SSH

ssh_binary runs the host’s ssh from PATH through al_binary_run. AL configurations and plugins can inject SSH keys before the command runs.

load("//tools/ssh:defs.bzl", "ssh_binary")

ssh_binary(
    name = "ssh",
    configs = [":config"],
    args = ["example.invalid"],
)

The macro accepts al_binary_run attributes, including configs, run_args, data, env, and visibility. Declare injection plugins in data and select their calls through run_args. The consuming AL configuration owns Vault references and key injection. No authentication is selected by default.

Run bazel run //tools/ssh -- -V to check the host client. Arguments supplied at invocation are appended after the target’s fixed SSH arguments. The host must provide OpenSSH; it is not downloaded or built by Bazel.