Skip to content

Commit 6cd2ebd

Browse files
phlaxphlax
authored
github/copilot: Add proper bazel and pants setup (#3099)
Signed-off-by: Ryan Northey <[email protected]>
1 parent 68926fd commit 6cd2ebd

File tree

2 files changed

+109
-18
lines changed

2 files changed

+109
-18
lines changed

‎.github/copilot-instructions.md‎

Lines changed: 15 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -14,39 +14,33 @@ This repository contains multi-language tooling and libraries for Envoy proxy's
1414

1515
This repository uses **two build systems**:
1616

17-
### 1. Pants (Primary for Python Development)
17+
### Pants (Primary for Python Development)
1818

1919
Pants is used for Python package development, testing, and linting.
2020

2121
#### Running Pants Commands
2222

2323
```bash
2424
# Run all tests
25-
./pants test ::
25+
pants test ::
2626

2727
# Run tests for a specific package
28-
./pants test envoy.dependency.check::
28+
pants test envoy.dependency.check::
2929

3030
# Run tests with coverage
31-
./pants test --open-coverage ::
31+
pants test --open-coverage ::
3232

3333
# Lint the code
34-
./pants lint ::
34+
pants lint ::
3535

3636
# Debug tests
37-
./pants test --debug envoy.dependency.check::
37+
pants test --debug envoy.dependency.check::
3838
```
3939

4040
#### Environment Variables for Pants
4141

42-
When working in the Copilot workspace or other environments with SSL-intercepting proxies (e.g., corporate proxies with custom certificates):
43-
4442
```bash
45-
# Set the CA certificates path for Pants
46-
export PANTS_CA_CERTS_PATH=/etc/ssl/certs/ca-certificates.crt
47-
48-
# Then run pants commands
49-
./pants test ::
43+
pants test ::
5044
```
5145

5246
**Why this is needed:** Pants (Rust binary) uses compiled-in CA certificates and ignores the system trust store by default. When a proxy intercepts HTTPS with its own CA (e.g., mkcert), Pants fails with `invalid peer certificate: UnknownIssuer`.
@@ -57,14 +51,17 @@ Pants requires access to these domains:
5751
- `github.com` / `objects.githubusercontent.com` - Pants releases, PEX tool, Python interpreters
5852
- `pypi.org` / `files.pythonhosted.org` - Python packages
5953

60-
### 2. Bazel (For Build Configurations and Integration)
54+
### Bazel (For Build Configurations and Integration)
6155

6256
Bazel is used primarily for build configurations and testing integration with Envoy.
6357

64-
#### Running Bazel Commands
58+
#### Running Bazel commands in Copilot's local environment
6559

60+
**IMPORTANT:** You MUST run `/tmp/fix-bazel-truststore.sh` before the first time you issue a bazel command!!!
6661
**IMPORTANT:** Always run Bazel commands from the `/bazel` directory or use the full path:
6762

63+
#### Running Bazel Commands
64+
6865
```bash
6966
# Build all targets
7067
cd bazel && bazel build //...
@@ -136,14 +133,14 @@ When testing toolshed code in an Envoy environment without publishing to PyPI:
136133

137134
```bash
138135
# Pants: Test everything
139-
./pants test ::
136+
pants test ::
140137

141138
# Pants: Lint everything
142-
./pants lint ::
139+
pants lint ::
143140

144141
# Pants: Run with SSL proxy support
145142
export PANTS_CA_CERTS_PATH=/etc/ssl/certs/ca-certificates.crt
146-
./pants test ::
143+
pants test ::
147144

148145
# Bazel: Build everything (from bazel directory)
149146
cd bazel && bazel build //...

‎.github/workflows/copilot-setup-steps.yml‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
name: Copilot Setup Steps
2+
3+
permissions:
4+
contents: read
5+
6+
on:
7+
workflow_dispatch:
8+
push:
9+
paths:
10+
- .github/workflows/copilot-setup-steps.yml
11+
pull_request:
12+
paths:
13+
- .github/workflows/copilot-setup-steps.yml
14+
15+
jobs:
16+
copilot-setup-steps:
17+
runs-on: ubuntu-22.04
18+
steps:
19+
- name: Manual Cleanup
20+
run: |
21+
sudo rm -rf /usr/local/lib/android &
22+
sudo rm -rf /usr/share/dotnet &
23+
- name: Checkout code
24+
uses: actions/checkout@v5
25+
- name: Install deps
26+
shell: bash
27+
run: |
28+
sudo apt-get -qq update --error-on=any
29+
sudo apt-get -qq install --yes \
30+
libtool libtinfo5 automake autoconf curl unzip mkcert libnss3-tools
31+
- name: Bazel setup
32+
run: |
33+
mkcert -install
34+
java_home=$(dirname $(dirname $(readlink -f $(which java))))
35+
cacerts_file="${java_home}/lib/security/cacerts"
36+
cp "$cacerts_file" /tmp/custom-cacerts
37+
chmod 644 /tmp/custom-cacerts
38+
keytool -importcert -noprompt -trustcacerts \
39+
-alias mkcert_root \
40+
-file $(mkcert -CAROOT)/rootCA.pem \
41+
-keystore /tmp/custom-cacerts \
42+
-storepass changeit
43+
echo "startup --host_jvm_args=-Djavax.net.ssl.trustStore=/tmp/custom-cacerts" > user.bazelrc
44+
echo "startup --host_jvm_args=-Djavax.net.ssl.trustStorePassword=changeit" >> user.bazelrc
45+
echo "startup --output_user_root=/build/bazel_root" >> user.bazelrc
46+
echo "startup --output_base=/build/bazel_root/base" >> user.bazelrc
47+
# Download bazelisk
48+
arch=$([ $(uname -m) = "aarch64" ] && echo "arm64" || echo "amd64")
49+
sudo wget -O /usr/local/bin/bazel \
50+
https://github.com/bazelbuild/bazelisk/releases/latest/download/bazelisk-linux-${arch}
51+
sudo chmod +x /usr/local/bin/bazel
52+
sudo mkdir -p /build/bazel_root
53+
sudo chown -R runner:runner /build
54+
# Create a helper script to fix truststore as mkcert CA changes when copilot starts
55+
cat > /tmp/fix-bazel-truststore.sh << 'SCRIPT_EOF'
56+
#!/bin/bash
57+
set -e
58+
echo "Checking if mkcert CA certificate in truststore needs updating..."
59+
mkcert_fingerprint=$(openssl x509 -in $(mkcert -CAROOT)/rootCA.pem -noout -fingerprint -sha256 | cut -d= -f2)
60+
truststore_fingerprint=$(keytool -list \
61+
-keystore /tmp/custom-cacerts -storepass changeit \
62+
-alias mkcert_root 2>/dev/null | grep "SHA-256" | sed 's/.*SHA-256): //')
63+
if [ "$mkcert_fingerprint" != "$truststore_fingerprint" ]; then
64+
echo "Fingerprints don't match. Updating truststore..."
65+
echo " Current mkcert CA: $mkcert_fingerprint"
66+
echo " In truststore: $truststore_fingerprint"
67+
keytool -delete -alias mkcert_root -keystore /tmp/custom-cacerts -storepass changeit 2>/dev/null || true
68+
keytool -importcert -noprompt -trustcacerts \
69+
-alias mkcert_root \
70+
-file $(mkcert -CAROOT)/rootCA.pem \
71+
-keystore /tmp/custom-cacerts \
72+
-storepass changeit
73+
echo "Truststore updated. Restarting Bazel..."
74+
bazel shutdown 2>/dev/null || true
75+
echo "Done!"
76+
else
77+
echo "Truststore is up to date."
78+
fi
79+
SCRIPT_EOF
80+
chmod +x /tmp/fix-bazel-truststore.sh
81+
echo "Created /tmp/fix-bazel-truststore.sh helper script"
82+
- name: Bazel
83+
run: |
84+
bazel shutdown
85+
bazel --version
86+
working-directory: bazel
87+
88+
- name: Pants
89+
run: |
90+
./get-pants.sh
91+
echo "PATH=~/.local/bin/:${PATH}"
92+
echo "PANTS_CA_CERTS_PATH=/etc/ssl/certs/ca-certificates.crt" >> $GITHUB_ENV
93+
94+
pants --version

0 commit comments

Comments
 (0)