ci: add Bazel RBE lane

[haasonsaas]

Summary

• add Bazel 9/Bzlmod/rules_python wiring for the core agent harness library and pytest suite
• add a repo-scoped Bazel RBE workflow gated by BAZEL_RBE_ENABLED and the evalops-agent-harness-rbe runner label
• add a compiled Python requirements lock and Make targets for local and remote Bazel validation

Test plan

• actionlint .github/workflows/ci.yml .github/workflows/bazel-rbe.yml
• python3 -m pytest -q
• make bazel-check
• make bazel-test

[cursor]

PR Summary

Medium Risk
Medium risk because it introduces a new Bazel/Bzlmod build+test path (including remote execution) and a large generated MODULE.bazel.lock, which can affect CI reliability and dependency resolution but does not change runtime application logic.

Overview
Introduces a Bazel-based build/test lane for the Python agent harness: adds BUILD.bazel targets (py_library + py_test) and MODULE.bazel/MODULE.bazel.lock for Bazel 9 + Bzlmod + rules_python dependency resolution.

Adds remote execution (RBE) support via .bazelrc (remote-gcp-dev config + linux platform definition) and a scripts/run-bazel-rbe.sh helper that tunnels to a GCP buildfarm.

Updates CI/tooling: a new gated GitHub Actions workflow bazel-rbe.yml (runs only when BAZEL_RBE_ENABLED or manual dispatch), plus Makefile targets for locking Python deps (requirements_lock.txt), Bazel formatting/tidying, and local/remote Bazel test runs; also ignores Bazel outputs in .gitignore/.bazelignore.

^{Reviewed by Cursor Bugbot for commit 3c714e9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pathspec@​1.1.1
	coverage@​7.14.0
	click@​8.3.3
	pygments@​2.20.0
	librt@​0.11.0
	packaging@​26.2
	typing-extensions@​4.15.0
	platformdirs@​4.9.6
	iniconfig@​2.3.0
	ast-serialize@​0.4.0
	pytokens@​0.4.1
	pluggy@​1.6.0
	mypy-extensions@​1.1.0

View full report

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON, but it could not run because the branch was deleted or merged before autofix could start.}

^{Reviewed by Cursor Bugbot for commit 3c714e9. Configure here.}

[cursor]

CI "check" target modifies files instead of validating

Medium Severity

The bazel-check target depends on requirements-lock, bazel-format, and bazel-mod-tidy, all of which mutate files in-place (regenerating the lock file, reformatting BUILD files, tidying MODULE.bazel) before running bazel-test. When the CI workflow runs make bazel-check, it silently fixes stale or unformatted committed files and then tests against the modified working tree, so it will never catch a PR with a stale requirements_lock.txt or unformatted BUILD files. The committed files remain incorrect but CI passes.

Additional Locations (1)

• .github/workflows/bazel-rbe.yml#L62-L64

 

^{Reviewed by Cursor Bugbot for commit 3c714e9. Configure here.}