[danlapid]

Moves the last tests CI ran on the test-linux job's runner onto bazelflare:

• Network tests (requires-network: dns-nodejs, http-nodejs, worker-loader) ask for an executor with egress (network=on).
• Container tests (requires-container-engine: container-client, container-shutdown) run on executors started from the deployment's Docker-in-Docker image (container-image=executor-dind). They now load their images from docker load tarballs themselves, so CI's bazel run //images:load_all step is gone. The images go through //build/config:container_test_images, which workerd's .bazelrc turns on, because edgeworker loads workerd as a plain repository without rules_oci.

That retires ci-bazelflare-runner-tests. Coverage stays as before: the sanitizer and coverage configs keep skipping both kinds of test, which ran only in the default config on the runner.

All 13 network and container test targets pass on bazelflare from a workstation.

🤖 Generated with Claude Code

[ask-bonk]

Since last review: 0 resolved, 0 still open, 0 new.
LGTM!

Not re-run: api-compat (no author changes in their files since the last review)

---

_{Reviewed commit: 66b83968 · github run}

[clanky-the-clanker]

💬 Approved with comments — The CI, Bazel and test changes are consistent. The only finding is an INFO note: the sanitizer and coverage bazelflare configs now build the container and network targets, even though they still skip running those tests.

Findings: 1 info

_{The decision is advisory: this comment never approves, blocks or requests changes on the pull request.}

---

📋 Code Quality: 💬 1 info

The change is consistent. One INFO note: the sanitizer and coverage configs no longer leave the container image targets out of the build.

Recommendation: 💬 Optional Nits

• [INFO] The sanitizer and coverage bazelflare configs override only the test tag filters. Since common:bazelflare --build_tag_filters no longer excludes requires-container-engine, bazel build under those configs now also builds the container image targets. (.bazelrc:634)

View full review

• .bazelrc:634, .bazelrc:657-664: sanitizer and coverage configs.
  • test:bazelflare-asan, test:bazelflare-tsan and coverage:bazelflare-coverage still skip running network and container tests through --test_tag_filters.
  • The shared common:bazelflare --build_tag_filters no longer excludes requires-network or requires-container-engine, though.
  • As a result, bazel build //... with one of those configs will now build the oci_image, oci_load and tarball targets under the sanitizer platforms. This also happens because the no-remote-exec tags on those targets were removed.
  • If that is not intended, add build: tag filters for those configs that keep -requires-container-engine.
• Checked, no issue:
  • build/wd_test.bzl adds container_images to the runfiles and runs docker load under set -euo pipefail before the sidecar starts.
  • exec_properties.bzl sets test.slots=1 for container tests, and wd_test merges it in.
  • In _bazel.yml, the IPv6 Docker daemon step is still used on the runner fallback path.
• Minor robustness point. In test.mjs, if //build/config:container_test_images is off, the glob finds no tarballs and no images load. The test would then fail later with a less obvious error.

---

✅ All other checks passed

🔒 Security: ✅ LGTM

• Network egress (network=on) applies only to targets tagged requires-network, inside the bazelflare select().
• The Docker-in-Docker executor is requested only for targets tagged requires-container-engine. That image is defined outside this repository, so its contents were not checked here.
• The docker load paths come from Bazel and are quoted, and test.mjs calls execFileSync with an argument array, so no shell is involved.

---

📖 AGENTS.md: ✅ LGTM

No issues found.

---

⚡ Performance: ✅ LGTM

Each container test now runs docker load on its image tarballs every time it runs. The cost is small and bounded.

---

📝 Documentation: ✅ LGTM

No issues found.

---

_{Reviewed commit: 66b83968}

[ask-bonk]

Author identity unknown

*** Please tell me who you are.

Run

git config --global user.email "you@example.com"
git config --global user.name "Your Name"

to set your account's default identity.
Omit --global to set the identity only in this repository.

fatal: empty ident name (for runner@runnervmtai0g.dy0dcyvzke5e5dxxzu5nqqj3qb.cx.internal.cloudapp.net) not allowed

github run

[ask-bonk]

Author identity unknown

*** Please tell me who you are.

Run

git config --global user.email "you@example.com"
git config --global user.name "Your Name"

to set your account's default identity.
Omit --global to set the identity only in this repository.

fatal: empty ident name (for runner@runnervmtai0g.dy0dcyvzke5e5dxxzu5nqqj3qb.cx.internal.cloudapp.net) not allowed

github run

[ask-bonk]

Author identity unknown

*** Please tell me who you are.

Run

git config --global user.email "you@example.com"
git config --global user.name "Your Name"

to set your account's default identity.
Omit --global to set the identity only in this repository.

fatal: empty ident name (for runner@runnervmtai0g.dy0dcyvzke5e5dxxzu5nqqj3qb.cx.internal.cloudapp.net) not allowed

github run

[ask-bonk]

@danlapid Bonk workflow failed. Check the logs for details.

View workflow run · To retry, trigger Bonk again.