Try more things

.bazelrc

@@ -39,7 +39,10 @@ common --grpc_keepalive_time=30s
 # memory in exchange for higher download concurrency.
 common --jobs=30
 
+# These configs are split so linux CI can configure a custom exec platform.
 common:remote --extra_execution_platforms=//:rbe
-common:remote --remote_executor=grpcs://remote.buildbuddy.io
-common:remote --jobs=800
+common:remote --config=remote-base
+
+common:remote-base --remote_executor=grpcs://remote.buildbuddy.io
+common:remote-base --jobs=800
 

.github/workflows/bazel.yml

@@ -97,35 +97,24 @@ jobs:
           # Use a very short path to reduce argv/path length issues.
           "BAZEL_STARTUP_ARGS=--output_user_root=C:\" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
 
+      - name: Configure Bazel startup args (Linux)
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          echo "BAZEL_STARTUP_ARGS=--bazelrc=.github/workflows/linux.bazelrc" >> "$GITHUB_ENV"
+
       - name: bazel test //...
         env:
           BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
         shell: bash
         run: |
-          bazel $BAZEL_STARTUP_ARGS --bazelrc=.github/workflows/ci.bazelrc test //... \
-            --build_metadata=REPO_URL=https://github.com/openai/codex.git \
-            --build_metadata=COMMIT_SHA=$(git rev-parse HEAD) \
-            --build_metadata=ROLE=CI \
-            --build_metadata=VISIBILITY=PUBLIC \
-            "--remote_header=x-buildbuddy-api-key=$BUILDBUDDY_API_KEY"
+          target="${{ matrix.target }}"
+          host_arch="${target%%-*}" # e.g. aarch64 / x86_64
 
-  cloud-build:
-    name: just bazel-remote-test
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - name: Set up Bazel
-        uses: bazelbuild/setup-bazelisk@v3
-      - name: bazel test //... --config=remote
-        env:
-          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          bazel test //... \
+          bazel $BAZEL_STARTUP_ARGS --bazelrc=.github/workflows/ci.bazelrc test //... \
+            --config="$host_arch" \
             --build_metadata=REPO_URL=https://github.com/openai/codex.git \
             --build_metadata=COMMIT_SHA=$(git rev-parse HEAD) \
             --build_metadata=ROLE=CI \
             --build_metadata=VISIBILITY=PUBLIC \
-            "--remote_header=x-buildbuddy-api-key=$BUILDBUDDY_API_KEY" \
-            --config=remote --platforms=//:rbe --keep_going
+            "--remote_header=x-buildbuddy-api-key=$BUILDBUDDY_API_KEY"

.github/workflows/ci.bazelrc

@@ -1,15 +1,23 @@
 common --remote_download_minimal
 common --nobuild_runfile_links
-common --keep_going
 
-# Prefer to run the build actions entirely remotely so we can dial up the concurrency.
-# Currently remote builds only work on Mac hosts, until we untangle the libc constraints mess on linux.
+# These config settings are used to route linux RBE actions, but the linux bazelrc is included conditionally.
+# This ensures that the configs are defined on non-linux as well.
+common:aarch64 --keep_going
+common:x86_64 --keep_going
+
+# We prefer to run the build actions entirely remotely so we can dial up the concurrency.
+# We have platform-specific tests, so we want to execute the tests on all platforms using the strongest sandboxing available on each platform.
+
+# On linux, we can do a full remote build/test, by targeting the right (x86/arm) runners, so we have coverage of both.
+# Linux crossbuilds don't work until we untangle the libc constraint mess.
+common:linux --config=remote-base
+common:linux --strategy=remote
+
+# On mac, we can run all the build actions remotely but test actions locally.
 common:macos --config=remote
 common:macos --strategy=remote
-
-# We have platform-specific tests, so execute the tests locally using the strongest sandboxing available on each platform.
 common:macos --strategy=TestRunner=darwin-sandbox,local
-# Note: linux-sandbox is stronger, but not available in GHA.
-common:linux --strategy=TestRunner=processwrapper-sandbox,local
+
 common:windows --strategy=TestRunner=local
 

.github/workflows/linux.bazelrc

@@ -0,0 +1,4 @@
+common:aarch64 --extra_execution_platforms=//:rbe_arm64
+common:aarch64 --platforms=//:rbe_arm64
+common:x86_64 --extra_execution_platforms=//:rbe
+common:x86_64 --platforms=//:rbe

BUILD.bazel

@@ -24,14 +24,15 @@ platform(
         # tools that various integration tests need.
         # Verify at https://hub.docker.com/layers/mbolin491/codex-bazel/latest/images/sha256:8c9ff94187ea7c08a31e9a81f5fe8046ea3972a6768983c955c4079fa30567fb
         "container-image": "docker://docker.io/mbolin491/codex-bazel@sha256:8c9ff94187ea7c08a31e9a81f5fe8046ea3972a6768983c955c4079fa30567fb",
+        "Arch": "amd64",
         "OSFamily": "Linux",
     },
 )
 
 platform(
-    name = "rbe-arm64",
+    name = "rbe_arm64",
     constraint_values = [
-        "@platforms//cpu:arm64",
+        "@platforms//cpu:aarch64",
         "@platforms//os:linux",
         "@bazel_tools//tools/cpp:clang",
         "@toolchains_llvm_bootstrapped//constraints/libc:gnu.2.28",
@@ -41,6 +42,7 @@ platform(
         # tools that various integration tests need.
         # Verify at https://hub.docker.com/layers/mbolin491/codex-bazel/latest/images/sha256:ad9506086215fccfc66ed8d2be87847324be56790ae6a1964c241c28b77ef141
         "container-image": "docker://docker.io/mbolin491/codex-bazel@sha256:ad9506086215fccfc66ed8d2be87847324be56790ae6a1964c241c28b77ef141",
+        "Arch": "arm64",
         "OSFamily": "Linux",
     },
 )