fix: support remote arm64 builds, as well (#9018)

.github/workflows/Dockerfile.bazel

@@ -4,7 +4,7 @@ FROM ubuntu:24.04
 # initial debugging, but we should publish to a more proper location.
 #
 # docker buildx create --use
-# docker buildx build --platform linux/amd64 -f .github/workflows/Dockerfile.bazel -t mbolin491/codex-bazel:latest --push .
+# docker buildx build --platform linux/amd64,linux/arm64 -f .github/workflows/Dockerfile.bazel -t mbolin491/codex-bazel:latest --push .
 
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \

.github/workflows/bazel.yml

@@ -108,24 +108,3 @@ jobs:
             --build_metadata=ROLE=CI \
             --build_metadata=VISIBILITY=PUBLIC \
             "--remote_header=x-buildbuddy-api-key=$BUILDBUDDY_API_KEY"
-
-  cloud-build:
-    name: just bazel-remote-test
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - name: Set up Bazel
-        uses: bazelbuild/setup-bazelisk@v3
-      - name: bazel test //... --config=remote
-        env:
-          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          bazel test //... \
-            --build_metadata=REPO_URL=https://github.com/openai/codex.git \
-            --build_metadata=COMMIT_SHA=$(git rev-parse HEAD) \
-            --build_metadata=ROLE=CI \
-            --build_metadata=VISIBILITY=PUBLIC \
-            "--remote_header=x-buildbuddy-api-key=$BUILDBUDDY_API_KEY" \
-            --config=remote --platforms=//:rbe --keep_going

.github/workflows/ci.bazelrc

@@ -2,14 +2,19 @@ common --remote_download_minimal
 common --nobuild_runfile_links
 common --keep_going
 
-# Prefer to run the build actions entirely remotely so we can dial up the concurrency.
-# Currently remote builds only work on Mac hosts, until we untangle the libc constraints mess on linux.
+# We prefer to run the build actions entirely remotely so we can dial up the concurrency.
+# We have platform-specific tests, so we want to execute the tests on all platforms using the strongest sandboxing available on each platform.
+
+# On linux, we can do a full remote build/test, by targeting the right (x86/arm) runners, so we have coverage of both.
+# Linux crossbuilds don't work until we untangle the libc constraint mess.
+common:linux --config=remote
+common:linux --strategy=remote
+common:linux --platforms=//:rbe
+
+# On mac, we can run all the build actions remotely but test actions locally.
 common:macos --config=remote
 common:macos --strategy=remote
-
-# We have platform-specific tests, so execute the tests locally using the strongest sandboxing available on each platform.
 common:macos --strategy=TestRunner=darwin-sandbox,local
-# Note: linux-sandbox is stronger, but not available in GHA.
-common:linux --strategy=TestRunner=processwrapper-sandbox,local
+
 common:windows --strategy=TestRunner=local
 

BUILD.bazel

@@ -11,21 +11,9 @@ platform(
     ],
 )
 
-platform(
+alias(
     name = "rbe",
-    constraint_values = [
-        "@platforms//cpu:x86_64",
-        "@platforms//os:linux",
-        "@bazel_tools//tools/cpp:clang",
-        "@toolchains_llvm_bootstrapped//constraints/libc:gnu.2.28",
-    ],
-    exec_properties = {
-        # Ubuntu-based image that includes git, python3, dotslash, and other
-        # tools that various integration tests need.
-        # Verify at https://hub.docker.com/layers/mbolin491/codex-bazel/latest/images/sha256:8c9ff94187ea7c08a31e9a81f5fe8046ea3972a6768983c955c4079fa30567fb
-        "container-image": "docker://docker.io/mbolin491/codex-bazel@sha256:8c9ff94187ea7c08a31e9a81f5fe8046ea3972a6768983c955c4079fa30567fb",
-        "OSFamily": "Linux",
-    },
+    actual = "@rbe_platform",
 )
 
 exports_files(["AGENTS.md"])

MODULE.bazel

@@ -120,3 +120,9 @@ crate.annotation(
     deps = [":windows_import_lib"],
 )
 use_repo(crate, "crates")
+
+rbe_platform_repository = use_repo_rule("//:rbe.bzl", "rbe_platform_repository")
+
+rbe_platform_repository(
+    name = "rbe_platform",
+)

rbe.bzl

@@ -0,0 +1,42 @@
+def _rbe_platform_repo_impl(rctx):
+    arch = rctx.os.arch
+    if arch in ["x86_64", "amd64"]:
+        cpu = "x86_64"
+        exec_arch = "amd64"
+        image_sha = "8c9ff94187ea7c08a31e9a81f5fe8046ea3972a6768983c955c4079fa30567fb"
+    elif arch in ["aarch64", "arm64"]:
+        cpu = "aarch64"
+        exec_arch = "arm64"
+        image_sha = "ad9506086215fccfc66ed8d2be87847324be56790ae6a1964c241c28b77ef141"
+    else:
+        fail("Unsupported host arch for rbe platform: {}".format(arch))
+
+    rctx.file("BUILD.bazel", """\
+platform(
+    name = "rbe_platform",
+    constraint_values = [
+        "@platforms//cpu:{cpu}",
+        "@platforms//os:linux",
+        "@bazel_tools//tools/cpp:clang",
+        "@toolchains_llvm_bootstrapped//constraints/libc:gnu.2.28",
+    ],
+    exec_properties = {{
+        # Ubuntu-based image that includes git, python3, dotslash, and other
+        # tools that various integration tests need.
+        # Verify at https://hub.docker.com/layers/mbolin491/codex-bazel/latest/images/sha256:{image_sha}
+        "container-image": "docker://docker.io/mbolin491/codex-bazel@sha256:{image_sha}",
+        "Arch": "{arch}",
+        "OSFamily": "Linux",
+    }},
+    visibility = ["//visibility:public"],
+)
+""".format(
+    cpu = cpu,
+    arch = exec_arch,
+    image_sha = image_sha
+))
+
+rbe_platform_repository = repository_rule(
+    implementation = _rbe_platform_repo_impl,
+    doc = "Sets up a platform for remote builds with an Arch exec_property matching the host.",
+)