.bazelrc

#############################################################################
# startup
#############################################################################

# Bazel doesn't need more than 200MB of memory for local build based on memory profiling:
# https://docs.bazel.build/versions/master/skylark/performance.html#memory-profiling
# The default JVM max heapsize is 1/4 of physical memory up to 32GB which could be large
# enough to consume all memory constrained by cgroup in large host.
# Limiting JVM heapsize here to let it do GC more when approaching the limit to
# leave room for compiler/linker.
# The number 3G is chosen heuristically to both support large VM and small VM with RBE.
# Startup options cannot be selected via config.
# TODO: Adding just to test android
startup --host_jvm_args=-Xmx3g
startup --host_jvm_args="-DBAZEL_TRACK_SOURCE_DIRECTORIES=1"


#############################################################################
# global
#############################################################################

common --noenable_bzlmod

fetch --color=yes
run --color=yes

build --color=yes
build --jobs=HOST_CPUS-1
build --workspace_status_command="bash bazel/get_workspace_status"
build --incompatible_strict_action_env
build --java_runtime_version=remotejdk_11
build --tool_java_runtime_version=remotejdk_11
build --java_language_version=11
build --tool_java_language_version=11
# silence absl logspam.
build --copt=-DABSL_MIN_LOG_LEVEL=4
# Global C++ standard and common warning suppressions
build --cxxopt=-std=c++20 --host_cxxopt=-std=c++20
build --copt=-Wno-deprecated-declarations
build --define envoy_mobile_listener=enabled
build --experimental_repository_downloader_retries=2
build --experimental_cc_static_library
build --enable_platform_specific_config
build --incompatible_merge_fixed_and_default_shell_env
# A workaround for slow ICU download.
build --http_timeout_scaling=6.0

# Allow stamped caches to bust when local filesystem changes.
# Requires setting `BAZEL_VOLATILE_DIRTY` in the env.
build --action_env=BAZEL_VOLATILE_DIRTY --host_action_env=BAZEL_VOLATILE_DIRTY

build --test_summary=terse

# TODO(keith): Remove once these 2 are the default
build --incompatible_config_setting_private_default_visibility
build --incompatible_enforce_config_setting_visibility

test --test_verbose_timeout_warnings
test --experimental_ui_max_stdouterr_bytes=11712829 #default 1048576

# Allow tags to influence execution requirements
common --experimental_allow_tags_propagation

# Python
common --@rules_python//python/config_settings:bootstrap_impl=script
build --incompatible_default_to_explicit_init_py

# We already have absl in the build, define absl=1 to tell googletest to use absl for backtrace.
build --define absl=1

# Disable ICU linking for googleurl.
build --@googleurl//build_config:system_icu=0

# Test options
build --test_env=HEAPCHECK=normal --test_env=PPROF_PATH

# Coverage options
coverage --config=coverage
coverage --build_tests_only

# Specifies the rustfmt.toml for all rustfmt_test targets.
build --@rules_rust//rust/settings:rustfmt.toml=@envoy//:rustfmt.toml


#############################################################################
# os
#############################################################################

build:linux --copt=-fdebug-types-section
# Enable position independent code (this is the default on macOS and Windows)
# (Workaround for https://github.com/bazelbuild/rules_foreign_cc/issues/421)
build:linux --copt=-fPIC
build:linux --cxxopt=-fsized-deallocation --host_cxxopt=-fsized-deallocation
build:linux --conlyopt=-fexceptions
build:linux --fission=dbg,opt
build:linux --features=per_object_debug_info

# macOS
build:macos --action_env=PATH=/opt/homebrew/bin:/opt/local/bin:/usr/local/bin:/usr/bin:/bin
build:macos --host_action_env=PATH=/opt/homebrew/bin:/opt/local/bin:/usr/local/bin:/usr/bin:/bin
build:macos --define tcmalloc=disabled
build:macos --cxxopt=-Wno-nullability-completeness
build:macos --@toolchains_llvm//toolchain/config:compiler-rt=false
build:macos --@toolchains_llvm//toolchain/config:libunwind=false


#############################################################################
# compiler
#############################################################################

# Common flags for Clang (shared between all clang variants)
common:clang-common --linkopt=-fuse-ld=lld
common:clang-common --@toolchains_llvm//toolchain/config:compiler-rt=false
common:clang-common --@toolchains_llvm//toolchain/config:libunwind=false

# Clang with libc++ (default)
common:clang --config=clang-common
common:clang --config=libc++
common:clang --host_platform=@clang_platform
common:clang --repo_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1

# Clang installed to non-standard location (ie not /opt/llvm/)
common:clang-local --config=clang-common
common:clang-local --config=libc++

# Use gold linker for gcc compiler.
build:gcc --config=libstdc++
build:gcc --test_env=HEAPCHECK=
build:gcc --action_env=BAZEL_COMPILER=gcc
build:gcc --action_env=CC=gcc --action_env=CXX=g++
# This is to work around a bug in GCC that makes debug-types-section
# option not play well with fission:
# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110885
build:gcc --copt=-fno-debug-types-section
# These trigger errors in multiple places both in Envoy dependecies
# and in Envoy code itself when using GCC.
# And in all cases the reports appear to be clear false positives.
build:gcc --copt=-Wno-error=restrict
build:gcc --copt=-Wno-error=uninitialized
build:gcc --cxxopt=-Wno-missing-requires
build:gcc --cxxopt=-Wno-dangling-reference
build:gcc --cxxopt=-Wno-nonnull-compare
build:gcc --cxxopt=-Wno-trigraphs
build:gcc --linkopt=-fuse-ld=gold --host_linkopt=-fuse-ld=gold
build:gcc --host_platform=@envoy//bazel/rbe/toolchains:rbe_linux_gcc_platform
build:gcc --linkopt=-fuse-ld=gold --host_linkopt=-fuse-ld=gold
build:gcc --action_env=BAZEL_LINKOPTS=-lm:-fuse-ld=gold

# libc++ - default for clang
common:libc++ --action_env=CXXFLAGS=-stdlib=libc++
common:libc++ --action_env=LDFLAGS="-stdlib=libc++ -fuse-ld=lld"
common:libc++ --action_env=BAZEL_CXXOPTS=-stdlib=libc++
common:libc++ --action_env=BAZEL_LINKLIBS=-l%:libc++.a:-l%:libc++abi.a
common:libc++ --action_env=BAZEL_LINKOPTS=-lm:-pthread
common:libc++ --define force_libcpp=enabled
common:libc++ --@envoy//bazel:libc++=true

# libstdc++ - currently only used for gcc
build:libstdc++ --action_env=BAZEL_LINKLIBS=-l%:libstdc++.a
build:libstdc++ --@envoy//bazel:libc++=false
build:libstdc++ --@envoy//bazel:libstdc++=true


#############################################################################
# tests
#############################################################################

# Coverage
build:coverage --action_env=BAZEL_USE_LLVM_NATIVE_COVERAGE=1
build:coverage --action_env=GCOV=llvm-profdata
build:coverage --copt=-DNDEBUG
# 1.5x original timeout + 300s for trace merger in all categories
build:coverage --test_timeout=390,750,1500,5700
build:coverage --define=ENVOY_CONFIG_COVERAGE=1
build:coverage --cxxopt="-DENVOY_CONFIG_COVERAGE=1"
build:coverage --test_env=HEAPCHECK=
build:coverage --combined_report=lcov
build:coverage --strategy=TestRunner=remote,sandboxed,local
build:coverage --strategy=CoverageReport=sandboxed,local
build:coverage --experimental_use_llvm_covmap
build:coverage --experimental_generate_llvm_lcov
build:coverage --experimental_split_coverage_postprocessing
build:coverage --experimental_fetch_all_coverage_outputs
build:coverage --collect_code_coverage
build:coverage --instrumentation_filter="^//source(?!/common/quic/platform)[/:],^//envoy[/:],^//contrib(?!/.*/test)[/:]"
build:coverage --remote_download_minimal
build:coverage --define=tcmalloc=gperftools
build:coverage --define=no_debug_info=1
# `--no-relax` is required for coverage to not err with `relocation R_X86_64_REX_GOTPCRELX`
build:coverage --linkopt=-Wl,-s,--no-relax
build:coverage --test_env=ENVOY_IP_TEST_VERSIONS=v4only
build:coverage --define=dynamic_link_tests=false
# Use custom report generator that also generates HTML
build:coverage --coverage_report_generator=@envoy//tools/coverage:report_generator

build:test-coverage --test_arg="-l trace"
build:test-coverage --test_arg="--log-path /dev/null"
build:test-coverage --test_tag_filters=-nocoverage,-fuzz_target

## Compile-time-options testing
# Right now, none of the available compile-time options conflict with each other. If this
# changes, this build type may need to be broken up.
build:compile-time-options --define=admin_html=disabled
build:compile-time-options --define=signal_trace=disabled
build:compile-time-options --define=hot_restart=disabled
build:compile-time-options --define=google_grpc=disabled
build:compile-time-options --config=boringssl-fips
build:compile-time-options --define=log_debug_assert_in_release=enabled
build:compile-time-options --define=path_normalization_by_default=true
build:compile-time-options --define=deprecated_features=disabled
build:compile-time-options --define=tcmalloc=gperftools
build:compile-time-options --define=uhv=enabled
# gRPC has a lot of deprecated-enum-enum-conversion warnings with C++20
build:compile-time-options --copt=-Wno-error=deprecated-enum-enum-conversion
build:compile-time-options --test_env=ENVOY_HAS_EXTRA_EXTENSIONS=true
build:compile-time-options --@envoy//bazel:http3=False
build:compile-time-options --@envoy//source/extensions/filters/http/kill_request:enabled


#############################################################################
# SSL
#############################################################################

common:fips-common --test_tag_filters=-nofips
common:fips-common --build_tag_filters=-nofips
common:fips-common --//bazel:fips=True

# BoringSSL FIPS
common:boringssl-fips --config=fips-common
common:boringssl-fips --//bazel:ssl=@boringssl_fips//:ssl
common:boringssl-fips --//bazel:crypto=@boringssl_fips//:crypto

# AWS-LC FIPS
common:aws-lc-fips --config=fips-common
common:aws-lc-fips --//bazel:ssl=@aws_lc//:ssl
common:aws-lc-fips --//bazel:crypto=@aws_lc//:crypto
common:aws-lc-fips --//bazel:http3=False


#############################################################################
# sanitizers
#############################################################################

# Common flags for sanitizers
build:sanitizer --define tcmalloc=disabled
build:sanitizer --linkopt -ldl
test:sanitizer --build_tests_only

# ASAN config with clang runtime
build:asan --config=asan-common
build:asan --linkopt --rtlib=compiler-rt
build:asan --linkopt --unwindlib=libgcc
build:asan --linkopt=-l:libclang_rt.ubsan_standalone.a
build:asan --linkopt=-l:libclang_rt.ubsan_standalone_cxx.a
build:asan --action_env=ENVOY_UBSAN_VPTR=1
build:asan --copt=-fsanitize=vptr,function
build:asan --linkopt=-fsanitize=vptr,function
build:asan --linkopt='-L/opt/llvm/lib/clang/18/lib/x86_64-unknown-linux-gnu'

# Basic ASAN/UBSAN that works for gcc or llvm
build:asan-common --config=sanitizer
# ASAN install its signal handler, disable ours so the stacktrace will be printed by ASAN
build:asan-common --define signal_trace=disabled
build:asan-common --define ENVOY_CONFIG_ASAN=1
build:asan-common --build_tag_filters=-no_san
build:asan-common --test_tag_filters=-no_san
build:asan-common --copt -fsanitize=address,undefined
build:asan-common --linkopt -fsanitize=address,undefined
# vptr and function sanitizer are enabled in asan if it is set up via bazel/setup_clang.sh.
build:asan-common --copt -fno-sanitize=vptr,function
build:asan-common --linkopt -fno-sanitize=vptr,function
build:asan-common --copt -DADDRESS_SANITIZER=1
build:asan-common --copt -DUNDEFINED_SANITIZER=1
build:asan-common --copt -D__SANITIZE_ADDRESS__
build:asan-common --test_env=ASAN_OPTIONS=handle_abort=1:allow_addr2line=true:check_initialization_order=true:strict_init_order=true:detect_odr_violation=1
build:asan-common --test_env=UBSAN_OPTIONS=halt_on_error=true:print_stacktrace=1
build:asan-common --test_env=ASAN_SYMBOLIZER_PATH
# ASAN needs -O1 to get reasonable performance.
build:asan-common --copt -O1
build:asan-common --copt -fno-optimize-sibling-calls

# macOS ASAN/UBSAN
build:macos-asan --config=asan
# Workaround, see https://github.com/bazelbuild/bazel/issues/6932
build:macos-asan --copt -Wno-macro-redefined
build:macos-asan --copt -D_FORTIFY_SOURCE=0
# Workaround, see https://github.com/bazelbuild/bazel/issues/4341
build:macos-asan --copt -DGRPC_BAZEL_BUILD
# Dynamic link cause issues like: `dyld: malformed mach-o: load commands size (59272) > 32768`
build:macos-asan --dynamic_mode=off

# Base MSAN config
build:msan --action_env=ENVOY_MSAN=1
build:msan --config=sanitizer
build:msan --build_tag_filters=-no_san
build:msan --test_tag_filters=-no_san
build:msan --define ENVOY_CONFIG_MSAN=1
build:msan --copt -fsanitize=memory
build:msan --linkopt -fsanitize=memory
build:msan --copt -fsanitize-memory-track-origins=2
build:msan --copt -DMEMORY_SANITIZER=1
build:msan --test_env=MSAN_SYMBOLIZER_PATH
# MSAN needs -O1 to get reasonable performance.
build:msan --copt -O1
build:msan --copt -fno-optimize-sibling-calls

# Base TSAN config
build:tsan --action_env=ENVOY_TSAN=1
build:tsan --config=sanitizer
build:tsan --define ENVOY_CONFIG_TSAN=1
build:tsan --copt -fsanitize=thread
build:tsan --linkopt -fsanitize=thread
build:tsan --copt -DTHREAD_SANITIZER=1
build:tsan --build_tag_filters=-no_san,-no_tsan
build:tsan --test_tag_filters=-no_san,-no_tsan
# Needed due to https://github.com/libevent/libevent/issues/777
build:tsan --copt -DEVENT__DISABLE_DEBUG_MODE
# https://github.com/abseil/abseil-cpp/issues/760
# https://github.com/google/sanitizers/issues/953
build:tsan --test_env="TSAN_OPTIONS=report_atomic_races=0"
build:tsan --test_timeout=120,600,1500,4800


#############################################################################
# fuzzing
#############################################################################

## Fuzz builds
# Shared fuzzing configuration.
build:fuzzing --define=ENVOY_CONFIG_ASAN=1
build:fuzzing --copt=-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION

# ASAN fuzzer
build:asan-fuzzer --config=plain-fuzzer
build:asan-fuzzer --config=asan
build:asan-fuzzer --copt=-fno-omit-frame-pointer
# Remove UBSAN halt_on_error to avoid crashing on protobuf errors.
build:asan-fuzzer --test_env=UBSAN_OPTIONS=print_stacktrace=1
build:asan-fuzzer --linkopt=-lc++

build:fuzz-coverage --config=plain-fuzzer
build:fuzz-coverage --run_under=@envoy//bazel/coverage:fuzz_coverage_wrapper.sh
build:fuzz-coverage --test_tag_filters=-nocoverage
# Existing fuzz tests don't need a full WASM runtime and in generally we don't really want to
# fuzz dependencies anyways. On the other hand, disabling WASM reduces the build time and
# resources required to build and run the tests.
build:fuzz-coverage --define=wasm=disabled
build:fuzz-coverage --config=fuzz-coverage-config
build:fuzz-coverage-config --//tools/coverage:config=@envoy//test:fuzz_coverage_config

build:oss-fuzz --config=fuzzing
build:oss-fuzz --config=libc++
build:oss-fuzz --define=FUZZING_ENGINE=oss-fuzz
build:oss-fuzz --@rules_fuzzing//fuzzing:cc_engine_instrumentation=oss-fuzz
build:oss-fuzz --@rules_fuzzing//fuzzing:cc_engine_sanitizer=none
build:oss-fuzz --dynamic_mode=off
build:oss-fuzz --strip=never
build:oss-fuzz --copt=-fno-sanitize=vptr
build:oss-fuzz --linkopt=-fno-sanitize=vptr
build:oss-fuzz --define=tcmalloc=disabled
build:oss-fuzz --define=signal_trace=disabled
build:oss-fuzz --copt=-D_LIBCPP_DISABLE_DEPRECATION_WARNINGS
build:oss-fuzz --define=force_libcpp=enabled
build:oss-fuzz --linkopt=-lc++
build:oss-fuzz --linkopt=-pthread

# Fuzzing without ASAN. This is useful for profiling fuzzers without any ASAN artifacts.
build:plain-fuzzer --config=fuzzing
build:plain-fuzzer --define=FUZZING_ENGINE=libfuzzer
# The fuzzing rules provide their own instrumentation, but it is currently
# disabled due to bazelbuild/bazel#12888. Instead, we provide instrumentation at
# the top level through these options.
build:plain-fuzzer --copt=-fsanitize=fuzzer-no-link
build:plain-fuzzer --linkopt=-fsanitize=fuzzer-no-link


#############################################################################
# miscellaneous
#############################################################################

build:cache-local --remote_cache=grpc://localhost:9092

# Flags for Clang + PCH
build:clang-pch --spawn_strategy=local
build:clang-pch --define=ENVOY_CLANG_PCH=1

# Clang-tidy
build:clang-tidy --@envoy_toolshed//format/clang_tidy:executable=@envoy//tools/clang-tidy
build:clang-tidy --@envoy_toolshed//format/clang_tidy:config=//:clang_tidy_config
build:clang-tidy --aspects @envoy_toolshed//format/clang_tidy:clang_tidy.bzl%clang_tidy_aspect
build:clang-tidy --output_groups=report
build:clang-tidy --build_tag_filters=-notidy

# Compile database generation config
build:compdb --build_tag_filters=-nocompdb

common:cves --//tools/dependency:cve-data=//tools/dependency:cve-data-dir

build:docs-ci --action_env=DOCS_RST_CHECK=1 --host_action_env=DOCS_RST_CHECK=1

# Optimize build for binary size reduction.
build:sizeopt -c opt --copt -Os


#############################################################################
# remote: Setup for cache, BES, RBE, and Docker workers
#############################################################################

build:remote --spawn_strategy=remote,sandboxed,local
build:remote --strategy=Javac=remote,sandboxed,local
build:remote --strategy=Closure=remote,sandboxed,local
build:remote --strategy=Genrule=remote,sandboxed,local
build:remote --action_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
# This flag may be more generally useful - it sets foreign_cc builds -jauto.
# It is only set here because if it were the default it risks OOMing on local builds.
build:remote --@envoy//bazel/foreign_cc:parallel_builds

## RBE (Engflow Envoy)

# this is not included in the `--config=rbe` target - set it to publish to engflow ui
common:bes --bes_backend=grpcs://mordenite.cluster.engflow.com/
common:bes --bes_results_url=https://mordenite.cluster.engflow.com/invocation/
common:bes --bes_timeout=3600s
common:bes --bes_upload_mode=fully_async
common:bes --nolegacy_important_outputs

common:engflow-common --google_default_credentials=false
common:engflow-common --credential_helper=*.engflow.com=%workspace%/bazel/engflow-bazel-credential-helper.sh
common:engflow-common --grpc_keepalive_time=60s
common:engflow-common --grpc_keepalive_timeout=30s
common:engflow-common --remote_cache_compression

# this provides access to RBE+cache
common:rbe --config=remote-cache
common:rbe --config=remote-exec

# this provides access to just cache
common:remote-cache --config=engflow-common
common:remote-cache --remote_cache=grpcs://mordenite.cluster.engflow.com
common:remote-cache --remote_timeout=3600s

common:remote-exec --remote_executor=grpcs://mordenite.cluster.engflow.com
common:remote-exec --jobs=200
common:remote-exec --define=engflow_rbe=true

# Docker sandboxes
build:docker-sandbox --spawn_strategy=docker
build:docker-sandbox --strategy=Javac=docker
build:docker-sandbox --strategy=Closure=docker
build:docker-sandbox --strategy=Genrule=docker
build:docker-sandbox --define=EXECUTOR=remote
build:docker-sandbox --experimental_docker_verbose
build:docker-sandbox --experimental_enable_docker_sandbox

build:docker-clang --config=docker-sandbox
build:docker-clang --config=clang

build:docker-gcc --config=docker-sandbox
build:docker-gcc --config=gcc

build:docker-asan --config=docker-sandbox
build:docker-asan --config=clang
build:docker-asan --config=asan

build:docker-msan --config=docker-sandbox
build:docker-msan --config=clang
build:docker-msan --config=msan

build:docker-tsan --config=docker-sandbox
build:docker-tsan --config=clang
build:docker-tsan --config=tsan


#############################################################################
# ci
#############################################################################

# CI configurations
build:remote-ci --config=ci
build:remote-ci --remote_download_minimal

# Note this config is used by mobile CI also.
common:ci --noshow_progress
common:ci --noshow_loading_progress
common:ci --test_output=errors


#############################################################################
# debug: Various Bazel debugging flags
#############################################################################
# debug/bazel
common:debug-bazel --announce_rc
common:debug-bazel -s
# debug/sandbox
common:debug-sandbox --verbose_failures
common:debug-sandbox --sandbox_debug
# debug/coverage
common:debug-coverage --action_env=VERBOSE_COVERAGE=true
common:debug-coverage --test_env=VERBOSE_COVERAGE=true
common:debug-coverage --test_env=DISPLAY_LCOV_CMD=true
common:debug-coverage --config=debug-tests
# debug/tests
common:debug-tests --test_output=all
# debug/everything
common:debug --config=debug-bazel
common:debug --config=debug-sandbox
common:debug --config=debug-coverage
common:debug --config=debug-tests

try-import %workspace%/repo.bazelrc
try-import %workspace%/clang.bazelrc
try-import %workspace%/user.bazelrc
try-import %workspace%/local_tsan.bazelrc