-
Notifications
You must be signed in to change notification settings - Fork 1.4k
[ABLD-300] Generalize bazel configuration in CI
#43274
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Static quality checks✅ Please find below the results from static quality gates Successful checksInfo
|
Regression DetectorRegression Detector ResultsMetrics dashboard Baseline: 1fa8a3a Optimization Goals: ✅ No significant changes detected
|
| perf | experiment | goal | Δ mean % | Δ mean % CI | trials | links |
|---|---|---|---|---|---|---|
| ➖ | docker_containers_cpu | % cpu utilization | -2.01 | [-4.94, +0.92] | 1 | Logs |
Fine details of change detection per experiment
| perf | experiment | goal | Δ mean % | Δ mean % CI | trials | links |
|---|---|---|---|---|---|---|
| ➖ | ddot_metrics_sum_delta | memory utilization | +0.58 | [+0.37, +0.79] | 1 | Logs |
| ➖ | tcp_syslog_to_blackhole | ingress throughput | +0.44 | [+0.38, +0.50] | 1 | Logs |
| ➖ | ddot_metrics_sum_cumulative | memory utilization | +0.31 | [+0.16, +0.47] | 1 | Logs |
| ➖ | quality_gate_idle | memory utilization | +0.20 | [+0.16, +0.25] | 1 | Logs bounds checks dashboard |
| ➖ | file_tree | memory utilization | +0.19 | [+0.14, +0.24] | 1 | Logs |
| ➖ | otlp_ingest_metrics | memory utilization | +0.11 | [-0.04, +0.25] | 1 | Logs |
| ➖ | uds_dogstatsd_20mb_12k_contexts_20_senders | memory utilization | +0.03 | [-0.02, +0.08] | 1 | Logs |
| ➖ | file_to_blackhole_100ms_latency | egress throughput | +0.03 | [-0.02, +0.07] | 1 | Logs |
| ➖ | ddot_metrics_sum_cumulativetodelta_exporter | memory utilization | +0.02 | [-0.22, +0.26] | 1 | Logs |
| ➖ | uds_dogstatsd_to_api_v3 | ingress throughput | +0.00 | [-0.12, +0.13] | 1 | Logs |
| ➖ | tcp_dd_logs_filter_exclude | ingress throughput | +0.00 | [-0.07, +0.08] | 1 | Logs |
| ➖ | file_to_blackhole_1000ms_latency | egress throughput | -0.01 | [-0.42, +0.40] | 1 | Logs |
| ➖ | uds_dogstatsd_to_api | ingress throughput | -0.01 | [-0.13, +0.11] | 1 | Logs |
| ➖ | file_to_blackhole_0ms_latency | egress throughput | -0.06 | [-0.46, +0.35] | 1 | Logs |
| ➖ | quality_gate_idle_all_features | memory utilization | -0.15 | [-0.21, -0.10] | 1 | Logs bounds checks dashboard |
| ➖ | file_to_blackhole_500ms_latency | egress throughput | -0.18 | [-0.55, +0.20] | 1 | Logs |
| ➖ | docker_containers_memory | memory utilization | -0.44 | [-0.53, -0.36] | 1 | Logs |
| ➖ | quality_gate_logs | % cpu utilization | -0.64 | [-2.08, +0.80] | 1 | Logs bounds checks dashboard |
| ➖ | otlp_ingest_logs | memory utilization | -0.82 | [-0.92, -0.73] | 1 | Logs |
| ➖ | ddot_logs | memory utilization | -0.83 | [-0.90, -0.77] | 1 | Logs |
| ➖ | ddot_metrics | memory utilization | -1.06 | [-1.26, -0.86] | 1 | Logs |
| ➖ | quality_gate_metrics_logs | memory utilization | -1.17 | [-1.38, -0.96] | 1 | Logs bounds checks dashboard |
| ➖ | docker_containers_cpu | % cpu utilization | -2.01 | [-4.94, +0.92] | 1 | Logs |
Bounds Checks: ✅ Passed
| perf | experiment | bounds_check_name | replicates_passed | links |
|---|---|---|---|---|
| ✅ | docker_containers_cpu | simple_check_run | 10/10 | |
| ✅ | docker_containers_memory | memory_usage | 10/10 | |
| ✅ | docker_containers_memory | simple_check_run | 10/10 | |
| ✅ | file_to_blackhole_0ms_latency | lost_bytes | 10/10 | |
| ✅ | file_to_blackhole_0ms_latency | memory_usage | 10/10 | |
| ✅ | file_to_blackhole_1000ms_latency | lost_bytes | 10/10 | |
| ✅ | file_to_blackhole_1000ms_latency | memory_usage | 10/10 | |
| ✅ | file_to_blackhole_100ms_latency | lost_bytes | 10/10 | |
| ✅ | file_to_blackhole_100ms_latency | memory_usage | 10/10 | |
| ✅ | file_to_blackhole_500ms_latency | lost_bytes | 10/10 | |
| ✅ | file_to_blackhole_500ms_latency | memory_usage | 10/10 | |
| ✅ | quality_gate_idle | intake_connections | 10/10 | bounds checks dashboard |
| ✅ | quality_gate_idle | memory_usage | 10/10 | bounds checks dashboard |
| ✅ | quality_gate_idle_all_features | intake_connections | 10/10 | bounds checks dashboard |
| ✅ | quality_gate_idle_all_features | memory_usage | 10/10 | bounds checks dashboard |
| ✅ | quality_gate_logs | intake_connections | 10/10 | bounds checks dashboard |
| ✅ | quality_gate_logs | lost_bytes | 10/10 | bounds checks dashboard |
| ✅ | quality_gate_logs | memory_usage | 10/10 | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | cpu_usage | 10/10 | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | intake_connections | 10/10 | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | lost_bytes | 10/10 | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | memory_usage | 10/10 | bounds checks dashboard |
Explanation
Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%
Performance changes are noted in the perf column of each table:
- ✅ = significantly better comparison variant performance
- ❌ = significantly worse comparison variant performance
- ➖ = no significant change in performance
A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".
For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:
-
Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.
-
Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.
-
Its configuration does not mark it "erratic".
CI Pass/Fail Decision
✅ Passed. All Quality Gates passed.
- quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check lost_bytes: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check lost_bytes: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
- quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.
600a4b2 to
ec60221
Compare
94b5923 to
ff82978
Compare
Gitlab CI Configuration ChangesChanges Summary
ℹ️ Diff available in the job log. |
0399832 to
40dfc49
Compare
40dfc49 to
948ebb1
Compare
bazel configuration in CI
948ebb1 to
d8a27df
Compare
d8a27df to
69883a4
Compare
2870f06 to
c28e3bf
Compare
c28e3bf to
bf067b8
Compare
|
Just rebased a last time before adding to MQ to make sure recently merged |
|
/merge |
|
View all feedbacks in Devflow UI.
This pull request is not mergeable according to GitHub. Common reasons include pending required checks, missing approvals, or merge conflicts — but it could also be blocked by other repository rules or settings.
devflow unqueued this merge request: It did not become mergeable within the expected time |
21c1647 to
8fbfdf8
Compare
8fbfdf8 to
c6d32ea
Compare
c6d32ea to
adfaadf
Compare
adfaadf to
ca26e31
Compare
ca26e31 to
2c1959e
Compare
### What does this PR do? Generalizes `bazel` CI configuration to make deeply nested `bazel[isk]` invocations in `omnibus` scripts and `invoke` tasks automatically benefit from the CI configuration (`--config=ci` as defined in `.bazelrc`). ### Motivation **Problem with previous approach:** GitLab cache configuration was cumbersome with deeply nested bazel invocations. Each `variable`, `cache`, and their respective `paths` needed to be explicitly propagated to every build job (and soon, test jobs). This created a maintenance burden with multiple points of configuration scattered across the codebase. **Solution:** Centralize Bazel CI configuration in `.bazelrc` (single point of maintenance) and propagate only two environment variables: - `CI`: Triggers `--config=ci` in wrapper scripts - `XDG_CACHE_HOME`: Root directory for both bazelisk and bazel caches This allows all nested bazel invocations to automatically use: - Remote cache configuration (from `.bazelrc`) - (Semi-)persistent local caches - Other CI-specific flags ### Changes **1. Simplified wrapper scripts** Both `tools/bazel` and `tools/bazel.bat` now: - Require `XDG_CACHE_HOME` to be set in CI - Validate that `XDG_CACHE_HOME` points to a directory - Generate minimal `.user.bazelrc` with only `--config=ci` - Use local `.cache` fallback when not in CI **2. Standardized cache location via XDG_CACHE_HOME** Per runner type: - **Persistent Linux runners**: `/data/bzl` (on persistent volume) - **Ephemeral Linux/macOS runners**: `$RUNNER_TEMP_PROJECT_DIR` - **Windows runners**: `c:\bzl` (on persistent volume) **3. Platform-specific implementation** - **Linux/macOS**: Native XDG_CACHE_HOME support (Bazel 7.2.0+ / 8.4.0+) - **Windows**: Emulated via `--output_user_root=$XDG_CACHE_HOME/bazel` **4. Updated GitLab CI configuration** - Introduced `.bazel:defs:posix`, `.bazel:defs:windows`, `.bazel:defs:posix-persistent` - Removed GitLab cache configuration (replaced by persistent volumes) - Pass `CI` and `XDG_CACHE_HOME` to all jobs, including Windows Docker containers ### Implementation Details **Using $RUNNER_TEMP_PROJECT_DIR:** GitLab Runner creates `$RUNNER_TEMP_PROJECT_DIR` alongside `$CI_PROJECT_DIR` with the same lifecycle (created before job, cleaned after job). We generalized its use based on positive experience from our earlier externalization of Bazel's `--repo_contents_cache`, which required a directory outside the build tree to avoid circular dependencies. **Windows path handling:** Windows wrapper converts backslashes to forward slashes for Bazel compatibility (see github.com/bazelbuild/bazel/issues/3275). **tools/bazel (POSIX):** ```bash if [ -n "${CI:-}" ]; then # Validate XDG_CACHE_HOME is a directory # Generate user.bazelrc with --config=ci fi ``` **tools/bazel.bat (Windows):** ```batch if defined CI ( # Validate XDG_CACHE_HOME is a directory # Set --output_user_root=%XDG_CACHE_HOME%/bazel # Generate user.bazelrc with --config=ci ) ``` ### References - XDG Base Directory Specification: https://specifications.freedesktop.org/basedir/latest/ - Bazel XDG support (Linux): bazelbuild/bazel#21817 (7.2.0) - Bazel XDG support (macOS): bazelbuild/bazel#26773 (8.4.0) - Bazel Windows backslash issue: bazelbuild/bazel#3275 - Windows XDG feature request: bazelbuild/bazel#27808
2c1959e to
3f01b6c
Compare
|
/merge |
|
View all feedbacks in Devflow UI.
This pull request is not mergeable according to GitHub. Common reasons include pending required checks, missing approvals, or merge conflicts — but it could also be blocked by other repository rules or settings.
The expected merge time in
|
eBPF complexity changesSummary result: ❔ - needs attention
runtime_security detailsruntime_security [programs with changes]
runtime_security [programs without changes]
runtime_security_fentry detailsruntime_security_fentry [programs with changes]
runtime_security_fentry [programs without changes]
runtime_security_syscall_wrapper detailsruntime_security_syscall_wrapper [programs with changes]
runtime_security_syscall_wrapper [programs without changes]
This report was generated based on the complexity data for the current branch regis.desgroppes/abld-300 (pipeline 84292710, commit 3f01b6c) and the base branch main (commit 96695f6). Objects without changes are not reported. Contact #ebpf-platform if you have any questions/feedback. Table complexity legend: 🔵 - new; ⚪ - unchanged; 🟢 - reduced; 🔴 - increased |
What does this PR do?
It generalizes
bazelCI configuration to make nestedbazel[isk]invocations inomnibusscripts andinvoketasks automatically benefit frombazel --config=ci(single point of maintenance defined in.bazelrc) as well as applicable caching.Motivation
The GitLab cache used so far for ephemeral runners was only benefiting top-level
bazelcommands used in smoke tests and linters. It didn't benefit nestedbazelinvocations, nor were settings implied by--config=cibecausetools/bazel[.bat]hook scripts had no clue they were running in CI.The GitLab cache configuration used to be too tricky to generalize due to the many environment variables involved, that's why the present approach consists in limiting them to only 2 environment variables:
CI: to triggerbazel --config=ci.The presence of this variable is anyway a de facto standard leveraged by existing tools, of which in-house
dda,XDG_CACHE_HOME: root directory for bothbazeliskandbazelcaches.Originating from Linux/BSD ecosystems, this variable is also honored by
bazel(8.4.0+) on macOS and I filed a feature request to get it honored on Windows - meanwhile we "emulate" it there via--output_user_root=$XDG_CACHE_HOME/bazel(only remaining path explicitly passed tobazel).Additional Notes
$XDG_CACHE_HOMEdenotes a directory in CI,.user.bazelrcto the bare minimum,XDG_CACHE_HOMEper runner type:bazelcommands):/data/bzl(on persistent volume), now also for AArch64 (aka ARM64),$CI_PROJECT_DIR/.cache, because GitLab requires cacheable paths to reside below$CI_PROJECT_DIR,c:/bzl(but$RUNNER_TEMP_PROJECT_DIRshould be fine too if we get rid ofmsbuild, @alopezz to confirm or deny),omnibuscache insertions by a combined cache extension comprising bothbazelcaches as well as theomnibuscache definition. The latter is of course aimed at vanishing at the end of the ongoing transition, hence the name:omnibus-transition,CItodocker runs in order to fail if we forget to propagateXDG_CACHE_HOMEwhen enablingbazelthere.References:
XDG_CACHE_HOMEon Windows bazelbuild/bazel#27808