Switch base toolchains to LRE

This commit migrates the base toolchains to NativeLink with LRE.

Due to issues with modules the new remote toolchains are't fully
functional, but non-module LLVM parts of it are.

We can now use `ll up` to set up a NativeLink LRE deployment in a local
K8s cluster to debug against a proper remote exec setup.

Changes the nix-bundled bazel to bazelisk. This is easier to get working
with remote execution and is independently updateable.

.bazelrc

@@ -1,9 +1,6 @@
 # Don't inherit PATH and LD_LIBRARY_PATH.
 build --incompatible_strict_action_env
 
-# TODO(aaronmondal): Remove this once we get the build working without it.
-common --noincompatible_sandbox_hermetic_tmp
-
 # Enforce C++20 as the default for rules_cc, regardless of toolchain config.
 build --cxxopt=-std=c++20 --host_cxxopt=-std=c++20
 
@@ -30,16 +27,7 @@ common --enable_bzlmod
 common --registry=https://raw.githubusercontent.com/bazelbuild/bazel-central-registry/main/
 common --registry=https://raw.githubusercontent.com/eomii/bazel-eomii-registry/main/
 
-# Make sure to use the correct java runtime.
-build --java_runtime_version=rbe_jdk
-build --tool_java_runtime_version=rbe_jdk
-
-# Always act as if using remote execution.
-build --action_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
-build --define=EXECUTOR=remote
-
 # Remote optimizations.
-build --experimental_remote_cache_compression
 build --remote_build_event_upload=minimal
 build --remote_download_minimal
 build --nolegacy_important_outputs
@@ -49,16 +37,15 @@ build --slim_profile
 build --experimental_profile_include_target_label
 build --noexperimental_profile_include_primary_output
 
-# This config should only be used to test remote execution locally.
-build:rbe_local --experimental_docker_image=localhost:5000/rules_ll_remote:latest
-build:rbe_local --noexperimental_docker_use_customized_images
-build:rbe_local --spawn_strategy=docker --strategy=Javac=docker --genrule_strategy=docker
-build:rbe_local --experimental_enable_docker_sandbox
-build:rbe_local --experimental_docker_verbose
+# Workaround for NativeLink expecting this to be set to `main`
+build --remote_instance_name=main
 
 # Nix-generated action env for rules_ll.
 try-import %workspace%/.bazelrc.ll
 
+# Nix-generated flags for LRE.
+try-import %workspace%/.bazelrc.lre
+
 # Allow user-side customization.
 try-import %workspace%/.bazelrc.user
 

.bazelversion

@@ -0,0 +1 @@
+8.0.0-pre.20240422.4

.github/workflows/codeql.yml

@@ -27,7 +27,7 @@ jobs:
         uses: >- # v2.17.0
           github/codeql-action/init@99c9897648dded3fe63d6f328c46089dd57735ca
         with:
-          languages: go
+          languages: cpp
 
       - name: Autobuild
         uses: >- # v2.17.0

.gitignore

@@ -1,10 +1,7 @@
 # Ignore bazel build directories.
 bazel-*
 
-# Don't ignore the bazel-wrapper directory.
-!bazel-wrapper/
-
-# Generated during the rbegen invocation or when building a flake output.
+# Generated when building a flake output.
 result
 
 # Locally generated by direnv.
@@ -20,15 +17,19 @@ llvm-project/
 .devenv
 
 # Generated via nix.
-/.pre-commit-config.yaml
-examples/.pre-commit-config.yaml
+.pre-commit-config.yaml
 
 # TODO(aaronmondal): At the moment It's unclear whether this file is
 # reproducible across runs with different configurations. Double-check and add
 # it to the repository when we're certain it's safe to do so.
 MODULE.bazel.lock
 examples/MODULE.bazel.lock
 
-# Generated by the bazelrc hook.
+# Generated by the rules_ll bazelrc hook.
 .bazelrc.ll
-examples/bazelrc.ll
+
+# Generated by the LRE bazelrc hook.
+.bazelrc.lre
+
+# Ignore NativeLink's local Pulumi stack.
+Pulumi.dev.yaml

MODULE.bazel

@@ -4,13 +4,7 @@ module(
     compatibility_level = 0,
 )
 
-register_execution_platforms("@rules_ll//rbe/default/config:platform")
-
-register_toolchains(
-    "@rules_ll//ll:ll_toolchain",
-    "@rules_ll//rbe/default/config:cc-toolchain",
-    "@rules_ll//rbe/default/java:all",
-)
+register_toolchains("@rules_ll//ll:ll_toolchain")
 
 # Platform support.
 bazel_dep(name = "platforms", version = "0.0.9")
@@ -21,8 +15,7 @@ bazel_dep(name = "bazel_skylib", version = "1.5.0")
 
 # Documentation. These should be dev_dependencies, but that doesn't work at the
 # moment. This is a bug.
-bazel_dep(name = "rules_java", version = "7.5.0", dev_dependency = True)
-
+bazel_dep(name = "rules_java", version = "7.5.0", dev_dependency = False)
 bazel_dep(name = "stardoc", version = "0.6.2", dev_dependency = False)
 
 # The LLVM project. We override the specific commit below.
@@ -40,6 +33,7 @@ llvm_project_overlay.configure(
         "@rules_ll//patches:rules_ll_overlay_patch.diff",
         "@rules_ll//patches:llvm-project-fix-zlib-includes.diff",
         "@rules_ll//patches:llvm-add-missing-cuda-cmath-header.diff",
+        "@rules_ll//patches:llvm-project-bundle-with-bash.diff",
     ],
     sha256 = "da9a908ea6b158de5986ac1b40444a08a7329bd81e0940875413f1193c24ce5d",
     targets = [
@@ -65,6 +59,7 @@ use_repo(
     "clr",
     "hip",
     "llvm-project-rocm",
+    "local-remote-execution",
     "rocr",
     "roct",
     "zlib-ng",

Pulumi.yaml

@@ -0,0 +1,11 @@
+---
+name: nativelink
+org: eomii
+runtime: go
+description: NativeLink development cluster for rules_ll.
+organization:
+  pulumi:tags:
+    company: "eomii"
+backend:
+  # Only intended to run locally.
+  url: file://~