feat(bazel): migrate build system to Bazel with full CI

.bazelrc

@@ -0,0 +1,56 @@
+# SteleKit .bazelrc
+# All Bazel flags for local and CI builds.
+#
+# Machine-specific overrides (ANDROID_HOME path, extra tool paths, etc.) go in
+# .bazelrc.user — that file is gitignored and imported below.  Copy
+# .bazelrc.user.example to .bazelrc.user and edit for your machine.
+try-import %workspace%/.bazelrc.user
+
+# ── Bazel server JVM heap ─────────────────────────────────────────────────────
+# Caps the Bazel server at 6 GB so Maven resolution doesn't OOM the host.
+# Coursier's transitive graph for Compose+AndroidX is large; capping forces GC
+# before the machine swaps out.  Increase to -Xmx8g on 32 GB machines.
+startup --host_jvm_args=-Xmx6g
+
+# ── JVM toolchain ─────────────────────────────────────────────────────────────
+build --java_runtime_version=21
+build --tool_java_runtime_version=21
+
+# ── Android SDK ───────────────────────────────────────────────────────────────
+# android_sdk_repository_extension runs at repo-loading time (before config
+# flags), so ANDROID_HOME must be a global repo_env, not scoped to :android.
+# The value is supplied by .bazelrc.user locally and by the CI environment on
+# GitHub Actions (android-actions/setup-android sets ANDROID_HOME).
+build --repo_env=ANDROID_HOME
+
+# --android_sdk and the toolchain flag are kept in :android so that JVM-only
+# targets (business_tests, desktop_app) do not trigger Android toolchain
+# resolution.  Pass --config=android when building Android targets.
+build:android --android_sdk=@androidsdk//:sdk
+
+# ── Correctness / hermetic sandbox ────────────────────────────────────────────
+build --sandbox_default_allow_network=false
+build --incompatible_strict_action_env
+
+# ── X11 socket access for Compose Desktop tests ───────────────────────────────
+# Compose Desktop tests require an X display.  The Linux sandbox creates a new
+# mount namespace and does not include /tmp/.X11-unix by default, so the X11
+# socket (DISPLAY=:N → /tmp/.X11-unix/XN) is inaccessible even when DISPLAY is
+# inherited.  Mount the X11 socket directory into every test sandbox.
+# Locally: use whatever X server is running.
+# CI: xvfb-run --auto-servernum creates the socket before bazel runs.
+test --sandbox_add_mount_pair=/tmp/.X11-unix
+
+# ── CI caching ────────────────────────────────────────────────────────────────
+# Bazel caching in CI is handled entirely by bazel-contrib/setup-bazel@0.19.0
+# (disk-cache, repository-cache, external-cache inputs) which uses GitHub Actions
+# native cache — no third-party service required.  See .github/workflows/bazel-ci.yml.
+
+# ── Remote HTTP cache (bazel-cache-proxy) ─────────────────────────────────────
+# Enable with --config=remote-cache.  CI starts bazel-cache-proxy on port 9090
+# backed by the GHA cache API; all jobs on the same PR share the cache.
+# PRs write to their own scoped namespace so main's cache is never polluted.
+# Local use: start `bazel-cache-proxy serve` with a disk backend, then pass
+# --config=remote-cache to any bazel command.
+build:remote-cache --remote_cache=http://127.0.0.1:9090
+build:remote-cache --remote_upload_local_results

.bazelrc.user.example

@@ -0,0 +1,25 @@
+# Copy this file to .bazelrc.user (gitignored) and edit for your machine.
+# .bazelrc.user is imported by .bazelrc via try-import — it is NOT committed.
+
+# ── Android SDK path ──────────────────────────────────────────────────────────
+# build --repo_env=ANDROID_HOME=/home/<you>/Android/Sdk       # Linux
+# build --repo_env=ANDROID_HOME=/Users/<you>/Library/Android/sdk  # macOS
+
+# ── Tool PATH (if unzip is outside the hermetic PATH, e.g. Homebrew) ─────────
+# build --action_env=PATH=/home/linuxbrew/.linuxbrew/bin:/usr/local/bin:/usr/bin:/bin
+
+# ── Local disk cache ─────────────────────────────────────────────────────────
+# Persists build action results between sessions and workspace switches.
+# Dramatically speeds up incremental builds — similar benefit to ccache for C++.
+# Grows unboundedly; run `bazel clean --expunge` or delete the dir to reclaim space.
+# build --disk_cache=~/.cache/bazel-disk-cache
+
+# ── Remote cache (optional — for sharing across machines) ────────────────────
+# If you build on multiple machines and want a shared cache, you can point at
+# any Bazel-compatible remote cache (BuildBuddy free tier, self-hosted bazel-remote, etc.):
+# build --remote_cache=grpcs://remote.buildbuddy.io
+# build --remote_header=x-buildbuddy-api-key=<YOUR_KEY>
+# build --remote_cache_compression=zstd
+#
+# CI uses GitHub Actions native caching (setup-bazel disk/repo/external-cache)
+# so no API key is needed there.

.github/workflows/bazel-ci.yml

@@ -0,0 +1,262 @@
+name: Bazel CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# Only one CI run per branch at a time; newer push cancels in-progress run.
+concurrency:
+  group: bazel-ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # ── JVM / Desktop tests ────────────────────────────────────────────────────
+  bazel-jvm:
+    name: Bazel JVM tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    if: github.event.pull_request.draft == false
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Cache bazel-cache-proxy binary
+        id: bcp-cache
+        uses: actions/cache@v4
+        with:
+          path: ~/.cargo/bin/bazel-cache-proxy
+          key: bcp-${{ runner.os }}-7806c5f
+
+      - name: Install bazel-cache-proxy
+        if: steps.bcp-cache.outputs.cache-hit != 'true'
+        run: |
+          sudo apt-get install -y --no-install-recommends protobuf-compiler
+          cargo install --git https://github.com/tstapler/bazel-cache-proxy --rev 7806c5f bazel-cache-proxy --locked
+
+      - name: Start bazel-cache-proxy (GHA backend)
+        run: |
+          printf '[backend]\ntype = "gha"\n' > /tmp/bcp.toml
+          ~/.cargo/bin/bazel-cache-proxy serve --config /tmp/bcp.toml &
+          sleep 2
+          curl -sf http://127.0.0.1:9090/healthz
+
+      - name: Set up Bazel
+        uses: bazel-contrib/setup-bazel@0.19.0
+        with:
+          bazelisk-version: "1.x"
+          # Persistent disk cache for build action results (compiled Kotlin, JARs).
+          # Keyed per-job so JVM and Android caches don't collide.
+          disk-cache: jvm
+          # Shared Maven/artifact download cache across all jobs (keyed by MODULE.bazel).
+          repository-cache: true
+          # Cache large individual external repos (Compose Desktop, AndroidX) separately.
+          external-cache: true
+          # Only write cache on main-branch pushes; PRs read but don't pollute.
+          cache-save: ${{ github.event_name != 'pull_request' }}
+
+      - name: Install Xvfb (headless display for Compose Desktop tests)
+        run: |
+          sudo apt-get install -y --no-install-recommends xvfb
+          # Ensure /tmp/.X11-unix exists before Bazel sandbox tries to bind-mount it
+          # (xvfb-run creates the socket, but Bazel validates the mount source at startup)
+          mkdir -p /tmp/.X11-unix
+
+      - name: Build JVM target
+        run: bazel build //kmp:desktop_app --config=remote-cache
+
+      - name: Run JVM tests
+        run: |
+          xvfb-run --auto-servernum bazel test //kmp:jvm_tests \
+            --config=remote-cache \
+            --test_output=all \
+            --sandbox_add_mount_pair=/tmp/.X11-unix \
+            --test_env=DISPLAY \
+            --test_env=XAUTHORITY
+
+  # ── Android build ──────────────────────────────────────────────────────────
+  bazel-android:
+    name: Bazel Android build
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    if: github.event.pull_request.draft == false
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up JDK 21 + Android SDK
+        uses: actions/setup-java@v4
+        with:
+          java-version: "21"
+          distribution: "temurin"
+
+      - name: Set up Android SDK
+        uses: android-actions/setup-android@v3
+
+      - name: Install host tools required by aar_import
+        run: sudo apt-get install -y --no-install-recommends unzip
+
+      - name: Cache bazel-cache-proxy binary
+        id: bcp-cache
+        uses: actions/cache@v4
+        with:
+          path: ~/.cargo/bin/bazel-cache-proxy
+          key: bcp-${{ runner.os }}-7806c5f
+
+      - name: Install bazel-cache-proxy
+        if: steps.bcp-cache.outputs.cache-hit != 'true'
+        run: |
+          sudo apt-get install -y --no-install-recommends protobuf-compiler
+          cargo install --git https://github.com/tstapler/bazel-cache-proxy --rev 7806c5f bazel-cache-proxy --locked
+
+      - name: Start bazel-cache-proxy (GHA backend)
+        run: |
+          printf '[backend]\ntype = "gha"\n' > /tmp/bcp.toml
+          ~/.cargo/bin/bazel-cache-proxy serve --config /tmp/bcp.toml &
+          sleep 2
+          curl -sf http://127.0.0.1:9090/healthz
+
+      - name: Set up Bazel
+        uses: bazel-contrib/setup-bazel@0.19.0
+        with:
+          bazelisk-version: "1.x"
+          disk-cache: android
+          repository-cache: true
+          external-cache: true
+          cache-save: ${{ github.event_name != 'pull_request' }}
+
+      - name: Build Android APK
+        run: bazel build //kmp:android_app --config=android --config=remote-cache
+
+  # ── Android unit tests ─────────────────────────────────────────────────────
+  bazel-android-tests:
+    name: Bazel Android unit tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    if: github.event.pull_request.draft == false
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up JDK 21 + Android SDK
+        uses: actions/setup-java@v4
+        with:
+          java-version: "21"
+          distribution: "temurin"
+
+      - name: Set up Android SDK
+        uses: android-actions/setup-android@v3
+
+      - name: Install host tools required by aar_import
+        run: sudo apt-get install -y --no-install-recommends unzip
+
+      - name: Cache bazel-cache-proxy binary
+        id: bcp-cache
+        uses: actions/cache@v4
+        with:
+          path: ~/.cargo/bin/bazel-cache-proxy
+          key: bcp-${{ runner.os }}-7806c5f
+
+      - name: Install bazel-cache-proxy
+        if: steps.bcp-cache.outputs.cache-hit != 'true'
+        run: |
+          sudo apt-get install -y --no-install-recommends protobuf-compiler
+          cargo install --git https://github.com/tstapler/bazel-cache-proxy --rev 7806c5f bazel-cache-proxy --locked
+
+      - name: Start bazel-cache-proxy (GHA backend)
+        run: |
+          printf '[backend]\ntype = "gha"\n' > /tmp/bcp.toml
+          ~/.cargo/bin/bazel-cache-proxy serve --config /tmp/bcp.toml &
+          sleep 2
+          curl -sf http://127.0.0.1:9090/healthz
+
+      - name: Set up Bazel
+        uses: bazel-contrib/setup-bazel@0.19.0
+        with:
+          bazelisk-version: "1.x"
+          disk-cache: android-tests
+          repository-cache: true
+          external-cache: true
+          cache-save: ${{ github.event_name != 'pull_request' }}
+
+      - name: Run Android unit tests
+        run: |
+          bazel test //kmp/src/androidUnitTest/kotlin:android_unit_tests \
+            --config=android \
+            --config=remote-cache \
+            --test_output=all \
+            --experimental_ui_max_stdouterr_bytes=4194304
+
+  # ── WASM/JS web build ─────────────────────────────────────────────────────
+  # rules_kotlin does not yet support Kotlin/WASM natively (rules_kotlin#567).
+  # //kmp:web_app is a genrule that delegates to Gradle's wasmJsBrowserDistribution.
+  # Gradle's own incremental cache is preserved via the gradle-home cache key.
+  bazel-web:
+    name: Bazel web (WASM/JS via Gradle genrule)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    if: github.event.pull_request.draft == false
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@v4
+        with:
+          java-version: "21"
+          distribution: "temurin"
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - name: Cache Gradle home
+        uses: actions/cache@v4
+        with:
+          path: ~/.gradle
+          key: gradle-web-${{ runner.os }}-${{ hashFiles('kmp/build.gradle.kts', 'settings.gradle.kts', 'gradle.properties') }}-${{ github.sha }}
+          restore-keys: |
+            gradle-web-${{ runner.os }}-${{ hashFiles('kmp/build.gradle.kts', 'settings.gradle.kts', 'gradle.properties') }}-
+            gradle-web-${{ runner.os }}-
+
+      - name: Cache bazel-cache-proxy binary
+        id: bcp-cache
+        uses: actions/cache@v4
+        with:
+          path: ~/.cargo/bin/bazel-cache-proxy
+          key: bcp-${{ runner.os }}-7806c5f
+
+      - name: Install bazel-cache-proxy
+        if: steps.bcp-cache.outputs.cache-hit != 'true'
+        run: |
+          sudo apt-get install -y --no-install-recommends protobuf-compiler
+          cargo install --git https://github.com/tstapler/bazel-cache-proxy --rev 7806c5f bazel-cache-proxy --locked
+
+      - name: Start bazel-cache-proxy (GHA backend)
+        run: |
+          printf '[backend]\ntype = "gha"\n' > /tmp/bcp.toml
+          ~/.cargo/bin/bazel-cache-proxy serve --config /tmp/bcp.toml &
+          sleep 2
+          curl -sf http://127.0.0.1:9090/healthz
+
+      - name: Set up Bazel
+        uses: bazel-contrib/setup-bazel@0.19.0
+        with:
+          bazelisk-version: "1.x"
+          disk-cache: web
+          repository-cache: true
+          external-cache: true
+          cache-save: ${{ github.event_name != 'pull_request' }}
+
+      - name: Build web bundle
+        run: bazel build //kmp:web_app --config=remote-cache
+
+      - name: Upload web distribution artifact
+        if: github.event_name == 'push'
+        uses: actions/upload-artifact@v4
+        with:
+          name: web-dist
+          path: bazel-bin/kmp/web_dist.tar.gz
+          retention-days: 7

.gitignore

@@ -168,4 +168,15 @@ fdroid/archive/
 *.rej
 *.bak
 *.tmp
-*.tempuploads/
+*.temp
+uploads/
+
+# --------------------
+# Bazel
+# --------------------
+/bazel-bin
+/bazel-out
+/bazel-testlogs
+/bazel-*
+# Machine-specific overrides (ANDROID_HOME, tool paths) — see .bazelrc.user.example
+.bazelrc.user