Skip to content

hermetic: run dx generate and dx coverage inside the isolated consumer - #6440

Merged
TrapsterDK merged 1 commit into
mainfrom
hermetic-dx-probes-6188
Nov 4, 2026
Merged

TrapsterDK merged 1 commit into
mainfrom
hermetic-dx-probes-6188

Conversation

@TrapsterDK

Copy link
Copy Markdown
Collaborator

Closes #6188

Adds two network-denied probes, dx_generate_check and dx_coverage, run after the bazel coverage probe when the manifest has coverage patterns. dx runs with a PATH whose first entry is a run-local bazel wrapper that execs the resolved bazelisk with --output_user_root. Both probes are required in verify_evidence, with unit cases.

Deviations: the wrapper script replaces a bind mount, and dx generate has no --check flag (it checks by default).

Tests: hermetic_unit_test passes. Not run: //tools/testing/hermetic:cpp_rust (nested Bazel), so the new probes are unverified end to end.

Assisted by Claude.

🤖 Generated with Claude Code

https://claude.ai/code/session_011u9TXHDZrfmzFQ2WT8QAKK

@TrapsterDK
TrapsterDK merged commit 09aed0e into main Nov 4, 2026
1 check failed
@TrapsterDK
TrapsterDK deleted the hermetic-dx-probes-6188 branch November 4, 2026 19:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

hermetic: run dx generate --check and dx coverage inside the isolated consumer

1 participant