Define Bazel version in one shared location

.buildkite/bindists-pipeline

@@ -5,7 +5,7 @@
 
 set -euo pipefail
 
-BAZEL_DIR="$(.buildkite/fetch-bazel-bindist)"
+BAZEL_DIR="$(.ci/fetch-bazel-bindist)"
 REPO_CACHE="$HOME/repo_cache"
 
 trap "rm -rf '$BAZEL_DIR'" EXIT

.buildkite/pipeline.yml

@@ -6,9 +6,9 @@ steps:
       nix-shell --arg docTools false --pure --run '
       set -e
       # Ensure that the Nixpkgs bazel version matches the one specified in
-      # `.buildkite/bazel-version` and fetched in
+      # `.bazelversion` and fetched in
       # `.buildkite/bindists-pipeline` for the bindists version.
-      .buildkite/check-bazel-version
+      .ci/check-bazel-version
       ./tests/run-start-script.sh --use-nix
       bazel build --config ci //tests:run-tests
       ./bazel-ci-bin/tests/run-tests

.ci/bazel-2.0.0-darwin-x86_64.sha256

@@ -0,0 +1 @@
+3eca4c96cfda97a9d5f8d3d0dec4155a5cc5ff339b10d3f35213c398bf13881e  bazel-2.0.0-darwin-x86_64

.buildkite/bazel-sha256 → .ci/bazel-2.0.0-linux-x86_64.sha256

@@ -1 +1 @@
-4df79462c6c3ecdeeee7af99fc269b52ab1aa4828ef3bc359c1837d3fafeeee7  bazel
+4df79462c6c3ecdeeee7af99fc269b52ab1aa4828ef3bc359c1837d3fafeeee7  bazel-2.0.0-linux-x86_64

.ci/bazel-2.0.0-windows-x86_64.exe.sha256

@@ -0,0 +1 @@
+cc7b3ff6f4bfd6bc2121a80656afec66ee57713e8b88e9d2fb58b4eddf271268  bazel-2.0.0-windows-x86_64.exe

.ci/check-bazel-version

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+
+# Ideally we would place .bazelversion in the top-level so it could be used by
+# tools like bazelisk. However, this breaks the nixpkgs provided Bazel
+# installation, see https://github.com/NixOS/nixpkgs/issues/80950.
+VERSION_EXPECTED="bazel $(cat "$DIR/bazelversion")"
+VERSION_ACTUAL=$(bazel version --gnu_format)
+# nixpkgs Bazel version ends on '- (@non-git)'.
+[[ "$VERSION_ACTUAL" =~ ^"$VERSION_EXPECTED"("- (@non-git)")?$ ]] || {
+  echo "Expected Bazel version $VERSION_EXPECTED but found $VERSION_ACTUAL." >&2
+  exit 1
+}

.ci/fetch-bazel-bindist

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+set -euo pipefail
+TOP="$( cd "$( dirname "${BASH_SOURCE[0]}" )/.." >/dev/null 2>&1 && pwd )"
+
+case "$OSTYPE" in
+  linux-gnu) OS=linux-x86_64; EXT=;;
+  darwin) OS=darwin-x86_64; EXT=;;
+  cygwin|msys|win32) OS=windows-x86_64; EXT=.exe;;
+  **) echo "Unknown operating system" >&2; exit 1;;
+esac
+VERSION=$(cat "$TOP/.ci/bazelversion")
+INSTALL="$(mktemp -d)"
+(cd "$INSTALL" && curl -LO "https://github.com/bazelbuild/bazel/releases/download/$VERSION/bazel-$VERSION-$OS$EXT" >&2)
+(cd "$INSTALL" && sha256sum --quiet -c "$TOP/.ci/bazel-$VERSION-$OS$EXT.sha256") >&2
+mv "$INSTALL/bazel-$VERSION-$OS$EXT" "$INSTALL/bazel$EXT"
+chmod +x "$INSTALL/bazel$EXT"
+echo -n "$INSTALL"

.ci/update-bazel-version

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+set -euo pipefail
+TOP="$( cd "$( dirname "${BASH_SOURCE[0]}" )/.." >/dev/null 2>&1 && pwd )"
+
+usage() {
+  cat >&2 <<EOF
+USAGE: update-bazel-version VERSION
+Updates .ci/bazelversion and .ci/bazel-*.sha256
+EOF
+}
+trap usage ERR
+
+if [[ $# -ne 1 ]]; then
+  usage
+  exit 1
+fi
+
+VERSION="$1"
+echo "$VERSION" >"$TOP/.ci/bazelversion"
+mkdir -p "$TOP/.ci"
+for OSEXT in windows-x86_64.exe linux-x86_64 darwin-x86_64; do
+  URL="https://github.com/bazelbuild/bazel/releases/download/$VERSION/bazel-$VERSION-$OSEXT.sha256"
+  (cd "$TOP/.ci" && curl -LO "$URL")
+done

.circleci/config.yml

@@ -57,6 +57,12 @@ jobs:
               - v1-rules_haskell-cache-{{ .Branch }}-
               - v1-rules_haskell-cache-master-
 
+      - run:
+          name: Check Bazel version
+          shell: /bin/bash -eilo pipefail
+          command: |
+            nix-shell --arg docTools false --pure --run \
+              '.ci/check-bazel-version'
       - run:
           name: Prefetch Stackage snapshot
           shell: /bin/bash -eilo pipefail

.gitattributes

@@ -0,0 +1,3 @@
+# Prevent git from automatically introducing \r characters in .sha256 files.
+# Otherwise msys sha256sum fails.
+*.sha256 binary

.netlify/install.sh

@@ -1,9 +1,4 @@
 #!/bin/sh
-
 set -eux
-
-V=2.0.0
-
-curl -LO https://github.com/bazelbuild/bazel/releases/download/$V/bazel-$V-installer-linux-x86_64.sh
-chmod +x bazel-$V-installer-linux-x86_64.sh
-./bazel-$V-installer-linux-x86_64.sh --user
+INSTALL="$(.ci/fetch-bazel-bindist)"
+mv "$INSTALL" "$HOME/bin"

MAINTAINERS.md

@@ -51,7 +51,8 @@
 We strive to always test against the latest non-LTS release
 nonetheless, so bumping bazel regularly is required.
 
-- [ ] Bump bazel download link for bazel in `azure-pipelines.yml`
+- [ ] Use `.ci/update-bazel-version` to update `.ci/bazelversion` and
+      `.ci/bazel-*.sha256`.
 - [ ] Update all bazel rules dependencies in `WORKSPACE` (e.g.
       `io_bazel_stardoc`)
 - [ ] Update bazel in nixpkgs and bump `nixpkgs/default.nix`
@@ -60,4 +61,3 @@ nonetheless, so bumping bazel regularly is required.
   - Bump `MIN_BAZEL_*` in `start`
   - TODO
 - [ ] Add update notice to `CHANGELOG`
-- [ ] Bump bazel version in .netlify/install.sh

azure-pipelines.yml

@@ -9,11 +9,10 @@ jobs:
       architecture: 'x64'
   - bash: |
       set -e
-      curl -LO https://github.com/bazelbuild/bazel/releases/download/2.0.0/bazel-2.0.0-windows-x86_64.exe
-      mv bazel-*.exe bazel.exe
-      mkdir /c/bazel
-      mv bazel.exe /c/bazel
+      INSTALL="$(.ci/fetch-bazel-bindist)"
+      mv "$INSTALL" /c/bazel
       /c/bazel/bazel.exe info release
+      PATH="/c/bazel:$PATH" .ci/check-bazel-version
 
     displayName: 'Install Bazel'