structure, or implementation details that can change without affecting behavior. Test what the code *does*, not how it's constructed.
 - **No `time.Sleep` for synchronization** — use channels, callbacks, condition variables.
+- **No hardcoded test timeouts** — do not add timeouts to tests or synchronization helpers; rely on the upstream test runner's timeout (for example, Bazel's test timeout).
 - **Use testify** — `assert`/`require` instead of `t.Fatal()`.
 
 **Integration tests** use Docker Compose via `testutil.ComposeStack`:
 - Package naming: folder name as package (NOT `*_test` suffix)
-- Bazel: add `tags = ["integration"]` and `data = [...]` for compose/schema files
+- Bazel: add `tags = ["integration", "requires-network"]` and `data = [...]` for every input the test reads (compose file, schema dirs, Dockerfiles, Bazel-built `*_linux` service binaries). Tests are hermetic: never resolve the repo root — resolve inputs from runfiles via `testutil.Runfile` and stage docker build contexts with `testutil.WithBuildContext`.
 - Use `testutil.NewComposeStack()` with meaningful context (e.g., `"ext-storage-mysql"`)
 
 See [doc/howto/TESTING.md](doc/howto/TESTING.md) for full testing guide.

Makefile

@@ -60,7 +60,9 @@ build: ## Build all services and examples
 	@$(BAZEL) build //...
 	@echo "Build complete!"
 
-# Build Linux binaries required for Docker containers
+# Build Linux binaries required for the local docker-compose flows (local-*).
+# Bazel-run integration/e2e tests do NOT need these: they build the service
+# binaries hermetically as data dependencies.
 build-all-linux: build-submitqueue-gateway-linux build-submitqueue-orchestrator-linux build-stovepipe-linux build-runway-linux ## Build all Linux binaries for Docker
 	@echo "All Linux binaries ready for Docker"
 
@@ -132,7 +134,7 @@ clean-proto: ## Clean generated proto files
 deps: tidy-go ## Download and tidy Go dependencies
 	@echo "Dependencies installed!"
 
-e2e-test: build-all-linux ## Run end-to-end tests (hermetic, auto-builds binaries; runs in parallel)
+e2e-test: ## Run end-to-end tests (hermetic; Bazel builds all inputs; runs in parallel)
 	@echo "Running end-to-end tests (parallel)..."
 	@$(BAZEL) test //test/e2e/... --test_output=errors
 
@@ -147,7 +149,7 @@ gazelle: ## Update BUILD.bazel files
 	@echo "Running Gazelle to update BUILD files..."
 	@$(BAZEL) run //:gazelle
 
-integration-test: build-all-linux ## Run all integration tests (auto-builds binaries; runs in parallel)
+integration-test: ## Run all integration tests (hermetic; Bazel builds all inputs; runs in parallel)
 	@echo "Running all integration tests (parallel)..."
 	@$(BAZEL) test //test/integration/... --test_output=errors
 
@@ -159,11 +161,11 @@ integration-test-extensions: ## Run extension integration tests (runs in paralle
 	@echo "Running extension integration tests (parallel)..."
 	@$(BAZEL) test //test/integration/submitqueue/extension/... //test/integration/extension/... --test_output=errors
 
-integration-test-submitqueue-gateway: build-submitqueue-gateway-linux ## Run Gateway integration tests (auto-builds binary)
+integration-test-submitqueue-gateway: ## Run Gateway integration tests
 	@echo "Running Gateway integration tests..."
 	@$(BAZEL) test //test/integration/submitqueue/gateway:go_default_test --test_output=streamed
 
-integration-test-submitqueue-orchestrator: build-submitqueue-orchestrator-linux ## Run Orchestrator integration tests (auto-builds binary)
+integration-test-submitqueue-orchestrator: ## Run Orchestrator integration tests
 	@echo "Running Orchestrator integration tests..."
 	@$(BAZEL) test //test/integration/submitqueue/orchestrator:go_default_test --test_output=streamed
 

api/runway/messagequeue/merge_test.go

@@ -33,12 +33,12 @@ func TestMergeRequestRoundTrip(t *testing.T) {
 		Steps: []*MergeStep{
 			{
 				StepId:   "queue-a/1",
-				Changes:  []*changepb.Change{{Uris: []string{"github://github.example.com/uber/repo/pull/1/0123456789abcdef0123456789abcdef01234567"}}},
+				Change:   &changepb.Change{Uris: []string{"github://github.example.com/uber/repo/pull/1/0123456789abcdef0123456789abcdef01234567"}},
 				Strategy: strategypb.Strategy_REBASE,
 			},
 			{
 				StepId:   "queue-a/2",
-				Changes:  []*changepb.Change{{Uris: []string{"github://github.example.com/uber/repo/pull/2/89abcdef0123456789abcdef0123456789abcdef"}}},
+				Change:   &changepb.Change{Uris: []string{"github://github.example.com/uber/repo/pull/2/89abcdef0123456789abcdef0123456789abcdef"}},
 				Strategy: strategypb.Strategy_MERGE,
 			},
 		},

api/runway/messagequeue/proto/merge.proto

@@ -25,19 +25,21 @@ option java_multiple_files = true;
 option java_outer_classname = "MergeProto";
 option java_package = "com.uber.submitqueue.runway.messagequeue";
 
-// MergeStep is one step of an ordered merge: a single set of change(s) applied
-// with a strategy. Runway applies the steps of a request in order on top of the
-// merge target; the ordering encodes the base-layering (earlier steps are the
-// in-flight base, the last step is the candidate).
+// MergeStep is one step of an ordered merge: a single change applied with a
+// strategy. Runway applies the steps of a request in order on top of the merge
+// target; the ordering encodes the base-layering (earlier steps are the
+// in-flight base, the last step is the candidate). A change may contain
+// multiple URIs (e.g. stacked PRs that land together).
 message MergeStep {
     // step_id is an opaque, caller-assigned identifier for this step. Runway
     // treats it as an attribution token only -- it echoes it back per-step in
     // StepResult so a multi-step result is attributable -- and never interprets
     // its contents.
     string step_id = 1;
-    // changes are the code change(s) to apply for this step.
-    repeated uber.base.change.Change changes = 2;
-    // strategy is how this step's changes are integrated into the merge target.
+    // change is the code change to apply for this step. A change may carry
+    // multiple URIs when the step represents stacked or grouped changes.
+    uber.base.change.Change change = 2;
+    // strategy is how this step's change is integrated into the merge target.
     uber.base.mergestrategy.Strategy strategy = 3;
 }
 

api/runway/messagequeue/protopb/merge.pb.go

@@ -62,7 +62,7 @@ make e2e-test
 
 # Build
 make build                          # Build all targets
-make build-all-linux                # Build Linux binaries for Docker
+make build-all-linux                # Build Linux binaries for the local docker-compose flows (tests build their own)
 ```
 
 ### Testing Levels

doc/howto/TESTING.md

@@ -33,12 +33,12 @@ func testRequest() *runwaymq.MergeRequest {
 		Steps: []*runwaymq.MergeStep{
 			{
 				StepId:   "queue-a/1",
-				Changes:  []*changepb.Change{{Uris: []string{"github://github.example.com/uber/repo/pull/1/abcdef0123456789abcdef0123456789abcdef01"}}},
+				Change:   &changepb.Change{Uris: []string{"github://github.example.com/uber/repo/pull/1/abcdef0123456789abcdef0123456789abcdef01"}},
 				Strategy: strategypb.Strategy_REBASE,
 			},
 			{
 				StepId:   "queue-a/2",
-				Changes:  []*changepb.Change{{Uris: []string{"github://github.example.com/uber/repo/pull/2/89abcdef0123456789abcdef0123456789abcdef"}}},
+				Change:   &changepb.Change{Uris: []string{"github://github.example.com/uber/repo/pull/2/89abcdef0123456789abcdef0123456789abcdef"}},
 				Strategy: strategypb.Strategy_MERGE,
 			},
 		},

runway/extension/merger/noop/noop_test.go

@@ -1,4 +1,12 @@
-load("@rules_go//go:def.bzl", "go_binary", "go_library")
+load("@rules_go//go:def.bzl", "go_binary", "go_cross_binary", "go_library")
+
+exports_files(
+    [
+        "Dockerfile",
+        "docker-compose.yml",
+    ],
+    visibility = ["//visibility:public"],
+)
 
 go_library(
     name = "go_default_library",
@@ -32,3 +40,13 @@ go_binary(
     embed = [":go_default_library"],
     visibility = ["//visibility:public"],
 )
+
+# Linux binary consumed by the Docker image build. Docker-based tests depend on
+# this target as data so Bazel builds the exact binary that ends up in the
+# container image — no pre-built .docker-bin artifacts required.
+go_cross_binary(
+    name = "runway_linux",
+    platform = "@rules_go//go/toolchain:linux_amd64",
+    target = ":runway",
+    visibility = ["//visibility:public"],
+)