Feature/1.0.0 rc4 patched router

.bazelrc

@@ -88,11 +88,13 @@ build --@rules_rust//:extra_rustc_flag=-Wtrivial_casts
 build --@rules_rust//:extra_rustc_flag=-Wtrivial_numeric_casts
 build --@rules_rust//:extra_rustc_flag=-Dunconditional_recursion
 build --@rules_rust//:extra_rustc_flag=-Dunexpected_cfgs
+build --@rules_rust//:extra_rustc_flag=-Dunknown_lints
 build --@rules_rust//:extra_rustc_flag=-Dunnameable_test_items
 build --@rules_rust//:extra_rustc_flag=-Wunreachable_pub
 build --@rules_rust//:extra_rustc_flag=-Dunsafe_op_in_unsafe_fn
 build --@rules_rust//:extra_rustc_flag=-Dunstable_syntax_pre_expansion
 build --@rules_rust//:extra_rustc_flag=-Wunused_import_braces
+build --@rules_rust//:extra_rustc_flag=-Dunused_imports
 build --@rules_rust//:extra_rustc_flag=-Wunused_lifetimes
 build --@rules_rust//:extra_rustc_flag=-Wunused_qualifications
 build --@rules_rust//:extra_rustc_flag=-Wvariant_size_differences
@@ -102,22 +104,42 @@ build --@rules_rust//:clippy_flag=-Wclippy::nursery
 build --@rules_rust//:clippy_flag=-Wclippy::pedantic
 build --@rules_rust//:clippy_flag=-Dclippy::alloc_instead_of_core
 build --@rules_rust//:clippy_flag=-Dclippy::as_underscore
+build --@rules_rust//:clippy_flag=-Dclippy::await_holding_lock
+build --@rules_rust//:clippy_flag=-Dclippy::bind_instead_of_map
+build --@rules_rust//:clippy_flag=-Dclippy::collapsible_if
 build --@rules_rust//:clippy_flag=-Wclippy::dbg_macro
 build --@rules_rust//:clippy_flag=-Wclippy::decimal_literal_representation
+build --@rules_rust//:clippy_flag=-Dclippy::disallowed_methods
+build --@rules_rust//:clippy_flag=-Dclippy::doc_markdown
 build --@rules_rust//:clippy_flag=-Dclippy::elidable_lifetime_names
+build --@rules_rust//:clippy_flag=-Dclippy::explicit_into_iter_loop
+build --@rules_rust//:clippy_flag=-Dclippy::future_not_send
 build --@rules_rust//:clippy_flag=-Aclippy::get_unwrap
+build --@rules_rust//:clippy_flag=-Dclippy::implicit_clone
+build --@rules_rust//:clippy_flag=-Dclippy::implicit_hasher
+build --@rules_rust//:clippy_flag=-Dclippy::manual_is_variant_and
+build --@rules_rust//:clippy_flag=-Dclippy::map_unwrap_or
 build --@rules_rust//:clippy_flag=-Dclippy::missing_const_for_fn
 build --@rules_rust//:clippy_flag=-Aclippy::missing_docs_in_private_items
+build --@rules_rust//:clippy_flag=-Dclippy::or_fun_call
 build --@rules_rust//:clippy_flag=-Wclippy::print_stdout
+build --@rules_rust//:clippy_flag=-Dclippy::ptr_arg
+build --@rules_rust//:clippy_flag=-Dclippy::redundant_closure_for_method_calls
 build --@rules_rust//:clippy_flag=-Dclippy::semicolon_if_nothing_returned
+build --@rules_rust//:clippy_flag=-Dclippy::single_char_pattern
 build --@rules_rust//:clippy_flag=-Dclippy::std_instead_of_core
+build --@rules_rust//:clippy_flag=-Dclippy::string_lit_as_bytes
 build --@rules_rust//:clippy_flag=-Dclippy::todo
 build --@rules_rust//:clippy_flag=-Aclippy::too_long_first_doc_paragraph
+build --@rules_rust//:clippy_flag=-Dclippy::unchecked_duration_subtraction
 build --@rules_rust//:clippy_flag=-Wclippy::unimplemented
+build --@rules_rust//:clippy_flag=-Dclippy::unnecessary_semicolon
 build --@rules_rust//:clippy_flag=-Aclippy::unwrap_in_result
 build --@rules_rust//:clippy_flag=-Aclippy::unwrap_used
 build --@rules_rust//:clippy_flag=-Wclippy::use_debug
-build --@rules_rust//:clippy_flag=-Aclippy::cast_possible_truncation
+build --@rules_rust//:clippy_flag=-Dclippy::used_underscore_binding
+build --@rules_rust//:clippy_flag=-Dclippy::useless_format
+build --@rules_rust//:clippy_flag=-Dclippy::cast_possible_truncation
 build --@rules_rust//:clippy_flag=-Aclippy::cast_possible_wrap
 build --@rules_rust//:clippy_flag=-Aclippy::cast_precision_loss
 build --@rules_rust//:clippy_flag=-Aclippy::cast_sign_loss

.github/actions/free-disk/action.yaml

@@ -0,0 +1,48 @@
+---
+name: Free up disk space
+description: "Free up disk space on workers"
+runs:
+  using: "composite"
+  steps:
+    - name: Free disk space
+      uses: >- # v3.1.0
+        endersonmenezes/free-disk-space@e6ed9b02e683a3b55ed0252f1ee469ce3b39a885
+      with:
+        rm_cmd: "rmz" # For speed up
+        remove_android: false # Takes too long.
+        remove_dotnet: true
+        remove_haskell: true
+        remove_tool_cache: false # TODO(palfrey): Do we really need this?
+        # Note: Not deleting google-cloud-cli because it takes too long.
+        remove_packages: >
+          azure-cli
+          microsoft-edge-stable
+          google-chrome-stable
+          firefox
+          postgresql*
+          temurin-*
+          *llvm*
+          mysql*
+          dotnet-sdk-*
+        remove_packages_one_command: true
+        remove_folders: >
+          /usr/share/swift
+          /usr/share/miniconda
+          /usr/share/az*
+          /usr/share/glade*
+          /usr/local/share/chromium
+          /usr/local/share/powershell
+
+    - name: Delete platform specific items to free up disk space
+      shell: bash
+      run: |
+        if [ "$(uname)" = "Darwin" ]; then
+          echo "Deleting Applications"
+          sudo rm -rf ~/Applications/*
+          echo "Deleting all iOS simulators"
+          xcrun simctl delete all
+          echo "Deleting iOS Simulator caches"
+          sudo rm -rf ~/Library/Developer/CoreSimulator/Caches/*
+        else
+          echo "Nothing to do here."
+        fi

.github/actions/prepare-nix/action.yaml

@@ -5,52 +5,21 @@ runs:
   using: "composite"
   steps:
     - name: Free disk space
-      uses: >- # v2.0.0
-        endersonmenezes/free-disk-space@3f9ec39ebae520864ac93467ee395f5237585c21
-      with:
-        remove_android: false # Takes too long.
-        remove_dotnet: true
-        remove_haskell: true
-        remove_tool_cache: false # TODO(palfrey): Do we really need this?
-        # Note: Not deleting google-cloud-cli because it takes too long.
-        remove_packages: >
-          azure-cli
-          microsoft-edge-stable
-          google-chrome-stable
-          firefox
-          postgresql*
-          temurin-*
-          *llvm*
-          mysql*
-          dotnet-sdk-*
-        remove_packages_one_command: true
-        remove_folders: >
-          /usr/share/swift
-          /usr/share/miniconda
-          /usr/share/az*
-          /usr/share/glade*
-          /usr/local/lib/node_modules
-          /usr/local/share/chromium
-          /usr/local/share/powershell
-
-    - name: Delete platform specific items to free up disk space
-      shell: bash
-      run: |
-        if [ "$(uname)" = "Darwin" ]; then
-          echo "Deleting Applications"
-          sudo rm -rf ~/Applications/*
-          echo "Deleting all iOS simulators"
-          xcrun simctl delete all
-          echo "Deleting iOS Simulator caches"
-          sudo rm -rf ~/Library/Developer/CoreSimulator/Caches/*
-        else
-          echo "Nothing to do here."
-        fi
+      uses: ./.github/actions/free-disk
 
     - name: Install Nix
-      uses: >- # https://github.com/DeterminateSystems/nix-installer-action/releases/tag/v17
-        DeterminateSystems/nix-installer-action@21a544727d0c62386e78b4befe52d19ad12692e3
+      uses: >- # https://github.com/DeterminateSystems/nix-installer-action/releases/tag/v20
+        DeterminateSystems/nix-installer-action@786fff0690178f1234e4e1fe9b536e94f5433196
+      with:
+        source-tag: v3.13.0
+
+    # FIXME(palfrey): Replace with better cache. Workers are currently taking minutes to upload data
+    # all the time, probably because we're at ~500GB of 10GB in the cache storage and it's breaking.
+    # We've tried Flakehub, but it doesn't work for us because it assumes "branches on an org repo"
+    # not our "fork and branch on your own repo" setup for it's auth so we can't currently use that.
 
-    - name: Add Nix magic cache
-      uses: >- # https://github.com/DeterminateSystems/magic-nix-cache-action/releases/tag/v11
-        DeterminateSystems/magic-nix-cache-action@def9f5a5c6a6b8751c0534e8813a5d0ad2635660
+    # - name: Add Nix magic cache
+    #   uses: >- # https://github.com/DeterminateSystems/magic-nix-cache-action/releases/tag/v13
+    #     DeterminateSystems/magic-nix-cache-action@565684385bcd71bad329742eefe8d12f2e765b39
+    #   with:
+    #     source-tag: v0.1.6

.github/renovate.json5

@@ -8,6 +8,7 @@
       matchUpdateTypes: [
         "patch",
         "minor",
+        "digest",
       ],
       enabled: false,
     },

.github/styles/config/vocabularies/TraceMachina/accept.txt

@@ -17,6 +17,8 @@ FFI
 FFIs
 GPUs
 Goma
+gzip
+[Hh]eatmap
 [Hh]ermeticity
 Istio
 JDK
@@ -111,7 +113,16 @@ Trendshift
 Norwest
 Databricks
 Datadog
+Downsampling
 Brex
 Citrix
 Menlo
 benchmarked
+Thanos
+Quickwit
+[Mm]iddleware
+queryable
+gRPC
+[Mm]itigations
+[Pp]recompute
+attrs

.github/workflows/custom-image.yaml

@@ -0,0 +1,141 @@
+name: Build Custom Docker Image
+
+on:
+  workflow_dispatch:
+    inputs:
+      image:
+        description: 'Image to build'
+        required: false
+        default: 'image'
+        type: choice
+        options:
+          - image
+          - nativelink-worker-init
+          - nativelink-worker-lre-cc
+      skip_signing:
+        description: 'Skip cosign signing'
+        required: false
+        default: true
+        type: boolean
+
+  issue_comment:
+    types: [created]
+
+permissions:
+  contents: read
+  packages: write
+  pull-requests: write
+  id-token: write
+
+jobs:
+  check-trigger:
+    runs-on: ubuntu-latest
+    outputs:
+      should_build: ${{ steps.check.outputs.should_build }}
+      pr_sha: ${{ steps.check.outputs.pr_sha }}
+      image: ${{ steps.check.outputs.image }}
+    steps:
+      - name: Check trigger
+        id: check
+        uses: actions/github-script@v8
+        with:
+          script: |
+            if (context.eventName === 'workflow_dispatch') {
+              core.setOutput('should_build', 'true');
+              core.setOutput('pr_sha', context.sha);
+              core.setOutput('image', '${{ inputs.image }}');
+              return;
+            }
+
+            if (context.eventName === 'issue_comment') {
+              const body = context.payload.comment.body.trim();
+              const isPR = !!context.payload.issue.pull_request;
+
+              // Match /build-image or /build-image <image-name>
+              const match = body.match(/^\/build-image(?:\s+(\S+))?/i);
+
+              if (isPR && match) {
+                const { data: pr } = await github.rest.pulls.get({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  pull_number: context.payload.issue.number
+                });
+
+                const image = match[1] || 'image';
+                const validImages = ['image', 'nativelink-worker-init', 'nativelink-worker-lre-cc'];
+
+                if (!validImages.includes(image)) {
+                  await github.rest.issues.createComment({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: context.payload.issue.number,
+                    body: `Unknown image: \`${image}\`\n\nValid options: ${validImages.map(i => `\`${i}\``).join(', ')}`
+                  });
+                  core.setOutput('should_build', 'false');
+                  return;
+                }
+
+                core.setOutput('should_build', 'true');
+                core.setOutput('pr_sha', pr.head.sha);
+                core.setOutput('image', image);
+
+                await github.rest.reactions.createForIssueComment({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  comment_id: context.payload.comment.id,
+                  content: 'rocket'
+                });
+                return;
+              }
+            }
+
+            core.setOutput('should_build', 'false');
+
+  build-image:
+    name: Build and Push Image
+    needs: check-trigger
+    if: needs.check-trigger.outputs.should_build == 'true'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.check-trigger.outputs.pr_sha }}
+
+      - name: Prepare Worker
+        uses: ./.github/actions/prepare-nix
+
+      - name: Upload image
+        id: upload
+        run: |
+          GIT_HASH=$(git rev-parse --short HEAD)
+          nix run .#publish-ghcr ${{ needs.check-trigger.outputs.image }} "$GIT_HASH"
+
+          IMAGE_NAME=$(nix eval .#${{ needs.check-trigger.outputs.image }}.imageName --raw)
+          echo "image_tag=ghcr.io/${{ github.repository_owner }}/${IMAGE_NAME}:${GIT_HASH}" >> $GITHUB_OUTPUT
+        env:
+          GHCR_REGISTRY: ghcr.io/${{ github.repository_owner }}
+          GHCR_USERNAME: ${{ github.actor }}
+          GHCR_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
+          SKIP_SIGNING: "true"
+          SKIP_TRIVY: "true"
+
+      - name: Output image info
+        run: |
+          echo "### Published Image" >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+          echo "${{ steps.upload.outputs.image_tag }}" >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+
+      - name: Comment on PR
+        if: github.event_name == 'issue_comment'
+        uses: actions/github-script@v8
+        with:
+          script: |
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.payload.issue.number,
+              body: `Image built and pushed!\n\n\`\`\`\n${{ steps.upload.outputs.image_tag }}\n\`\`\``
+            });