Pull request

Summary

The GitHub Bazel workflow previously built and tested only named aggregates such as //:portable_tests, leaving the analyzer, extension, and full MTP suites outside CI. eng/bazel/validate.ps1 now builds //... and runs every automatic test target uncached on Windows and Linux.

The validation gate requires all queried targets to report their expected outcomes, at least 35 automatic test targets, and an exact allowlist of six unreachable manual negative fixtures. MTP-based tests must produce a fresh, internally consistent TRX with at least one passing result and no failed or unknown outcomes. Twelve analysis/sample/console targets legitimately produce no TRX and are explicitly allowlisted; stale entries and unexpected reports fail validation. Intentional failures, zero-result exits, and mixed-module failure aggregation remain checked.

Making the full graph work required:

• Retargeting the portable graph to net10.0/net11.0, matching MSBuild's supported frameworks, with per-TFM and Windows-TFM targets reached through their wrappers.
• Matching native test-host metadata, child probes, OpenTelemetry setup, runtime-relative launches, and writable-output behavior to the MSBuild hosts.
• Using TEST_TMPDIR as the working directory and short private MTP pipe directories on Unix.
• Adding aot_publish_test on supported Linux/macOS hosts. Windows NativeAOT remains unsupported by the pinned rules_dotnet; Windows-only platform-services tests are skipped on Linux.
• Fixing TelemetryManager to create the sentinel directory through its injected IFileSystem; preserving the assertions in impersonation tests while reporting Inconclusive when the host lacks the required privilege; and removing the obsolete CancelledTestNodeStateProperty arm from the sample.
• Fixing two failures found on hosted runners: Bazel's case-sensitive environment inheritance now accepts both uppercase and mixed-case Windows ProgramFiles names; package validation now expects one self-contained publisher per supported framework rather than the obsolete count of four.

The shipping Arcade pipeline is unchanged. The experimental Bazel workflow remains optional/non-required, watches samples/**, and has a 90-minute job timeout.

Design and decision record

The maintained Bazel decision record records the contract, failing baseline, alternatives, validation matrix, and hosted follow-up repairs. Usage documentation describes the gates and supported scope.

The manual-target query is intentionally unconfigured: it proves reachability across select() branches, not execution of every branch. Test applications run on net10.0; //:managed_all builds the product graph for net10.0 and net11.0. Host-incompatible targets are explicit rather than inferred. The Azure DevOps definition azure-pipelines-bazel.yml is still not registered in dnceng-public; registration requires an administrator and is outside this PR.

Demonstration

No UI/layout is changed. The successful hosted run and its bazel-windows-latest / bazel-ubuntu-latest artifacts provide executable evidence, validation manifests, logs, and reports rather than screenshots.

Validation and regression proof

Final hosted validation passed for head 624fed4b5ae70fb3810f93722c3e597ee83f5fa3. Run 43501140825 completed successfully on both Windows and Ubuntu. Its checkout was PR merge 994d6e938fc9a4bb05c2a3377f32583440fe40cf, whose parents were base 548d3bfc1567fe0aa3663d8dacbe78ab33cedf6e and that exact head. Both uploaded artifact sets were downloaded and their manifests inspected.

Toolchain: Bazel 9.1.1 and rules_dotnet SDK 11.0.100-rc.3.26522.148.

Both full-graph manifests record the expected exits for all 14 steps: 0 for build/cached-build/queries/all-tests/discovery/reports/provenance; 2 for the failing-test probe; 9 for empty selection; 3 for mixed results; and 1 for each reference-alias negative.

Additional local confirmation for the final repair: pwsh -NoLogo -NoProfile -File eng/bazel/validate.ps1 -Jobs 4 -EvidenceRoot <dir> passed with mixed-case Windows installation-path variables, including all 3,050 passing analyzer cases and one conditional skip. The corresponding package and expanded-Windows validators also passed locally.

Historical validation at 63f0c0e7bd730bbd67ebce7b2c8bbebd1d2b006d, based on bb99b2c77543888679b8db19ae926d9f7962a0e8, is retained in the decision record: full local Windows/WSL graph runs passed; MSBuild compiled the affected projects; changed test classes passed with platform 114 passed/2 Inconclusive, extensions 74 passed, and generator continuation tests 10 passed/1 conditional skip. These earlier results are not presented as executions at the final head.

Remaining boundaries: macOS is not in the workflow matrix; Windows NativeAOT is unsupported upstream; expanded Windows library validation does not exercise app registration or XAML compilation. Required review and any still-running non-Bazel Azure checks remain separate merge gates. This PR has not been merged.

Test-value evidence

• Product regression, earlier revision 63f0c0e7bd730bbd67ebce7b2c8bbebd1d2b006d: --filter FullyQualifiedName~TelemetryManagerTests on net10.0. Restoring Directory.CreateDirectory produced exit 2, 14/15 passed, with TelemetryManager_SentinelIsWrittenPerUserAndAvoidsShowingNoticeOnSubsequentRuns failing its expected IFileSystem.CreateDirectory invocation. Restoring the fix produced exit 0, 15/15 passed. This paired run was not repeated for later unrelated launcher changes; the full final-head platform suite passed in CI.
• Workflow contract: python .github/scripts/test_bazel_cache.py with the base validator made test_validation_builds_and_tests_the_full_graph fail both build and test subtests (exit 1). The changed validator passed all 14 tests; the final-head contract run also passed. The full hosted graph provides execution evidence beyond this static wiring contract.
• Windows launcher repair, parent bf07eed116fa73aace608716c59a54059e19a7b8 to final head: pwsh -NoLogo -NoProfile -File eng/bazel.ps1 test //:analyzer_tests --nocache_test_results --test_arg=--filter --test_arg=FullyQualifiedName~AssertionArgsShouldAvoidConditionalAccessAnalyzerTests --jobs=4 --noshow_progress. With mixed-case ProgramFiles/ProgramFiles(x86) variables, the old rule failed all 11 selected cases during NuGet initialization (Bazel exit 3). The repaired rule executed and passed all 11 (exit 0), and uppercase variables also passed all 11. This is launcher/setup failure-and-recovery evidence, not an analyzer behavioral red assertion. The full final-head analyzer suite also passed on both hosted platforms.
• Publisher matrix repair: pre-fix run 43497565692 built the native publishers successfully, then failed the obsolete four-publisher assertion. The final-head package validator passed on both hosts, preserving the cardinality and unique-framework checks and executing each real staged runtime with 0/2/9 outcomes.
• Host parity and impersonation: MSBuild behavior remains preserved except that unavailable impersonation privilege produces Inconclusive instead of a false failure. Assertions remain intact. No paired assertion-based red/green claim is made for that capability gate.