AL is a command runner that prepares credentials and environment variables through plugins, runs your command, and cleans up afterward. Its Bazel rules package commands with their configuration and required plugins.
This is the multi-page printable view of this section. Click here to print.
Al
Repository command runner and Bazel configuration rules
- 1: Command and plugin lifecycle
- 2: Releases
- 2.1: head
- 3: Rules
- 3.1: Bzl
- 3.1.1: al_config
- 3.1.2: al_toolchain
- 3.1.3: al_toolchain_resolved
1 - Command and plugin lifecycle
Startup, shutdown, and secret cleanup guarantees
al run starts selected plugins, passes their environment to a command, and
keeps plugin resources available until that command exits. On cancellation it
asks the command to terminate and waits up to ten seconds before killing it.
Plugin shutdown then drains requests, releases resources in reverse registration
order, and waits for plugin exit. Startup failure cancels sibling starts and
rolls back partially initialized resources. Cleanup errors fail the invocation.
The injector creates secret files with owner-only permissions and removes them
after consumers stop. Vault stores revoke AppRole tokens they issue; failed
AppRole login attempts destroy their unused single-use SecretID. The role’s
bootstrap policy must permit secret-id-accessor/destroy, as declared by
projects/tf_modules/vault_approle. The user’s existing token-helper credential
is never erased or revoked. Secret inputs and remote response bodies are omitted
from diagnostic messages. OIDC authorization uses the configured Vault HTTPS
origin and TLS transport, rejecting alternate origins and redirects.
Explicit config dumps still contain the requested configuration; file outputs
use owner-only permissions and truncate previous contents.
no_auth prevents AL’s Vault client from loading credentials. For environment
injection it clears inherited VAULT_TOKEN; it does not sandbox the command or
prevent a command from independently reading the user’s token helper. Plugins
and invoked commands remain trusted programs with the user’s filesystem access.
Cleanup is observable best effort, not secure erasure. Memory copies are not zeroized. Forced termination, host failure, unresponsive cleanup code, or an unavailable service can prevent deletion or revocation. Subprocess signaling targets direct children, not arbitrary descendants. Credential expiry remains a fallback; service-specific logout requirements are documented with each plugin.
2 - Releases
Releases
head
-
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy header, project descriptions and a linked documentation directory. Omit the repeated page title and generated language heading. Remove the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct GitHub Pages DNS records. Preserve repeated publication when pages is the remote default branch, and include Rules ISO in the main documentation. Document site onboarding in a registered, validated skill. Keep AL introduction short with useful links and preserve its lifecycle details in a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and Chrome inputs, sandboxed export actions, an update target and freshness checks, and include the maintained diagrams in infra/arch documentation. Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests, diagram repeatability and freshness, DNS configuration, Terraform formatting, semantic lint and repository quality.
Goal-Ref: build-and-deploy-every-project-landing-page-a782b800 Attempt-ID: attempt-00941092c164
LLM-disclaimer: This commit was generated by an LLM.
-
Wait for AL secret cleanup and plugin shutdown
Roll back partial plugin startup, drain requests before releasing resources, and wait for plugin and command processes to exit. Stop independent plugins concurrently while preserving dependency order inside each plugin.
Revoke invocation-owned credentials, remove temporary secret files, and verify Forgejo and Harbor session cleanup. Preserve the user’s existing Vault login. Enforce Vault OIDC origins and no_auth, redact sensitive errors, and restrict config dumps to owner-only files. Add the AppRole SecretID cleanup permission.
Cover normal exit, cancellation, failed startup, credential revocation, and transport cleanup with synthetic unit and real command/plugin regression tests.
Clarify that required formatting-only repairs need no separate approval, and fix the existing blank-line formatting failure in the GitHub AL wrapper.
Goal-Ref: fix-al-secret-lifecycle-and-plugin-shutdown-3137c0b0 Attempt-ID: attempt-0c1353676e2f
LLM-disclaimer: This commit was generated by an LLM.
-
Keep Bazel dependencies lazy and generate the root module
Declare pinned InfiniTime sources and the Hedron extractor through use_repo_rule, retain recursive firmware submodules, and use the official contrib_rules_jvm 0.32.0 release. Keep default toolchain registration convenient for consumers.
Move root tool implementations into owning packages while preserving compatibility labels, visibility, manual tags, Python paths, Terraform working directories, pnpm dependency pins, and documentation archive layout. Guard the load-free root BUILD with a parser-based quality test. Generate root MODULE.bazel directly from owning include files, with an update command and freshness/integration tests.
Cache hermetic agent tests, preserve lint analysis across modes, and build only lint outputs in lint mode. Allow normal agent lockfile updates while retaining strict CI checks. Limit host Bazel scheduling to eight jobs and half its CPUs, with matching checked-in host configuration.
Fix DNSControl command ordering, JSON manifest loading, record filename suffixes, and credential-file wiring through existing Vault environment injection. Add an offline config test. Correct the Git wrapper shebang for direct execution and refresh derived catalogs affected by the Bazel changes.
Validation covers compatibility builds, firmware, documentation outputs, generator freshness, DNS configuration, and a live DNS preview without applying changes. The repository-wide audit also identifies pre-existing test and coverage gaps.
Goal-Ref: avoid-unrelated-bazel-dependency-downloads-638e8329 Attempt-ID: attempt-106ffd5ccaeb
LLM-disclaimer: This commit was generated by an LLM.
-
Repair site navigation and simplify page layout
Show one homepage panel with vertically stacked GitHub and Docs rows using the name: URL format, hiding the protocol and trailing slash in the link text. Center the panel and cap its width at 40rem while allowing it to shrink on mobile. Move it slightly lower on desktop and brighten the footer link. Restore the project assets mount so custom styles load. Reduce the footer to its content height with compact padding. Size the homepage against the visible viewport so mobile browser controls do not hide its footer. Remove the separate Projects page and its header link, while keeping project documentation under Docs. Remove the introductory homepage copy and visible title.
Resolve Markdown links and images from their source locations, package missing documentation and book covers, correct source links, and scope anchors and release controls in combined print pages. Restore the archive-root CNAME explicitly during deployment so replacing the site preserves the custom domain.
Validate generated HTML for missing internal files and fragments, duplicate IDs, image alternatives, and the homepage, Misc source-link, and Goal diagram regressions. Check the production build, repository quality, affected-target semantic lint, desktop and mobile homepage rendering, and deployment output.
Goal-Ref: out/site-fix/goals/fix-local-alwaldend-com-layout-and-links-a2e69a4e Attempt-ID: attempt-165dd5be7d71
LLM-disclaimer: This commit was generated by an LLM.
-
Extract DNSControl setup into rules_dnscontrol
Extract the DNSControl setup into
rules_dnscontrol, generate its Bazel dependency bundle from project-owned record files, and update the DNS guidance. Move Hugo rules and the worker to role-based package paths, and give each non-nested project a locally owned Hugo landing target that reuses the shared README-to-landing macro.Clean all landing and Pages DNS records so GitHub Pages serves each project subdomain directly without Cloudflare proxying. Improve the main site with a three-panel home layout, complete project links, documentation explore links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with the nested
rules_hugotests, Buildifier, and repository quality checks.LLM-disclaimer: This commit was generated by an LLM.
-
Improve the Hugo site and fix the persistent worker
Extract the Hugo build rules into a standalone nested module projects/rules_hugo and add a Go-based persistent Hugo worker with a Dart Sass toolchain, then fix the worker’s empty-destination defect, polish the rules, add per-project landing pages and DNS declarations, and improve the site deploy.
- rules_hugo: standalone nested module with MODULE.bazel, main/bzl rules, tests, and README; no root-workspace labels.
- hugo_worker: persistent worker that resolves execroot-relative paths through the work directory and probes DART_SASS_BINARY, so the site destination is populated with HTML and Sass-compiled CSS.
- sass: Dart Sass 1.103.1 toolchain wired into the site build.
- alwaldend.com: Hugo 0.165.0, Docsy 0.17.0, Bootstrap 5.3.8, Font Awesome 7.3.1, module mounts, and the site build switched to the worker.
- Landing pages: content/projects/_index.md links every project to its docs page; a Projects menu entry is added and the content filegroup is wired.
- DNS: projects/alwaldend.com/dnsconfig.json declares no records (no new subdomains) and is wired into infra/dns/dnsconfig.js.
- Deploy: the genrule clones the pages branch that GitHub Pages serves, clears the previous checkout, writes .nojekyll, stages deletions, skips no-op deploys, and pushes HEAD:pages without a force push; the README deploy section is updated.
- Content: rename the reserved sites taxonomy to websites so the alwaldend.com term renders, and fix main/bzl docs prefix collisions across nested modules.
- Review fixes: document the extension-based toolchain registration in the rules_hugo README, sync the full-repo-check eval rubric to nine nested workspaces and twenty commands, and drop the worker’s unsupported outs attribute.
- Validation: site build produces 3051 HTML pages and Sass CSS; worker, terraform, buildifier, and nested rules_hugo tests pass; git diff –check is clean.
LLM-disclaimer: This commit was generated by an LLM.
-
Complete Phase 1 agent system controls
Close the registered agent-reachable universe with owner-local operation declarations, a report-only completeness checker, shared task-run contracts, task/run-isolated Cordis scratch, explicit Terraform mutations, and bounded Bazel diagnostics. Record numeric resource ceilings and accepted durable-goal evidence for the exact candidate.
Integrate the non-render agent tooling and Blender toolchain changes from PR 24 while retaining the old Blender data package whose move destination is excluded. Direct repository agents to prefer Cordis over shell for supported inspection and to consider bounded Cordis handlers for recurring gaps.
Verification:
- affected Bazel build: 74 targets passed
- affected Bazel tests: 23 of 23 passed
- Phase 1 registered-universe report: valid
- goal validation: valid
- git diff –check HEAD: passed
LLM-disclaimer: This commit was generated by an LLM.
-
docs: define the repository agent system
Make the repository legible as one coherent agent-operated system while preserving one mutation authority per fact.
- add revision-bound current state, target architecture, and phased roadmap
- route root and agent entry points to the canonical model and durable goal
- normalize repository-tree policy and the public-information boundary
- clarify task-private secret scratch and non-obvious tool narration
- correct question and secret skill contracts and stale operator examples
- render source-compatible Markdown links correctly in the documentation site
- retain the complete audit, decision, validation, and acceptance record
Validated with focused skill and Buildifier tests, affected Bazel builds, the full Hugo site, source and rendered link checks, exact label queries, repository-pinned formatting, and goal-record validation.
LLM-disclaimer: This commit was generated by an LLM.
- Complete repository quality coverage
-
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source and configuration file types through Bazel, and add Buildifier, Ruff, and ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin cache/runfiles adapters where required, expose format and check targets, and wire the checks into the pre-commit workflow. Format the existing tree and fix the correctness defects uncovered by the new checks. Preserve generated sources and exact-content fixtures that are not safely rewritable, and clarify that ordinary infrastructure build output is safe to display.
Validation:
- all 21 repository quality and compatibility formatter tests pass
- Buildifier test passes
- lint aspects analyze all 4,629 ordinary root targets without findings
- the complete 18-command root and nested full-repository audit was exercised; remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
-
Add global repository versioning
Introduce a Bazel-built Go tool that calculates the repository’s global SemVer-compatible ISO-week calendar versions, creates guarded nightly tags and weekly release branches atomically, advances release patches by first-parent commit, and emits deterministic Bazel workspace-status keys.
Route release stamping through the tool and add a packaged, discoverable versioning skill with offline Promptfoo validation. Cover ISO week boundaries, SemVer formatting, branch and dirty-tree guards, release patch calculation, tag integrity, and stamping output with focused tests.
Provide a clean-checkout bootstrap that builds the Go tool before it launches the stamped Bazel command. Bind ref transactions to the inspected commit, neutralize Git replace/graft/routing inputs, make dry runs validate namespace collisions, validate every published patch tag against its exact first-parent position, reject ambiguous or inconsistent tag states, and require explicit context for detached release calculations. Route detached release-tag selection through those same history-integrity checks. Keep development status cache-safe by emitting Git identity as volatile data while making immutable nightly and release identities stable.
Add a repository-delivery integration regression proving that a failed aggregate whitespace check identifies the offending path exactly once.
Verified with:
- bazel_agent test //tools/versioning/… //tools/repo_delivery/main/go:go_test //:write_skill_links_test //:buildifier_test
- bazel_agent build //tools/versioning/… //tools/repo_delivery/…
- tools/versioning/cmd/versioning/versioning.sh bazel – build –config=release //tools/versioning/cmd/versioning
- real Git integration tests covering ref transactions, SHA-256 repositories, environment isolation, detached contexts, tag ordering, and namespace collisions
LLM-disclaimer: This commit was generated by an LLM.
-
Add standalone documentation rules
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
This commit was generated by an LLM.
-
Keep embedded site server in target configuration
This commit was generated by an LLM.
-
Fix Bazel build caching and tool configuration
This commit was generated by an LLM.
-
Remove redundant documentation mappings
Inline sources from eight layout-neutral pkg_files wrappers and migrate the remaining legacy Vial docs producer to docs_filegroup. Keep only mappings that perform required renames.\n\nThis commit was generated by an LLM.
-
Complete docs filegroup migration
Pass ordinary documentation sources directly and isolate generated or renamed outputs in semantic pkg_files dependencies. Remove the obsolete renames and strip_prefix surface from docs_filegroup.\n\nThis commit was generated by an LLM.
-
Make release generation hermetic
Add the missing AL and Kustomization release targets and give release actions a declared bare Git snapshot instead of access to the workspace repository.\n\nThis commit was generated by an LLM.
-
Migrate documentation packaging to docs_filegroup
Preserve custom prefixes, renames, strip prefixes, and standalone workspace behavior.\n\nThis commit was generated by an LLM.
-
Make Qt and Maven dependencies hermetic
Align protobuf with the Android build tools and refresh generated locks.\n\nThis commit was generated by an LLM.
-
Make Android SDK setup reproducible
This commit was generated by an LLM.
-
Add agent-friendly Bazel config
This commit was generated by an LLM.
- Use an image from the marketplace, update some locks, add CODEOWNERS
- Finish opencode deploy
- Add //third_party/org_fedora_cloud, fix alwaldend.com roles
- Set up unikernel deploy
- Refactor flux manifests a bit, add //tools/ops
- Add a server to //projects/alwaldend.com
- Add OIDC for k3s, add OIDC fetcher to injector
- Add drawio-desktop, add //infra/arch, update opencode restrictions
- Finish forgejo_login, add org to forgejo tf, remove cl1
- Add //third_party/org_kernel_headers, rename all deps files to include
- Add //third_party/org_nmap_nmap
- Fix ssh key signing
- Add ssh key signing to injector, remove more FP from injector
- Finish the lifecycle manager, intergrate it
- Continue working on the lifecycle manager
- Add a lifecycle manager
- Add WaitCtx to fp.WaitGroupE
- Split startups and shutdowns, add timeouts to shutdowns
- Improve plugin clients and servers
- Improve plugin concurrency, remove FP from tf_backend
- Migrate all state to Vault
- Finish rewriting the injector into a gRPC plugin
- Set up convertation between protobuf json and regular json
- Continue rewriting the secret injector to a plugin
- Continue rewriting the injector to a plugin
- Continue rewriting the vault injector to a plugin
- Add //tools/vault/injector, start migrating resource_handler to it
- Add pipes with error and panic handling, add some more FP stuff
- Fix plugins broken after the refactor, remove main from bazelrc, move FP updates
- Refactor FP to use recursive generics, add some iterator handling
- Add more FP stuff, add plugin configs to al.lua, migrate pve_login and tf_backend to new configs
- Move //tools/al to //projects/al, add Result and Pipe to fp
- Automate root token generation, split the main vault policy into separate ones
- Set up cert authentication
- Add //tools/ykman
- Add //tools/al, remove //tools/secrets, set up proper approle workflow
- Setup Vault token helper using gnome-keyring
- Disable mTLS of the Vault instance, add unsealing information, setup //tools/vault
- Fix some Js and Python CVEs
- Add some information about SSL
- Add new pgp key, rename //data/gpg to //data/pgp, add some info about ssh and pgp
- Add data to //projects/alwaldend.com, add //data/gpg
- Use write_source_files for git_hooks
- Add lvol role, setup LVM volumes on bm3
- Remove //tools/docs, remove .github
- Finalize rules_template refactoring
- Update dns
- Add rules_distroless, add some qubes os info
- Remove al_go_cross_binary, update the setup guide a bit
- Update the setup guide, update android tools, update leetcode, update books
- Update the repo setup doc a bit
- Add //tools/word_lists, update DNS and glossary
- Update leetcode
- Add build_test tests
- Fix urllib vulnerabilities
- Add editing, encryption, decryption
- Start adding secret rules, add badges to books
- Move all the logig out of the screen to the controller
- Add deploy to dockerhub, add //tools/oras
- Remove last modification footer
- Add missing features to the Pomodoro app, update project readmes, add github pages
- Update infinitime patch, start adding trufflehog rules
- Add hugo lock support, add proper hugo toolchain support, improve the ansible lock
- Move all remaining code to main
- Move a portion of tool code to main
- Move the registry to //projects/bazel_registry
- Add minisign rules
- Remove sites taxonomy, start adding xray_manager
- Fix release page rendering
- Move to a light nvim theme, add full git info to releases
- Add release_page generation, remove redundant release templates
- Fix nvim library paths
- Parallelize git info retrieval
- Move links to the config, use list groups
- Remove contracts tree
- Add changelogs
- Allow docs to put content outside of docs, refactor git to just use .git directly
- Add the footer back, add hugo env information
- Move release items to a list group, add item counter
- Add cross-compilation, move leetcode downloader contracts out of //contracts
- Refactor release templates into partials, add release cards
- Add RSS links, rewrite links shortcode to html, improve release tables
- Add file size to releases, add round_float partial
- Write release tool in go, start adding it to projects, add py proto generation
- Add release rules, add gzip rules, add several other tools, remove autoscrool deps from the root
- Add dev_shell rules, add make_install_binary, flatten sh rules, add dotfiles/bin
- Add //tools/make_install, start moving dotfiles to it
- Add label_link shortcode, add todo page
- Move book data to data/books
- Add tools/rfc
- Add bzl snippets to proto docs, add targets for ansible playbooks
- Remove the footer from the docs
- Add dnscontrol rules
- Move book data to the books page, add lazy loading, save some thumbnails locally
- Make tables more compact
- Disable inline partials, add last modified section
- Tweak tables again
- Improve tables on home and books pages
- Improve tables
- Do not use nested tables in docs/misc/books
- Fix book rendering, add arm CI for some reason
- Add git image, split root MODULE.bazel
- Add more taxonomies, remove docs tree, move alwaldend.com to projects
- Initial commit
- Update vulnerable Go dependencies
-
Add spellcheck skill
This commit was generated by an LLM.
2.1 - head
Release head
-
Publish project sites and reproducible infrastructure diagrams
Build and deploy all 30 remaining project sites with the standard Docsy header, project descriptions and a linked documentation directory. Omit the repeated page title and generated language heading. Remove the unused cgit and xray_manager projects and retire their site resources.
Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct GitHub Pages DNS records. Preserve repeated publication when pages is the remote default branch, and include Rules ISO in the main documentation. Document site onboarding in a registered, validated skill. Keep AL introduction short with useful links and preserve its lifecycle details in a dedicated documentation page.
Render all 15 existing infrastructure Drawio pages with pinned Drawio and Chrome inputs, sandboxed export actions, an update target and freshness checks, and include the maintained diagrams in infra/arch documentation. Paint an opaque white canvas to preserve readability in dark themes.
Validation covers project and apex builds, rendered pages, publisher tests, diagram repeatability and freshness, DNS configuration, Terraform formatting, semantic lint and repository quality.
Goal-Ref: build-and-deploy-every-project-landing-page-a782b800 Attempt-ID: attempt-00941092c164
LLM-disclaimer: This commit was generated by an LLM.
-
Wait for AL secret cleanup and plugin shutdown
Roll back partial plugin startup, drain requests before releasing resources, and wait for plugin and command processes to exit. Stop independent plugins concurrently while preserving dependency order inside each plugin.
Revoke invocation-owned credentials, remove temporary secret files, and verify Forgejo and Harbor session cleanup. Preserve the user’s existing Vault login. Enforce Vault OIDC origins and no_auth, redact sensitive errors, and restrict config dumps to owner-only files. Add the AppRole SecretID cleanup permission.
Cover normal exit, cancellation, failed startup, credential revocation, and transport cleanup with synthetic unit and real command/plugin regression tests.
Clarify that required formatting-only repairs need no separate approval, and fix the existing blank-line formatting failure in the GitHub AL wrapper.
Goal-Ref: fix-al-secret-lifecycle-and-plugin-shutdown-3137c0b0 Attempt-ID: attempt-0c1353676e2f
LLM-disclaimer: This commit was generated by an LLM.
-
Keep Bazel dependencies lazy and generate the root module
Declare pinned InfiniTime sources and the Hedron extractor through use_repo_rule, retain recursive firmware submodules, and use the official contrib_rules_jvm 0.32.0 release. Keep default toolchain registration convenient for consumers.
Move root tool implementations into owning packages while preserving compatibility labels, visibility, manual tags, Python paths, Terraform working directories, pnpm dependency pins, and documentation archive layout. Guard the load-free root BUILD with a parser-based quality test. Generate root MODULE.bazel directly from owning include files, with an update command and freshness/integration tests.
Cache hermetic agent tests, preserve lint analysis across modes, and build only lint outputs in lint mode. Allow normal agent lockfile updates while retaining strict CI checks. Limit host Bazel scheduling to eight jobs and half its CPUs, with matching checked-in host configuration.
Fix DNSControl command ordering, JSON manifest loading, record filename suffixes, and credential-file wiring through existing Vault environment injection. Add an offline config test. Correct the Git wrapper shebang for direct execution and refresh derived catalogs affected by the Bazel changes.
Validation covers compatibility builds, firmware, documentation outputs, generator freshness, DNS configuration, and a live DNS preview without applying changes. The repository-wide audit also identifies pre-existing test and coverage gaps.
Goal-Ref: avoid-unrelated-bazel-dependency-downloads-638e8329 Attempt-ID: attempt-106ffd5ccaeb
LLM-disclaimer: This commit was generated by an LLM.
-
Repair site navigation and simplify page layout
Show one homepage panel with vertically stacked GitHub and Docs rows using the name: URL format, hiding the protocol and trailing slash in the link text. Center the panel and cap its width at 40rem while allowing it to shrink on mobile. Move it slightly lower on desktop and brighten the footer link. Restore the project assets mount so custom styles load. Reduce the footer to its content height with compact padding. Size the homepage against the visible viewport so mobile browser controls do not hide its footer. Remove the separate Projects page and its header link, while keeping project documentation under Docs. Remove the introductory homepage copy and visible title.
Resolve Markdown links and images from their source locations, package missing documentation and book covers, correct source links, and scope anchors and release controls in combined print pages. Restore the archive-root CNAME explicitly during deployment so replacing the site preserves the custom domain.
Validate generated HTML for missing internal files and fragments, duplicate IDs, image alternatives, and the homepage, Misc source-link, and Goal diagram regressions. Check the production build, repository quality, affected-target semantic lint, desktop and mobile homepage rendering, and deployment output.
Goal-Ref: out/site-fix/goals/fix-local-alwaldend-com-layout-and-links-a2e69a4e Attempt-ID: attempt-165dd5be7d71
LLM-disclaimer: This commit was generated by an LLM.
-
Extract DNSControl setup into rules_dnscontrol
Extract the DNSControl setup into
rules_dnscontrol, generate its Bazel dependency bundle from project-owned record files, and update the DNS guidance. Move Hugo rules and the worker to role-based package paths, and give each non-nested project a locally owned Hugo landing target that reuses the shared README-to-landing macro.Clean all landing and Pages DNS records so GitHub Pages serves each project subdomain directly without Cloudflare proxying. Improve the main site with a three-panel home layout, complete project links, documentation explore links, and current deployment guidance.
All affected root-workspace landing, DNS, and site targets pass, along with the nested
rules_hugotests, Buildifier, and repository quality checks.LLM-disclaimer: This commit was generated by an LLM.
-
Improve the Hugo site and fix the persistent worker
Extract the Hugo build rules into a standalone nested module projects/rules_hugo and add a Go-based persistent Hugo worker with a Dart Sass toolchain, then fix the worker’s empty-destination defect, polish the rules, add per-project landing pages and DNS declarations, and improve the site deploy.
- rules_hugo: standalone nested module with MODULE.bazel, main/bzl rules, tests, and README; no root-workspace labels.
- hugo_worker: persistent worker that resolves execroot-relative paths through the work directory and probes DART_SASS_BINARY, so the site destination is populated with HTML and Sass-compiled CSS.
- sass: Dart Sass 1.103.1 toolchain wired into the site build.
- alwaldend.com: Hugo 0.165.0, Docsy 0.17.0, Bootstrap 5.3.8, Font Awesome 7.3.1, module mounts, and the site build switched to the worker.
- Landing pages: content/projects/_index.md links every project to its docs page; a Projects menu entry is added and the content filegroup is wired.
- DNS: projects/alwaldend.com/dnsconfig.json declares no records (no new subdomains) and is wired into infra/dns/dnsconfig.js.
- Deploy: the genrule clones the pages branch that GitHub Pages serves, clears the previous checkout, writes .nojekyll, stages deletions, skips no-op deploys, and pushes HEAD:pages without a force push; the README deploy section is updated.
- Content: rename the reserved sites taxonomy to websites so the alwaldend.com term renders, and fix main/bzl docs prefix collisions across nested modules.
- Review fixes: document the extension-based toolchain registration in the rules_hugo README, sync the full-repo-check eval rubric to nine nested workspaces and twenty commands, and drop the worker’s unsupported outs attribute.
- Validation: site build produces 3051 HTML pages and Sass CSS; worker, terraform, buildifier, and nested rules_hugo tests pass; git diff –check is clean.
LLM-disclaimer: This commit was generated by an LLM.
-
Complete Phase 1 agent system controls
Close the registered agent-reachable universe with owner-local operation declarations, a report-only completeness checker, shared task-run contracts, task/run-isolated Cordis scratch, explicit Terraform mutations, and bounded Bazel diagnostics. Record numeric resource ceilings and accepted durable-goal evidence for the exact candidate.
Integrate the non-render agent tooling and Blender toolchain changes from PR 24 while retaining the old Blender data package whose move destination is excluded. Direct repository agents to prefer Cordis over shell for supported inspection and to consider bounded Cordis handlers for recurring gaps.
Verification:
- affected Bazel build: 74 targets passed
- affected Bazel tests: 23 of 23 passed
- Phase 1 registered-universe report: valid
- goal validation: valid
- git diff –check HEAD: passed
LLM-disclaimer: This commit was generated by an LLM.
-
docs: define the repository agent system
Make the repository legible as one coherent agent-operated system while preserving one mutation authority per fact.
- add revision-bound current state, target architecture, and phased roadmap
- route root and agent entry points to the canonical model and durable goal
- normalize repository-tree policy and the public-information boundary
- clarify task-private secret scratch and non-obvious tool narration
- correct question and secret skill contracts and stale operator examples
- render source-compatible Markdown links correctly in the documentation site
- retain the complete audit, decision, validation, and acceptance record
Validated with focused skill and Buildifier tests, affected Bazel builds, the full Hugo site, source and rendered link checks, exact label queries, repository-pinned formatting, and goal-record validation.
LLM-disclaimer: This commit was generated by an LLM.
- Complete repository quality coverage
-
Add hermetic repository-wide formatting and linting
Integrate upstream formatters for the repository’s meaningful tracked source and configuration file types through Bazel, and add Buildifier, Ruff, and ShellCheck lint aspects for correctness-oriented repository-wide checks.
Pin all new external tools through Bzlmod or the existing pnpm lock, add thin cache/runfiles adapters where required, expose format and check targets, and wire the checks into the pre-commit workflow. Format the existing tree and fix the correctness defects uncovered by the new checks. Preserve generated sources and exact-content fixtures that are not safely rewritable, and clarify that ordinary infrastructure build output is safe to display.
Validation:
- all 21 repository quality and compatibility formatter tests pass
- Buildifier test passes
- lint aspects analyze all 4,629 ordinary root targets without findings
- the complete 18-command root and nested full-repository audit was exercised; remaining failures are documented environment or pre-existing test limits
LLM-disclaimer: This commit was generated by an LLM.
-
Add global repository versioning
Introduce a Bazel-built Go tool that calculates the repository’s global SemVer-compatible ISO-week calendar versions, creates guarded nightly tags and weekly release branches atomically, advances release patches by first-parent commit, and emits deterministic Bazel workspace-status keys.
Route release stamping through the tool and add a packaged, discoverable versioning skill with offline Promptfoo validation. Cover ISO week boundaries, SemVer formatting, branch and dirty-tree guards, release patch calculation, tag integrity, and stamping output with focused tests.
Provide a clean-checkout bootstrap that builds the Go tool before it launches the stamped Bazel command. Bind ref transactions to the inspected commit, neutralize Git replace/graft/routing inputs, make dry runs validate namespace collisions, validate every published patch tag against its exact first-parent position, reject ambiguous or inconsistent tag states, and require explicit context for detached release calculations. Route detached release-tag selection through those same history-integrity checks. Keep development status cache-safe by emitting Git identity as volatile data while making immutable nightly and release identities stable.
Add a repository-delivery integration regression proving that a failed aggregate whitespace check identifies the offending path exactly once.
Verified with:
- bazel_agent test //tools/versioning/… //tools/repo_delivery/main/go:go_test //:write_skill_links_test //:buildifier_test
- bazel_agent build //tools/versioning/… //tools/repo_delivery/…
- tools/versioning/cmd/versioning/versioning.sh bazel – build –config=release //tools/versioning/cmd/versioning
- real Git integration tests covering ref transactions, SHA-256 repositories, environment isolation, detached contexts, tag ordering, and namespace collisions
LLM-disclaimer: This commit was generated by an LLM.
-
Add standalone documentation rules
Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.
Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.
Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.
This commit was generated by an LLM.
-
Keep embedded site server in target configuration
This commit was generated by an LLM.
-
Fix Bazel build caching and tool configuration
This commit was generated by an LLM.
-
Remove redundant documentation mappings
Inline sources from eight layout-neutral pkg_files wrappers and migrate the remaining legacy Vial docs producer to docs_filegroup. Keep only mappings that perform required renames.\n\nThis commit was generated by an LLM.
-
Complete docs filegroup migration
Pass ordinary documentation sources directly and isolate generated or renamed outputs in semantic pkg_files dependencies. Remove the obsolete renames and strip_prefix surface from docs_filegroup.\n\nThis commit was generated by an LLM.
-
Make release generation hermetic
Add the missing AL and Kustomization release targets and give release actions a declared bare Git snapshot instead of access to the workspace repository.\n\nThis commit was generated by an LLM.
-
Migrate documentation packaging to docs_filegroup
Preserve custom prefixes, renames, strip prefixes, and standalone workspace behavior.\n\nThis commit was generated by an LLM.
-
Make Qt and Maven dependencies hermetic
Align protobuf with the Android build tools and refresh generated locks.\n\nThis commit was generated by an LLM.
-
Make Android SDK setup reproducible
This commit was generated by an LLM.
-
Add agent-friendly Bazel config
This commit was generated by an LLM.
- Use an image from the marketplace, update some locks, add CODEOWNERS
- Finish opencode deploy
- Add //third_party/org_fedora_cloud, fix alwaldend.com roles
- Set up unikernel deploy
- Refactor flux manifests a bit, add //tools/ops
- Add a server to //projects/alwaldend.com
- Add OIDC for k3s, add OIDC fetcher to injector
- Add drawio-desktop, add //infra/arch, update opencode restrictions
- Finish forgejo_login, add org to forgejo tf, remove cl1
- Add //third_party/org_kernel_headers, rename all deps files to include
- Add //third_party/org_nmap_nmap
- Fix ssh key signing
- Add ssh key signing to injector, remove more FP from injector
- Finish the lifecycle manager, intergrate it
- Continue working on the lifecycle manager
- Add a lifecycle manager
- Add WaitCtx to fp.WaitGroupE
- Split startups and shutdowns, add timeouts to shutdowns
- Improve plugin clients and servers
- Improve plugin concurrency, remove FP from tf_backend
- Migrate all state to Vault
- Finish rewriting the injector into a gRPC plugin
- Set up convertation between protobuf json and regular json
- Continue rewriting the secret injector to a plugin
- Continue rewriting the injector to a plugin
- Continue rewriting the vault injector to a plugin
- Add //tools/vault/injector, start migrating resource_handler to it
- Add pipes with error and panic handling, add some more FP stuff
- Fix plugins broken after the refactor, remove main from bazelrc, move FP updates
- Refactor FP to use recursive generics, add some iterator handling
- Add more FP stuff, add plugin configs to al.lua, migrate pve_login and tf_backend to new configs
- Move //tools/al to //projects/al, add Result and Pipe to fp
- Automate root token generation, split the main vault policy into separate ones
- Set up cert authentication
- Add //tools/ykman
- Add //tools/al, remove //tools/secrets, set up proper approle workflow
- Setup Vault token helper using gnome-keyring
- Disable mTLS of the Vault instance, add unsealing information, setup //tools/vault
- Fix some Js and Python CVEs
- Add some information about SSL
- Add new pgp key, rename //data/gpg to //data/pgp, add some info about ssh and pgp
- Add data to //projects/alwaldend.com, add //data/gpg
- Use write_source_files for git_hooks
- Add lvol role, setup LVM volumes on bm3
- Remove //tools/docs, remove .github
- Finalize rules_template refactoring
- Update dns
- Add rules_distroless, add some qubes os info
- Remove al_go_cross_binary, update the setup guide a bit
- Update the setup guide, update android tools, update leetcode, update books
- Update the repo setup doc a bit
- Add //tools/word_lists, update DNS and glossary
- Update leetcode
- Add build_test tests
- Fix urllib vulnerabilities
- Add editing, encryption, decryption
- Start adding secret rules, add badges to books
- Move all the logig out of the screen to the controller
- Add deploy to dockerhub, add //tools/oras
- Remove last modification footer
- Add missing features to the Pomodoro app, update project readmes, add github pages
- Update infinitime patch, start adding trufflehog rules
- Add hugo lock support, add proper hugo toolchain support, improve the ansible lock
- Move all remaining code to main
- Move a portion of tool code to main
- Move the registry to //projects/bazel_registry
- Add minisign rules
- Remove sites taxonomy, start adding xray_manager
- Fix release page rendering
- Move to a light nvim theme, add full git info to releases
- Add release_page generation, remove redundant release templates
- Fix nvim library paths
- Parallelize git info retrieval
- Move links to the config, use list groups
- Remove contracts tree
- Add changelogs
- Allow docs to put content outside of docs, refactor git to just use .git directly
- Add the footer back, add hugo env information
- Move release items to a list group, add item counter
- Add cross-compilation, move leetcode downloader contracts out of //contracts
- Refactor release templates into partials, add release cards
- Add RSS links, rewrite links shortcode to html, improve release tables
- Add file size to releases, add round_float partial
- Write release tool in go, start adding it to projects, add py proto generation
- Add release rules, add gzip rules, add several other tools, remove autoscrool deps from the root
- Add dev_shell rules, add make_install_binary, flatten sh rules, add dotfiles/bin
- Add //tools/make_install, start moving dotfiles to it
- Add label_link shortcode, add todo page
- Move book data to data/books
- Add tools/rfc
- Add bzl snippets to proto docs, add targets for ansible playbooks
- Remove the footer from the docs
- Add dnscontrol rules
- Move book data to the books page, add lazy loading, save some thumbnails locally
- Make tables more compact
- Disable inline partials, add last modified section
- Tweak tables again
- Improve tables on home and books pages
- Improve tables
- Do not use nested tables in docs/misc/books
- Fix book rendering, add arm CI for some reason
- Add git image, split root MODULE.bazel
- Add more taxonomies, remove docs tree, move alwaldend.com to projects
- Initial commit
- Update vulnerable Go dependencies
-
Add spellcheck skill
This commit was generated by an LLM.
3 - Rules
Bazel rules
3.1 - Bzl
Bazel rules
3.1.1 - al_config
al_config
load("@com_alwaldend_src//projects/al/rules/al:al_config.bzl", "al_config")
al_config(name, deps, srcs, data)
Dump al config
ATTRIBUTES
| Name | Description | Type | Mandatory | Default |
|---|---|---|---|---|
| name | A unique name for this target. | Name | required | |
| deps | Al configs (targets) | List of labels | optional | [] |
| srcs | Al configs (source files) | List of labels | optional | [] |
| data | Data | List of labels | optional | [] |
AlConfigInfo
load("@com_alwaldend_src//projects/al/rules/al:al_config.bzl", "AlConfigInfo")
AlConfigInfo(config)
Config info
FIELDS
| Name | Description |
|---|---|
| config | Merged config file |
3.1.2 - al_toolchain
al_toolchain
load("@com_alwaldend_src//projects/al/rules/al:al_toolchain.bzl", "al_toolchain")
al_toolchain(name, al)
Al toolchain
ATTRIBUTES
| Name | Description | Type | Mandatory | Default |
|---|---|---|---|---|
| name | A unique name for this target. | Name | required | |
| al | Al binary | Label | required |
3.1.3 - al_toolchain_resolved
al_toolchain_resolved
load("@com_alwaldend_src//projects/al/rules/al:al_toolchain_resolved.bzl", "al_toolchain_resolved")
al_toolchain_resolved(name)
Resolved al toolchain (for genrules)
ATTRIBUTES
| Name | Description | Type | Mandatory | Default |
|---|---|---|---|---|
| name | A unique name for this target. | Name | required |