build: add Makefile indirections, bazel caching and unify MODULE.bazel check

.github/workflows/android.yaml

@@ -133,11 +133,7 @@ jobs:
       - name: Build Bazel APK and AAR
         timeout-minutes: 30
         run: |
-          # Build APK for x86_64 (this also builds the AAR dependency)
-          ./bazelw build --config ci --config release-android --android_platforms=@rules_android//:x86_64 //examples/android:android_app
-          # Build AAR for x86_64 to match the APK architecture and reuse build artifacts
-          ./bazelw build :capture_aar --config ci --config release-android --android_platforms=@rules_android//:x86_64
-
+          make android-build-app
       - name: Upload PR APK
         uses: actions/upload-artifact@v4
         with:

.github/workflows/ios.yaml

@@ -21,6 +21,14 @@ jobs:
         with:
           fetch-depth: 0
 
+      # Set up a dedicated cache for this workflow job to avoid having to pull in a large cache just to check for changes.
+      - name: Setup Bazel
+        uses: bazel-contrib/[email protected]
+        with:
+          bazelisk-cache: true
+          disk-cache: ${{ github.workflow }}-pre
+          repository-cache: true
+
       - name: Check for Bazel build file changes
         id: bazel_check
         run: |
@@ -29,7 +37,7 @@ jobs:
       - name: Check for workflow file changes
         id: workflow_check
         run: |
-          ./ci/files_changed.sh .github/workflows/ios.yaml MODULE.bazel MODULE.bazel.lock
+          ./ci/files_changed.sh .github/workflows/ios.yaml
         continue-on-error: true
       - name: Determine if tests should run
         id: check_changes_separate
@@ -71,12 +79,19 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Setup Bazel
+        uses: bazel-contrib/[email protected]
+        with:
+          bazelisk-cache: true
+          disk-cache: ${{ github.workflow }}
+          repository-cache: true
+
       - name: "Install dependencies"
         run: ./ci/mac_ci_setup.sh
-      - run: ./bazelw build --config ci --config release-ios //examples/swift/hello_world:ios_app
+      - run: make ios-build-app
         name: "Build app"
       # TODO(snowp): Add some kind of assertion that the app does that it's supposed to
-      - run: ./bazelw run --config ci --config release-ios //examples/swift/hello_world:ios_app &> /tmp/envoy.log &
+      - run: make ios-run-app &> /tmp/envoy.log &
         name: "Run app"
   macos_tsan:
     # Note: tsan has been disabled because it's too flaky.
@@ -89,10 +104,17 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Setup Bazel
+        uses: bazel-contrib/[email protected]
+        with:
+          bazelisk-cache: true
+          disk-cache: ${{ github.workflow }}
+          repository-cache: true
+
       - name: "Install dependencies"
         run: ./ci/mac_ci_setup.sh
       - name: Run iOS tests (tsan)
-        run: env -u ANDROID_NDK_HOME ./bazelw test $(./bazelw query 'kind(ios_unit_test, //test/platform/swift/unit_integration/core/...)') --test_tag_filters=macos_only --test_output=errors --config ci --config ios
+        run: env -u ANDROID_NDK_HOME make ios-test
   verify_ios:
     runs-on: ubuntu-latest
     needs: ["macos_tsan", "swift_hello_world"]

.github/workflows/linux_tests.yaml

@@ -59,7 +59,7 @@ jobs:
           echo "Script completed with exit code: $res"
           if [[ $res -ne 0 ]]; then
             set -e
-            CC=$(which clang) CXX=$(which clang++) ./bazelw test //core/... //platform/... //test/... --config ci --config nomacos --config libunwind --test_output=errors --test_env=RUST_LOG=debug
+            CC=$(which clang) CXX=$(which clang++) make linux-test
           else
               echo "No changes detected in the version-only change script. Skipping tests."
           fi

Makefile

@@ -42,3 +42,23 @@ repin:
 
 .PHONY: push-additional-images
 push-additional-images:
+
+.PHONY: ios-run-app
+ios-run-app:
+	./bazelw run --config ci --config release-ios //examples/swift/hello_world:ios_app
+
+.PHONY: ios-build-app
+ios-build-app:
+	./bazelw build --config ci --config release-ios //examples/swift/hello_world:ios_app
+
+.PHONY: ios-test
+ios-test:
+	./bazelw test $(shell ./bazelw query 'kind(ios_unit_test, //test/platform/swift/unit_integration/core/...)') --test_tag_filters=macos_only --test_output=errors --config=ci --config=ios
+
+.PHONY: android-build-app
+android-build-app:
+	./bazelw build --config ci --config release-android --android_platforms=@rules_android//:x86_64 //examples/android:android_app :capture_aar
+
+.PHONY: linux-test
+linux-test:
+	./bazelw test //core/... //platform/... //test/... --config ci --config nomacos --config libunwind --test_output=errors --test_env=RUST_LOG=debug

ci/check_bazel.sh

@@ -34,10 +34,14 @@ bazel_path=$(pwd)/bazelw
 # If the only file that changed was .sdk_version, we don't need to run bazel-diff and just mark it as no changes detected.
 if ./ci/version_only_change.sh; then
   echo "Only change was platform/shared/.sdk-version, no Bazel changes detected."
-  echo "check_result=2" >> "$GITHUB_OUTPUT"
+  echo "check_result=2" >>"$GITHUB_OUTPUT"
   exit 1
 fi
 
+# Always run Bazel changes when the MODULE.bazel file changes. These changes don't seem to be reflected in the hashes,
+# so we need to explicitly check for changes to this file.
+./ci/files_changed.sh MODULE.bazel
+
 starting_hashes_json="/tmp/starting_hashes.json"
 final_hashes_json="/tmp/final_hashes.json"
 impacted_targets_path="/tmp/impacted_targets.txt"
@@ -58,8 +62,11 @@ $bazel_diff get-impacted-targets -sh $starting_hashes_json -fh $final_hashes_jso
 # First pretty print the targets for debugging
 
 impacted_targets=()
-IFS=$'\n' read -d '' -r -a impacted_targets < $impacted_targets_path || true
-formatted_impacted_targets="$(IFS=$'\n'; echo "${impacted_targets[*]}")"
+IFS=$'\n' read -d '' -r -a impacted_targets <$impacted_targets_path || true
+formatted_impacted_targets="$(
+  IFS=$'\n'
+  echo "${impacted_targets[*]}"
+)"
 
 # Piping the output through to grep is flaky and will cause a broken pipe. Write the contents to a file
 # and grep the file to avoid this.
@@ -75,8 +82,7 @@ pattern_impacted() {
 
 changes_detected=false
 
-for pattern in "$@"
-do
+for pattern in "$@"; do
   if pattern_impacted "$pattern"; then
     echo "$pattern changed!"
     changes_detected=true
@@ -86,10 +92,10 @@ done
 
 # Exit code based on whether changes were detected
 if [ "$changes_detected" = true ]; then
-  echo "check_result=0" >> "$GITHUB_OUTPUT"
-  exit 0  # Changes found
+  echo "check_result=0" >>"$GITHUB_OUTPUT"
+  exit 0 # Changes found
 else
   echo "No changes detected."
-  echo "check_result=2" >> "$GITHUB_OUTPUT"
+  echo "check_result=2" >>"$GITHUB_OUTPUT"
   exit 1
 fi