[tonyredondo]

Fixes #276.

#287 is merged. This PR now targets main and adds archive installation and draft-release automation. Head 75a9b7bf rebases the archive changes onto that merged baseline.

Released dependencies should not require a Git checkout. This adds a release archive with a pinned SHA256 and makes archive-based installation the default in the onboarding docs. Git overrides remain available for development snapshots and older releases without bundle assets.

What changes

tools/dev/build_release.py packages one committed revision and produces:

Asset	Contents
rules_test_optimization-X.Y.Z.tar.gz	Core, all six companions, and the maintained Orchestrion-enabled Go forks
SHA256SUMS	Checksums for the archive and generated metadata/notes
release.json	Source commit, version, archive URL/SHA256, and module/fork prefixes
INSTALL.md	Copyable archive_override and http_archive blocks for that exact archive
RELEASE_NOTES.md	The matching changelog section and installation instructions

Changing the install recipe alone would leave the Go bootstrap looking for a Git commit to select the Orchestrion-enabled fork. It now understands literal archive overrides: it keeps mirrors, checksums and extraction types, infers the fork from a core/Go companion archive, and preserves an existing supported fork archive. Compatible manual archive wiring moves into the managed block without duplicating the override. Computed archive values need explicit pins. Custom fork patches are rejected before MODULE.bazel is written, including when explicit archive flags are supplied. Explicit Git settings and existing managed Git forks keep their current behavior.

The generated WORKSPACE Go companion block includes the @rules_go → @io_bazel_rules_go repository mapping, matching the public repository helper.

Release workflow

Both manual and tag runs build the bundle and test the packaged Go consumer in Bzlmod and WORKSPACE. A manual branch run saves a workflow artifact only. A version-tag push creates a draft release after every release validation succeeds, using that same validated bundle.

The draft job checks the bundle SHA/tag against the checkout and the live tag target. It cannot create a missing tag, overwrite an existing release, publish the draft, or submit BCR changes. A maintainer still reviews and publishes the draft. Version bumps and changelog entries remain reviewed source changes.

This applies to future release tags. It does not replace or backfill the already published v1.3.0 release. Runtime instrumentation, metadata selection and payload uploading are unchanged.

Validation

At 75a9b7bf, the complete source tree is identical to the previously validated integration tree. All 11 commits retain their patches; the rebase changes ancestry only.

• All 116 Go bootstrap tests pass through Bazel 8.8.2, with no skips. The onboarding-pin suite passes too. New regressions reproduce the reported failures before the fix and cover single/double-quoted IPv6 and bracketed URLs, nested computed URL expressions, managed/unmanaged computed prefixes and types, and idempotent reruns through run().
• The unchanged public CLI paths were also checked for managed-prefix and unmanaged-type migrations using the actual archive flags, plus literal IPv6 inference. Buildifier independently parsed each generated MODULE file, and a second CLI run left its checksum unchanged. Go module synchronization and backend access were disabled in these local smokes.
• The argument reader now consumes the complete outer value. It does not infer a literal from a nested keyword or a string fragment. Computed values still require explicit pins; unsupported patches, authentication attributes and attribute expansion are rejected before writing. A different literal unmanaged fork is still rejected.
• Built the committed bundle twice. All five assets are byte-identical and their checksums verify. Module-version alignment, all 43 required fork archive paths, gofmt and git diff --check pass.
• The full Python tooling target passes locally through Bazel: 552 tests with one existing platform skip. The 14 release-tool tests also pass independently, covering packaging, repository mappings, tag/version guards, line endings and BEP symlink staging. Buildifier checks pass for the affected BUILD files.

Current-head CI passes all 55 jobs on its first attempt, with no retries. All 62 current head checks pass, including security, documentation and mergegate. The tested merge revision, 5c73e06b, combines 75a9b7bf with main at 9688a041; the source tree matches the local checks above. GitHub reports no merge conflicts and retains the human approval.

The passing matrix covers Ubuntu, macOS and Windows main jobs, Linux hermetic validation, both public Go fork profiles on all four maintained versions on x86-64 and ARM64, and all eight native Windows Go bootstrap combinations. Raw logs confirm the current merge checkout for every profile and native-Windows leaf job.

The runtime inputs are unchanged by this parser follow-up. Existing packaged-consumer Bzlmod/WORKSPACE and sibling-fixture proof covers those unchanged inputs; no new full local consumer run is claimed for this commit. The sibling WORKSPACE fixture's extra legacy execution-log cache probe was inconclusive and is not counted as proof. No real backend uploads or GitHub draft-release creation were performed locally.

All eight existing review threads are resolved, and their archive-bootstrap fixes remain in the current head. GitHub retained the human approval after the rebase. A fresh automated review of this head has not yet been observed; the remaining checks and normal merge gates still apply. No tag, release or BCR submission has been created by this PR.

[datadog-datadog-prod-us1-2]

Two distinct correctness bugs are present: the raw-text block scanner used when removing/migrating archive overrides does not skip comments, so a parenthesis inside a comment is mistaken for the call's closing delimiter and MODULE.bazel is left malformed; separately, the URL-list parser in archive.go accepts only the first literal list and silently discards any trailing computed expression (list concatenation or conditional), causing mirror URLs to be dropped and potentially breaking archive resolution.

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit 290c74b}

[datadog-datadog-prod-us1-2]

The two most critical issues are: (1) generated WORKSPACE blocks in build_release.py omit the @rules_go → @io_bazel_rules_go repository mapping, leaving Go companion loads unresolved; and (2) in archive.go, a computed type = ARCHIVE_TYPE attribute is silently treated as absent by literalAttribute, causing the rewritten MODULE.bazel override to drop the extraction type and break Bazel dependency resolution for extensionless mirror URLs.

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit bd033b5}

[datadog-datadog-prod-us1-2]

Two of the most critical issues are: (1) the regex-based URL list parser in archive.go line 202 is too shallow — it mishandles both nested dict expressions and IPv6 bracket literals, requiring a proper argument parser; and (2) hydration in main.go fires before explicit archive-pin configuration, so any managed archive whose strip_prefix is a computed concatenation is rejected before the documented --rto-archive-* flags can override it.

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit 511cf44}