[tonyredondo]

Stack: #287 → #286. This base PR combines the CI fixes previously split between #287 and #288, plus a test-only follow-up found in the new CI run. The Windows-fix commit was incorporated by fast-forward; #286 keeps its existing head and is based directly on this branch.

Two CI paths were out of sync after the Bazel 8.8.2 security update in #284. Both failures already occur on main and block unrelated changes, including the release work in #286.

Runtime patch profiles

The patch generator rejects changed files that a profile does not classify. The security update changed five development-only paths that neither runtime profile listed:

.bazelrc
.bazelversion
examples/.bazelrc
examples/basic_gazelle/.bazelversion
examples/hello/.bazelversion

Both profiles now exclude those exact paths. They configure development of the vendored fork; consumers keep their own Bazel settings. Runtime changes still enter the patch, and unknown paths still fail generation. The original failure is visible on main.

WORKSPACE Go fixtures

The generated WORKSPACE made rules_shell available through go_rules_dependencies() but never registered its shell toolchains. On Windows, Bazel's collect_coverage helper then failed before the Go test ran with No suitable shell toolchain found. Main has this failure too.

Call the public rules_shell_dependencies() and rules_shell_toolchains() macros after go_rules_dependencies(). Both local and archive fixtures use this path. The regression executes the actual WORKSPACE writer in both modes and checks initialization order and exactly one toolchain registration.

Offline builder fixture

TestLoadModulePackageMetadataBatchSkipsBrokenTransitiveDeps deliberately imports the nonexistent example.com/missing. It inherited the host's Go module settings, so metadata lookup could contact public module servers. In the new CI run, the test reached its 60-second limit while resolving that dependency.

The fixture now disables module and checksum lookup, clears private-module overrides and ambient Go flags, and uses the installed toolchain. The original metadata assertions and timeout are unchanged. The same test is maintained in all four fork trees; their canonical full-delta patches are regenerated alongside it.

Bazel remains at 8.8.2. Security pins, lockfiles and production fork sources are unchanged. There are no instrumentation, target-selection or payload-handling changes.

Validation

• All 36 focused profile/WORKSPACE tests pass. They cover the exact exclusions, runtime inclusion, rejection of unknown paths, preservation of consumer Bazel settings, and both WORKSPACE fetch modes.
• Both profiles generate and apply cleanly for all four maintained rules_go versions. Manifest/hash, private-safety, fork-materialization and fork-map checks pass. The local verifier used --skip-functional-smoke; the functional coverage below comes from CI.
• The full builder suite passes locally through Bazel with Go 1.25.0: 27 tests, no skips. Verbose output confirms that the previously failing test ran and passed. A counting-proxy reproduction records two module requests before the fix and zero afterward, with the same metadata assertions passing. The fixed probe also passes with Go 1.27.3. Cross-platform CI remains required.
• All eight generated public runtime patches are byte-identical before and after the fixture change. The test is not a production builder input. The current CI below also validates the consumer paths.
• The Windows smokes require no metadata, cache or payloads while disabled, followed by a successful instrumented test and payload checks when enabled. No timeout or assertion was relaxed.
• Current-head CI at 467145c0 passes all 55 jobs on merge revision bcb6b45c, including both runtime profiles for every maintained upstream on x86-64 and ARM64, all eight native Windows Go bootstrap combinations, and the Ubuntu/macOS/Windows main suites. All 62 current head checks pass, including security, documentation and mergegate.
• The v0.62 builder suite passes with compilepkg_test completing in 0.1 seconds. Six consumer/profile jobs needed one failed-only retry after HTTP/2 dependency-download errors; the 45 successful first-attempt results were retained. No test timeout, assertion, network setting or security pin was changed to make those retries pass.

GitHub automatically marked #288 as merged when its exact commit became part of this base branch. Nothing has been merged into main; no merge commit or history rewrite was needed. The latest automated review predates the follow-ups; human review and normal merge gates still apply.

[datadog-datadog-prod-us1-2]

More details

The exact-path exclusions preserve consumers’ Bazel configuration while retaining runtime changes and rejection of unknown paths. The completed static review found no reportable defects.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit 33057eb}

[datadog-datadog-prod-us1-2]

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 467145c | Docs | View more details | Give us feedback!}