🧹 Clean up after LRE changes (#235)

Mostly improvements to the `ll` command and doc adjustments.

.github/styles/config/vocabularies/eomii/accept.txt

@@ -7,6 +7,7 @@ CUDA
 GPUs
 HIP
 LLVM
+NativeLink
 NVPTX
 Nvidia
 OSSF

.gitignore

@@ -33,3 +33,6 @@ examples/MODULE.bazel.lock
 
 # Ignore NativeLink's local Pulumi stack.
 Pulumi.dev.yaml
+
+# Ignore the temporary kustomization.yaml
+/kustomization.yaml

MODULE.bazel

@@ -65,20 +65,3 @@ use_repo(
     "zlib-ng",
     "zstd",
 )
-
-bazel_dep(name = "rules_go", version = "0.46.0")
-
-# This overrides the Go dependency github.com/cloudflare/circl, which requires
-# custom patches beyond what Gazelle can generate.
-bazel_dep(name = "circl", version = "1.3.7")
-bazel_dep(name = "gazelle", version = "0.36.0")
-
-go_deps = use_extension("@gazelle//:extensions.bzl", "go_deps")
-go_deps.from_file(go_mod = "//:go.mod")
-use_repo(
-    go_deps,
-    "com_github_go_git_go_git_v5",
-    "com_github_pulumi_pulumi_kubernetes_sdk_v4",
-    "com_github_pulumi_pulumi_sdk_v3",
-    "io_k8s_sigs_kind",
-)

README.md

@@ -1,7 +1,7 @@
 # `rules_ll`
 
 [![OpenSSF Best Practices](https://bestpractices.coreinfrastructure.org/projects/6822/badge)](https://bestpractices.coreinfrastructure.org/projects/6822)
-[![OSSF-Scorecard Score](https://img.shields.io/ossf-scorecard/github.com/eomii/rules_ll?label=openssf%20scorecard)](https://api.securityscorecards.dev/projects/github.com/eomii/rules_ll)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/eomii/rules_ll/badge)](https://securityscorecards.dev/viewer/?uri=github.com/eomii/rules_ll)
 
 An upstream Clang/LLVM-based toolchain for contemporary C++ and heterogeneous
 programming.
@@ -20,34 +20,44 @@ share caches.
 
 ## ✨ Setup
 
-1. Install the [nix package manager](https://nixos.org/download.html) and enable
-   [flakes](https://nixos.wiki/wiki/Flakes).
+<!-- markdownlint-disable MD029 -->
+
+1. Install [nix with flakes](https://github.com/NixOS/experimental-nix-installer).
 
 2. Create a `rules_ll` compatible workspace. To keep the development shell in
-   sync with the `rules_ll` Bazel module, pin the flake to a specific version:
+   sync with the `rules_ll` Bazel module, pin the flake to a specific commit:
 
-    ```bash
-    git init
-    nix flake init -t github:eomii/rules_ll/<version>
-    ```
+   ```bash
+   git init
+   nix flake init -t github:eomii/rules_ll/<commit>
+   ```
 
-    The default toolchains include C++ and HIP for AMDGPU. If you also want to
-    target NVPTX devices (Nvidia GPUs), make sure to read the [CUDA license](https://docs.nvidia.com/cuda/eula/index.html)
-    and set `unfree = true` in `flake.nix`.
+   The default toolchains include C++ and HIP for AMDGPU. If you also want to
+   target NVPTX devices (Nvidia GPUs), make sure to read the [CUDA license](https://docs.nvidia.com/cuda/eula/index.html)
+   and set `comment.allowUnfree` and `config.cudaSupport` in `flake.nix`.
 
-    See [tags](https://github.com/eomii/rules_ll/tags) to find the most recent
-    version.
+> [!WARNING]
+> Don't use the tags or releases from the GitHub repository. They're an artifact
+> from old versions of `rules_ll` and probably in a broken state. We'll remove
+> them at some point. Use a pinned commit instead.
 
 3. Enter the `rules_ll` development shell:
 
-    ```bash
-    nix develop
-    ```
+   ```bash
+   nix develop
+   ```
+
+> [!TIP]
+> Strongly consider setting up [`direnv`](https://github.com/direnv/direnv) so
+> that you don't need to remember running `nix develop` to enter the flake and
+> `exit` to exit it.
 
 4. Consider setting up at least a local remote cache as described in the [remote
    execution guide](https://ll.eomii.org/setup/remote_execution).
 <!-- vale alex.ProfanityUnlikely = YES -->
 
+<!-- markdownlint-enable MD029 -->
+
 ## 🔗 Links
 
 - [Docs](https://ll.eomii.org)

devtools/ll.nix

@@ -1,4 +1,4 @@
-{ pkgs, bazel, tag }:
+{ pkgs, native, ... }:
 
 let
 
@@ -15,7 +15,7 @@ let
   opt = (string: "\\E[33m" + string + "\\033[0m");
 
 
-  ll_up = llScript "up" ./up.sh;
+  ll_up = import ./up.nix { inherit pkgs native; };
   ll_docs = llScript "docs" ./docs.sh;
   ll_patch = llScript "overlay" ./overlay.sh;
   ll_release = llScript "module" ./module.sh;

devtools/up.nix

@@ -0,0 +1,85 @@
+{ pkgs, native, ... }:
+
+let
+  # Packages needed for the script
+  kubectl = pkgs.kubectl;
+  curl = pkgs.curl;
+  git = pkgs.git;
+  kustomize = pkgs.kustomize;
+  nix = pkgs.nix;
+
+  # The specific commit to use
+  nativelinkCommit = "60f712bcddd5c2cd3d3bdd537c4cc136fe6497c7";
+
+  # Base URL for GitHub access
+  githubBaseUrl = "github:TraceMachina/nativelink/";
+
+in
+
+pkgs.writeShellScriptBin "up" ''
+  set -xeuo pipefail
+
+  # Start the native service
+  ${native}/bin/native up
+
+  # Wait for the gateway to be ready
+  ${kubectl}/bin/kubectl wait --for=condition=Programmed --timeout=60s gateway eventlistener
+
+  # Allow an additional grace period for potential routes to set themselves up.
+  # TODO(aaronmondal): Find a better solution.
+  sleep 10
+
+  # Retrieve the event listener address
+  EVENTLISTENER=''$(${kubectl}/bin/kubectl get gtw eventlistener -o=jsonpath='{.status.addresses[0].value}')
+
+  # POST requests to the event listener
+  ${curl}/bin/curl -v \
+    -H 'Content-Type: application/json' \
+    -d '{"flakeOutput": "${githubBaseUrl}${nativelinkCommit}#image"}' \
+    http://"''${EVENTLISTENER}":8080
+
+  ${curl}/bin/curl -v \
+    -H 'Content-Type: application/json' \
+    -d '{"flakeOutput": "${githubBaseUrl}${nativelinkCommit}#nativelink-worker-lre-cc"}' \
+    http://"''${EVENTLISTENER}":8080
+
+  # Wait for PipelineRuns to start
+  until ${kubectl}/bin/kubectl get pipelinerun \
+      -l tekton.dev/pipeline=rebuild-nativelink | grep -q 'NAME'; do
+    echo "Waiting for PipelineRuns to start..."
+    sleep 0.1
+  done
+
+  # Wait for the pipeline to succeed
+  ${kubectl}/bin/kubectl wait \
+    --for=condition=Succeeded \
+    --timeout=30m \
+    pipelinerun \
+        -l tekton.dev/pipeline=rebuild-nativelink
+
+  # Define kustomize directory and setup
+  KUSTOMIZE_DIR=''$(${git}/bin/git rev-parse --show-toplevel)
+
+  cat <<EOF > "''${KUSTOMIZE_DIR}"/kustomization.yaml
+  ---
+  apiVersion: kustomize.config.k8s.io/v1beta1
+  kind: Kustomization
+  bases:
+  resources:
+    - https://github.com/TraceMachina/nativelink//deployment-examples/kubernetes/base
+    - https://raw.githubusercontent.com/TraceMachina/nativelink/main/deployment-examples/kubernetes/worker-lre-cc.yaml
+  EOF
+
+  # Use kustomize to set images
+  cd "''${KUSTOMIZE_DIR}" && ${kustomize}/bin/kustomize edit set image \
+    nativelink=localhost:5001/nativelink:"''$(${nix}/bin/nix eval ${githubBaseUrl}${nativelinkCommit}#image.imageTag --raw)" \
+    nativelink-worker-lre-cc=localhost:5001/nativelink-worker-lre-cc:"''$(${nix}/bin/nix eval ${githubBaseUrl}${nativelinkCommit}#nativelink-worker-lre-cc.imageTag --raw)"
+
+  # Apply the configuration
+  ${kubectl}/bin/kubectl apply -k "''${KUSTOMIZE_DIR}"
+
+  # Monitor the deployment rollout
+  ${kubectl}/bin/kubectl rollout status deploy/nativelink-cas
+  ${kubectl}/bin/kubectl rollout status deploy/nativelink-scheduler
+  ${kubectl}/bin/kubectl rollout status deploy/nativelink-worker-lre-cc
+''

docs/index.md

@@ -1,6 +1,7 @@
 # `rules_ll`
 
 [![OpenSSF Best Practices](https://bestpractices.coreinfrastructure.org/projects/6822/badge)](https://bestpractices.coreinfrastructure.org/projects/6822)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/eomii/rules_ll/badge)](https://securityscorecards.dev/viewer/?uri=github.com/eomii/rules_ll)
 
 An upstream Clang/LLVM-based toolchain for contemporary C++ and heterogeneous
 programming.
@@ -11,7 +12,9 @@ dependency graph.
 
 ## Links
 
-- [Discord Server](https://discord.gg/Ax67899n4y)
 - [Setup](setup/setup.md)
 - [Examples](https://github.com/eomii/rules_ll/tree/main/examples)
 - [Guides](guides/index.md)
+
+If you have questions regarding remote execution, consider asking for help in
+the [NativeLink Slack](https://nativelink.slack.com/join/shared_invite/zt-281qk1ho0-krT7HfTUIYfQMdwflRuq7A#/shared-invite/email).

docs/setup/remote_execution.md

@@ -4,17 +4,14 @@
 `rules_ll` uses remote execution compatible toolchains by default, even when you
 run local builds.
 
-`rules_ll` disables Bazel's toolchain auto detection and pins every tool to a
+`rules_ll` extends [Local Remote Execution (LRE)](https://github.com/TraceMachina/nativelink/tree/main/local-remote-execution)
+which disables Bazel's toolchain auto detection and pins every tool to a
 reproducible artifact from `nixpkgs`. This way every system running the same
 version of `rules_ll` uses the same toolchain, regardless of the host's
 operating system and locally installed toolchains.
 
-The remote execution toolchains in `rules_ll` achieve virtually perfect cache
-hit rates even among different systems sharing the same cache.
-
-You don't actually have to use the `ll_*` rules to leverage the remote execution
-setup. The implementation in `rules_ll` also works for `rules_cc`. You do need
-to set up your workspace as described in the [setup](./setup.md) though.
+Similar to LRE, the remote execution toolchains in `rules_ll` achieve virtually
+perfect cache hit rates even among different systems sharing the same cache.
 
 <!-- markdownlint-disable code-block-style -->
 !!! warning
@@ -32,12 +29,11 @@ and you probably don't want to rebuild LLVM every time you start a new project.
 
 ![Local Remote Cache](../images/local_remote_cache.png){ loading=lazy }
 
-1. Set up a remote cache like [`bazel-remote`](https://github.com/buchgr/bazel-remote)
-   or [`turbo-cache`](https://github.com/allada/turbo-cache).
+1. Set up a remote cache like [NativeLink](https://github.com/TraceMachina/nativelink).
 2. Instruct all your local Bazel invocations to use that cache:
 
     ```bash title="~/.bazelrc"
-    build --remote_cache=grpc://127.0.0.1:9002
+    build --remote_cache=grpc://<ip>:<port>
     ```
 
 ## Personal remote cache
@@ -51,8 +47,8 @@ cache via the internet this setup requires some form of authentication:
 ```bash title="~/.bazelrc"
 build --remote_cache=grpcs://<remote_cache>
 
-# Authenticate as instructed by your remote cache provider.
-build --some_authentication_flags
+# Authenticate as instructed by your remote cache provider. For instance
+build --remote_header=...
 ```
 
 ## Trusted remote cache