cleanup: Fix asan/tsan builds; re-enable them on CI.

msan still broken.

.bazelrc

@@ -13,7 +13,7 @@ build --show_progress_rate_limit=0.5
 build --check_licenses=true
 build --process_headers_in_dependencies
 #build --remote_cache_compression  # needs newer bazel version
-build --remote_download_minimal
+build --remote_download_outputs=minimal  # use "all" to make YCM work
 build --strict_filesets=true
 #build --strict_proto_deps=strict
 #build --strict_public_imports=strict
@@ -184,6 +184,8 @@ build:asan-libfuzzer --@rules_fuzzing//fuzzing:cc_engine_sanitizer=asan
 build:sanitizer --config=debug
 build:sanitizer --copt='-UNDEBUG'
 build:sanitizer --copt='-O3'
+# TODO(https://github.com/tweag/rules_nixpkgs/issues/430): Remove when released.
+build:sanitizer --copt='-fno-sanitize-ignorelist'
 build:sanitizer --per_file_copt='//c-toxcore[:/]@-O0'
 build:sanitizer --per_file_copt='//c-toxcore[:/]@-fno-inline,-fno-omit-frame-pointer'
 build:sanitizer --flaky_test_attempts=1

.github/workflows/docker.yml

@@ -23,11 +23,11 @@ jobs:
       - name: Build and push
         uses: docker/build-push-action@v4
         with:
-          push: true
           file: tools/built/src/Dockerfile.haskell
           tags: toxchat/toktok-stack:haskell
           cache-from: type=registry,ref=toxchat/toktok-stack:haskell
           cache-to: type=inline
+          push: true
 
   docker-third_party:
     runs-on: ubuntu-latest
@@ -42,11 +42,11 @@ jobs:
       - name: Build and push
         uses: docker/build-push-action@v4
         with:
-          push: true
           file: tools/built/src/Dockerfile.third_party
           tags: toxchat/toktok-stack:latest-third_party
           cache-from: type=registry,ref=toxchat/toktok-stack:latest-third_party
           cache-to: type=inline
+          push: true
 
   docker:
     runs-on: ubuntu-latest
@@ -62,11 +62,11 @@ jobs:
       - name: Build and push
         uses: docker/build-push-action@v4
         with:
-          push: true
           file: tools/built/src/Dockerfile
           tags: toxchat/toktok-stack:latest
           cache-from: type=registry,ref=toxchat/toktok-stack:latest
           cache-to: type=inline
+          push: true
 
   docker-release:
     runs-on: ubuntu-latest
@@ -82,11 +82,11 @@ jobs:
       - name: Build and push
         uses: docker/build-push-action@v4
         with:
-          push: true
           file: tools/built/src/Dockerfile.release
           tags: toxchat/toktok-stack:latest-release
           cache-from: type=registry,ref=toxchat/toktok-stack:latest-release
           cache-to: type=inline
+          push: true
 
   docker-fastbuild:
     runs-on: ubuntu-latest
@@ -102,11 +102,11 @@ jobs:
       - name: Build and push
         uses: docker/build-push-action@v4
         with:
-          push: true
           file: tools/built/src/Dockerfile.fastbuild
           tags: toxchat/toktok-stack:latest-fastbuild
           cache-from: type=registry,ref=toxchat/toktok-stack:latest-fastbuild
           cache-to: type=inline
+          push: true
 
   docker-dev:
     runs-on: ubuntu-latest
@@ -122,11 +122,11 @@ jobs:
       - name: Build and push
         uses: docker/build-push-action@v4
         with:
-          push: true
           file: tools/built/src/Dockerfile.dev
           tags: toxchat/toktok-stack:latest-dev
           cache-from: type=registry,ref=toxchat/toktok-stack:latest-dev
           cache-to: type=inline
+          push: true
 
   docker-debug:
     runs-on: ubuntu-latest
@@ -142,32 +142,31 @@ jobs:
       - name: Build and push
         uses: docker/build-push-action@v4
         with:
-          push: true
           file: tools/built/src/Dockerfile.debug
           tags: toxchat/toktok-stack:latest-debug
           cache-from: type=registry,ref=toxchat/toktok-stack:latest-debug
           cache-to: type=inline
+          push: true
 
-# TODO(iphydf): Fix asan: https://github.com/tweag/rules_nixpkgs/issues/430
-# docker-asan:
-#   runs-on: ubuntu-latest
-#   needs: [docker]
-#   steps:
-#     - name: Set up Docker Buildx
-#       uses: docker/setup-buildx-action@v2
-#     - name: Login to DockerHub
-#       uses: docker/login-action@v2
-#       with:
-#         username: ${{ secrets.DOCKERHUB_USERNAME }}
-#         password: ${{ secrets.DOCKERHUB_TOKEN }}
-#     - name: Build and push
-#       uses: docker/build-push-action@v4
-#       with:
-#         push: true
-#         file: tools/built/src/Dockerfile.asan
-#         tags: toxchat/toktok-stack:latest-asan
-#         cache-from: type=registry,ref=toxchat/toktok-stack:latest-asan
-#         cache-to: type=inline
+  docker-asan:
+    runs-on: ubuntu-latest
+    needs: [docker]
+    steps:
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+      - name: Login to DockerHub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v4
+        with:
+          file: tools/built/src/Dockerfile.asan
+          tags: toxchat/toktok-stack:latest-asan
+          cache-from: type=registry,ref=toxchat/toktok-stack:latest-asan
+          cache-to: type=inline
+          push: true
 
 # TODO(iphydf): Fix msan.
 # docker-msan:
@@ -184,28 +183,28 @@ jobs:
 #     - name: Build and push
 #       uses: docker/build-push-action@v4
 #       with:
-#         push: true
 #         file: tools/built/src/Dockerfile.msan
 #         tags: toxchat/toktok-stack:latest-msan
 #         cache-from: type=registry,ref=toxchat/toktok-stack:latest-msan
 #         cache-to: type=inline
-
-# docker-tsan:
-#   runs-on: ubuntu-latest
-#   needs: [docker]
-#   steps:
-#     - name: Set up Docker Buildx
-#       uses: docker/setup-buildx-action@v2
-#     - name: Login to DockerHub
-#       uses: docker/login-action@v2
-#       with:
-#         username: ${{ secrets.DOCKERHUB_USERNAME }}
-#         password: ${{ secrets.DOCKERHUB_TOKEN }}
-#     - name: Build and push
-#       uses: docker/build-push-action@v4
-#       with:
 #         push: true
-#         file: tools/built/src/Dockerfile.tsan
-#         tags: toxchat/toktok-stack:latest-tsan
-#         cache-from: type=registry,ref=toxchat/toktok-stack:latest-tsan
-#         cache-to: type=inline
+
+  docker-tsan:
+    runs-on: ubuntu-latest
+    needs: [docker]
+    steps:
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+      - name: Login to DockerHub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v4
+        with:
+          file: tools/built/src/Dockerfile.tsan
+          tags: toxchat/toktok-stack:latest-tsan
+          cache-from: type=registry,ref=toxchat/toktok-stack:latest-tsan
+          cache-to: type=inline
+          push: true

tools/built/src/home/.config/home-manager/home.nix

@@ -11,11 +11,14 @@
 
   # Packages that should be installed to the user profile.
   home.packages = with pkgs; [
-    connect # for ssh proxy via tor
-    gnupg
-    openssh
-    screen # terminal window manager
-    tor
+    connect         # for ssh proxy via tor
+    gdb             # debugger for C code
+    gnupg           # for signing git commits
+    openssh         # ssh server
+    screen          # terminal window manager
+    stylish-haskell # formatter for Haskell
+    tor             # onion routing for privacy when testing tox inside the container
+    xxd             # hex viewer (to inspect dumps and tox saves)
   ];
 
   # This value determines the Home Manager release that your
@@ -72,7 +75,7 @@
       nnoremap <C-l> :noh<CR><C-l>
       map Q gqap
 
-      au FileType bzl set ts=4 sw=4
+      au FileType bzl,haskell,lhaskell set ts=4 sw=4
     '';
   };
 

tools/built/src/setup-dev.sh

@@ -37,6 +37,14 @@ if [ ! -f /nix/var/nix/daemon-socket/socket ]; then
   sleep 1
 fi
 
+# Generate compile_commands.json, used by YCM.
 nix-shell -p python3 --run "python3 $HOME/.bin/bazel-compdb"
-bazel build --show_timestamps //...
+
+# Download the entire remote build cache so it's available locally in the dev
+# container. Really we only need the headers for YCM, but I don't know how to
+# easily limit this to headers only.
+bazel build --show_timestamps --remote_download_outputs=all //...
+
+# Run all tests to completion, so the dev container starts out with all tests
+# passing (so any potential breakage is local only).
 tools/retry 5 bazel test --show_timestamps -- //...

tools/project/haskell/cirrus.yml.in

@@ -8,5 +8,5 @@ bazel-opt_task:
     - /src/workspace/tools/inject-repo hs-{PACKAGE}
   test_all_script:
     - cd /src/workspace && bazel test -k
-        --remote_http_cache=http://$CIRRUS_HTTP_CACHE_HOST
+        --config=ci
         //hs-{PACKAGE}/...

tools/workspace/github.bzl

@@ -2,12 +2,12 @@
 
 load("@bazel_tools//tools/build_defs/repo:http.bzl", _http_archive = "http_archive")
 
-def github_archive(name, repo, version, **kwargs):
+def github_archive(name, repo, version, strip_prefix="", **kwargs):
     """http_archive but for GitHub downloads."""
     owner, repo = repo.split("/")
     _http_archive(
         name = name,
-        strip_prefix = "%s-%s" % (repo, version.replace("v", "")),
+        strip_prefix = "%s-%s%s" % (repo, version.replace("v", ""), strip_prefix),
         urls = ["https://github.com/%s/%s/archive/%s.zip" % (owner, repo, version)],
         **kwargs
     )