Bump `rules_foreign_cc` for Bazel 9 fixes by rdesgroppes · Pull Request #48071 · DataDog/datadog-agent

rdesgroppes · 2026-03-19T19:01:27Z

Depends on #48082.

Motivation

Moving the unreleased tip of main allows to address Bazel 9 related issues instead of patching locally:

fix: load CcSharedLibraryInfo from rules_cc for Bazel 9 bazel-contrib/rules_foreign_cc#1493
deps: bump bazel_skylib_gazelle_plugin to 1.9.0 bazel-contrib/rules_foreign_cc#1492 (CcInfo and other Cc* symbols)

Other notable commits since:

Additional Notes

Patches 0002 (bazel-contrib/rules_foreign_cc#1452) and 0003 (bazel-contrib/rules_foreign_cc#1491) are still carried locally as neither has landed upstream yet (but we're working on it).

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 51504ed806

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

deps/repos.MODULE.bazel

agent-platform-auto-pr · 2026-03-19T20:13:33Z

Files inventory check summary

File checks results against ancestor b1362953:

Results for datadog-agent_7.79.0~devel.git.39.5764d7f.pipeline.103839463-1_amd64.deb:

No change detected

cit-pr-commenter-54b7da · 2026-03-19T20:34:37Z

Regression Detector

Regression Detector Results

Metrics dashboard
Target profiles
Run ID: 5a43073e-7c7d-45c4-98c0-a9b415be905b

Baseline: 604e5e9
Comparison: 18a1df7
Diff

Optimization Goals: ✅ Improvement(s) detected

perf	experiment	goal	Δ mean %	Δ mean % CI	trials	links
✅	tcp_syslog_to_blackhole	ingress throughput	+20.19	[+20.01, +20.37]	1	Logs
✅	quality_gate_metrics_logs	memory utilization	-5.43	[-5.65, -5.20]	1	Logs bounds checks dashboard
✅	quality_gate_logs	% cpu utilization	-42.66	[-44.01, -41.30]	1	Logs bounds checks dashboard

Experiments ignored for regressions

Regressions in experiments with settings containing erratic: true are ignored.

perf	experiment	goal	Δ mean %	Δ mean % CI	trials	links
➖	docker_containers_cpu	% cpu utilization	-2.08	[-5.10, +0.94]	1	Logs

Fine details of change detection per experiment

perf	experiment	goal	Δ mean %	Δ mean % CI	trials	links
✅	tcp_syslog_to_blackhole	ingress throughput	+20.19	[+20.01, +20.37]	1	Logs
➖	docker_containers_memory	memory utilization	+0.09	[-0.06, +0.23]	1	Logs
➖	uds_dogstatsd_to_api_v3	ingress throughput	+0.01	[-0.19, +0.20]	1	Logs
➖	uds_dogstatsd_to_api	ingress throughput	-0.00	[-0.21, +0.20]	1	Logs
➖	tcp_dd_logs_filter_exclude	ingress throughput	-0.00	[-0.12, +0.11]	1	Logs
➖	ddot_metrics_sum_cumulative	memory utilization	-0.43	[-0.57, -0.29]	1	Logs
➖	file_to_blackhole_0ms_latency	egress throughput	-0.45	[-1.13, +0.24]	1	Logs
➖	file_to_blackhole_1000ms_latency	egress throughput	-0.47	[-0.87, -0.06]	1	Logs
➖	file_to_blackhole_100ms_latency	egress throughput	-0.49	[-0.57, -0.41]	1	Logs
➖	file_to_blackhole_500ms_latency	egress throughput	-0.58	[-0.97, -0.20]	1	Logs
➖	ddot_metrics	memory utilization	-0.64	[-0.82, -0.47]	1	Logs
➖	ddot_metrics_sum_cumulativetodelta_exporter	memory utilization	-0.75	[-0.97, -0.52]	1	Logs
➖	ddot_metrics_sum_delta	memory utilization	-0.85	[-1.02, -0.67]	1	Logs
➖	ddot_logs	memory utilization	-1.95	[-2.02, -1.89]	1	Logs
➖	docker_containers_cpu	% cpu utilization	-2.08	[-5.10, +0.94]	1	Logs
➖	quality_gate_idle	memory utilization	-2.20	[-2.25, -2.15]	1	Logs bounds checks dashboard
➖	quality_gate_idle_all_features	memory utilization	-2.30	[-2.34, -2.27]	1	Logs bounds checks dashboard
➖	file_tree	memory utilization	-2.59	[-2.65, -2.54]	1	Logs
➖	uds_dogstatsd_20mb_12k_contexts_20_senders	memory utilization	-2.66	[-2.72, -2.60]	1	Logs
➖	otlp_ingest_logs	memory utilization	-2.70	[-2.80, -2.59]	1	Logs
➖	otlp_ingest_metrics	memory utilization	-3.35	[-3.50, -3.20]	1	Logs
✅	quality_gate_metrics_logs	memory utilization	-5.43	[-5.65, -5.20]	1	Logs bounds checks dashboard
✅	quality_gate_logs	% cpu utilization	-42.66	[-44.01, -41.30]	1	Logs bounds checks dashboard

Bounds Checks: ✅ Passed

perf	experiment	bounds_check_name	replicates_passed	observed_value	links
✅	docker_containers_cpu	simple_check_run	10/10	701 ≥ 26
✅	docker_containers_memory	memory_usage	10/10	275.52MiB ≤ 370MiB
✅	docker_containers_memory	simple_check_run	10/10	723 ≥ 26
✅	file_to_blackhole_0ms_latency	memory_usage	10/10	0.19GiB ≤ 1.20GiB
✅	file_to_blackhole_0ms_latency	missed_bytes	10/10	0B = 0B
✅	file_to_blackhole_1000ms_latency	memory_usage	10/10	0.23GiB ≤ 1.20GiB
✅	file_to_blackhole_1000ms_latency	missed_bytes	10/10	0B = 0B
✅	file_to_blackhole_100ms_latency	memory_usage	10/10	0.20GiB ≤ 1.20GiB
✅	file_to_blackhole_100ms_latency	missed_bytes	10/10	0B = 0B
✅	file_to_blackhole_500ms_latency	memory_usage	10/10	0.22GiB ≤ 1.20GiB
✅	file_to_blackhole_500ms_latency	missed_bytes	10/10	0B = 0B
✅	quality_gate_idle	intake_connections	10/10	3 = 3	bounds checks dashboard
✅	quality_gate_idle	memory_usage	10/10	174.41MiB ≤ 175MiB	bounds checks dashboard
✅	quality_gate_idle_all_features	intake_connections	10/10	2 ≤ 3	bounds checks dashboard
✅	quality_gate_idle_all_features	memory_usage	10/10	502.66MiB ≤ 550MiB	bounds checks dashboard
✅	quality_gate_logs	intake_connections	10/10	3 ≤ 6	bounds checks dashboard
✅	quality_gate_logs	memory_usage	10/10	204.07MiB ≤ 220MiB	bounds checks dashboard
✅	quality_gate_logs	missed_bytes	10/10	0B = 0B	bounds checks dashboard
✅	quality_gate_metrics_logs	cpu_usage	10/10	339.83 ≤ 2000	bounds checks dashboard
✅	quality_gate_metrics_logs	intake_connections	10/10	3 ≤ 6	bounds checks dashboard
✅	quality_gate_metrics_logs	memory_usage	10/10	408.36MiB ≤ 475MiB	bounds checks dashboard
✅	quality_gate_metrics_logs	missed_bytes	10/10	0B = 0B	bounds checks dashboard

Explanation

Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%

Performance changes are noted in the perf column of each table:

✅ = significantly better comparison variant performance
❌ = significantly worse comparison variant performance
➖ = no significant change in performance

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:

Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.
Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.
Its configuration does not mark it "erratic".

CI Pass/Fail Decision

✅ Passed. All Quality Gates passed.

quality_gate_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_metrics_logs, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
quality_gate_metrics_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
quality_gate_metrics_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_metrics_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.

agent-platform-auto-pr · 2026-03-20T00:20:04Z

Static quality checks

✅ Please find below the results from static quality gates
Comparison made with ancestor b136295
📊 Static Quality Gates Dashboard
🔗 SQG Job

31 successful checks with minimal change (< 2 KiB)

	Quality gate	Current Size
✅	agent_deb_amd64	751.462 MiB
✅	agent_deb_amd64_fips	708.433 MiB
✅	agent_heroku_amd64	313.045 MiB
✅	agent_msi	604.516 MiB
✅	agent_rpm_amd64	751.446 MiB
✅	agent_rpm_amd64_fips	708.417 MiB
✅	agent_rpm_arm64	729.800 MiB
✅	agent_rpm_arm64_fips	689.777 MiB
✅	agent_suse_amd64	751.446 MiB
✅	agent_suse_amd64_fips	708.417 MiB
✅	agent_suse_arm64	729.800 MiB
✅	agent_suse_arm64_fips	689.777 MiB
✅	docker_agent_amd64	811.769 MiB
✅	docker_agent_arm64	814.886 MiB
✅	docker_agent_jmx_amd64	1002.684 MiB
✅	docker_agent_jmx_arm64	994.580 MiB
✅	docker_cluster_agent_amd64	205.316 MiB
✅	docker_cluster_agent_arm64	219.677 MiB
✅	docker_cws_instrumentation_amd64	7.142 MiB
✅	docker_cws_instrumentation_arm64	6.689 MiB
✅	docker_dogstatsd_amd64	39.230 MiB
✅	docker_dogstatsd_arm64	37.445 MiB
✅	dogstatsd_deb_amd64	29.874 MiB
✅	dogstatsd_deb_arm64	28.026 MiB
✅	dogstatsd_rpm_amd64	29.874 MiB
✅	dogstatsd_suse_amd64	29.874 MiB
✅	iot_agent_deb_amd64	43.254 MiB
✅	iot_agent_deb_arm64	40.305 MiB
✅	iot_agent_deb_armhf	41.052 MiB
✅	iot_agent_rpm_amd64	43.255 MiB
✅	iot_agent_suse_amd64	43.255 MiB

On-wire sizes (compressed)

	Quality gate	Change	Size (prev → curr → max)
✅	agent_deb_amd64	-9.99 KiB (0.01% reduction)	174.749 → 174.739 → 178.360
✅	agent_deb_amd64_fips	neutral	165.353 MiB → 172.790
✅	agent_heroku_amd64	neutral	74.960 MiB → 79.970
✅	agent_msi	+12.0 KiB (0.01% increase)	138.184 → 138.195 → 146.220
✅	agent_rpm_amd64	+10.87 KiB (0.01% increase)	177.593 → 177.604 → 181.830
✅	agent_rpm_amd64_fips	+23.55 KiB (0.01% increase)	167.551 → 167.574 → 173.370
✅	agent_rpm_arm64	-29.18 KiB (0.02% reduction)	159.568 → 159.540 → 163.060
✅	agent_rpm_arm64_fips	+6.15 KiB (0.00% increase)	151.440 → 151.446 → 156.170
✅	agent_suse_amd64	+10.87 KiB (0.01% increase)	177.593 → 177.604 → 181.830
✅	agent_suse_amd64_fips	+23.55 KiB (0.01% increase)	167.551 → 167.574 → 173.370
✅	agent_suse_arm64	-29.18 KiB (0.02% reduction)	159.568 → 159.540 → 163.060
✅	agent_suse_arm64_fips	+6.15 KiB (0.00% increase)	151.440 → 151.446 → 156.170
✅	docker_agent_amd64	neutral	268.089 MiB → 272.480
✅	docker_agent_arm64	+15.61 KiB (0.01% increase)	255.281 → 255.296 → 261.060
✅	docker_agent_jmx_amd64	neutral	336.743 MiB → 341.100
✅	docker_agent_jmx_arm64	neutral	319.922 MiB → 325.620
✅	docker_cluster_agent_amd64	neutral	71.930 MiB → 72.920
✅	docker_cluster_agent_arm64	neutral	67.505 MiB → 68.220
✅	docker_cws_instrumentation_amd64	neutral	2.999 MiB → 3.330
✅	docker_cws_instrumentation_arm64	neutral	2.729 MiB → 3.090
✅	docker_dogstatsd_amd64	neutral	15.169 MiB → 15.820
✅	docker_dogstatsd_arm64	neutral	14.488 MiB → 14.830
✅	dogstatsd_deb_amd64	neutral	7.891 MiB → 8.790
✅	dogstatsd_deb_arm64	neutral	6.776 MiB → 7.710
✅	dogstatsd_rpm_amd64	neutral	7.901 MiB → 8.800
✅	dogstatsd_suse_amd64	neutral	7.901 MiB → 8.800
✅	iot_agent_deb_amd64	neutral	11.394 MiB → 12.040
✅	iot_agent_deb_arm64	neutral	9.698 MiB → 10.450
✅	iot_agent_deb_armhf	neutral	9.933 MiB → 10.620
✅	iot_agent_rpm_amd64	neutral	11.414 MiB → 12.060
✅	iot_agent_suse_amd64	neutral	11.414 MiB → 12.060

### What does this PR do? Bump `rules_python` from 1.8.5 to 1.9.0 in isolation, as a prerequisite for bumping `rules_foreign_cc` to a commit that requires its transitive deps to be up-to-date (#48071). This requires to fix Windows breakages exposed by the bump: ``` The following shell command exited with status 1: $ bazelisk run --//:install_dir=C:/opt/datadog-agent --//packages/agent:flavor=base -- //packages/install_dir:install Output: (nothing) Error: [...] INFO: Running command line: C:/bzl/bazel/bv4fleb2/execroot/_main/bazel-out/x64_windows-fastbuild-ST-591ff087943d/bin/packages/install_dir/install.exe INFO: Installing to C:/opt/datadog-agent Traceback (most recent call last): [...] File "C:\Users\ContainerAdministrator\AppData\Local\Temp\Bazel.runfiles_heizzvq5\runfiles\rules_python++python+python_3_12_x86_64-pc-windows-msvc\Lib\shutil.py", line 598, in copytree with os.scandir(src) as itr: ^^^^^^^^^^^^^^^ FileNotFoundError: [WinError 3] The system cannot find the path specified: 'C:\\Users\\ContainerAdministrator\\AppData\\Local\\Temp\\Bazel.runfiles_heizzvq5\\runfiles/_main/packages/install_dir/sources' ``` ([example](https://gitlab.ddbuild.io/DataDog/datadog-agent/-/jobs/1524102425#L1688)) ``` The following shell command exited with status 1: $ bazelisk run --//packages/agent:flavor=fips -- @openssl//:install --destdir=C:/opt/datadog-agent Output: (nothing) Error: [...] INFO: Running command line: C:/bzl/bazel/bv4fleb2/execroot/_main/bazel-out/x64_windows-fastbuild-ST-591ff087943d/bin/external/+_repo_rules+openssl/install.exe <args omitted> INFO: Installing to C:/opt/datadog-agent Traceback (most recent call last): [...] File "C:\Users\ContainerAdministrator\AppData\Local\Temp\Bazel.runfiles_5r0pk0mf\runfiles\rules_python++python+python_3_12_x86_64-pc-windows-msvc\Lib\shutil.py", line 598, in copytree with os.scandir(src) as itr: ^^^^^^^^^^^^^^^ FileNotFoundError: [WinError 3] The system cannot find the path specified: 'C:\\Users\\ContainerAdministrator\\AppData\\Local\\Temp\\Bazel.runfiles_5r0pk0mf\\runfiles/+_repo_rules+openssl/openssl/ssl' ``` ([example](https://gitlab.ddbuild.io/DataDog/datadog-agent/-/jobs/1524399502#L484)) ### Motivation `rules_python` 1.9.0 enables runfiles on Windows (👍) for `py_binary` (bazel-contrib/rules_python#3610) so, where 1.8.5 pointed `RUNFILES_DIR` at the build-time runfiles directory, 1.9.0 makes `bazel run` copy the runfiles into a fresh temp directory **where Bazel would skip empty directories**, logically leading `pkg_install`'s `copytree` to fail with above `FileNotFoundError` cases. Bug (TODOs) surfaced: 1. `package_licenses` unconditionally included the `offers_dir` tree artifact in `pkg_files` but, since **`ship_source_offer` is not declared by any dep (work in progress?), `offers_dir` is always empty**: - on Linux and macOS `bazel run` uses symlinks, so an empty tree is useless but harmless, - on Windows the directory is absent from the temp copy => `FileNotFoundError`. **The fix consists in excluding `offers_dir` on ~Windows~ _all platforms_ until the work is resumed.** 2. the openssl FIPS build on Windows declares `out_data_dirs = ["ssl", "lib/ossl-modules", "lib/engines-3"]`, but `ssl/` is empty because `--openssldir` is set to an absolute path (`C:/Program Files/…`) **outside the Bazel sandbox**, so `install_ssldirs` writes there and leaves the sandbox copy empty => `FileNotFoundError`. **The fix drops `ssl/` from `out_data_dirs` on Windows FIPS** via the existing `fips_windows` config setting. ### Describe how you validated your changes Reproduced the failures locally on a Windows VM with rules_python 1.9.0, confirmed the fixes resolve them. Co-authored-by: regis.desgroppes <regis.desgroppes@datadoghq.com>

compliance/package_licenses.bzl

#48071 (comment): > You can also add > `#TODO(ABLD-351): deal with products that don't have source offers` here. > When I do a global cleanup of that I'll find this location to take a > better look.

Moving the unreleased tip of main allows to address Bazel 9 related issues instead of patching locally: - bazel-contrib/rules_foreign_cc#1493 - bazel-contrib/rules_foreign_cc#1492 Other notable commits since: - bazel-contrib/rules_foreign_cc#1483 - bazel-contrib/rules_foreign_cc#1490 - bazel-contrib/rules_foreign_cc#1496 Patches 0002 (DY/LD_LIBRARY_PATH) and 0003 (-j on make command line) are still carried locally as neither has landed upstream yet (but we're working on it).

#48071 (comment): > You can also add > `#TODO(ABLD-351): deal with products that don't have source offers` here. > When I do a global cleanup of that I'll find this location to take a > better look.

### What does this PR do? Upgrades the Bazel toolchain from 8.6.0 to 9.0.1. ### Motivation 9.0.1 ships two upstream fixes that directly benefit our build: - bazelbuild/bazel#28606: NPE when `--repo_env` is set to an env var that has no value — contributed by Datadog (Joseph Gette). - bazelbuild/bazel#26842: `DefaultSyscallCache` incorrectly treated `BUILD` files and `build` directories as the same entry on case-insensitive / normalizing filesystems (e.g. Linux container on a macOS host), causing spurious build failures. ### Describe how you validated your changes `bazel test //...` passes. ### Additional Notes Groundwork landed in advance: - #47716: Bump `rules_cc` with explicit loads for Bazel 9 - #47745: Fix `rules_cc` leftovers from #47716 for Bazel 9 - #47982: Add explicit `cc_static_library` import for Bazel 9 - #48016: Add explicit `py_binary` import for Bazel 9 - #48071: Bump `rules_foreign_cc` for Bazel 9 fixes - #48082: Bump `rules_python` to 1.9.0 and fix misuses spotted on Windows - #48183: Fix Python hermetic toolchain check for Bazel 9 - #48186: Disable `repo_contents_cache` when in-workspace for Bazel 9 - #48228: Bump `protobuf` Bazel dep to 34.1

@JSGette

### What does this PR do? Upgrade `bazel` from 8.6.0 to 9.0.1. ### Motivation Bazel 9.0.1 ships upstream fixes that directly benefit our build & developer experience: - bazelbuild/bazel#26842: `BUILD` files and `build` directories were incorrectly treated as the same entry on case-insensitive filesystems (e.g., Linux container running on a macOS host), causing spurious build failures (esp. for `rloader` we had to `gazelle`-exclude because of that), - bazelbuild/bazel#27695: a contribution of ours (also available in 8.6.0 as bazelbuild/bazel#28367) - nice to have when sharing a folder between a Linux host and a Windows VM through `virtiofs`, - bazelbuild/bazel#28640: another contribution of ours (@JSGette) - critical because it what preventing us from switching to Bazel 9 (ADMS config). ### Describe how you validated your changes `bazel test //...` passes. ### Additional Notes Groundwork landed in advance: - #47716 - #47745 - #47982 - #48016 - #48071 - #48082 - #48183 - #48186 - #48200 (>= Bazel 9 min) - #48201 (>= Bazel 9 min) - #48228 (>= Bazel 9 min) Co-authored-by: regis.desgroppes <regis.desgroppes@datadoghq.com>

@JSGette

### What does this PR do? Upgrade `bazel` from 8.6.0 to 9.0.1. ### Motivation Bazel 9.0.1 ships upstream fixes that directly benefit our build & developer experience: - bazelbuild/bazel#26842: `BUILD` files and `build` directories were incorrectly treated as the same entry on case-insensitive filesystems (e.g., Linux container running on a macOS host), causing spurious build failures (esp. for `rloader` we had to `gazelle`-exclude because of that), - bazelbuild/bazel#27695: a contribution of ours (also available in 8.6.0 as bazelbuild/bazel#28367) - nice to have when sharing a folder between a Linux host and a Windows VM through `virtiofs`, - bazelbuild/bazel#28640: another contribution of ours (@JSGette) - critical because it what preventing us from switching to Bazel 9 (ADMS config). ### Describe how you validated your changes `bazel test //...` passes. ### Additional Notes Groundwork landed in advance: - #47716 - #47745 - #47982 - #48016 - #48071 - #48082 - #48183 - #48186 - #48200 (>= Bazel 9 min) - #48201 (>= Bazel 9 min) - #48228 (>= Bazel 9 min) Co-authored-by: regis.desgroppes <regis.desgroppes@datadoghq.com>

### What does this PR do? Bump `rules_python` from 1.8.5 to 1.9.0 in isolation, as a prerequisite for bumping `rules_foreign_cc` to a commit that requires its transitive deps to be up-to-date (#48071). This requires to fix Windows breakages exposed by the bump: ``` The following shell command exited with status 1: $ bazelisk run --//:install_dir=C:/opt/datadog-agent --//packages/agent:flavor=base -- //packages/install_dir:install Output: (nothing) Error: [...] INFO: Running command line: C:/bzl/bazel/bv4fleb2/execroot/_main/bazel-out/x64_windows-fastbuild-ST-591ff087943d/bin/packages/install_dir/install.exe INFO: Installing to C:/opt/datadog-agent Traceback (most recent call last): [...] File "C:\Users\ContainerAdministrator\AppData\Local\Temp\Bazel.runfiles_heizzvq5\runfiles\rules_python++python+python_3_12_x86_64-pc-windows-msvc\Lib\shutil.py", line 598, in copytree with os.scandir(src) as itr: ^^^^^^^^^^^^^^^ FileNotFoundError: [WinError 3] The system cannot find the path specified: 'C:\\Users\\ContainerAdministrator\\AppData\\Local\\Temp\\Bazel.runfiles_heizzvq5\\runfiles/_main/packages/install_dir/sources' ``` ([example](https://gitlab.ddbuild.io/DataDog/datadog-agent/-/jobs/1524102425#L1688)) ``` The following shell command exited with status 1: $ bazelisk run --//packages/agent:flavor=fips -- @openssl//:install --destdir=C:/opt/datadog-agent Output: (nothing) Error: [...] INFO: Running command line: C:/bzl/bazel/bv4fleb2/execroot/_main/bazel-out/x64_windows-fastbuild-ST-591ff087943d/bin/external/+_repo_rules+openssl/install.exe <args omitted> INFO: Installing to C:/opt/datadog-agent Traceback (most recent call last): [...] File "C:\Users\ContainerAdministrator\AppData\Local\Temp\Bazel.runfiles_5r0pk0mf\runfiles\rules_python++python+python_3_12_x86_64-pc-windows-msvc\Lib\shutil.py", line 598, in copytree with os.scandir(src) as itr: ^^^^^^^^^^^^^^^ FileNotFoundError: [WinError 3] The system cannot find the path specified: 'C:\\Users\\ContainerAdministrator\\AppData\\Local\\Temp\\Bazel.runfiles_5r0pk0mf\\runfiles/+_repo_rules+openssl/openssl/ssl' ``` ([example](https://gitlab.ddbuild.io/DataDog/datadog-agent/-/jobs/1524399502#L484)) ### Motivation `rules_python` 1.9.0 enables runfiles on Windows (👍) for `py_binary` (bazel-contrib/rules_python#3610) so, where 1.8.5 pointed `RUNFILES_DIR` at the build-time runfiles directory, 1.9.0 makes `bazel run` copy the runfiles into a fresh temp directory **where Bazel would skip empty directories**, logically leading `pkg_install`'s `copytree` to fail with above `FileNotFoundError` cases. Bug (TODOs) surfaced: 1. `package_licenses` unconditionally included the `offers_dir` tree artifact in `pkg_files` but, since **`ship_source_offer` is not declared by any dep (work in progress?), `offers_dir` is always empty**: - on Linux and macOS `bazel run` uses symlinks, so an empty tree is useless but harmless, - on Windows the directory is absent from the temp copy => `FileNotFoundError`. **The fix consists in excluding `offers_dir` on ~Windows~ _all platforms_ until the work is resumed.** 2. the openssl FIPS build on Windows declares `out_data_dirs = ["ssl", "lib/ossl-modules", "lib/engines-3"]`, but `ssl/` is empty because `--openssldir` is set to an absolute path (`C:/Program Files/…`) **outside the Bazel sandbox**, so `install_ssldirs` writes there and leaves the sandbox copy empty => `FileNotFoundError`. **The fix drops `ssl/` from `out_data_dirs` on Windows FIPS** via the existing `fips_windows` config setting. ### Describe how you validated your changes Reproduced the failures locally on a Windows VM with rules_python 1.9.0, confirmed the fixes resolve them. Co-authored-by: regis.desgroppes <regis.desgroppes@datadoghq.com>

Depends on #48082. ### Motivation Moving the unreleased tip of main allows to address Bazel 9 related issues instead of patching locally: - bazel-contrib/rules_foreign_cc#1493 - bazel-contrib/rules_foreign_cc#1492 (`CcInfo` and other `Cc*` symbols) Other notable commits since: - bazel-contrib/rules_foreign_cc#1483 - bazel-contrib/rules_foreign_cc#1490 - bazel-contrib/rules_foreign_cc#1496 ### Additional Notes Patches 0002 (bazel-contrib/rules_foreign_cc#1452) and 0003 (bazel-contrib/rules_foreign_cc#1491) are still carried locally as neither has landed upstream yet (but we're working on it). Co-authored-by: regis.desgroppes <regis.desgroppes@datadoghq.com>

@JSGette

### What does this PR do? Upgrade `bazel` from 8.6.0 to 9.0.1. ### Motivation Bazel 9.0.1 ships upstream fixes that directly benefit our build & developer experience: - bazelbuild/bazel#26842: `BUILD` files and `build` directories were incorrectly treated as the same entry on case-insensitive filesystems (e.g., Linux container running on a macOS host), causing spurious build failures (esp. for `rloader` we had to `gazelle`-exclude because of that), - bazelbuild/bazel#27695: a contribution of ours (also available in 8.6.0 as bazelbuild/bazel#28367) - nice to have when sharing a folder between a Linux host and a Windows VM through `virtiofs`, - bazelbuild/bazel#28640: another contribution of ours (@JSGette) - critical because it what preventing us from switching to Bazel 9 (ADMS config). ### Describe how you validated your changes `bazel test //...` passes. ### Additional Notes Groundwork landed in advance: - #47716 - #47745 - #47982 - #48016 - #48071 - #48082 - #48183 - #48186 - #48200 (>= Bazel 9 min) - #48201 (>= Bazel 9 min) - #48228 (>= Bazel 9 min) Co-authored-by: regis.desgroppes <regis.desgroppes@datadoghq.com>

### What does this PR do? Bump `rules_python` from 1.8.5 to 1.9.0 in isolation, as a prerequisite for bumping `rules_foreign_cc` to a commit that requires its transitive deps to be up-to-date (#48071). This requires to fix Windows breakages exposed by the bump: ``` The following shell command exited with status 1: $ bazelisk run --//:install_dir=C:/opt/datadog-agent --//packages/agent:flavor=base -- //packages/install_dir:install Output: (nothing) Error: [...] INFO: Running command line: C:/bzl/bazel/bv4fleb2/execroot/_main/bazel-out/x64_windows-fastbuild-ST-591ff087943d/bin/packages/install_dir/install.exe INFO: Installing to C:/opt/datadog-agent Traceback (most recent call last): [...] File "C:\Users\ContainerAdministrator\AppData\Local\Temp\Bazel.runfiles_heizzvq5\runfiles\rules_python++python+python_3_12_x86_64-pc-windows-msvc\Lib\shutil.py", line 598, in copytree with os.scandir(src) as itr: ^^^^^^^^^^^^^^^ FileNotFoundError: [WinError 3] The system cannot find the path specified: 'C:\\Users\\ContainerAdministrator\\AppData\\Local\\Temp\\Bazel.runfiles_heizzvq5\\runfiles/_main/packages/install_dir/sources' ``` ([example](https://gitlab.ddbuild.io/DataDog/datadog-agent/-/jobs/1524102425#L1688)) ``` The following shell command exited with status 1: $ bazelisk run --//packages/agent:flavor=fips -- @openssl//:install --destdir=C:/opt/datadog-agent Output: (nothing) Error: [...] INFO: Running command line: C:/bzl/bazel/bv4fleb2/execroot/_main/bazel-out/x64_windows-fastbuild-ST-591ff087943d/bin/external/+_repo_rules+openssl/install.exe <args omitted> INFO: Installing to C:/opt/datadog-agent Traceback (most recent call last): [...] File "C:\Users\ContainerAdministrator\AppData\Local\Temp\Bazel.runfiles_5r0pk0mf\runfiles\rules_python++python+python_3_12_x86_64-pc-windows-msvc\Lib\shutil.py", line 598, in copytree with os.scandir(src) as itr: ^^^^^^^^^^^^^^^ FileNotFoundError: [WinError 3] The system cannot find the path specified: 'C:\\Users\\ContainerAdministrator\\AppData\\Local\\Temp\\Bazel.runfiles_5r0pk0mf\\runfiles/+_repo_rules+openssl/openssl/ssl' ``` ([example](https://gitlab.ddbuild.io/DataDog/datadog-agent/-/jobs/1524399502#L484)) ### Motivation `rules_python` 1.9.0 enables runfiles on Windows (👍) for `py_binary` (bazel-contrib/rules_python#3610) so, where 1.8.5 pointed `RUNFILES_DIR` at the build-time runfiles directory, 1.9.0 makes `bazel run` copy the runfiles into a fresh temp directory **where Bazel would skip empty directories**, logically leading `pkg_install`'s `copytree` to fail with above `FileNotFoundError` cases. Bug (TODOs) surfaced: 1. `package_licenses` unconditionally included the `offers_dir` tree artifact in `pkg_files` but, since **`ship_source_offer` is not declared by any dep (work in progress?), `offers_dir` is always empty**: - on Linux and macOS `bazel run` uses symlinks, so an empty tree is useless but harmless, - on Windows the directory is absent from the temp copy => `FileNotFoundError`. **The fix consists in excluding `offers_dir` on ~Windows~ _all platforms_ until the work is resumed.** 2. the openssl FIPS build on Windows declares `out_data_dirs = ["ssl", "lib/ossl-modules", "lib/engines-3"]`, but `ssl/` is empty because `--openssldir` is set to an absolute path (`C:/Program Files/…`) **outside the Bazel sandbox**, so `install_ssldirs` writes there and leaves the sandbox copy empty => `FileNotFoundError`. **The fix drops `ssl/` from `out_data_dirs` on Windows FIPS** via the existing `fips_windows` config setting. ### Describe how you validated your changes Reproduced the failures locally on a Windows VM with rules_python 1.9.0, confirmed the fixes resolve them. Co-authored-by: regis.desgroppes <regis.desgroppes@datadoghq.com>

Depends on #48082. ### Motivation Moving the unreleased tip of main allows to address Bazel 9 related issues instead of patching locally: - bazel-contrib/rules_foreign_cc#1493 - bazel-contrib/rules_foreign_cc#1492 (`CcInfo` and other `Cc*` symbols) Other notable commits since: - bazel-contrib/rules_foreign_cc#1483 - bazel-contrib/rules_foreign_cc#1490 - bazel-contrib/rules_foreign_cc#1496 ### Additional Notes Patches 0002 (bazel-contrib/rules_foreign_cc#1452) and 0003 (bazel-contrib/rules_foreign_cc#1491) are still carried locally as neither has landed upstream yet (but we're working on it). Co-authored-by: regis.desgroppes <regis.desgroppes@datadoghq.com>

@JSGette

### What does this PR do? Upgrade `bazel` from 8.6.0 to 9.0.1. ### Motivation Bazel 9.0.1 ships upstream fixes that directly benefit our build & developer experience: - bazelbuild/bazel#26842: `BUILD` files and `build` directories were incorrectly treated as the same entry on case-insensitive filesystems (e.g., Linux container running on a macOS host), causing spurious build failures (esp. for `rloader` we had to `gazelle`-exclude because of that), - bazelbuild/bazel#27695: a contribution of ours (also available in 8.6.0 as bazelbuild/bazel#28367) - nice to have when sharing a folder between a Linux host and a Windows VM through `virtiofs`, - bazelbuild/bazel#28640: another contribution of ours (@JSGette) - critical because it what preventing us from switching to Bazel 9 (ADMS config). ### Describe how you validated your changes `bazel test //...` passes. ### Additional Notes Groundwork landed in advance: - #47716 - #47745 - #47982 - #48016 - #48071 - #48082 - #48183 - #48186 - #48200 (>= Bazel 9 min) - #48201 (>= Bazel 9 min) - #48228 (>= Bazel 9 min) Co-authored-by: regis.desgroppes <regis.desgroppes@datadoghq.com>

rdesgroppes requested a review from a team as a code owner March 19, 2026 19:01

rdesgroppes added changelog/no-changelog No changelog entry needed qa/no-code-change No code change in Agent code requiring validation labels Mar 19, 2026

dd-octo-sts bot added internal Identify a non-fork PR team/agent-build labels Mar 19, 2026

github-actions bot added the short review PR is simple enough to be reviewed quickly label Mar 19, 2026

chatgpt-codex-connector bot reviewed Mar 19, 2026

View reviewed changes

deps/repos.MODULE.bazel Outdated Show resolved Hide resolved

github-actions bot added medium review PR review might take time and removed short review PR is simple enough to be reviewed quickly labels Mar 19, 2026

rdesgroppes force-pushed the regis.desgroppes/bump-rules-foreign-cc branch from 51504ed to ee6129e Compare March 19, 2026 19:49

rdesgroppes force-pushed the regis.desgroppes/bump-rules-foreign-cc branch 2 times, most recently from 5ea3a27 to bbfd9b3 Compare March 19, 2026 23:39

rdesgroppes mentioned this pull request Mar 20, 2026

Bump rules_python to 1.9.0 and fix misuses spotted on Windows #48082

Merged

aiuto approved these changes Mar 20, 2026

View reviewed changes

aiuto reviewed Mar 20, 2026

View reviewed changes

compliance/package_licenses.bzl Outdated Show resolved Hide resolved

rdesgroppes force-pushed the regis.desgroppes/bump-rules-foreign-cc branch from bbfd9b3 to 9a8fde1 Compare March 21, 2026 00:28

rdesgroppes added 2 commits March 21, 2026 01:35

Address review comment

5764d7f

#48071 (comment): > You can also add > `#TODO(ABLD-351): deal with products that don't have source offers` here. > When I do a global cleanup of that I'll find this location to take a > better look.

rdesgroppes force-pushed the regis.desgroppes/bump-rules-foreign-cc branch from 9a8fde1 to 5764d7f Compare March 21, 2026 00:35

gh-worker-dd-mergequeue-cf854d bot merged commit 18a1df7 into main Mar 21, 2026
254 checks passed

gh-worker-dd-mergequeue-cf854d bot deleted the regis.desgroppes/bump-rules-foreign-cc branch March 21, 2026 02:04

github-actions bot added this to the 7.79.0 milestone Mar 21, 2026

rdesgroppes mentioned this pull request Mar 23, 2026

Bump bazel to 9.0.1 #47742

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump `rules_foreign_cc` for Bazel 9 fixes#48071

Bump `rules_foreign_cc` for Bazel 9 fixes#48071
gh-worker-dd-mergequeue-cf854d[bot] merged 2 commits intomainfrom
regis.desgroppes/bump-rules-foreign-cc

rdesgroppes commented Mar 19, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

Uh oh!

agent-platform-auto-pr bot commented Mar 19, 2026 •

edited

Loading

Uh oh!

cit-pr-commenter-54b7da bot commented Mar 19, 2026 •

edited

Loading

Experiments ignored for regressions

Fine details of change detection per experiment

Bounds Checks: ✅ Passed

Explanation

Uh oh!

agent-platform-auto-pr bot commented Mar 20, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

rdesgroppes commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

Additional Notes

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

agent-platform-auto-pr bot commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Files inventory check summary

Results for datadog-agent_7.79.0~devel.git.39.5764d7f.pipeline.103839463-1_amd64.deb:

Uh oh!

cit-pr-commenter-54b7da bot commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Regression Detector

Regression Detector Results

Optimization Goals: ✅ Improvement(s) detected

Experiments ignored for regressions

Fine details of change detection per experiment

Bounds Checks: ✅ Passed

Explanation

CI Pass/Fail Decision

Uh oh!

agent-platform-auto-pr bot commented Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Static quality checks

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

rdesgroppes commented Mar 19, 2026 •

edited

Loading

agent-platform-auto-pr bot commented Mar 19, 2026 •

edited

Loading

cit-pr-commenter-54b7da bot commented Mar 19, 2026 •

edited

Loading

agent-platform-auto-pr bot commented Mar 20, 2026 •

edited

Loading