update .aspect/bazelrc

.aspect/bazelrc/bazel6.bazelrc

@@ -13,3 +13,42 @@ build --reuse_sandbox_directories
 # Avoid this flag being enabled by remote_download_minimal or remote_download_toplevel
 # See https://meroton.com/blog/bazel-6-errors-build-without-the-bytes/
 build --noexperimental_action_cache_store_output_metadata
+
+# Speed up all builds by not checking if output files have been modified. Lets you make changes to
+# the output tree without triggering a build for local debugging. For example, you can modify
+# [rules_js](https://github.com/aspect-build/rules_js) 3rd party npm packages in the output tree
+# when local debugging.
+# Docs: https://github.com/bazelbuild/bazel/blob/1af61b21df99edc2fc66939cdf14449c2661f873/src/main/java/com/google/devtools/build/lib/pkgcache/PackageOptions.java#L185
+# NB: This flag is in bazel6.bazelrc as when used in Bazel 7 is has been observed to break
+# "build without the bytes" --remote_download_outputs=toplevel. See https://github.com/bazel-contrib/bazel-lib/pull/711
+# for more info.
+build --noexperimental_check_output_files
+fetch --noexperimental_check_output_files
+query --noexperimental_check_output_files
+
+# Don't apply `--noremote_upload_local_results` and `--noremote_accept_cached` to the disk cache.
+# If you have both `--noremote_upload_local_results` and `--disk_cache`, then this fixes a bug where
+# Bazel doesn't write to the local disk cache as it treats as a remote cache.
+# Docs: https://bazel.build/reference/command-line-reference#flag--incompatible_remote_results_ignore_disk
+# NB: This flag is in bazel6.bazelrc because it became a no-op in Bazel 7 and has been removed
+# in Bazel 8.
+build --incompatible_remote_results_ignore_disk
+
+# Propagate tags from a target declaration to the actions' execution requirements.
+# Ensures that tags applied in your BUILD file, like `tags=["no-remote"]`
+# get propagated to actions created by the rule.
+# Without this option, you rely on rules authors to manually check the tags you passed
+# and apply relevant ones to the actions they create.
+# See https://github.com/bazelbuild/bazel/issues/8830 for details.
+# Docs: https://bazel.build/reference/command-line-reference#flag--experimental_allow_tags_propagation
+build --experimental_allow_tags_propagation
+fetch --experimental_allow_tags_propagation
+query --experimental_allow_tags_propagation
+
+# Do not build runfiles symlink forests for external repositories under
+# `.runfiles/wsname/external/repo` (in addition to `.runfiles/repo`). This reduces runfiles &
+# sandbox creation times & prevents accidentally depending on this feature which may flip to off by
+# default in the future. Note, some rules may fail under this flag, please file issues with the rule
+# author.
+# Docs: https://bazel.build/reference/command-line-reference#flag--legacy_external_runfiles
+build --nolegacy_external_runfiles

.aspect/bazelrc/bazel7.bazelrc

@@ -0,0 +1,23 @@
+# Speed up all builds by not checking if external repository files have been modified.
+# Docs: https://github.com/bazelbuild/bazel/blob/1af61b21df99edc2fc66939cdf14449c2661f873/src/main/java/com/google/devtools/build/lib/bazel/repository/RepositoryOptions.java#L244
+common --noexperimental_check_external_repository_files
+
+# Don't report when the root module's lower bound for a dependency happens to be less than the resolved version.
+# This is expected and should NOT prompt an engineer to update our lower bound to match.
+# WARNING: For repository 'aspect_bazel_lib', the root module requires module version [email protected],
+# but got [email protected] in the resolved dependency graph.
+common --check_direct_dependencies=off
+
+# Directories used by sandboxed non-worker execution may be reused to avoid unnecessary setup costs.
+# Save time on Sandbox creation and deletion when many of the same kind of action run during the
+# build.
+# Docs: https://bazel.build/reference/command-line-reference#flag--reuse_sandbox_directories
+build --reuse_sandbox_directories
+
+# Do not build runfiles symlink forests for external repositories under
+# `.runfiles/wsname/external/repo` (in addition to `.runfiles/repo`). This reduces runfiles &
+# sandbox creation times & prevents accidentally depending on this feature which may flip to off by
+# default in the future. Note, some rules may fail under this flag, please file issues with the rule
+# author.
+# Docs: https://bazel.build/reference/command-line-reference#flag--legacy_external_runfiles
+build --nolegacy_external_runfiles

.aspect/bazelrc/ci.bazelrc

@@ -1,10 +1,3 @@
-# We recommend enforcing a policy that keeps your CI from being slowed down
-# by individual test targets that should be optimized
-# or split up into multiple test targets with sharding or manually.
-# Set this flag to exclude targets that have their timeout set to eternal (>15m) from running on CI.
-# Docs: https://bazel.build/docs/user-manual#test-timeout-filters
-build --test_timeout_filters=-eternal
-
 # Set this flag to enable re-tries of failed tests on CI.
 # When any test target fails, try one or more times. This applies regardless of whether the "flaky"
 # tag appears on the target definition.
@@ -16,7 +9,7 @@ build --test_timeout_filters=-eternal
 # is more likely to get fixed.
 # Note that when passing after the first attempt, Bazel will give a special "FLAKY" status.
 # Docs: https://bazel.build/docs/user-manual#flaky-test-attempts
-build --flaky_test_attempts=2
+test --flaky_test_attempts=2
 
 # Announce all announces command options read from the bazelrc file(s) when starting up at the
 # beginning of each Bazel invocation. This is very useful on CI to be able to inspect what Bazel rc

.aspect/bazelrc/convenience.bazelrc

@@ -3,7 +3,7 @@
 build --keep_going
 
 # Output test errors to stderr so users don't have to `cat` or open test failure log files when test
-# fail. This makes the log noiser in exchange for reducing the time-to-feedback on test failures for
+# fail. This makes the log noisier in exchange for reducing the time-to-feedback on test failures for
 # users.
 # Docs: https://bazel.build/docs/user-manual#test-output
 test --test_output=errors

.aspect/bazelrc/correctness.bazelrc

@@ -24,7 +24,7 @@ test --test_verbose_timeout_warnings
 # Allow the Bazel server to check directory sources for changes. Ensures that the Bazel server
 # notices when a directory changes, if you have a directory listed in the srcs of some target.
 # Recommended when using
-# [copy_directory](https://github.com/aspect-build/bazel-lib/blob/main/docs/copy_directory.md) and
+# [copy_directory](https://github.com/bazel-contrib/bazel-lib/blob/main/docs/copy_directory.md) and
 # [rules_js](https://github.com/aspect-build/rules_js) since npm package are source directories
 # inputs to copy_directory actions.
 # Docs: https://bazel.build/reference/command-line-reference#flag--host_jvm_args
@@ -42,21 +42,23 @@ test --incompatible_exclusive_test_sandboxed
 # Docs: https://bazel.build/reference/command-line-reference#flag--incompatible_strict_action_env
 build --incompatible_strict_action_env
 
-# Propagate tags from a target declaration to the actions' execution requirements.
-# Ensures that tags applied in your BUILD file, like `tags=["no-remote"]`
-# get propagated to actions created by the rule.
-# Without this option, you rely on rules authors to manually check the tags you passed
-# and apply relevant ones to the actions they create.
-# See https://github.com/bazelbuild/bazel/issues/8830 for details.
-# Docs: https://bazel.build/reference/command-line-reference#flag--experimental_allow_tags_propagation
-build --experimental_allow_tags_propagation
-fetch --experimental_allow_tags_propagation
-query --experimental_allow_tags_propagation
-
 # Do not automatically create `__init__.py` files in the runfiles of Python targets. Fixes the wrong
 # default that comes from Google's internal monorepo by using `__init__.py` to delimit a Python
 # package. Precisely, when a `py_binary` or `py_test` target has `legacy_create_init` set to `auto (the
 # default), it is treated as false if and only if this flag is set. See
 # https://github.com/bazelbuild/bazel/issues/10076.
 # Docs: https://bazel.build/reference/command-line-reference#flag--incompatible_default_to_explicit_init_py
 build --incompatible_default_to_explicit_init_py
+
+# Set default value of `allow_empty` to `False` in `glob()`. This prevents a common mistake when
+# attempting to use `glob()` to match files in a subdirectory that is opaque to the current package
+# because it contains a BUILD file. See https://github.com/bazelbuild/bazel/issues/8195.
+# Docs: https://bazel.build/reference/command-line-reference#flag--incompatible_disallow_empty_glob
+common --incompatible_disallow_empty_glob
+
+# Always download coverage files for tests from the remote cache. By default, coverage files are not
+# downloaded on test result cache hits when --remote_download_minimal is enabled, making it impossible
+# to generate a full coverage report.
+# Docs: https://bazel.build/reference/command-line-reference#flag--experimental_fetch_all_coverage_outputs
+# detching remote cache results
+test --experimental_fetch_all_coverage_outputs

.aspect/bazelrc/java.bazelrc

@@ -0,0 +1,27 @@
+# Aspect recommended Bazel flags when using rules_java and rules_jvm_external
+
+# Pin java versions to desired language level
+# See https://bazel.build/docs/bazel-and-java#java-versions
+# and https://en.wikipedia.org/wiki/Java_version_history
+
+# What version of Java are the source files in this repo?
+# See https://bazel.build/docs/user-manual#java-language-version
+common --java_language_version=17
+
+# The Java language version used to build tools that are executed during a build
+# See https://bazel.build/docs/user-manual#tool-java-language-version
+common --tool_java_language_version=17
+
+# The version of JVM to use to execute the code and run the tests.
+# NB: The default value is local_jdk which is non-hermetic.
+# See https://bazel.build/docs/user-manual#java-runtime-version
+common --java_runtime_version=remotejdk_17
+
+# The version of JVM used to execute tools that are needed during a build.
+# See https://bazel.build/docs/user-manual#tool-java-runtime-version
+common --tool_java_runtime_version=remotejdk_17
+
+# Repository rules, such as rules_jvm_external: put Bazel's JDK on the path.
+# Avoids non-hermeticity from dependency on a JAVA_HOME pointing at a system JDK
+# see https://github.com/bazelbuild/rules_jvm_external/issues/445
+common --repo_env=JAVA_HOME=../bazel_tools/jdk

.aspect/bazelrc/javascript.bazelrc

@@ -8,21 +8,4 @@
 # details.
 # Docs: https://nodejs.org/en/docs/guides/debugging-getting-started/#command-line-options
 run:debug -- --node_options=--inspect-brk
-
-# Enable runfiles on all platforms. Runfiles are on by default on Linux and MacOS but off on
-# Windows.
-#
-# In general, rules_js and derivate rule sets assume that runfiles are enabled and do not support no
-# runfiles case because it does not scale to teach all Node.js tools to use the runfiles manifest.
-#
-# If you are developing on Windows, you must either run bazel with administrator privileges or
-# enable developer mode. If you do not you may hit this error on Windows:
-#
-#   Bazel needs to create symlinks to build the runfiles tree.
-#   Creating symlinks on Windows requires one of the following:
-#       1. Bazel is run with administrator privileges.
-#       2. The system version is Windows 10 Creators Update (1703) or later
-#          and developer mode is enabled.
-#
-# Docs: https://bazel.build/reference/command-line-reference#flag--enable_runfiles
-build --enable_runfiles
+test:debug --test_env=NODE_OPTIONS=--inspect-brk

.aspect/bazelrc/performance.bazelrc

@@ -1,38 +1,19 @@
-# Speed up all builds by not checking if output files have been modified. Lets you make changes to
-# the output tree without triggering a build for local debugging. For example, you can modify
-# [rules_js](https://github.com/aspect-build/rules_js) 3rd party npm packages in the output tree
-# when local debugging.
-# Docs: https://github.com/bazelbuild/bazel/blob/1af61b21df99edc2fc66939cdf14449c2661f873/src/main/java/com/google/devtools/build/lib/pkgcache/PackageOptions.java#L185
-build --noexperimental_check_output_files
-fetch --noexperimental_check_output_files
-query --noexperimental_check_output_files
-
-# Don't apply `--noremote_upload_local_results` and `--noremote_accept_cached` to the disk cache.
-# If you have both `--noremote_upload_local_results` and `--disk_cache`, then this fixes a bug where
-# Bazel doesn't write to the local disk cache as it treats as a remote cache.
-# Docs: https://bazel.build/reference/command-line-reference#flag--incompatible_remote_results_ignore_disk
-build --incompatible_remote_results_ignore_disk
-
 # Directories used by sandboxed non-worker execution may be reused to avoid unnecessary setup costs.
 # Save time on Sandbox creation and deletion when many of the same kind of action run during the
 # build.
 # No longer experimental in Bazel 6: https://github.com/bazelbuild/bazel/commit/c1a95501a5611878e5cc43a3cc531f2b9e47835b
 # Docs: https://bazel.build/reference/command-line-reference#flag--reuse_sandbox_directories
 build --experimental_reuse_sandbox_directories
 
-# Do not build runfiles symlink forests for external repositories under
-# `.runfiles/wsname/external/repo` (in addition to `.runfiles/repo`). This reduces runfiles &
-# sandbox creation times & prevents accidentally depending on this feature which may flip to off by
-# default in the future. Note, some rules may fail under this flag, please file issues with the rule
-# author.
-# Docs: https://bazel.build/reference/command-line-reference#flag--legacy_external_runfiles
-build --nolegacy_external_runfiles
+# Avoid creating a runfiles tree for binaries or tests until it is needed.
+# Docs: https://bazel.build/reference/command-line-reference#flag--build_runfile_links
+# See https://github.com/bazelbuild/bazel/issues/6627
+#
+# This may break local workflows that `build` a binary target, then run the resulting program
+# outside of `bazel run`. In those cases, the script will need to call
+# `bazel build --build_runfile_links //my/binary:target` and then execute the resulting program.
+build --nobuild_runfile_links
 
-# Some actions are always IO-intensive but require little compute. It's wasteful to put the output
-# in the remote cache, it just saturates the network and fills the cache storage causing earlier
-# evictions. It's also not worth sending them for remote execution.
-# For actions like PackageTar it's usually faster to just re-run the work locally every time.
-# You'll have to look at an execution log to figure out what other action mnemonics you care about.
-# In some cases you may need to patch rulesets to add a mnemonic to actions that don't have one.
-# https://bazel.build/reference/command-line-reference#flag--modify_execution_info
-build --modify_execution_info=PackageTar=+no-remote
+# Needed prior to Bazel 8; see
+# https://github.com/bazelbuild/bazel/issues/20577
+coverage --build_runfile_links