From 2085acd097ce041439f557e72ae30403d4ce10b0 Mon Sep 17 00:00:00 2001
From: Bas van Dijk <bas@dfinity.org>
Date: Fri, 25 Apr 2025 14:22:07 +0000
Subject: [PATCH 01/29] chore: use --execution_log_compact_file to prevent OOM

---
 .github/actions/bazel/action.yaml     |  59 ++--
 .github/actions/bazel/bin/bazel       |   4 +-
 bazel/BUILD.bazel                     |  27 ++
 bazel/execution_log_compact_to_csv.py |  92 ++++++
 bazel/spawn.proto                     | 460 ++++++++++++++++++++++++++
 5 files changed, 607 insertions(+), 35 deletions(-)
 create mode 100644 bazel/execution_log_compact_to_csv.py
 create mode 100644 bazel/spawn.proto

diff --git a/.github/actions/bazel/action.yaml b/.github/actions/bazel/action.yaml
index 4106c040bde4..844e807d221c 100644
--- a/.github/actions/bazel/action.yaml
+++ b/.github/actions/bazel/action.yaml
@@ -73,46 +73,39 @@ runs:
           ${{ steps.metrics-tmpdir.outputs.dir }}/bazel-bep-*.pb.gpg
           ${{ steps.metrics-tmpdir.outputs.dir }}/profile-*.json
 
-
-      # Remove unnecessary entries from the JSON execlogs and create a CSV out of them
-    - name: Clean up execlogs
+    - name: Build execution_log_compact_to_csv
       shell: bash
       if: (success() || failure()) && inputs.execlogs-artifact-name != ''
+      env:
+        # Used by the bazel wrapper
+        BUILDBUDDY_LINKS: '[CI Job](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})'
       run: |
-        execlogs_json_in='${{ steps.metrics-tmpdir.outputs.dir }}/execlogs.json'
-        find '${{ steps.metrics-tmpdir.outputs.dir }}' -name 'execlog-*.json' \
-          -exec cat {} \; > "$execlogs_json_in"
+        set -euo pipefail
 
-        execlogs_csv_out='${{ steps.metrics-tmpdir.outputs.dir }}/execlogs.csv'
-        if ! [ -s "$execlogs_json_in" ]; then
-          echo "no execlogs found"
-          exit 0
-        fi
+        # Here we overwrite the PATH with our custom bazel wrapper to ensure
+        # the specified commands are run with the CI-specific options included
+        # in the wrapper.
+        export BAZEL_ACTION_OLDPATH="$PATH"
+        # github.action_path doesn't seem to work
+        PATH="$PWD/.github/actions/bazel/bin:$BAZEL_ACTION_OLDPATH"
+        hash -r
 
-        # this filters out some entries from the input JSON execlogs. Without this,
-        # jq takes 3+ minutes to parse the execlogs.
-        # Effectively removes a full line of "commandArgs", and takes care of skipping
-        # multiple lines for some multiline array values we don't care about
-        prog='
-          BEGIN { arr = 0; }
-          arr == 1 && /  }],?/ { arr = 0; next }
-          arr == 1 { next }
-          /  "commandArgs":.*/ { next }
-          /  "environmentVariables": \[\{/ { arr = 1; next; }
-          /  "inputs": \[\{/ { arr = 1; next; }
-          { print }
-          '
+        # Used by the bazel wrapper
+        export BAZEL_ACTION_METRICS_OUT='${{ steps.metrics-tmpdir.outputs.dir }}'
 
-        # Turns the JSON execlogs into a CSV with the following columns:
-        #   <label>,<output path>,<hash>
-        # only the target labels matching "whitelist_pat" are considered
-        whitelist_pat='^//'
-        time (cat "$execlogs_json_in" \
-          | awk "$prog" \
-          | jq -cMr --arg whitelist_pat "$whitelist_pat" \
-              'select(.targetLabel | test($whitelist_pat)) | .targetLabel as $targetLabel | .actualOutputs | map(. | $targetLabel+","+.path+","+.digest.hash) | .[]' \
-          >"$execlogs_csv_out")
+        bazel build --config=ci //bazel:execution_log_compact_to_csv
 
+    - name: Convert execlogs to CSV
+      shell: bash
+      if: (success() || failure()) && inputs.execlogs-artifact-name != ''
+      run: |
+        for execlog in $(find '${{ steps.metrics-tmpdir.outputs.dir }}' -name 'execlog-*.zst'); do
+          zstd -f -d $execlog -o execlog
+          bazel-bin/bazel/execution_log_compact_to_csv \
+            --input_execlog=execlog \
+            --whitelist_pat='^//'
+        done > '${{ steps.metrics-tmpdir.outputs.dir }}/execlogs.csv'
+        rm -f execlog
     - name: Upload execution log
       if: (success() || failure()) && inputs.execlogs-artifact-name != ''
       uses: actions/upload-artifact@v4
diff --git a/.github/actions/bazel/bin/bazel b/.github/actions/bazel/bin/bazel
index 213b08b51369..bda6361d7153 100755
--- a/.github/actions/bazel/bin/bazel
+++ b/.github/actions/bazel/bin/bazel
@@ -59,8 +59,8 @@ if [[ $bazel_command == "build" ]] || [[ $bazel_command == "test" ]]; then
     command_timestamp=$(date +%s)
     bazel_args+=(
 
-        # write execlogs, mostly for build reproducibility checks
-        --execution_log_json_file="$BAZEL_ACTION_METRICS_OUT/execlog-$command_timestamp.json"
+        # write execlog, mostly for build reproducibility checks
+        --execution_log_compact_file="$BAZEL_ACTION_METRICS_OUT/execlog-$command_timestamp.zst"
 
         --verbose_failures=true
 
diff --git a/bazel/BUILD.bazel b/bazel/BUILD.bazel
index 33493d6004ff..95fc314a179e 100644
--- a/bazel/BUILD.bazel
+++ b/bazel/BUILD.bazel
@@ -1,7 +1,34 @@
 load("@bazel_skylib//rules:common_settings.bzl", "bool_flag", "string_flag")
 load("@buildifier_prebuilt//:rules.bzl", "buildifier")
+load("@com_google_protobuf//bazel:proto_library.bzl", "proto_library")
+load("@com_google_protobuf//bazel:py_proto_library.bzl", "py_proto_library")
+load("@rules_python//python:py_binary.bzl", "py_binary")
 load("//bazel:defs.bzl", "write_info_file_var")
 
+proto_library(
+    name = "spawn_pb2",
+    srcs = ["spawn.proto"],
+    deps = [
+        "@com_google_protobuf//:duration_proto",
+        "@com_google_protobuf//:timestamp_proto",
+    ],
+)
+
+py_proto_library(
+    name = "spawn_py_pb2",
+    deps = [":spawn_pb2"],
+)
+
+py_binary(
+    name = "execution_log_compact_to_csv",
+    srcs = [
+        "execution_log_compact_to_csv.py",
+    ],
+    deps = [
+        ":spawn_py_pb2",
+    ],
+)
+
 bool_flag(
     name = "enable_malicious_code",
     build_setting_default = False,
diff --git a/bazel/execution_log_compact_to_csv.py b/bazel/execution_log_compact_to_csv.py
new file mode 100644
index 000000000000..86b3f5de65ac
--- /dev/null
+++ b/bazel/execution_log_compact_to_csv.py
@@ -0,0 +1,92 @@
+# This Python script converts bazel's compact execution log (--execution_log_compact_file)
+# to a CSV file that contains a row per output file for every bazel target matching the given
+# --whitelist_pat regular expression. Each row contains the columns: target, path, and hash.
+#
+# Example usage:
+#
+# To invoke this script first generate a compact execution log with bazel using for example:
+#
+#   $ bazel build //rs/replica:replica --execution_log_compact_file=compact_execlog.zst
+#
+# Then decompress the file:
+#
+#   $ zstd -d compact_execlog.zst
+#
+# Finally build and run this script to convert the decompressed file to a CSV:
+#
+#   $ bazel build //bazel:execution_log_compact_to_csv && \
+#     bazel-bin/bazel/execution_log_compact_to_csv \
+#       --input_execlog=compact_execlog \
+#       --whitelist_pat='^//'
+#
+#   //rs/http_endpoints/public:build_script_,bazel-out/k8-opt-exec-ST-d57f47055a04/bin/rs/http_endpoints/public/build_script_,4463251579c194bf83a24408a184da9a7f46d5777f753e33a77afa5c2287fd1d
+#   //rs/http_endpoints/public:build_script,bazel-out/k8-opt/bin/rs/http_endpoints/public/build_script.out_dir/dashboard.rs,f0ba2e4976ac312782190b6391ce945f57708b46126b741f6336b355968a8a84
+#   ...
+#   //rs/replica:replica_lib,bazel-out/k8-opt/bin/rs/replica/libic_replica-974340861.rlib,0d45ec60aee4472020f69d0a19ac2ad4519388216f5a21e19152539fa3d0c4ce
+#   //rs/replica:replica,bazel-out/k8-opt/bin/rs/replica/replica,0ecf150fbff09dc7b92ac976827fc46179561f2e8e83487840330ce247b61b5d
+
+import argparse
+import csv
+import re
+import sys
+
+import google.protobuf.internal
+
+import bazel.spawn_pb2
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Convert bazel's compact execution log to a CSV file printed to stdout."
+    )
+    parser.add_argument(
+        "--input_execlog",
+        required=True,
+        help="Path to the zstd _decompressed_ input file as generated with bazel's --execution_log_compact_file option.",
+    )
+    parser.add_argument(
+        "--whitelist_pat",
+        default=None,
+        help="Regex to match target labels to include in the CSV. If omitted, all targets are included.",
+    )
+    args = parser.parse_args()
+
+    id_to_entry = {}
+
+    with open(args.input_execlog, "rb") as execlog_file, sys.stdout as csv_file:
+        writer = csv.writer(csv_file)
+        while True:
+            msg_len = google.protobuf.internal.decoder._DecodeVarint32(execlog_file)
+            if msg_len is None:
+                break
+            msg_buf = execlog_file.read(msg_len)
+            execLogEntry = bazel.spawn_pb2.ExecLogEntry()
+            execLogEntry.ParseFromString(msg_buf)
+            entry_type = execLogEntry.WhichOneof("type")
+            if entry_type in ["file", "directory"]:
+                id_to_entry[execLogEntry.id] = execLogEntry
+            if entry_type == "spawn":
+                label = execLogEntry.spawn.target_label
+                if args.whitelist_pat is None or re.match(args.whitelist_pat, label):
+                    for output in execLogEntry.spawn.outputs:
+                        output_type = output.WhichOneof("type")
+                        if output_type == "output_id":
+                            output_id = output.output_id
+                            output_entry = id_to_entry[output_id]
+                            output_entry_type = output_entry.WhichOneof("type")
+                            if output_entry_type == "file":
+                                path = output_entry.file.path
+                                hash = output_entry.file.digest.hash
+                                writer.writerow([label, path, hash])
+                            elif output_entry_type == "directory":
+                                dir_path = output_entry.directory.path
+                                for dir_file in output_entry.directory.files:
+                                    path = dir_path + "/" + dir_file.path
+                                    hash = dir_file.digest.hash
+                                    writer.writerow([label, path, hash])
+                            else:
+                                raise ValueError(f"Unknown output entry type: {output_entry_type}")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/bazel/spawn.proto b/bazel/spawn.proto
new file mode 100644
index 000000000000..e3b633c5eb70
--- /dev/null
+++ b/bazel/spawn.proto
@@ -0,0 +1,460 @@
+// This file was downloaded using:
+//
+//   curl "https://raw.githubusercontent.com/bazelbuild/bazel/refs/tags/7.6.0/src/main/protobuf/spawn.proto" -O
+
+// Copyright 2018 The Bazel Authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package tools.protos;
+
+import "google/protobuf/duration.proto";
+import "google/protobuf/timestamp.proto";
+
+option java_package = "com.google.devtools.build.lib.exec";
+option java_outer_classname = "Protos";
+
+// This file defines the output formats emitted by the --execution_log_* flags.
+// The purpose of the execution log is to enable comparisons of multiple builds
+// to diagnose output differences or more subtle problems such as remote cache
+// misses.
+
+// Digest of a file or action cache entry.
+message Digest {
+  // The content hash as a lowercase hex string including any leading zeroes.
+  string hash = 1;
+
+  // The original content size in bytes.
+  int64 size_bytes = 2;
+
+  // The name of the digest function used to compute the hash.
+  string hash_function_name = 3;
+}
+
+message File {
+  // Path to the file relative to the execution root.
+  string path = 1;
+
+  // Symlink target path.
+  // Only set for unresolved symlinks.
+  string symlink_target_path = 4;
+
+  // File digest.
+  // Always omitted for unresolved symlinks. May be omitted for empty files.
+  Digest digest = 2;
+
+  // Whether the file is a tool.
+  // Only set for inputs, never for outputs.
+  bool is_tool = 3;
+}
+
+// Contents of command environment.
+message EnvironmentVariable {
+  string name = 1;
+  string value = 2;
+}
+
+// Command execution platform. This message needs to be kept in sync
+// with [Platform][google.devtools.remoteexecution.v1test.Platform].
+message Platform {
+  message Property {
+    string name = 1;
+    string value = 2;
+  }
+  repeated Property properties = 1;
+}
+
+// Timing, size, and memory statistics for a SpawnExec.
+message SpawnMetrics {
+  // Total wall time spent running a spawn, measured locally.
+  google.protobuf.Duration total_time = 1;
+  // Time taken to convert the spawn into a network request.
+  google.protobuf.Duration parse_time = 2;
+  // Time spent communicating over the network.
+  google.protobuf.Duration network_time = 3;
+  // Time spent fetching remote outputs.
+  google.protobuf.Duration fetch_time = 4;
+  // Time spent waiting in queues.
+  google.protobuf.Duration queue_time = 5;
+  // Time spent setting up the environment in which the spawn is run.
+  google.protobuf.Duration setup_time = 6;
+  // Time spent uploading outputs to a remote store.
+  google.protobuf.Duration upload_time = 7;
+  // Time spent running the subprocess.
+  google.protobuf.Duration execution_wall_time = 8;
+  // Time spent by the execution framework processing outputs.
+  google.protobuf.Duration process_outputs_time = 9;
+  // Time spent in previous failed attempts, not including queue time.
+  google.protobuf.Duration retry_time = 10;
+  // Total size in bytes of inputs or 0 if unavailable.
+  int64 input_bytes = 11;
+  // Total number of input files or 0 if unavailable.
+  int64 input_files = 12;
+  // Estimated memory usage or 0 if unavailable.
+  int64 memory_estimate_bytes = 13;
+  // Limit of total size of inputs or 0 if unavailable.
+  int64 input_bytes_limit = 14;
+  // Limit of total number of input files or 0 if unavailable.
+  int64 input_files_limit = 15;
+  // Limit of total size of outputs or 0 if unavailable.
+  int64 output_bytes_limit = 16;
+  // Limit of total number of output files or 0 if unavailable.
+  int64 output_files_limit = 17;
+  // Memory limit or 0 if unavailable.
+  int64 memory_bytes_limit = 18;
+  // Time limit or 0 if unavailable.
+  google.protobuf.Duration time_limit = 19;
+  // Instant when the spawn started to execute.
+  google.protobuf.Timestamp start_time = 20;
+}
+
+// Details of an executed spawn.
+// This is the format generated by --execution_log_{binary,json}_file.
+
+// Each message contains an executed command, its full inputs and outputs, and
+// other information. This format is relatively costly to produce and results
+// in very large files, due to the amount of repeated information. The
+// --experimental_execution_log_compact_file format provides a better
+// alternative.
+message SpawnExec {
+  // The command that was run.
+  repeated string command_args = 1;
+
+  // The command environment.
+  repeated EnvironmentVariable environment_variables = 2;
+
+  // The command execution platform.
+  Platform platform = 3;
+
+  // The inputs at the time of the execution.
+  repeated File inputs = 4;
+
+  // All the listed outputs paths. The paths are relative to the execution root.
+  // Actual outputs are a subset of the listed outputs. These paths are sorted.
+  repeated string listed_outputs = 5;
+
+  // Whether the spawn was allowed to run remotely.
+  bool remotable = 6;
+
+  // Whether the spawn was allowed to be cached.
+  bool cacheable = 7;
+
+  // The spawn timeout.
+  int64 timeout_millis = 8;
+
+  // The mnemonic of the action this spawn belongs to.
+  string mnemonic = 10;
+
+  // The outputs generated by the execution.
+  // In order for one of the listed_outputs to appear here, it must have been
+  // produced and have the expected type (file, directory or symlink).
+  repeated File actual_outputs = 11;
+
+  // If the spawn did not hit a disk or remote cache, this will be the name of
+  // the runner, e.g. "remote", "linux-sandbox" or "worker".
+  //
+  // If the spawn hit a disk or remote cache, this will be "disk cache hit" or
+  // "remote cache hit", respectively. This includes the case where a remote
+  // cache was hit while executing the spawn remotely.
+  //
+  // Note that spawns whose owning action hits the persistent action cache
+  // are never reported at all.
+  //
+  // This won't always match the spawn strategy. For the dynamic strategy, it
+  // will be the runner for the first branch to complete. For the remote
+  // strategy, it might be a local runner in case of a fallback.
+  string runner = 12;
+
+  // Whether the spawn hit a disk or remote cache.
+  bool cache_hit = 13;
+
+  // A text status describing an execution error. Empty in case of success.
+  string status = 14;
+
+  // This field contains the contents of SpawnResult.exitCode.
+  // Its semantics varies greatly depending on the status field.
+  // Dependable: if status is empty, exit_code is guaranteed to be zero.
+  int32 exit_code = 15;
+
+  // Whether the spawn was allowed to be cached remotely.
+  bool remote_cacheable = 16;
+
+  // The canonical label of the target this spawn belongs to.
+  string target_label = 18;
+
+  // The action cache digest.
+  // Only available when remote execution, remote cache or disk cache was
+  // enabled for this spawn.
+  Digest digest = 19;
+
+  // Timing, size and memory statistics.
+  SpawnMetrics metrics = 20;
+
+  reserved 9, 17;
+}
+
+// An entry in the compact log format.
+// This is the format generated by --experimental_execution_log_compact_file.
+//
+// Each entry describes either an executed spawn or non-spawn action or a piece
+// of data referenced by other entries. This considerably reduces the runtime
+// overhead and the size of the log when compared to the
+// --execution_log_{binary,json}_file formats.
+//
+// To ensure that the log can be parsed in a single pass, every entry must be
+// serialized after all other entries it references by ID. However, entries
+// aren't guaranteed to be serialized in increasing ID order.
+//
+// Entries other than spawns and non-spawn actions may not be assumed to be
+// canonical. For performance reasons, the same file, directory or input set may
+// be serialized multiple times with a different ID.
+message ExecLogEntry {
+  // Information pertaining to the entire invocation.
+  // May appear at most once in the initial position.
+  message Invocation {
+    // The hash function used to compute digests.
+    string hash_function_name = 1;
+
+    // The name of the subdirectory of the runfiles tree corresponding to the
+    // main repository (also known as the "workspace name").
+    //
+    // With --enable_bzlmod, this is always "_main", but can vary when using
+    // WORKSPACE.
+    string workspace_runfiles_directory = 2;
+
+    // Whether --experimental_sibling_repository_layout is enabled.
+    bool sibling_repository_layout = 3;
+
+    // The ID of the invocation.
+    string id = 4;
+  }
+
+  // An input or output file.
+  message File {
+    // The file path.
+    string path = 1;
+    // A digest of the file contents.
+    // The hash function name is omitted. It can be obtained from Invocation.
+    // May be omitted for empty files.
+    Digest digest = 2;
+  }
+
+  // An input or output directory.
+  // May be a source directory, a fileset tree, or a tree artifact.
+  message Directory {
+    // The directory path.
+    string path = 1;
+    // The contained files, whose paths are relative to the directory.
+    repeated File files = 2;
+  }
+
+  // An unresolved symlink.
+  message UnresolvedSymlink {
+    // The symlink path.
+    string path = 1;
+    // The path the symlink points to.
+    string target_path = 2;
+  }
+
+  // A set of spawn inputs.
+  // The contents of the set are the directly contained entries in addition to
+  // the contents of all transitively referenced sets. When order matters,
+  // transitive sets come before direct entries and within a set, entries are
+  // considered in left-to-right order ("postorder").
+  // Sets are not canonical: two sets with different structure may yield the
+  // same contents.
+  message InputSet {
+    // Entry IDs of files, directories, unresolved symlinks or runfiles trees
+    // belonging to this set.
+    repeated uint32 input_ids = 5;
+    // Entry IDs of other input sets contained in this set.
+    repeated uint32 transitive_set_ids = 4;
+
+    reserved 1, 2, 3;
+  }
+
+  // A collection of runfiles symlinked at custom locations.
+  // The contents of the set are the directly contained entries in addition to
+  // the contents of all transitively referenced sets. When order matters,
+  // transitive sets come before direct entries and within a set, entries are
+  // considered in left-to-right order ("postorder").
+  // Sets are not canonical: two sets with different structure may yield the
+  // same contents.
+  message SymlinkEntrySet {
+    // A map from relative paths of runfiles symlinks to the entry IDs of the
+    // symlink target, which may be a file, directory, or unresolved symlink.
+    map<string, uint32> direct_entries = 1;
+    // Entry IDs of other symlink entry sets transitively contained in this set.
+    repeated uint32 transitive_set_ids = 2;
+  }
+
+  // A structured representation of the .runfiles directory of an executable.
+  //
+  // Instead of storing the directory directly, the tree is represented
+  // similarly to its in-memory representation in Bazel and needs to be
+  // reassembled from the following parts (in case of path collisions, later
+  // entries overwrite earlier ones):
+  //
+  // 1. symlinks (symlinks_id)
+  // 2. artifacts at canonical locations (input_set_id)
+  // 3. empty files (empty_files)
+  // 4. root symlinks (root_symlinks_id)
+  // 5. the _repo_mapping file with the repo mapping manifest
+  // (repo_mapping_manifest)
+  // 6. the <workspace runfiles directory>/.runfile file (if the workspace
+  // runfiles directory
+  //    wouldn't exist otherwise)
+  //
+  // See SpawnLogReconstructor#reconstructRunfilesDir for details.
+  message RunfilesTree {
+    // The runfiles tree path.
+    string path = 1;
+    // The entry ID of the set of artifacts in the runfiles tree that are
+    // symlinked at their canonical locations relative to the tree path.
+    // See SpawnLogReconstructor#getRunfilesPaths for how to recover the
+    // tree-relative paths of the artifacts from their exec paths.
+    //
+    // In case of path collisions, later artifacts overwrite earlier ones and
+    // artifacts override custom symlinks.
+    //
+    // The referenced set must not transitively contain any runfile trees.
+    uint32 input_set_id = 2;
+    // The entry ID of the set of symlink entries with paths relative to the
+    // subdirectory of the runfiles tree root corresponding to the main
+    // repository.
+    uint32 symlinks_id = 3;
+    // The entry ID of the set of symlink entries with paths relative to the
+    // root of the runfiles tree.
+    uint32 root_symlinks_id = 4;
+    // The paths of empty files relative to the subdirectory of the runfiles
+    // tree root corresponding to the main repository.
+    repeated string empty_files = 5;
+    // The "_repo_mapping" file at the root of the runfiles tree, if it exists.
+    // Only the digest is stored as the relative path is fixed.
+    File repo_mapping_manifest = 6;
+    // Whether the runfiles tree contains external runfiles at their legacy
+    // locations (e.g. _main/external/bazel_tools/tools/bash/runfiles.bash)
+    // in addition to the default locations (e.g.
+    // bazel_tools/tools/bash/runfiles.bash).
+    bool legacy_external_runfiles = 7;
+  }
+
+  // A spawn output.
+  message Output {
+    oneof type {
+      // The ID of a file (ctx.actions.declare_file), directory
+      // (ctx.actions.declare_directory) or unresolved symlink
+      // (ctx.actions.declare_symlink) that is an output of the spawn.
+      uint32 output_id = 5;
+      // A declared output that is either missing or has the wrong type
+      // (e.g., a file where a directory was expected).
+      string invalid_output_path = 4;
+    }
+
+    reserved 1, 2, 3;
+  }
+
+  // An executed spawn.
+  message Spawn {
+    // The command line arguments.
+    repeated string args = 1;
+
+    // The environment variables.
+    repeated EnvironmentVariable env_vars = 2;
+
+    // The execution platform.
+    Platform platform = 3;
+
+    // Entry ID of the set of inputs. Unset means empty.
+    uint32 input_set_id = 4;
+
+    // Entry ID of the set of tool inputs. Unset means empty.
+    uint32 tool_set_id = 5;
+
+    // The set of outputs.
+    repeated Output outputs = 6;
+
+    // See SpawnExec.label.
+    string target_label = 7;
+
+    // See SpawnExec.mnemonic.
+    string mnemonic = 8;
+
+    // See SpawnExec.exit_code.
+    int32 exit_code = 9;
+
+    // See SpawnExec.status.
+    string status = 10;
+
+    // See SpawnExec.runner.
+    string runner = 11;
+
+    // See SpawnExec.cache_hit.
+    bool cache_hit = 12;
+
+    // See SpawnExec.remotable.
+    bool remotable = 13;
+
+    // See SpawnExec.cacheable.
+    bool cacheable = 14;
+
+    // See SpawnExec.remote_cacheable.
+    bool remote_cacheable = 15;
+
+    // See SpawnExec.digest.
+    // The hash function name is omitted. It can be obtained from Invocation.
+    // Unset if the file is empty.
+    Digest digest = 16;
+
+    // See SpawnExec.timeout_millis.
+    int64 timeout_millis = 17;
+
+    // See SpawnExec.metrics.
+    SpawnMetrics metrics = 18;
+  }
+
+  // A symlink action, which is not backed by a spawn.
+  message SymlinkAction {
+    // The path of the input file of the action (i.e., the target of the
+    // symlink).
+    string input_path = 1;
+
+    // The path of the output file of the action (i.e., the symlink itself).
+    string output_path = 2;
+
+    // The canonical label of the target this action belongs to.
+    string target_label = 3;
+
+    // The mnemonic of the action.
+    string mnemonic = 4;
+  }
+
+  // If nonzero, then this entry may be referenced by later entries by this ID.
+  // Nonzero IDs are unique within an execution log, but may not be contiguous.
+  uint32 id = 1;
+
+  // The entry payload.
+  oneof type {
+    Invocation invocation = 2;
+    File file = 3;
+    Directory directory = 4;
+    UnresolvedSymlink unresolved_symlink = 5;
+    InputSet input_set = 6;
+    Spawn spawn = 7;
+    SymlinkAction symlink_action = 8;
+    SymlinkEntrySet symlink_entry_set = 9;
+    RunfilesTree runfiles_tree = 10;
+  }
+}

From e574a8e41581b8a35a51175ec3c4b51a14e908a6 Mon Sep 17 00:00:00 2001
From: Bas van Dijk <bas@dfinity.org>
Date: Mon, 28 Apr 2025 21:43:50 +0000
Subject: [PATCH 02/29] docs

---
 bazel/execution_log_compact_to_csv.py | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/bazel/execution_log_compact_to_csv.py b/bazel/execution_log_compact_to_csv.py
index 86b3f5de65ac..79c5e561c73e 100644
--- a/bazel/execution_log_compact_to_csv.py
+++ b/bazel/execution_log_compact_to_csv.py
@@ -56,19 +56,28 @@ def main():
     with open(args.input_execlog, "rb") as execlog_file, sys.stdout as csv_file:
         writer = csv.writer(csv_file)
         while True:
+            # The execution log is a stream of protobuf messages, each preceded by a varint32 denoting its length.
             msg_len = google.protobuf.internal.decoder._DecodeVarint32(execlog_file)
             if msg_len is None:
                 break
+
+            # Parse the ExecLogEntry message. See spawn.proto for the message definition.
             msg_buf = execlog_file.read(msg_len)
-            execLogEntry = bazel.spawn_pb2.ExecLogEntry()
-            execLogEntry.ParseFromString(msg_buf)
-            entry_type = execLogEntry.WhichOneof("type")
+            exec_log_entry = bazel.spawn_pb2.ExecLogEntry()
+            exec_log_entry.ParseFromString(msg_buf)
+
+            # We intend to log the outputs of Spawns. Spawns refer to their output by ID
+            # so we need to keep track of the ID to entry mapping. Important note:
+            # if an entry (like a Spawn) refers to another entry (like a File or Direcory)
+            # the latter must precede the former.
+            entry_type = exec_log_entry.WhichOneof("type")
             if entry_type in ["file", "directory"]:
-                id_to_entry[execLogEntry.id] = execLogEntry
+                id_to_entry[exec_log_entry.id] = exec_log_entry
+
             if entry_type == "spawn":
-                label = execLogEntry.spawn.target_label
+                label = exec_log_entry.spawn.target_label
                 if args.whitelist_pat is None or re.match(args.whitelist_pat, label):
-                    for output in execLogEntry.spawn.outputs:
+                    for output in exec_log_entry.spawn.outputs:
                         output_type = output.WhichOneof("type")
                         if output_type == "output_id":
                             output_id = output.output_id

From ebf39f910fe8c72360cd61d0a91a50de1378d5da Mon Sep 17 00:00:00 2001
From: Bas van Dijk <bas@dfinity.org>
Date: Mon, 28 Apr 2025 21:45:10 +0000
Subject: [PATCH 03/29] layout

---
 bazel/execution_log_compact_to_csv.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/bazel/execution_log_compact_to_csv.py b/bazel/execution_log_compact_to_csv.py
index 79c5e561c73e..68460afc2649 100644
--- a/bazel/execution_log_compact_to_csv.py
+++ b/bazel/execution_log_compact_to_csv.py
@@ -56,7 +56,8 @@ def main():
     with open(args.input_execlog, "rb") as execlog_file, sys.stdout as csv_file:
         writer = csv.writer(csv_file)
         while True:
-            # The execution log is a stream of protobuf messages, each preceded by a varint32 denoting its length.
+            # The execution log is a stream of protobuf messages,
+            # each preceded by a varint32 denoting its length.
             msg_len = google.protobuf.internal.decoder._DecodeVarint32(execlog_file)
             if msg_len is None:
                 break

From 890482418a215538e6b247e44b2a98114a60ee94 Mon Sep 17 00:00:00 2001
From: Bas van Dijk <bas@dfinity.org>
Date: Mon, 28 Apr 2025 21:46:02 +0000
Subject: [PATCH 04/29] little touch

---
 bazel/execution_log_compact_to_csv.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bazel/execution_log_compact_to_csv.py b/bazel/execution_log_compact_to_csv.py
index 68460afc2649..12cecb34d9d9 100644
--- a/bazel/execution_log_compact_to_csv.py
+++ b/bazel/execution_log_compact_to_csv.py
@@ -62,7 +62,7 @@ def main():
             if msg_len is None:
                 break
 
-            # Parse the ExecLogEntry message. See spawn.proto for the message definition.
+            # Parse the ExecLogEntry message. See ./spawn.proto for the message definition.
             msg_buf = execlog_file.read(msg_len)
             exec_log_entry = bazel.spawn_pb2.ExecLogEntry()
             exec_log_entry.ParseFromString(msg_buf)

From 44473d70924e3be061ceea9020574befce89b786 Mon Sep 17 00:00:00 2001
From: Bas van Dijk <bas@dfinity.org>
Date: Mon, 28 Apr 2025 21:47:28 +0000
Subject: [PATCH 05/29] .

---
 bazel/execution_log_compact_to_csv.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bazel/execution_log_compact_to_csv.py b/bazel/execution_log_compact_to_csv.py
index 12cecb34d9d9..24bb87f35c13 100644
--- a/bazel/execution_log_compact_to_csv.py
+++ b/bazel/execution_log_compact_to_csv.py
@@ -70,7 +70,7 @@ def main():
             # We intend to log the outputs of Spawns. Spawns refer to their output by ID
             # so we need to keep track of the ID to entry mapping. Important note:
             # if an entry (like a Spawn) refers to another entry (like a File or Direcory)
-            # the latter must precede the former.
+            # it's guaranteed the latter will precede the former.
             entry_type = exec_log_entry.WhichOneof("type")
             if entry_type in ["file", "directory"]:
                 id_to_entry[exec_log_entry.id] = exec_log_entry

From abf364c4f557661fed14df8863cf7e128a36ad62 Mon Sep 17 00:00:00 2001
From: Bas van Dijk <bas@dfinity.org>
Date: Mon, 28 Apr 2025 21:48:55 +0000
Subject: [PATCH 06/29] inline

---
 bazel/execution_log_compact_to_csv.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/bazel/execution_log_compact_to_csv.py b/bazel/execution_log_compact_to_csv.py
index 24bb87f35c13..d1bae7f2c792 100644
--- a/bazel/execution_log_compact_to_csv.py
+++ b/bazel/execution_log_compact_to_csv.py
@@ -81,8 +81,7 @@ def main():
                     for output in exec_log_entry.spawn.outputs:
                         output_type = output.WhichOneof("type")
                         if output_type == "output_id":
-                            output_id = output.output_id
-                            output_entry = id_to_entry[output_id]
+                            output_entry = id_to_entry[output.output_id]
                             output_entry_type = output_entry.WhichOneof("type")
                             if output_entry_type == "file":
                                 path = output_entry.file.path

From b4f61d27f6d6bbb2d225dfa95483fedace9b1c92 Mon Sep 17 00:00:00 2001
From: Bas van Dijk <bas@dfinity.org>
Date: Mon, 28 Apr 2025 21:52:28 +0000
Subject: [PATCH 07/29] use a case statement

---
 bazel/execution_log_compact_to_csv.py | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/bazel/execution_log_compact_to_csv.py b/bazel/execution_log_compact_to_csv.py
index d1bae7f2c792..0cf6ec5b241f 100644
--- a/bazel/execution_log_compact_to_csv.py
+++ b/bazel/execution_log_compact_to_csv.py
@@ -83,18 +83,19 @@ def main():
                         if output_type == "output_id":
                             output_entry = id_to_entry[output.output_id]
                             output_entry_type = output_entry.WhichOneof("type")
-                            if output_entry_type == "file":
-                                path = output_entry.file.path
-                                hash = output_entry.file.digest.hash
-                                writer.writerow([label, path, hash])
-                            elif output_entry_type == "directory":
-                                dir_path = output_entry.directory.path
-                                for dir_file in output_entry.directory.files:
-                                    path = dir_path + "/" + dir_file.path
-                                    hash = dir_file.digest.hash
+                            match output_entry_type:
+                                case "file":
+                                    path = output_entry.file.path
+                                    hash = output_entry.file.digest.hash
                                     writer.writerow([label, path, hash])
-                            else:
-                                raise ValueError(f"Unknown output entry type: {output_entry_type}")
+                                case "directory":
+                                    dir_path = output_entry.directory.path
+                                    for dir_file in output_entry.directory.files:
+                                        path = dir_path + "/" + dir_file.path
+                                        hash = dir_file.digest.hash
+                                        writer.writerow([label, path, hash])
+                                case _:
+                                    raise ValueError(f"Unknown output entry type: {output_entry_type}")
 
 
 if __name__ == "__main__":

From 7e245d97bbb9175c78e660e1269b54fe7038e76d Mon Sep 17 00:00:00 2001
From: Bas van Dijk <bas@dfinity.org>
Date: Mon, 28 Apr 2025 22:06:30 +0000
Subject: [PATCH 08/29] better error message

---
 bazel/execution_log_compact_to_csv.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bazel/execution_log_compact_to_csv.py b/bazel/execution_log_compact_to_csv.py
index 0cf6ec5b241f..576a95da1965 100644
--- a/bazel/execution_log_compact_to_csv.py
+++ b/bazel/execution_log_compact_to_csv.py
@@ -95,7 +95,7 @@ def main():
                                         hash = dir_file.digest.hash
                                         writer.writerow([label, path, hash])
                                 case _:
-                                    raise ValueError(f"Unknown output entry type: {output_entry_type}")
+                                    raise ValueError(f"Unexpected output entry type: {output_entry_type}")
 
 
 if __name__ == "__main__":

From 61b38ec699afb241e1b3980fa4ae5135198a7a38 Mon Sep 17 00:00:00 2001
From: Bas van Dijk <bas@dfinity.org>
Date: Mon, 28 Apr 2025 22:09:56 +0000
Subject: [PATCH 09/29] match statement not yet supported in Python-3.8

---
 bazel/execution_log_compact_to_csv.py | 23 +++++++++++------------
 1 file changed, 11 insertions(+), 12 deletions(-)

diff --git a/bazel/execution_log_compact_to_csv.py b/bazel/execution_log_compact_to_csv.py
index 576a95da1965..b05fd0cfffb1 100644
--- a/bazel/execution_log_compact_to_csv.py
+++ b/bazel/execution_log_compact_to_csv.py
@@ -83,19 +83,18 @@ def main():
                         if output_type == "output_id":
                             output_entry = id_to_entry[output.output_id]
                             output_entry_type = output_entry.WhichOneof("type")
-                            match output_entry_type:
-                                case "file":
-                                    path = output_entry.file.path
-                                    hash = output_entry.file.digest.hash
+                            if output_entry_type == "file":
+                                path = output_entry.file.path
+                                hash = output_entry.file.digest.hash
+                                writer.writerow([label, path, hash])
+                            elif output_entry_type == "directory":
+                                dir_path = output_entry.directory.path
+                                for dir_file in output_entry.directory.files:
+                                    path = dir_path + "/" + dir_file.path
+                                    hash = dir_file.digest.hash
                                     writer.writerow([label, path, hash])
-                                case "directory":
-                                    dir_path = output_entry.directory.path
-                                    for dir_file in output_entry.directory.files:
-                                        path = dir_path + "/" + dir_file.path
-                                        hash = dir_file.digest.hash
-                                        writer.writerow([label, path, hash])
-                                case _:
-                                    raise ValueError(f"Unexpected output entry type: {output_entry_type}")
+                            else:
+                                raise ValueError(f"Unexpected output entry type: {output_entry_type}")
 
 
 if __name__ == "__main__":

From 1759bf64986d34b112e1856405b5c9634c5e9e2e Mon Sep 17 00:00:00 2001
From: Bas van Dijk <bas@dfinity.org>
Date: Mon, 28 Apr 2025 22:50:07 +0000
Subject: [PATCH 10/29] Don't commit spawn.proto

---
 WORKSPACE.bazel                       |   9 +
 bazel/BUILD.bazel                     |  12 +-
 bazel/execution_log_compact_to_csv.py |   7 +-
 bazel/spawn.proto                     | 460 --------------------------
 bazel/spawn_proto_library.bzl         |  32 ++
 5 files changed, 45 insertions(+), 475 deletions(-)
 delete mode 100644 bazel/spawn.proto
 create mode 100644 bazel/spawn_proto_library.bzl

diff --git a/WORKSPACE.bazel b/WORKSPACE.bazel
index 5e6e3ca878e6..339d8c74d3b0 100644
--- a/WORKSPACE.bazel
+++ b/WORKSPACE.bazel
@@ -265,3 +265,12 @@ load("//bazel:idl2json.bzl", "idl_to_json")
 idl_to_json(name = "idl2json")
 
 mainnet_icos_images()
+
+load("//bazel:spawn_proto_library.bzl", "spawn_proto_library")
+
+spawn_proto_library(
+    name = "spawn_proto_library",
+    sha256 = "381bcb109e2855d4055fdc75988cc2144e0a92aa8586298123bb662cdefa6afe",
+    # Make sure the version matches the version of Bazel.
+    url = "https://raw.githubusercontent.com/bazelbuild/bazel/refs/tags/7.6.0/src/main/protobuf/spawn.proto",
+)
diff --git a/bazel/BUILD.bazel b/bazel/BUILD.bazel
index 95fc314a179e..cf35a57244c3 100644
--- a/bazel/BUILD.bazel
+++ b/bazel/BUILD.bazel
@@ -1,22 +1,12 @@
 load("@bazel_skylib//rules:common_settings.bzl", "bool_flag", "string_flag")
 load("@buildifier_prebuilt//:rules.bzl", "buildifier")
-load("@com_google_protobuf//bazel:proto_library.bzl", "proto_library")
 load("@com_google_protobuf//bazel:py_proto_library.bzl", "py_proto_library")
 load("@rules_python//python:py_binary.bzl", "py_binary")
 load("//bazel:defs.bzl", "write_info_file_var")
 
-proto_library(
-    name = "spawn_pb2",
-    srcs = ["spawn.proto"],
-    deps = [
-        "@com_google_protobuf//:duration_proto",
-        "@com_google_protobuf//:timestamp_proto",
-    ],
-)
-
 py_proto_library(
     name = "spawn_py_pb2",
-    deps = [":spawn_pb2"],
+    deps = ["@spawn_proto_library//:spawn_pb2"],
 )
 
 py_binary(
diff --git a/bazel/execution_log_compact_to_csv.py b/bazel/execution_log_compact_to_csv.py
index b05fd0cfffb1..f1bc98e5b4f1 100644
--- a/bazel/execution_log_compact_to_csv.py
+++ b/bazel/execution_log_compact_to_csv.py
@@ -31,8 +31,7 @@
 import sys
 
 import google.protobuf.internal
-
-import bazel.spawn_pb2
+import spawn_pb2
 
 
 def main():
@@ -62,9 +61,9 @@ def main():
             if msg_len is None:
                 break
 
-            # Parse the ExecLogEntry message. See ./spawn.proto for the message definition.
+            # Parse the ExecLogEntry message. See spawn.proto for the message definition.
             msg_buf = execlog_file.read(msg_len)
-            exec_log_entry = bazel.spawn_pb2.ExecLogEntry()
+            exec_log_entry = spawn_pb2.ExecLogEntry()
             exec_log_entry.ParseFromString(msg_buf)
 
             # We intend to log the outputs of Spawns. Spawns refer to their output by ID
diff --git a/bazel/spawn.proto b/bazel/spawn.proto
deleted file mode 100644
index e3b633c5eb70..000000000000
--- a/bazel/spawn.proto
+++ /dev/null
@@ -1,460 +0,0 @@
-// This file was downloaded using:
-//
-//   curl "https://raw.githubusercontent.com/bazelbuild/bazel/refs/tags/7.6.0/src/main/protobuf/spawn.proto" -O
-
-// Copyright 2018 The Bazel Authors. All rights reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//    http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-syntax = "proto3";
-
-package tools.protos;
-
-import "google/protobuf/duration.proto";
-import "google/protobuf/timestamp.proto";
-
-option java_package = "com.google.devtools.build.lib.exec";
-option java_outer_classname = "Protos";
-
-// This file defines the output formats emitted by the --execution_log_* flags.
-// The purpose of the execution log is to enable comparisons of multiple builds
-// to diagnose output differences or more subtle problems such as remote cache
-// misses.
-
-// Digest of a file or action cache entry.
-message Digest {
-  // The content hash as a lowercase hex string including any leading zeroes.
-  string hash = 1;
-
-  // The original content size in bytes.
-  int64 size_bytes = 2;
-
-  // The name of the digest function used to compute the hash.
-  string hash_function_name = 3;
-}
-
-message File {
-  // Path to the file relative to the execution root.
-  string path = 1;
-
-  // Symlink target path.
-  // Only set for unresolved symlinks.
-  string symlink_target_path = 4;
-
-  // File digest.
-  // Always omitted for unresolved symlinks. May be omitted for empty files.
-  Digest digest = 2;
-
-  // Whether the file is a tool.
-  // Only set for inputs, never for outputs.
-  bool is_tool = 3;
-}
-
-// Contents of command environment.
-message EnvironmentVariable {
-  string name = 1;
-  string value = 2;
-}
-
-// Command execution platform. This message needs to be kept in sync
-// with [Platform][google.devtools.remoteexecution.v1test.Platform].
-message Platform {
-  message Property {
-    string name = 1;
-    string value = 2;
-  }
-  repeated Property properties = 1;
-}
-
-// Timing, size, and memory statistics for a SpawnExec.
-message SpawnMetrics {
-  // Total wall time spent running a spawn, measured locally.
-  google.protobuf.Duration total_time = 1;
-  // Time taken to convert the spawn into a network request.
-  google.protobuf.Duration parse_time = 2;
-  // Time spent communicating over the network.
-  google.protobuf.Duration network_time = 3;
-  // Time spent fetching remote outputs.
-  google.protobuf.Duration fetch_time = 4;
-  // Time spent waiting in queues.
-  google.protobuf.Duration queue_time = 5;
-  // Time spent setting up the environment in which the spawn is run.
-  google.protobuf.Duration setup_time = 6;
-  // Time spent uploading outputs to a remote store.
-  google.protobuf.Duration upload_time = 7;
-  // Time spent running the subprocess.
-  google.protobuf.Duration execution_wall_time = 8;
-  // Time spent by the execution framework processing outputs.
-  google.protobuf.Duration process_outputs_time = 9;
-  // Time spent in previous failed attempts, not including queue time.
-  google.protobuf.Duration retry_time = 10;
-  // Total size in bytes of inputs or 0 if unavailable.
-  int64 input_bytes = 11;
-  // Total number of input files or 0 if unavailable.
-  int64 input_files = 12;
-  // Estimated memory usage or 0 if unavailable.
-  int64 memory_estimate_bytes = 13;
-  // Limit of total size of inputs or 0 if unavailable.
-  int64 input_bytes_limit = 14;
-  // Limit of total number of input files or 0 if unavailable.
-  int64 input_files_limit = 15;
-  // Limit of total size of outputs or 0 if unavailable.
-  int64 output_bytes_limit = 16;
-  // Limit of total number of output files or 0 if unavailable.
-  int64 output_files_limit = 17;
-  // Memory limit or 0 if unavailable.
-  int64 memory_bytes_limit = 18;
-  // Time limit or 0 if unavailable.
-  google.protobuf.Duration time_limit = 19;
-  // Instant when the spawn started to execute.
-  google.protobuf.Timestamp start_time = 20;
-}
-
-// Details of an executed spawn.
-// This is the format generated by --execution_log_{binary,json}_file.
-
-// Each message contains an executed command, its full inputs and outputs, and
-// other information. This format is relatively costly to produce and results
-// in very large files, due to the amount of repeated information. The
-// --experimental_execution_log_compact_file format provides a better
-// alternative.
-message SpawnExec {
-  // The command that was run.
-  repeated string command_args = 1;
-
-  // The command environment.
-  repeated EnvironmentVariable environment_variables = 2;
-
-  // The command execution platform.
-  Platform platform = 3;
-
-  // The inputs at the time of the execution.
-  repeated File inputs = 4;
-
-  // All the listed outputs paths. The paths are relative to the execution root.
-  // Actual outputs are a subset of the listed outputs. These paths are sorted.
-  repeated string listed_outputs = 5;
-
-  // Whether the spawn was allowed to run remotely.
-  bool remotable = 6;
-
-  // Whether the spawn was allowed to be cached.
-  bool cacheable = 7;
-
-  // The spawn timeout.
-  int64 timeout_millis = 8;
-
-  // The mnemonic of the action this spawn belongs to.
-  string mnemonic = 10;
-
-  // The outputs generated by the execution.
-  // In order for one of the listed_outputs to appear here, it must have been
-  // produced and have the expected type (file, directory or symlink).
-  repeated File actual_outputs = 11;
-
-  // If the spawn did not hit a disk or remote cache, this will be the name of
-  // the runner, e.g. "remote", "linux-sandbox" or "worker".
-  //
-  // If the spawn hit a disk or remote cache, this will be "disk cache hit" or
-  // "remote cache hit", respectively. This includes the case where a remote
-  // cache was hit while executing the spawn remotely.
-  //
-  // Note that spawns whose owning action hits the persistent action cache
-  // are never reported at all.
-  //
-  // This won't always match the spawn strategy. For the dynamic strategy, it
-  // will be the runner for the first branch to complete. For the remote
-  // strategy, it might be a local runner in case of a fallback.
-  string runner = 12;
-
-  // Whether the spawn hit a disk or remote cache.
-  bool cache_hit = 13;
-
-  // A text status describing an execution error. Empty in case of success.
-  string status = 14;
-
-  // This field contains the contents of SpawnResult.exitCode.
-  // Its semantics varies greatly depending on the status field.
-  // Dependable: if status is empty, exit_code is guaranteed to be zero.
-  int32 exit_code = 15;
-
-  // Whether the spawn was allowed to be cached remotely.
-  bool remote_cacheable = 16;
-
-  // The canonical label of the target this spawn belongs to.
-  string target_label = 18;
-
-  // The action cache digest.
-  // Only available when remote execution, remote cache or disk cache was
-  // enabled for this spawn.
-  Digest digest = 19;
-
-  // Timing, size and memory statistics.
-  SpawnMetrics metrics = 20;
-
-  reserved 9, 17;
-}
-
-// An entry in the compact log format.
-// This is the format generated by --experimental_execution_log_compact_file.
-//
-// Each entry describes either an executed spawn or non-spawn action or a piece
-// of data referenced by other entries. This considerably reduces the runtime
-// overhead and the size of the log when compared to the
-// --execution_log_{binary,json}_file formats.
-//
-// To ensure that the log can be parsed in a single pass, every entry must be
-// serialized after all other entries it references by ID. However, entries
-// aren't guaranteed to be serialized in increasing ID order.
-//
-// Entries other than spawns and non-spawn actions may not be assumed to be
-// canonical. For performance reasons, the same file, directory or input set may
-// be serialized multiple times with a different ID.
-message ExecLogEntry {
-  // Information pertaining to the entire invocation.
-  // May appear at most once in the initial position.
-  message Invocation {
-    // The hash function used to compute digests.
-    string hash_function_name = 1;
-
-    // The name of the subdirectory of the runfiles tree corresponding to the
-    // main repository (also known as the "workspace name").
-    //
-    // With --enable_bzlmod, this is always "_main", but can vary when using
-    // WORKSPACE.
-    string workspace_runfiles_directory = 2;
-
-    // Whether --experimental_sibling_repository_layout is enabled.
-    bool sibling_repository_layout = 3;
-
-    // The ID of the invocation.
-    string id = 4;
-  }
-
-  // An input or output file.
-  message File {
-    // The file path.
-    string path = 1;
-    // A digest of the file contents.
-    // The hash function name is omitted. It can be obtained from Invocation.
-    // May be omitted for empty files.
-    Digest digest = 2;
-  }
-
-  // An input or output directory.
-  // May be a source directory, a fileset tree, or a tree artifact.
-  message Directory {
-    // The directory path.
-    string path = 1;
-    // The contained files, whose paths are relative to the directory.
-    repeated File files = 2;
-  }
-
-  // An unresolved symlink.
-  message UnresolvedSymlink {
-    // The symlink path.
-    string path = 1;
-    // The path the symlink points to.
-    string target_path = 2;
-  }
-
-  // A set of spawn inputs.
-  // The contents of the set are the directly contained entries in addition to
-  // the contents of all transitively referenced sets. When order matters,
-  // transitive sets come before direct entries and within a set, entries are
-  // considered in left-to-right order ("postorder").
-  // Sets are not canonical: two sets with different structure may yield the
-  // same contents.
-  message InputSet {
-    // Entry IDs of files, directories, unresolved symlinks or runfiles trees
-    // belonging to this set.
-    repeated uint32 input_ids = 5;
-    // Entry IDs of other input sets contained in this set.
-    repeated uint32 transitive_set_ids = 4;
-
-    reserved 1, 2, 3;
-  }
-
-  // A collection of runfiles symlinked at custom locations.
-  // The contents of the set are the directly contained entries in addition to
-  // the contents of all transitively referenced sets. When order matters,
-  // transitive sets come before direct entries and within a set, entries are
-  // considered in left-to-right order ("postorder").
-  // Sets are not canonical: two sets with different structure may yield the
-  // same contents.
-  message SymlinkEntrySet {
-    // A map from relative paths of runfiles symlinks to the entry IDs of the
-    // symlink target, which may be a file, directory, or unresolved symlink.
-    map<string, uint32> direct_entries = 1;
-    // Entry IDs of other symlink entry sets transitively contained in this set.
-    repeated uint32 transitive_set_ids = 2;
-  }
-
-  // A structured representation of the .runfiles directory of an executable.
-  //
-  // Instead of storing the directory directly, the tree is represented
-  // similarly to its in-memory representation in Bazel and needs to be
-  // reassembled from the following parts (in case of path collisions, later
-  // entries overwrite earlier ones):
-  //
-  // 1. symlinks (symlinks_id)
-  // 2. artifacts at canonical locations (input_set_id)
-  // 3. empty files (empty_files)
-  // 4. root symlinks (root_symlinks_id)
-  // 5. the _repo_mapping file with the repo mapping manifest
-  // (repo_mapping_manifest)
-  // 6. the <workspace runfiles directory>/.runfile file (if the workspace
-  // runfiles directory
-  //    wouldn't exist otherwise)
-  //
-  // See SpawnLogReconstructor#reconstructRunfilesDir for details.
-  message RunfilesTree {
-    // The runfiles tree path.
-    string path = 1;
-    // The entry ID of the set of artifacts in the runfiles tree that are
-    // symlinked at their canonical locations relative to the tree path.
-    // See SpawnLogReconstructor#getRunfilesPaths for how to recover the
-    // tree-relative paths of the artifacts from their exec paths.
-    //
-    // In case of path collisions, later artifacts overwrite earlier ones and
-    // artifacts override custom symlinks.
-    //
-    // The referenced set must not transitively contain any runfile trees.
-    uint32 input_set_id = 2;
-    // The entry ID of the set of symlink entries with paths relative to the
-    // subdirectory of the runfiles tree root corresponding to the main
-    // repository.
-    uint32 symlinks_id = 3;
-    // The entry ID of the set of symlink entries with paths relative to the
-    // root of the runfiles tree.
-    uint32 root_symlinks_id = 4;
-    // The paths of empty files relative to the subdirectory of the runfiles
-    // tree root corresponding to the main repository.
-    repeated string empty_files = 5;
-    // The "_repo_mapping" file at the root of the runfiles tree, if it exists.
-    // Only the digest is stored as the relative path is fixed.
-    File repo_mapping_manifest = 6;
-    // Whether the runfiles tree contains external runfiles at their legacy
-    // locations (e.g. _main/external/bazel_tools/tools/bash/runfiles.bash)
-    // in addition to the default locations (e.g.
-    // bazel_tools/tools/bash/runfiles.bash).
-    bool legacy_external_runfiles = 7;
-  }
-
-  // A spawn output.
-  message Output {
-    oneof type {
-      // The ID of a file (ctx.actions.declare_file), directory
-      // (ctx.actions.declare_directory) or unresolved symlink
-      // (ctx.actions.declare_symlink) that is an output of the spawn.
-      uint32 output_id = 5;
-      // A declared output that is either missing or has the wrong type
-      // (e.g., a file where a directory was expected).
-      string invalid_output_path = 4;
-    }
-
-    reserved 1, 2, 3;
-  }
-
-  // An executed spawn.
-  message Spawn {
-    // The command line arguments.
-    repeated string args = 1;
-
-    // The environment variables.
-    repeated EnvironmentVariable env_vars = 2;
-
-    // The execution platform.
-    Platform platform = 3;
-
-    // Entry ID of the set of inputs. Unset means empty.
-    uint32 input_set_id = 4;
-
-    // Entry ID of the set of tool inputs. Unset means empty.
-    uint32 tool_set_id = 5;
-
-    // The set of outputs.
-    repeated Output outputs = 6;
-
-    // See SpawnExec.label.
-    string target_label = 7;
-
-    // See SpawnExec.mnemonic.
-    string mnemonic = 8;
-
-    // See SpawnExec.exit_code.
-    int32 exit_code = 9;
-
-    // See SpawnExec.status.
-    string status = 10;
-
-    // See SpawnExec.runner.
-    string runner = 11;
-
-    // See SpawnExec.cache_hit.
-    bool cache_hit = 12;
-
-    // See SpawnExec.remotable.
-    bool remotable = 13;
-
-    // See SpawnExec.cacheable.
-    bool cacheable = 14;
-
-    // See SpawnExec.remote_cacheable.
-    bool remote_cacheable = 15;
-
-    // See SpawnExec.digest.
-    // The hash function name is omitted. It can be obtained from Invocation.
-    // Unset if the file is empty.
-    Digest digest = 16;
-
-    // See SpawnExec.timeout_millis.
-    int64 timeout_millis = 17;
-
-    // See SpawnExec.metrics.
-    SpawnMetrics metrics = 18;
-  }
-
-  // A symlink action, which is not backed by a spawn.
-  message SymlinkAction {
-    // The path of the input file of the action (i.e., the target of the
-    // symlink).
-    string input_path = 1;
-
-    // The path of the output file of the action (i.e., the symlink itself).
-    string output_path = 2;
-
-    // The canonical label of the target this action belongs to.
-    string target_label = 3;
-
-    // The mnemonic of the action.
-    string mnemonic = 4;
-  }
-
-  // If nonzero, then this entry may be referenced by later entries by this ID.
-  // Nonzero IDs are unique within an execution log, but may not be contiguous.
-  uint32 id = 1;
-
-  // The entry payload.
-  oneof type {
-    Invocation invocation = 2;
-    File file = 3;
-    Directory directory = 4;
-    UnresolvedSymlink unresolved_symlink = 5;
-    InputSet input_set = 6;
-    Spawn spawn = 7;
-    SymlinkAction symlink_action = 8;
-    SymlinkEntrySet symlink_entry_set = 9;
-    RunfilesTree runfiles_tree = 10;
-  }
-}
diff --git a/bazel/spawn_proto_library.bzl b/bazel/spawn_proto_library.bzl
new file mode 100644
index 000000000000..3243235e531f
--- /dev/null
+++ b/bazel/spawn_proto_library.bzl
@@ -0,0 +1,32 @@
+def _spawn_proto_library_impl(ctx):
+    dest = ctx.path("spawn.proto")
+
+    # Download the file
+    ctx.download(
+        url = ctx.attr.url,
+        output = dest.basename,
+        sha256 = ctx.attr.sha256,
+    )
+
+    ctx.file("BUILD.bazel", """
+load("@com_google_protobuf//bazel:proto_library.bzl", "proto_library")
+
+package(default_visibility = ["//visibility:public"])
+
+proto_library(
+    name = "spawn_pb2",
+    srcs = ["spawn.proto"],
+    deps = [
+        "@com_google_protobuf//:duration_proto",
+        "@com_google_protobuf//:timestamp_proto",
+    ],
+)
+    """)
+
+spawn_proto_library = repository_rule(
+    implementation = _spawn_proto_library_impl,
+    attrs = {
+        "url": attr.string(mandatory = True),
+        "sha256": attr.string(mandatory = True),
+    },
+)

From d09082c3c9cc2dcc26dfd61a501ba0f0833502e5 Mon Sep 17 00:00:00 2001
From: Bas van Dijk <bas@dfinity.org>
Date: Tue, 29 Apr 2025 05:56:19 +0000
Subject: [PATCH 11/29] fix //bazel:buildifier_test

---
 bazel/spawn_proto_library.bzl | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/bazel/spawn_proto_library.bzl b/bazel/spawn_proto_library.bzl
index 3243235e531f..9da282a1c694 100644
--- a/bazel/spawn_proto_library.bzl
+++ b/bazel/spawn_proto_library.bzl
@@ -1,3 +1,7 @@
+"""
+This module fetches the spawn.proto file from the bazel source code and turns it into a proto_library target.
+"""
+
 def _spawn_proto_library_impl(ctx):
     dest = ctx.path("spawn.proto")
 

From cf978aca17db24399a93941f5a1a09832f3640a8 Mon Sep 17 00:00:00 2001
From: Bas van Dijk <bas@dfinity.org>
Date: Tue, 29 Apr 2025 05:58:08 +0000
Subject: [PATCH 12/29] pop the output entry from the id_to_entry dict to
 preserve memory

---
 bazel/execution_log_compact_to_csv.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bazel/execution_log_compact_to_csv.py b/bazel/execution_log_compact_to_csv.py
index f1bc98e5b4f1..7fae1d97429f 100644
--- a/bazel/execution_log_compact_to_csv.py
+++ b/bazel/execution_log_compact_to_csv.py
@@ -80,7 +80,7 @@ def main():
                     for output in exec_log_entry.spawn.outputs:
                         output_type = output.WhichOneof("type")
                         if output_type == "output_id":
-                            output_entry = id_to_entry[output.output_id]
+                            output_entry = id_to_entry.pop(output.output_id)
                             output_entry_type = output_entry.WhichOneof("type")
                             if output_entry_type == "file":
                                 path = output_entry.file.path

From 56c6bddd6aa1fae869ddb9b83e9708a99a062e91 Mon Sep 17 00:00:00 2001
From: Bas van Dijk <bas@dfinity.org>
Date: Tue, 29 Apr 2025 06:04:10 +0000
Subject: [PATCH 13/29] Only build execution_log_compact_to_csv if necessary

---
 .github/actions/bazel/action.yaml | 29 ++++++++++++++++-------------
 1 file changed, 16 insertions(+), 13 deletions(-)

diff --git a/.github/actions/bazel/action.yaml b/.github/actions/bazel/action.yaml
index 844e807d221c..15afef9a436d 100644
--- a/.github/actions/bazel/action.yaml
+++ b/.github/actions/bazel/action.yaml
@@ -81,26 +81,29 @@ runs:
         BUILDBUDDY_LINKS: '[CI Job](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})'
       run: |
         set -euo pipefail
+        if [ -x bazel-bin/bazel/execution_log_compact_to_csv ]; then
+          echo "bazel-bin/bazel/execution_log_compact_to_csv already exists, skipping build"
+        else
+          # Here we overwrite the PATH with our custom bazel wrapper to ensure
+          # the specified commands are run with the CI-specific options included
+          # in the wrapper.
+          export BAZEL_ACTION_OLDPATH="$PATH"
+          # github.action_path doesn't seem to work
+          PATH="$PWD/.github/actions/bazel/bin:$BAZEL_ACTION_OLDPATH"
+          hash -r
 
-        # Here we overwrite the PATH with our custom bazel wrapper to ensure
-        # the specified commands are run with the CI-specific options included
-        # in the wrapper.
-        export BAZEL_ACTION_OLDPATH="$PATH"
-        # github.action_path doesn't seem to work
-        PATH="$PWD/.github/actions/bazel/bin:$BAZEL_ACTION_OLDPATH"
-        hash -r
-
-        # Used by the bazel wrapper
-        export BAZEL_ACTION_METRICS_OUT='${{ steps.metrics-tmpdir.outputs.dir }}'
+          # Used by the bazel wrapper
+          export BAZEL_ACTION_METRICS_OUT='${{ steps.metrics-tmpdir.outputs.dir }}'
 
-        bazel build --config=ci //bazel:execution_log_compact_to_csv
+          bazel build --config=ci //bazel:execution_log_compact_to_csv
+        fi
 
     - name: Convert execlogs to CSV
       shell: bash
       if: (success() || failure()) && inputs.execlogs-artifact-name != ''
       run: |
-        for execlog in $(find '${{ steps.metrics-tmpdir.outputs.dir }}' -name 'execlog-*.zst'); do
-          zstd -f -d $execlog -o execlog
+        for execlog in "$(find '${{ steps.metrics-tmpdir.outputs.dir }}' -name 'execlog-*.zst')"; do
+          zstd -f -d "$execlog" -o execlog
           bazel-bin/bazel/execution_log_compact_to_csv \
             --input_execlog=execlog \
             --whitelist_pat='^//'

From bc7316c1927ec1afafad94c6e0f78fa444b88e4e Mon Sep 17 00:00:00 2001
From: Bas van Dijk <bas@dfinity.org>
Date: Tue, 29 Apr 2025 06:15:13 +0000
Subject: [PATCH 14/29] Always fetch the right spawn.proto corresponding to the
 active bazel version

---
 WORKSPACE.bazel               | 3 ---
 bazel/spawn_proto_library.bzl | 8 ++------
 2 files changed, 2 insertions(+), 9 deletions(-)

diff --git a/WORKSPACE.bazel b/WORKSPACE.bazel
index 339d8c74d3b0..a3160ce3667c 100644
--- a/WORKSPACE.bazel
+++ b/WORKSPACE.bazel
@@ -270,7 +270,4 @@ load("//bazel:spawn_proto_library.bzl", "spawn_proto_library")
 
 spawn_proto_library(
     name = "spawn_proto_library",
-    sha256 = "381bcb109e2855d4055fdc75988cc2144e0a92aa8586298123bb662cdefa6afe",
-    # Make sure the version matches the version of Bazel.
-    url = "https://raw.githubusercontent.com/bazelbuild/bazel/refs/tags/7.6.0/src/main/protobuf/spawn.proto",
 )
diff --git a/bazel/spawn_proto_library.bzl b/bazel/spawn_proto_library.bzl
index 9da282a1c694..5497ab7c9a46 100644
--- a/bazel/spawn_proto_library.bzl
+++ b/bazel/spawn_proto_library.bzl
@@ -7,9 +7,9 @@ def _spawn_proto_library_impl(ctx):
 
     # Download the file
     ctx.download(
-        url = ctx.attr.url,
+        url = "https://raw.githubusercontent.com/bazelbuild/bazel/refs/tags/{bazel_version}/src/main/protobuf/spawn.proto".format(bazel_version = native.bazel_version),
         output = dest.basename,
-        sha256 = ctx.attr.sha256,
+        sha256 = "381bcb109e2855d4055fdc75988cc2144e0a92aa8586298123bb662cdefa6afe",
     )
 
     ctx.file("BUILD.bazel", """
@@ -29,8 +29,4 @@ proto_library(
 
 spawn_proto_library = repository_rule(
     implementation = _spawn_proto_library_impl,
-    attrs = {
-        "url": attr.string(mandatory = True),
-        "sha256": attr.string(mandatory = True),
-    },
 )

From 64b3593a96becaa3ac8d7a0d063e8f55948f9f99 Mon Sep 17 00:00:00 2001
From: Bas van Dijk <bas@dfinity.org>
Date: Tue, 29 Apr 2025 06:20:02 +0000
Subject: [PATCH 15/29] simplification

---
 bazel/spawn_proto_library.bzl | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/bazel/spawn_proto_library.bzl b/bazel/spawn_proto_library.bzl
index 5497ab7c9a46..69ce1e33624a 100644
--- a/bazel/spawn_proto_library.bzl
+++ b/bazel/spawn_proto_library.bzl
@@ -3,12 +3,9 @@ This module fetches the spawn.proto file from the bazel source code and turns it
 """
 
 def _spawn_proto_library_impl(ctx):
-    dest = ctx.path("spawn.proto")
-
-    # Download the file
     ctx.download(
         url = "https://raw.githubusercontent.com/bazelbuild/bazel/refs/tags/{bazel_version}/src/main/protobuf/spawn.proto".format(bazel_version = native.bazel_version),
-        output = dest.basename,
+        output = "spawn.proto",
         sha256 = "381bcb109e2855d4055fdc75988cc2144e0a92aa8586298123bb662cdefa6afe",
     )
 

From 87d3b65699549f857f847b0ad5971db85834fb81 Mon Sep 17 00:00:00 2001
From: Bas van Dijk <bas@dfinity.org>
Date: Tue, 29 Apr 2025 07:07:59 +0000
Subject: [PATCH 16/29] add --verbose

---
 .github/actions/bazel/action.yaml     | 3 ++-
 bazel/execution_log_compact_to_csv.py | 8 ++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/actions/bazel/action.yaml b/.github/actions/bazel/action.yaml
index 15afef9a436d..07103fd894fc 100644
--- a/.github/actions/bazel/action.yaml
+++ b/.github/actions/bazel/action.yaml
@@ -102,9 +102,10 @@ runs:
       shell: bash
       if: (success() || failure()) && inputs.execlogs-artifact-name != ''
       run: |
-        for execlog in "$(find '${{ steps.metrics-tmpdir.outputs.dir }}' -name 'execlog-*.zst')"; do
+        for execlog in $(find '${{ steps.metrics-tmpdir.outputs.dir }}' -name 'execlog-*.zst'); do
           zstd -f -d "$execlog" -o execlog
           bazel-bin/bazel/execution_log_compact_to_csv \
+            --verbose \
             --input_execlog=execlog \
             --whitelist_pat='^//'
         done > '${{ steps.metrics-tmpdir.outputs.dir }}/execlogs.csv'
diff --git a/bazel/execution_log_compact_to_csv.py b/bazel/execution_log_compact_to_csv.py
index 7fae1d97429f..b9895ff6f916 100644
--- a/bazel/execution_log_compact_to_csv.py
+++ b/bazel/execution_log_compact_to_csv.py
@@ -48,6 +48,11 @@ def main():
         default=None,
         help="Regex to match target labels to include in the CSV. If omitted, all targets are included.",
     )
+    parser.add_argument(
+        "--verbose",
+        default=None,
+        help="Log every ExecLogEntry to stderr. This is useful for debugging.",
+    )
     args = parser.parse_args()
 
     id_to_entry = {}
@@ -66,6 +71,9 @@ def main():
             exec_log_entry = spawn_pb2.ExecLogEntry()
             exec_log_entry.ParseFromString(msg_buf)
 
+            if args.verbose:
+                print(exec_log_entry, file=sys.stderr)
+
             # We intend to log the outputs of Spawns. Spawns refer to their output by ID
             # so we need to keep track of the ID to entry mapping. Important note:
             # if an entry (like a Spawn) refers to another entry (like a File or Direcory)

From ae38e5e7c69f64a765ff91630ddab63360944542 Mon Sep 17 00:00:00 2001
From: Bas van Dijk <bas@dfinity.org>
Date: Tue, 29 Apr 2025 07:24:01 +0000
Subject: [PATCH 17/29] fix

---
 bazel/execution_log_compact_to_csv.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bazel/execution_log_compact_to_csv.py b/bazel/execution_log_compact_to_csv.py
index b9895ff6f916..658e8eedd37d 100644
--- a/bazel/execution_log_compact_to_csv.py
+++ b/bazel/execution_log_compact_to_csv.py
@@ -50,7 +50,7 @@ def main():
     )
     parser.add_argument(
         "--verbose",
-        default=None,
+        action='store_true',
         help="Log every ExecLogEntry to stderr. This is useful for debugging.",
     )
     args = parser.parse_args()

From 20eb81ff237d5637a8727c86c59824a8d1494eca Mon Sep 17 00:00:00 2001
From: Bas van Dijk <bas@dfinity.org>
Date: Tue, 29 Apr 2025 08:19:10 +0000
Subject: [PATCH 18/29] don't use --verbose

---
 .github/actions/bazel/action.yaml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/actions/bazel/action.yaml b/.github/actions/bazel/action.yaml
index 07103fd894fc..b0a0ee24b11c 100644
--- a/.github/actions/bazel/action.yaml
+++ b/.github/actions/bazel/action.yaml
@@ -105,7 +105,6 @@ runs:
         for execlog in $(find '${{ steps.metrics-tmpdir.outputs.dir }}' -name 'execlog-*.zst'); do
           zstd -f -d "$execlog" -o execlog
           bazel-bin/bazel/execution_log_compact_to_csv \
-            --verbose \
             --input_execlog=execlog \
             --whitelist_pat='^//'
         done > '${{ steps.metrics-tmpdir.outputs.dir }}/execlogs.csv'

From 7380d21d2e06c291079b4e9ff1cb1e6686bf8a31 Mon Sep 17 00:00:00 2001
From: Bas van Dijk <bas@dfinity.org>
Date: Tue, 29 Apr 2025 08:50:26 +0000
Subject: [PATCH 19/29] don't pop entries from id_to_entry because that causes
 issues

---
 bazel/execution_log_compact_to_csv.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bazel/execution_log_compact_to_csv.py b/bazel/execution_log_compact_to_csv.py
index 658e8eedd37d..19a90649df72 100644
--- a/bazel/execution_log_compact_to_csv.py
+++ b/bazel/execution_log_compact_to_csv.py
@@ -88,7 +88,7 @@ def main():
                     for output in exec_log_entry.spawn.outputs:
                         output_type = output.WhichOneof("type")
                         if output_type == "output_id":
-                            output_entry = id_to_entry.pop(output.output_id)
+                            output_entry = id_to_entry[output.output_id]
                             output_entry_type = output_entry.WhichOneof("type")
                             if output_entry_type == "file":
                                 path = output_entry.file.path

From 3dd5da0fb39c54463acd199c2207a486860431ea Mon Sep 17 00:00:00 2001
From: Bas van Dijk <bas@dfinity.org>
Date: Tue, 29 Apr 2025 08:52:44 +0000
Subject: [PATCH 20/29] fmt

---
 bazel/BUILD.bazel | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/bazel/BUILD.bazel b/bazel/BUILD.bazel
index cf35a57244c3..310f14c95098 100644
--- a/bazel/BUILD.bazel
+++ b/bazel/BUILD.bazel
@@ -11,12 +11,8 @@ py_proto_library(
 
 py_binary(
     name = "execution_log_compact_to_csv",
-    srcs = [
-        "execution_log_compact_to_csv.py",
-    ],
-    deps = [
-        ":spawn_py_pb2",
-    ],
+    srcs = ["execution_log_compact_to_csv.py"],
+    deps = [":spawn_py_pb2"],
 )
 
 bool_flag(

From 0f617680699da1528f86e5a4b691f6fe7a305ae2 Mon Sep 17 00:00:00 2001
From: Bas van Dijk <bas@dfinity.org>
Date: Tue, 29 Apr 2025 08:53:45 +0000
Subject: [PATCH 21/29] fmt

---
 WORKSPACE.bazel | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/WORKSPACE.bazel b/WORKSPACE.bazel
index a3160ce3667c..c45fc0ef78ae 100644
--- a/WORKSPACE.bazel
+++ b/WORKSPACE.bazel
@@ -268,6 +268,4 @@ mainnet_icos_images()
 
 load("//bazel:spawn_proto_library.bzl", "spawn_proto_library")
 
-spawn_proto_library(
-    name = "spawn_proto_library",
-)
+spawn_proto_library(name = "spawn_proto_library")

From cc054eba8f4eedf1f552456258a3ba1116b35562 Mon Sep 17 00:00:00 2001
From: Bas van Dijk <bas@dfinity.org>
Date: Tue, 29 Apr 2025 08:54:51 +0000
Subject: [PATCH 22/29] fmt

---
 bazel/spawn_proto_library.bzl | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/bazel/spawn_proto_library.bzl b/bazel/spawn_proto_library.bzl
index 69ce1e33624a..8d406d5100d2 100644
--- a/bazel/spawn_proto_library.bzl
+++ b/bazel/spawn_proto_library.bzl
@@ -24,6 +24,4 @@ proto_library(
 )
     """)
 
-spawn_proto_library = repository_rule(
-    implementation = _spawn_proto_library_impl,
-)
+spawn_proto_library = repository_rule(implementation = _spawn_proto_library_impl)

From 4af311642595119bb1f18a9cc8f29e6b9a7631de Mon Sep 17 00:00:00 2001
From: Bas van Dijk <bas@dfinity.org>
Date: Tue, 29 Apr 2025 09:26:48 +0000
Subject: [PATCH 23/29] bazel run //:ruff-format

---
 bazel/execution_log_compact_to_csv.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bazel/execution_log_compact_to_csv.py b/bazel/execution_log_compact_to_csv.py
index 19a90649df72..347d3325a592 100644
--- a/bazel/execution_log_compact_to_csv.py
+++ b/bazel/execution_log_compact_to_csv.py
@@ -50,7 +50,7 @@ def main():
     )
     parser.add_argument(
         "--verbose",
-        action='store_true',
+        action="store_true",
         help="Log every ExecLogEntry to stderr. This is useful for debugging.",
     )
     args = parser.parse_args()

From dbe2af236ff29b9b9390efd3eea168b5e9a69721 Mon Sep 17 00:00:00 2001
From: Bas van Dijk <bas@dfinity.org>
Date: Tue, 29 Apr 2025 09:59:52 +0000
Subject: [PATCH 24/29] apply review suggestions

---
 bazel/execution_log_compact_to_csv.py | 49 ++++++++++++++-------------
 bazel/spawn_proto_library.bzl         |  3 +-
 2 files changed, 27 insertions(+), 25 deletions(-)

diff --git a/bazel/execution_log_compact_to_csv.py b/bazel/execution_log_compact_to_csv.py
index 347d3325a592..72ace506ff28 100644
--- a/bazel/execution_log_compact_to_csv.py
+++ b/bazel/execution_log_compact_to_csv.py
@@ -55,6 +55,10 @@ def main():
     )
     args = parser.parse_args()
 
+    # We intend to log the outputs of Spawns. Spawns refer to their output by ID
+    # so we need to keep track of the ID to entry mapping. Important note:
+    # if an entry (like a Spawn) refers to another entry (like a File or Directory)
+    # it's guaranteed the latter will precede the former.
     id_to_entry = {}
 
     with open(args.input_execlog, "rb") as execlog_file, sys.stdout as csv_file:
@@ -74,34 +78,31 @@ def main():
             if args.verbose:
                 print(exec_log_entry, file=sys.stderr)
 
-            # We intend to log the outputs of Spawns. Spawns refer to their output by ID
-            # so we need to keep track of the ID to entry mapping. Important note:
-            # if an entry (like a Spawn) refers to another entry (like a File or Direcory)
-            # it's guaranteed the latter will precede the former.
             entry_type = exec_log_entry.WhichOneof("type")
             if entry_type in ["file", "directory"]:
                 id_to_entry[exec_log_entry.id] = exec_log_entry
-
-            if entry_type == "spawn":
+            elif entry_type == "spawn":
                 label = exec_log_entry.spawn.target_label
-                if args.whitelist_pat is None or re.match(args.whitelist_pat, label):
-                    for output in exec_log_entry.spawn.outputs:
-                        output_type = output.WhichOneof("type")
-                        if output_type == "output_id":
-                            output_entry = id_to_entry[output.output_id]
-                            output_entry_type = output_entry.WhichOneof("type")
-                            if output_entry_type == "file":
-                                path = output_entry.file.path
-                                hash = output_entry.file.digest.hash
-                                writer.writerow([label, path, hash])
-                            elif output_entry_type == "directory":
-                                dir_path = output_entry.directory.path
-                                for dir_file in output_entry.directory.files:
-                                    path = dir_path + "/" + dir_file.path
-                                    hash = dir_file.digest.hash
-                                    writer.writerow([label, path, hash])
-                            else:
-                                raise ValueError(f"Unexpected output entry type: {output_entry_type}")
+                if args.whitelist_pat is not None and not re.match(args.whitelist_pat, label):
+                    continue
+                for output in exec_log_entry.spawn.outputs:
+                    output_type = output.WhichOneof("type")
+                    if output_type != "output_id":
+                        continue
+                    output_entry = id_to_entry[output.output_id]
+                    output_entry_type = output_entry.WhichOneof("type")
+                    if output_entry_type == "file":
+                        path = output_entry.file.path
+                        hash = output_entry.file.digest.hash
+                        writer.writerow([label, path, hash])
+                    elif output_entry_type == "directory":
+                        dir_path = output_entry.directory.path
+                        for dir_file in output_entry.directory.files:
+                            path = dir_path + "/" + dir_file.path
+                            hash = dir_file.digest.hash
+                            writer.writerow([label, path, hash])
+                    else:
+                        raise ValueError(f"Unexpected output entry type: {output_entry_type}")
 
 
 if __name__ == "__main__":
diff --git a/bazel/spawn_proto_library.bzl b/bazel/spawn_proto_library.bzl
index 8d406d5100d2..e326fc2f1f2c 100644
--- a/bazel/spawn_proto_library.bzl
+++ b/bazel/spawn_proto_library.bzl
@@ -4,7 +4,8 @@ This module fetches the spawn.proto file from the bazel source code and turns it
 
 def _spawn_proto_library_impl(ctx):
     ctx.download(
-        url = "https://raw.githubusercontent.com/bazelbuild/bazel/refs/tags/{bazel_version}/src/main/protobuf/spawn.proto".format(bazel_version = native.bazel_version),
+        # We assume the ExecLogEntry proto message is forward compatible such that we can use the spawn.proto from bazel-7.6.0 even after upgrading bazel.
+        url = "https://raw.githubusercontent.com/bazelbuild/bazel/refs/tags/7.6.0/src/main/protobuf/spawn.proto",
         output = "spawn.proto",
         sha256 = "381bcb109e2855d4055fdc75988cc2144e0a92aa8586298123bb662cdefa6afe",
     )

From f0c020510d172cdd96a5e627bcd2e1010e155f9a Mon Sep 17 00:00:00 2001
From: Bas van Dijk <bas@dfinity.org>
Date: Tue, 29 Apr 2025 10:59:23 +0000
Subject: [PATCH 25/29] use bazel run

---
 .github/actions/bazel/action.yaml | 30 +++---------------------------
 1 file changed, 3 insertions(+), 27 deletions(-)

diff --git a/.github/actions/bazel/action.yaml b/.github/actions/bazel/action.yaml
index b0a0ee24b11c..590bacbf2b1a 100644
--- a/.github/actions/bazel/action.yaml
+++ b/.github/actions/bazel/action.yaml
@@ -73,39 +73,15 @@ runs:
           ${{ steps.metrics-tmpdir.outputs.dir }}/bazel-bep-*.pb.gpg
           ${{ steps.metrics-tmpdir.outputs.dir }}/profile-*.json
 
-    - name: Build execution_log_compact_to_csv
-      shell: bash
-      if: (success() || failure()) && inputs.execlogs-artifact-name != ''
-      env:
-        # Used by the bazel wrapper
-        BUILDBUDDY_LINKS: '[CI Job](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})'
-      run: |
-        set -euo pipefail
-        if [ -x bazel-bin/bazel/execution_log_compact_to_csv ]; then
-          echo "bazel-bin/bazel/execution_log_compact_to_csv already exists, skipping build"
-        else
-          # Here we overwrite the PATH with our custom bazel wrapper to ensure
-          # the specified commands are run with the CI-specific options included
-          # in the wrapper.
-          export BAZEL_ACTION_OLDPATH="$PATH"
-          # github.action_path doesn't seem to work
-          PATH="$PWD/.github/actions/bazel/bin:$BAZEL_ACTION_OLDPATH"
-          hash -r
-
-          # Used by the bazel wrapper
-          export BAZEL_ACTION_METRICS_OUT='${{ steps.metrics-tmpdir.outputs.dir }}'
-
-          bazel build --config=ci //bazel:execution_log_compact_to_csv
-        fi
-
     - name: Convert execlogs to CSV
       shell: bash
       if: (success() || failure()) && inputs.execlogs-artifact-name != ''
       run: |
         for execlog in $(find '${{ steps.metrics-tmpdir.outputs.dir }}' -name 'execlog-*.zst'); do
           zstd -f -d "$execlog" -o execlog
-          bazel-bin/bazel/execution_log_compact_to_csv \
-            --input_execlog=execlog \
+          bazel run //bazel:execution_log_compact_to_csv \
+            $([[ "$(uname)" == "Linux" ]] && echo '--repository_cache=/cache/bazel') -- \
+            --input_execlog="$PWD/execlog" \
             --whitelist_pat='^//'
         done > '${{ steps.metrics-tmpdir.outputs.dir }}/execlogs.csv'
         rm -f execlog

From 8b3980a26fb2d1457b833a2375fcde4063dc0398 Mon Sep 17 00:00:00 2001
From: Bas van Dijk <bas@dfinity.org>
Date: Tue, 29 Apr 2025 11:08:53 +0000
Subject: [PATCH 26/29] refactor

---
 bazel/execution_log_compact_to_csv.py | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/bazel/execution_log_compact_to_csv.py b/bazel/execution_log_compact_to_csv.py
index 72ace506ff28..4f1e6c2d4490 100644
--- a/bazel/execution_log_compact_to_csv.py
+++ b/bazel/execution_log_compact_to_csv.py
@@ -92,15 +92,11 @@ def main():
                     output_entry = id_to_entry[output.output_id]
                     output_entry_type = output_entry.WhichOneof("type")
                     if output_entry_type == "file":
-                        path = output_entry.file.path
-                        hash = output_entry.file.digest.hash
-                        writer.writerow([label, path, hash])
+                        writer.writerow([label, output_entry.file.path, output_entry.file.digest.hash])
                     elif output_entry_type == "directory":
                         dir_path = output_entry.directory.path
                         for dir_file in output_entry.directory.files:
-                            path = dir_path + "/" + dir_file.path
-                            hash = dir_file.digest.hash
-                            writer.writerow([label, path, hash])
+                            writer.writerow([label, dir_path + "/" + dir_file.path, dir_file.digest.hash])
                     else:
                         raise ValueError(f"Unexpected output entry type: {output_entry_type}")
 

From 8a69656eae428076215a0b8d1a9fdefa350007a9 Mon Sep 17 00:00:00 2001
From: Bas van Dijk <bas@dfinity.org>
Date: Tue, 29 Apr 2025 12:00:02 +0000
Subject: [PATCH 27/29] include link to spawn.proto

---
 bazel/execution_log_compact_to_csv.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/bazel/execution_log_compact_to_csv.py b/bazel/execution_log_compact_to_csv.py
index 4f1e6c2d4490..05c711da4e5d 100644
--- a/bazel/execution_log_compact_to_csv.py
+++ b/bazel/execution_log_compact_to_csv.py
@@ -70,7 +70,8 @@ def main():
             if msg_len is None:
                 break
 
-            # Parse the ExecLogEntry message. See spawn.proto for the message definition.
+            # Parse the ExecLogEntry message. For the message definition see:
+            # https://github.com/bazelbuild/bazel/blob/master/src/main/protobuf/spawn.proto.
             msg_buf = execlog_file.read(msg_len)
             exec_log_entry = spawn_pb2.ExecLogEntry()
             exec_log_entry.ParseFromString(msg_buf)

From fa73dceefb250e64880afff921ab3023031c8779 Mon Sep 17 00:00:00 2001
From: Bas van Dijk <bas@dfinity.org>
Date: Tue, 29 Apr 2025 12:44:40 +0000
Subject: [PATCH 28/29] Use mktemp for the decompressed execlog

---
 .github/actions/bazel/action.yaml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/actions/bazel/action.yaml b/.github/actions/bazel/action.yaml
index be14e0eda599..c0b88024bba8 100644
--- a/.github/actions/bazel/action.yaml
+++ b/.github/actions/bazel/action.yaml
@@ -77,14 +77,15 @@ runs:
       shell: bash
       if: (success() || failure()) && inputs.execlogs-artifact-name != ''
       run: |
+        execlog="$(mktemp)"
+        trap "rm -f $execlog" INT TERM EXIT
         for execlog in $(find '${{ steps.metrics-tmpdir.outputs.dir }}' -name 'execlog-*.zst'); do
-          zstd -f -d "$execlog" -o execlog
+          zstd -f -d "$execlog" -o "$execlog"
           bazel run //bazel:execution_log_compact_to_csv \
             $([[ "$(uname)" == "Linux" ]] && echo '--repository_cache=/cache/bazel') -- \
-            --input_execlog="$PWD/execlog" \
+            --input_execlog="$execlog" \
             --whitelist_pat='^//'
         done > '${{ steps.metrics-tmpdir.outputs.dir }}/execlogs.csv'
-        rm -f execlog
 
     - name: Upload execution log
       if: (success() || failure()) && inputs.execlogs-artifact-name != ''

From 1a7726dd6476c2934fefe2fa49b4b4af6c05ad39 Mon Sep 17 00:00:00 2001
From: Bas van Dijk <bas@dfinity.org>
Date: Tue, 29 Apr 2025 12:57:02 +0000
Subject: [PATCH 29/29] fix

---
 .github/actions/bazel/action.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/actions/bazel/action.yaml b/.github/actions/bazel/action.yaml
index c0b88024bba8..3234a19a97ca 100644
--- a/.github/actions/bazel/action.yaml
+++ b/.github/actions/bazel/action.yaml
@@ -79,8 +79,8 @@ runs:
       run: |
         execlog="$(mktemp)"
         trap "rm -f $execlog" INT TERM EXIT
-        for execlog in $(find '${{ steps.metrics-tmpdir.outputs.dir }}' -name 'execlog-*.zst'); do
-          zstd -f -d "$execlog" -o "$execlog"
+        for execlog_zst in $(find '${{ steps.metrics-tmpdir.outputs.dir }}' -name 'execlog-*.zst'); do
+          zstd -f -d "$execlog_zst" -o "$execlog"
           bazel run //bazel:execution_log_compact_to_csv \
             $([[ "$(uname)" == "Linux" ]] && echo '--repository_cache=/cache/bazel') -- \
             --input_execlog="$execlog" \