dfinity · basvandijk · Jul 29, 2026 · Jun 28, 2026 · Jun 28, 2026 · Jun 28, 2026
@@ -1,5 +1,5 @@
 {
-  "image": "ghcr.io/dfinity/ic-dev@sha256:72798a5bed36f7174d2a318efe1996ed44d598c37f8cf3c909e6dec53cb73812",
+  "image": "ghcr.io/dfinity/ic-dev@sha256:2f98d344d708a1ae70938d5e777a1f141f7f2a9545687653f407a405eb1a27ea",
   "remoteUser": "ubuntu",
   "privileged": true,
   "runArgs": [

@@ -22,7 +22,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:0ed93dc568f53cce56042a86b31f98cd1bbb9cd3ea8e649532c366494b9c160a
+      image: ghcr.io/dfinity/ic-build@sha256:f4c6c7e0e16da470cba7ebceb0145f588d5fd4859c04acfa607bee475ecfa914
       options: >-
         -e NODE_NAME --privileged --cgroupns host
         --mount type=tmpfs,target="/home/buildifier/.local/share/containers"

diff --git a/.github/workflows/bre-namespace-test.yml b/.github/workflows/bre-namespace-test.yml
@@ -0,0 +1,84 @@
+name: BRE Namespace Test
+
+# Experimental: run `bazel test` on Namespace runners using Bazel Remote
+# Execution (BRE). Actions execute on Namespace workers booted from a custom
+# worker image (a mirror of ic-build) that is built, optimized and pinned by the
+# `container-autobuild.yml` workflow.
+#
+# See: https://namespace.so/docs/bazel/execution
+
+on:
+  workflow_dispatch:
+    inputs:
+      targets:
+        description: 'Bazel target patterns to test'
+        required: false
+        default: '//...'
+        type: string
+  pull_request:
+    types: [opened, synchronize, reopened, labeled]
+  push:
+    branches:
+      - 'dev-gh-*'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  bazel-test-bre:
+    name: Bazel Test (Namespace BRE)
+    runs-on: namespace-profile-amd64-linux-32x64
+    timeout-minutes: 120
+    # Opt-in while experimental: manual dispatch, pushes to dev-gh-* branches, or
+    # non-fork pull requests labeled 'CI_BRE'. Only on the public repo, where
+    # Namespace runners are configured (otherwise the job would get stuck). Fork
+    # PRs are excluded because this job runs on a privileged Namespace runner with
+    # pre-authenticated 'nsc' and must never execute untrusted PR code.
+    if: >-
+      github.repository == 'dfinity/ic' &&
+      ( github.event_name != 'pull_request' ||
+        ( github.event.pull_request.head.repo.full_name == github.repository &&
+          contains(github.event.pull_request.labels.*.name, 'CI_BRE') ) )
+    steps:
+      - name: Set up Bazel Remote Execution
+        run: |
+          # Provisions the Namespace RBE cluster and writes a bazelrc fragment with
+          # the remote executor, remote cache, credentials and recommended defaults.
+          # 'nsc' is pre-authenticated on Namespace runners.
+          # NOTE: do not print this bazelrc -- it contains short-lived credentials
+          # that would leak into the Actions logs.
+          nsc bazel execution setup --bazelrc=/tmp/bazel-rbe.bazelrc
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ./.github/actions/netrc
+      - name: Bazel Test with BRE
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          # Custom worker image: a mirror of ic-build, pinned to an immutable digest
+          # and optimized for BRE. The ref below (Namespace tenant registry + digest)
+          # is kept up to date automatically by the 'update-image-references' job in
+          # container-autobuild.yml.
+          # NOTE: the placeholder digest below is replaced on the first ic-build
+          # rebuild after this workflow is introduced; until then this job will fail.
+          worker_image="docker://nscr.io/c9ptjuknd7oc6/ic-build-worker@sha256:0000000000000000000000000000000000000000000000000000000000000000"
+
+          targets="${{ inputs.targets || '//...' }}"
+
+          # We deliberately bypass the workspace .bazelrc (which pulls in the
+          # DFINITY-internal cache / remote-execution config) and instead pass the
+          # build config plus the Namespace RBE config explicitly, mirroring the
+          # bazel-test-arm64 job in ci-main.yml.
+          bazel \
+            --noworkspace_rc \
+            --bazelrc=./bazel/conf/.bazelrc.build --bazelrc=/tmp/bazel-rbe.bazelrc \
+            test \
+            --test_tag_filters=-farm_system_test,-system_test_large,-system_test_benchmark,-fuzz_test,-fi_tests_nightly,-nns_tests_nightly,-pocketic_tests_nightly \
+            --remote_default_exec_properties=container-image="$worker_image" \
+            --keep_going \
+            $targets
@@ -33,7 +33,7 @@ jobs:
     runs-on: &dind-large-setup
       labels: dind-large
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:0ed93dc568f53cce56042a86b31f98cd1bbb9cd3ea8e649532c366494b9c160a
+      image: ghcr.io/dfinity/ic-build@sha256:f4c6c7e0e16da470cba7ebceb0145f588d5fd4859c04acfa607bee475ecfa914
       options: >-
          -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 90

@@ -37,7 +37,7 @@ jobs:
     runs-on: &dind-small-setup
       labels: dind-small
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:0ed93dc568f53cce56042a86b31f98cd1bbb9cd3ea8e649532c366494b9c160a
+      image: ghcr.io/dfinity/ic-build@sha256:f4c6c7e0e16da470cba7ebceb0145f588d5fd4859c04acfa607bee475ecfa914
       options: >-
          -e NODE_NAME --mount type=tmpfs,target="/tmp/containers"
     steps:

@@ -28,7 +28,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:0ed93dc568f53cce56042a86b31f98cd1bbb9cd3ea8e649532c366494b9c160a
+      image: ghcr.io/dfinity/ic-build@sha256:f4c6c7e0e16da470cba7ebceb0145f588d5fd4859c04acfa607bee475ecfa914
       options: >-
         -e NODE_NAME --privileged --cgroupns host
         --mount type=tmpfs,target="/home/buildifier/.local/share/containers"

@@ -103,10 +103,72 @@ jobs:
             exit 1
           fi
 
+  bre-worker-image:
+    name: Build BRE Worker Image
+    # Runs on a Namespace runner where 'nsc' is pre-authenticated. 'update-image-references'
+    # waits for this job and pins the resulting digest in the same commit. Like
+    # 'ic-build-image', this job is required: if it fails, that's a bug to fix.
+    runs-on: namespace-profile-amd64-linux-32x64
+    needs: [build-image-prep, ic-build-image]
+    # Restricted to the dfinity/ic repo and, for pull_request events, to non-fork
+    # PRs -- this job runs on a privileged Namespace runner with pre-authenticated
+    # 'nsc', so it must never run untrusted code from a fork.
+    if: |
+      needs.build-image-prep.outputs.build_image == 'true' &&
+      github.repository == 'dfinity/ic' &&
+      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
+    timeout-minutes: 30
+    outputs:
+      worker-image: ${{ steps.worker.outputs.worker-image }}
+    steps:
+      - name: Mirror ic-build to nscr.io and optimize for Bazel Remote Execution
+        id: worker
+        shell: bash
+        run: |
+          set -xeuo pipefail
+
+          # 'nsc base-image upload' pushes a *relative* name into the Namespace tenant
+          # registry, prepending $NSC_CONTAINER_REGISTRY (e.g. nscr.io/<tenant>). Do NOT
+          # pass a fully-qualified ref here or it gets double-prefixed.
+          : "${NSC_CONTAINER_REGISTRY:?NSC_CONTAINER_REGISTRY is not set on this runner}"
+
+          # Mirror the (unchanged) ic-build image -- just pushed to GHCR and pinned by
+          # digest -- into the Namespace tenant registry. Namespace BRE workers boot
+          # from this image.
+          src="ghcr.io/dfinity/ic-build@${{ needs.ic-build-image.outputs.ic-build-imageid }}"
+          worker_repo="${NSC_CONTAINER_REGISTRY}/ic-build-worker"
+          worker_tag="${{ needs.build-image-prep.outputs.image_tag }}"
+
+          nsc docker login
+
+          # Upload, then read the pushed digest from nsc's own "Uploaded base image:"
+          # line. We parse the upload output rather than 'docker buildx imagetools
+          # inspect', whose --format prints the whole manifest for the multi-platform
+          # attestation index that docker/build-push-action emits. BRE needs an
+          # immutable digest (mutable tags are rejected).
+          upload_log="$(nsc base-image upload "$src" "ic-build-worker:$worker_tag" 2>&1)"
+          echo "$upload_log"
+          worker_digest="$(printf '%s\n' "$upload_log" | grep -i 'Uploaded base image' | grep -oE 'sha256:[0-9a-f]{64}' | tail -n1 || true)"
+          : "${worker_digest:?could not parse pushed image digest from nsc base-image upload output}"
+          worker_image="${worker_repo}@${worker_digest}"
+          echo "Resolved worker image: $worker_image"
+
+          # Optimize the pinned digest into a fast-booting worker variant. This blocks
+          # until ready and only needs to be done once per digest.
+          # NOTE: requires the 'baseimage:optimize' permission on the tenant registry.
+          nsc base-image optimize --image_ref "$worker_image"
+
+          echo "worker-image=$worker_image" >> "$GITHUB_OUTPUT"
+
   update-image-references:
     name: Update Image References in Repo
     runs-on: ubuntu-latest
-    needs: [build-image-prep, ic-build-image]
+    # Waits for the (slower) 'bre-worker-image' to finish before committing: the push
+    # this job makes triggers a new workflow run, and 'cancel-in-progress' in the
+    # concurrency group would otherwise cancel 'bre-worker-image' mid-optimize.
+    # Both 'ic-build-image' and 'bre-worker-image' are required (default 'needs'
+    # semantics): if either fails, that's a bug to fix.
+    needs: [build-image-prep, ic-build-image, bre-worker-image]
     if: ${{ needs.build-image-prep.outputs.build_image == 'true' }}
     steps:
       - name: Create GitHub App Token
@@ -141,13 +203,20 @@ jobs:
           sed -i -E "s|${IMAGE_PREFIX}ic-build(:\|@)[^\"]{5,}|$IMG_NAME_IC_BUILD|g" -- workflow*/*
           popd
 
+          # Pin the BRE worker image (always produced by the required 'bre-worker-image')
+          # in the experimental BRE test workflow. Match any tenant in the registry path
+          # so this keeps working if the Namespace tenant ever changes.
+          WORKER_IMAGE='${{ needs.bre-worker-image.outputs.worker-image }}'
+          sed -i -E "s|nscr\.io/[^\"/]+/ic-build-worker@sha256:[0-9a-f]{64}|${WORKER_IMAGE}|g" .github/workflows/bre-namespace-test.yml
+
           git config --global user.name "IDX GitHub Automation"
           git config --global user.email "<>"
           git add .
           git commit \
             -m 'Updating container images to tag: ${{ needs.build-image-prep.outputs.image_tag }}' \
             -m 'ic-build: ${{ needs.ic-build-image.outputs.ic-build-imageid }}' \
-            -m 'ic-dev:   ${{ needs.ic-build-image.outputs.ic-dev-imageid }}'
+            -m 'ic-dev:   ${{ needs.ic-build-image.outputs.ic-dev-imageid }}' \
+            -m 'ic-build-worker: ${{ needs.bre-worker-image.outputs.worker-image }}'
           git push
 
       - name: Add PR Comment
@@ -162,6 +231,7 @@ jobs:
             message += 'New container images with tag: `${{ needs.build-image-prep.outputs.image_tag }}`\n'
             message += 'ic-build: `${{ needs.ic-build-image.outputs.ic-build-imageid }}`\n'
             message += 'ic-dev: `${{ needs.ic-build-image.outputs.ic-dev-imageid }}`\n'
+            message += 'ic-build-worker: `${{ needs.bre-worker-image.outputs.worker-image }}`\n'
 
             // Find existing comment from this workflow
             const comments = await github.rest.issues.listComments({

@@ -12,7 +12,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:0ed93dc568f53cce56042a86b31f98cd1bbb9cd3ea8e649532c366494b9c160a
+      image: ghcr.io/dfinity/ic-build@sha256:f4c6c7e0e16da470cba7ebceb0145f588d5fd4859c04acfa607bee475ecfa914
       options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 60

@@ -19,7 +19,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:0ed93dc568f53cce56042a86b31f98cd1bbb9cd3ea8e649532c366494b9c160a
+      image: ghcr.io/dfinity/ic-build@sha256:f4c6c7e0e16da470cba7ebceb0145f588d5fd4859c04acfa607bee475ecfa914
       options: >-
          -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 600

@@ -45,7 +45,7 @@ jobs:
   bazel-build-pocket-ic:
     name: Bazel Build PocketIC
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:0ed93dc568f53cce56042a86b31f98cd1bbb9cd3ea8e649532c366494b9c160a
+      image: ghcr.io/dfinity/ic-build@sha256:f4c6c7e0e16da470cba7ebceb0145f588d5fd4859c04acfa607bee475ecfa914
       options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 90

@@ -32,7 +32,7 @@ jobs:
       labels: dind-large
 
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:0ed93dc568f53cce56042a86b31f98cd1bbb9cd3ea8e649532c366494b9c160a
+      image: ghcr.io/dfinity/ic-build@sha256:f4c6c7e0e16da470cba7ebceb0145f588d5fd4859c04acfa607bee475ecfa914
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /var/tmp:/var/tmp -v /ceph-s3-info:/ceph-s3-info --mount type=tmpfs,target="/tmp/containers"
 

@@ -35,7 +35,7 @@ jobs:
       group: dm1
       labels: dind-large
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:0ed93dc568f53cce56042a86b31f98cd1bbb9cd3ea8e649532c366494b9c160a
+      image: ghcr.io/dfinity/ic-build@sha256:f4c6c7e0e16da470cba7ebceb0145f588d5fd4859c04acfa607bee475ecfa914
       options: >-
          -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 180

@@ -22,7 +22,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:0ed93dc568f53cce56042a86b31f98cd1bbb9cd3ea8e649532c366494b9c160a
+      image: ghcr.io/dfinity/ic-build@sha256:f4c6c7e0e16da470cba7ebceb0145f588d5fd4859c04acfa607bee475ecfa914
       options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     environment: DockerHub

@@ -32,7 +32,7 @@ jobs:
       labels: dind-large
 
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:0ed93dc568f53cce56042a86b31f98cd1bbb9cd3ea8e649532c366494b9c160a
+      image: ghcr.io/dfinity/ic-build@sha256:f4c6c7e0e16da470cba7ebceb0145f588d5fd4859c04acfa607bee475ecfa914
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /var/tmp:/var/tmp -v /ceph-s3-info:/ceph-s3-info --mount type=tmpfs,target="/tmp/containers"
 

@@ -14,7 +14,7 @@ jobs:
     runs-on: &dind-large-setup
       labels: dind-large
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:0ed93dc568f53cce56042a86b31f98cd1bbb9cd3ea8e649532c366494b9c160a
+      image: ghcr.io/dfinity/ic-build@sha256:f4c6c7e0e16da470cba7ebceb0145f588d5fd4859c04acfa607bee475ecfa914
       options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 720 # 12 hours

@@ -24,7 +24,7 @@ jobs:
       # see linux-x86-64 runner group
       labels: rust-benchmarks
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:0ed93dc568f53cce56042a86b31f98cd1bbb9cd3ea8e649532c366494b9c160a
+      image: ghcr.io/dfinity/ic-build@sha256:f4c6c7e0e16da470cba7ebceb0145f588d5fd4859c04acfa607bee475ecfa914
       # running on bare metal machine using ubuntu user
       options: --user ubuntu --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 720 # 12 hours

@@ -17,7 +17,7 @@ jobs:
       group: dm1
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:0ed93dc568f53cce56042a86b31f98cd1bbb9cd3ea8e649532c366494b9c160a
+      image: ghcr.io/dfinity/ic-build@sha256:f4c6c7e0e16da470cba7ebceb0145f588d5fd4859c04acfa607bee475ecfa914
       options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 480

@@ -25,7 +25,7 @@ jobs:
       labels: dind-small
     environment: CREATE_PR
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:0ed93dc568f53cce56042a86b31f98cd1bbb9cd3ea8e649532c366494b9c160a
+      image: ghcr.io/dfinity/ic-build@sha256:f4c6c7e0e16da470cba7ebceb0145f588d5fd4859c04acfa607bee475ecfa914
       options: >-
         -e NODE_NAME --privileged --cgroupns host -v /var/tmp:/var/tmp -v /ceph-s3-info:/ceph-s3-info --mount type=tmpfs,target="/tmp/containers"
     env:

diff --git a/ci/container/TAG b/ci/container/TAG
@@ -1 +1 @@
-daa25a4984be312c1cf51c5a932a200fa2fac895bdd550cac7bacb9dad553bae
+0000000000000000000000000000000000000000000000000000000000000000
Original file line number	Diff line number	Diff line change
		@@ -1 +1 @@
		daa25a4984be312c1cf51c5a932a200fa2fac895bdd550cac7bacb9dad553bae
		0000000000000000000000000000000000000000000000000000000000000000
Comment thread basvandijk marked this conversation as resolved. Outdated