Conversation
hoe-jo
requested review from
LittleHuba,
castler,
limdor and
ramceb
as code owners
September 17, 2026 12:40
Coverage ReportCoverage report was generated. Full report can be downloaded from the CI artifacts (expand Artifacts at the bottom of the run). Overall coverage rate: |
LittleHuba
reviewed
Sep 17, 2026
| #. Pin an exec-configuration toolchain for the docs pipeline only, so the | ||
| toolchain used for your product code is unaffected. | ||
| #. Split documentation targets into a separate build invocation with its own | ||
| ``--config``. |
Contributor
There was a problem hiding this comment.
Maybe you can add a comment here that we are actively resolving this upstream through bazel-contrib/rules_distroless#254
LittleHuba
reviewed
Sep 17, 2026
Comment on lines
+441
to
+497
| External hosts | ||
| ~~~~~~~~~~~~~~ | ||
|
|
||
| The table lists every host reachable from ``score_tooling``'s own module graph | ||
| and what it is needed for. Mirror or rewrite all of them that apply to the | ||
| targets you build. | ||
|
|
||
| .. list-table:: | ||
| :widths: 32 68 | ||
| :header-rows: 1 | ||
|
|
||
| * - Host | ||
| - Needed for | ||
| * - ``github.com`` | ||
| - Bazel modules and archives resolved from the Bazel Central Registry and | ||
| the S-CORE registry | ||
| * - ``raw.githubusercontent.com`` | ||
| - The S-CORE Bazel registry itself | ||
| (``https://raw.githubusercontent.com/eclipse-score/bazel_registry/main/``) | ||
| * - ``pypi.org`` / ``files.pythonhosted.org`` | ||
| - Python wheels for the Sphinx toolchain, TRLC, LOBSTER and the rule | ||
| implementations | ||
| * - ``snapshot.ubuntu.com`` | ||
| - ``.deb`` packages for the ``docs_runtime`` and ``tooling_sysroot`` | ||
| ``apt.install`` manifests (pinned Ubuntu 24.04 snapshot) | ||
| * - ``ftp.gnu.org`` | ||
| - gawk sources, pulled in transitively by the ``rules_distroless`` | ||
| ``flatten`` rule (see above) | ||
| * - ``repo1.maven.org`` | ||
| - The PlantUML jar (``net.sourceforge.plantuml:plantuml``) — required by | ||
| **every** documentation target | ||
| * - ``archive.ubuntu.com`` | ||
| - ``lcov_deb``, used only by ``//coverage:combined_report`` | ||
|
|
||
| Rewrite them with a ``downloader_config`` file:: | ||
|
|
||
| rewrite github.com/(.*) my-mirror.example.com/external-github-com/$1 | ||
| rewrite raw.githubusercontent.com/(.*) my-mirror.example.com/external-raw-githubusercontent-com/$1 | ||
| rewrite pypi.org/(.*) my-mirror.example.com/external-pypi-org/$1 | ||
| rewrite files.pythonhosted.org/(.*) my-mirror.example.com/external-pypi-files/$1 | ||
| rewrite snapshot.ubuntu.com/ubuntu/(.*) my-mirror.example.com/external-ubuntu-snapshots/$1 | ||
| rewrite ftp.gnu.org/gnu/(.*) my-mirror.example.com/external-ftp-gnu-org/$1 | ||
| rewrite repo1.maven.org/maven2/(.*) my-mirror.example.com/external-maven-central/$1 | ||
| rewrite archive.ubuntu.com/ubuntu/(.*) my-mirror.example.com/external-ubuntu-archive/$1 | ||
|
|
||
| allow my-mirror.example.com | ||
|
|
||
| and reference it from ``.bazelrc``:: | ||
|
|
||
| common --downloader_config=downloader_config | ||
|
|
||
| .. note:: | ||
|
|
||
| ``repo1.maven.org`` and ``snapshot.ubuntu.com`` are easy to miss: neither | ||
| appears in a ``bazel_dep``. They are reached from a module extension | ||
| (``maven.install`` and ``apt.install``) and therefore only fail once a | ||
| documentation target is actually built. |
Contributor
There was a problem hiding this comment.
This will probably not age well. Do we really want to keep this?
E.g. potentially every update of one of our transitive dependencies could break this list.
LittleHuba
reviewed
Sep 17, 2026
Comment on lines
+499
to
+524
| IPv6-only networks | ||
| ~~~~~~~~~~~~~~~~~~ | ||
|
|
||
| Bazel's downloader runs inside the Bazel JVM, which prefers IPv4 by default. | ||
| On an IPv6-only network — typical for minimal, air-gapped CI containers — | ||
| repository fetches hang or fail with connection errors even though the mirror | ||
| is reachable. Force IPv6 in ``.bazelrc``:: | ||
|
|
||
| # Prefer IPv6 over IPv4, required on IPv6-only CI networks. | ||
| startup --host_jvm_args=-Djava.net.preferIPv6Addresses=true | ||
| common --repo_env=JAVA_TOOL_OPTIONS=-Djava.net.preferIPv6Addresses=true | ||
|
|
||
| Both lines are needed and cover different processes: | ||
|
|
||
| ``startup --host_jvm_args`` | ||
| Applies to the Bazel server JVM itself, which performs ``http_archive`` and | ||
| repository-rule downloads. | ||
|
|
||
| ``common --repo_env=JAVA_TOOL_OPTIONS`` | ||
| Applies to JVMs started *by* repository rules and module extensions as | ||
| subprocesses (for example ``rules_jvm_external`` resolving the PlantUML | ||
| coordinates), which do not inherit ``--host_jvm_args``. | ||
|
|
||
| Because ``--repo_env`` is part of the repository-rule cache key, changing it | ||
| invalidates fetched repositories — set it once in a checked-in ``.bazelrc`` | ||
| rather than passing it ad hoc. |
Contributor
There was a problem hiding this comment.
This is not special to this module. If somebody sets up an IPv6 network they should be aware that A LOT of tools don't cope well with that on Linux. I would only put specific things to THIS module here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.