From fde705ba8ce2cc8f04350befc1b2067740e5f848 Mon Sep 17 00:00:00 2001
From: Greg Magolan <gmagolan@gmail.com>
Date: Thu, 16 Feb 2023 16:59:21 -0800
Subject: [PATCH] feat: make bazel-lib the source-of-truth for Aspect
 recommended bazelrc settings (#369)

---
 .aspect/bazelrc/BUILD.bazel                   |  1 +
 .aspect/bazelrc/README.md                     |  4 +
 .aspect/bazelrc/bazel5.bazelrc                |  5 ++
 .aspect/bazelrc/bazel6.bazelrc                | 15 ++++
 .aspect/bazelrc/ci.bazelrc                    | 75 +++++++++++++++++++
 .aspect/bazelrc/convenience.bazelrc           | 29 +++++++
 .aspect/bazelrc/correctness.bazelrc           | 68 +++++++++++++++++
 .aspect/bazelrc/debug.bazelrc                 | 19 +++++
 .aspect/bazelrc/javascript.bazelrc            | 28 +++++++
 .aspect/bazelrc/performance.bazelrc           | 54 +++++++++++++
 .bazelrc                                      | 70 +++++++----------
 .github/workflows/ci.bazelrc                  | 17 +----
 .github/workflows/ci.yaml                     | 19 ++++-
 BUILD.bazel                                   |  8 +-
 e2e/bzlmod/.aspect/bazelrc                    |  1 +
 e2e/bzlmod/.aspect/cli                        |  1 +
 e2e/copy_to_directory/.aspect/bazelrc         |  1 +
 e2e/copy_to_directory/.aspect/cli             |  1 +
 e2e/workspace/.aspect/bazelrc                 |  1 +
 e2e/workspace/.aspect/cli                     |  1 +
 e2e/write_source_files_root.sh                |  9 +++
 lib/tests/write_source_files/BUILD.bazel      | 28 +------
 .../subdir_test_input/a/b/c/test.txt          |  1 +
 .../symlinks_input/a/test.txt                 |  0
 .../symlinks_input/b/test.txt                 |  1 +
 25 files changed, 366 insertions(+), 91 deletions(-)
 create mode 100644 .aspect/bazelrc/BUILD.bazel
 create mode 100644 .aspect/bazelrc/README.md
 create mode 100644 .aspect/bazelrc/bazel5.bazelrc
 create mode 100644 .aspect/bazelrc/bazel6.bazelrc
 create mode 100644 .aspect/bazelrc/ci.bazelrc
 create mode 100644 .aspect/bazelrc/convenience.bazelrc
 create mode 100644 .aspect/bazelrc/correctness.bazelrc
 create mode 100644 .aspect/bazelrc/debug.bazelrc
 create mode 100644 .aspect/bazelrc/javascript.bazelrc
 create mode 100644 .aspect/bazelrc/performance.bazelrc
 create mode 120000 e2e/bzlmod/.aspect/bazelrc
 create mode 120000 e2e/bzlmod/.aspect/cli
 create mode 120000 e2e/copy_to_directory/.aspect/bazelrc
 create mode 120000 e2e/copy_to_directory/.aspect/cli
 create mode 120000 e2e/workspace/.aspect/bazelrc
 create mode 120000 e2e/workspace/.aspect/cli
 create mode 100644 lib/tests/write_source_files/subdir_test_input/a/b/c/test.txt
 create mode 100644 lib/tests/write_source_files/symlinks_input/a/test.txt
 create mode 120000 lib/tests/write_source_files/symlinks_input/b/test.txt

diff --git a/.aspect/bazelrc/BUILD.bazel b/.aspect/bazelrc/BUILD.bazel
new file mode 100644
index 000000000..3da118662
--- /dev/null
+++ b/.aspect/bazelrc/BUILD.bazel
@@ -0,0 +1 @@
+exports_files(glob(["*.bazelrc"]))
diff --git a/.aspect/bazelrc/README.md b/.aspect/bazelrc/README.md
new file mode 100644
index 000000000..fbe353624
--- /dev/null
+++ b/.aspect/bazelrc/README.md
@@ -0,0 +1,4 @@
+# Aspect Recommended Bazel Options
+
+The Bazel options found here are the source-of-truth for our recommended set of settings.
+They are mirrored on our docsite at https://docs.aspect.build/guides/bazelrc.
diff --git a/.aspect/bazelrc/bazel5.bazelrc b/.aspect/bazelrc/bazel5.bazelrc
new file mode 100644
index 000000000..c9d77444d
--- /dev/null
+++ b/.aspect/bazelrc/bazel5.bazelrc
@@ -0,0 +1,5 @@
+# Performance improvement for WORKSPACE evaluation
+# of slow rulesets, for example rules_k8s has been
+# observed to take 10 seconds without this flag.
+# See https://github.com/bazelbuild/bazel/issues/13907
+common --incompatible_existing_rules_immutable_view
diff --git a/.aspect/bazelrc/bazel6.bazelrc b/.aspect/bazelrc/bazel6.bazelrc
new file mode 100644
index 000000000..11a1c67fa
--- /dev/null
+++ b/.aspect/bazelrc/bazel6.bazelrc
@@ -0,0 +1,15 @@
+# Speed up all builds by not checking if external repository files have been modified.
+# Docs: https://github.com/bazelbuild/bazel/blob/1af61b21df99edc2fc66939cdf14449c2661f873/src/main/java/com/google/devtools/build/lib/bazel/repository/RepositoryOptions.java#L244
+build --noexperimental_check_external_repository_files
+fetch --noexperimental_check_external_repository_files
+query --noexperimental_check_external_repository_files
+
+# Directories used by sandboxed non-worker execution may be reused to avoid unnecessary setup costs.
+# Save time on Sandbox creation and deletion when many of the same kind of action run during the
+# build.
+# Docs: https://bazel.build/reference/command-line-reference#flag--reuse_sandbox_directories
+build --reuse_sandbox_directories
+
+# Avoid this flag being enabled by remote_download_minimal or remote_download_toplevel
+# See https://meroton.com/blog/bazel-6-errors-build-without-the-bytes/
+build --noexperimental_action_cache_store_output_metadata
diff --git a/.aspect/bazelrc/ci.bazelrc b/.aspect/bazelrc/ci.bazelrc
new file mode 100644
index 000000000..749c15847
--- /dev/null
+++ b/.aspect/bazelrc/ci.bazelrc
@@ -0,0 +1,75 @@
+# We recommend enforcing a policy that keeps your CI from being slowed down
+# by individual test targets that should be optimized
+# or split up into multiple test targets with sharding or manually.
+# Set this flag to exclude targets that have their timeout set to eternal (>15m) from running on CI.
+# Docs: https://bazel.build/docs/user-manual#test-timeout-filters
+build --test_timeout_filters=-eternal
+
+# Set this flag to enable re-tries of failed tests on CI.
+# When any test target fails, try one or more times. This applies regardless of whether the "flaky"
+# tag appears on the target definition.
+# This is a tradeoff: legitimately failing tests will take longer to report,
+# but we can paper over flaky tests that pass most of the time.
+# The alternative is to mark every flaky test with the `flaky = True` attribute, but this requires
+# the buildcop to make frequent code edits.
+# Not recommended for local builds so that the flakiness is observed during development and thus
+# is more likely to get fixed.
+# Note that when passing after the first attempt, Bazel will give a special "FLAKY" status.
+# Docs: https://bazel.build/docs/user-manual#flaky-test-attempts
+build --flaky_test_attempts=2
+
+# Announce all announces command options read from the bazelrc file(s) when starting up at the
+# beginning of each Bazel invocation. This is very useful on CI to be able to inspect what Bazel rc
+# settings are being applied on each run.
+# Docs: https://bazel.build/docs/user-manual#announce-rc
+build --announce_rc
+
+# Add a timestamp to each message generated by Bazel specifying the time at which the message was
+# displayed.
+# Docs: https://bazel.build/docs/user-manual#show-timestamps
+build --show_timestamps
+
+# Only show progress every 60 seconds on CI.
+# Docs: https://bazel.build/reference/command-line-reference#flag--progress_report_interval
+build --progress_report_interval=60
+
+# Only show progress every 60 seconds on CI.
+# https://bazel.build/reference/command-line-reference#flag--show_progress_rate_limit
+build --show_progress_rate_limit=60
+
+# Don't use cursor controls in its screen output.
+# Docs: https://bazel.build/docs/user-manual#curses
+build --curses=no
+
+# Use colors to highlight its output on the screen. Set to `no` if your CI does not display colors.
+# Docs: https://bazel.build/docs/user-manual#color
+build --color=yes
+
+# The terminal width in columns. Configure this to override the default value based on what your CI system renders.
+# Docs: https://github.com/bazelbuild/bazel/blob/1af61b21df99edc2fc66939cdf14449c2661f873/src/main/java/com/google/devtools/build/lib/runtime/UiOptions.java#L151
+build --terminal_columns=80
+
+######################################
+# Generic remote cache configuration #
+######################################
+
+# Only download remote outputs of top level targets to the local machine.
+# Docs: https://bazel.build/reference/command-line-reference#flag--remote_download_toplevel
+build --remote_download_toplevel
+
+# The maximum amount of time to wait for remote execution and cache calls.
+# https://bazel.build/reference/command-line-reference#flag--remote_timeout
+build --remote_timeout=3600
+
+# Upload locally executed action results to the remote cache.
+# Docs: https://bazel.build/reference/command-line-reference#flag--remote_upload_local_results
+build --remote_upload_local_results
+
+# Fall back to standalone local execution strategy if remote execution fails. If the grpc remote
+# cache connection fails, it will fail the build, add this so it falls back to the local cache.
+# Docs: https://bazel.build/reference/command-line-reference#flag--remote_local_fallback
+build --remote_local_fallback
+
+# Fixes builds hanging on CI that get the TCP connection closed without sending RST packets.
+# Docs: https://bazel.build/reference/command-line-reference#flag--grpc_keepalive_time
+build --grpc_keepalive_time=30s
diff --git a/.aspect/bazelrc/convenience.bazelrc b/.aspect/bazelrc/convenience.bazelrc
new file mode 100644
index 000000000..3122d3273
--- /dev/null
+++ b/.aspect/bazelrc/convenience.bazelrc
@@ -0,0 +1,29 @@
+# Attempt to build & test every target whose prerequisites were successfully built.
+# Docs: https://bazel.build/docs/user-manual#keep-going
+build --keep_going
+test  --keep_going
+
+# Output test errors to stderr so users don't have to `cat` or open test failure log files when test
+# fail. This makes the log noiser in exchange for reducing the time-to-feedback on test failures for
+# users.
+# Docs: https://bazel.build/docs/user-manual#test-output
+test --test_output=errors
+
+# Show the output files created by builds that requested more than one target. This helps users
+# locate the build outputs in more cases
+# Docs: https://bazel.build/docs/user-manual#show-result
+build --show_result=20
+
+# Bazel picks up host-OS-specific config lines from bazelrc files. For example, if the host OS is
+# Linux and you run bazel build, Bazel picks up lines starting with build:linux. Supported OS
+# identifiers are `linux`, `macos`, `windows`, `freebsd`, and `openbsd`. Enabling this flag is
+# equivalent to using `--config=linux` on Linux, `--config=windows` on Windows, etc.
+# Docs: https://bazel.build/reference/command-line-reference#flag--enable_platform_specific_config
+common --enable_platform_specific_config
+
+# Output a heap dump if an OOM is thrown during a Bazel invocation
+# (including OOMs due to `--experimental_oom_more_eagerly_threshold`).
+# The dump will be written to `<output_base>/<invocation_id>.heapdump.hprof`.
+# You may need to configure CI to capture this artifact and upload for later use.
+# Docs: https://bazel.build/reference/command-line-reference#flag--heap_dump_on_oom
+build --heap_dump_on_oom
diff --git a/.aspect/bazelrc/correctness.bazelrc b/.aspect/bazelrc/correctness.bazelrc
new file mode 100644
index 000000000..a23818444
--- /dev/null
+++ b/.aspect/bazelrc/correctness.bazelrc
@@ -0,0 +1,68 @@
+# Do not upload locally executed action results to the remote cache.
+# This should be the default for local builds so local builds cannot poison the remote cache.
+# It should be flipped to `--remote_upload_local_results` on CI
+# by using `--bazelrc=.aspect/bazelrc/ci.bazelrc`.
+# Docs: https://bazel.build/reference/command-line-reference#flag--remote_upload_local_results
+build --noremote_upload_local_results
+
+# Don't allow network access for build actions in the sandbox.
+# Ensures that you don't accidentally make non-hermetic actions/tests which depend on remote
+# services.
+# Developers should tag targets with `tags=["requires-network"]` to opt-out of the enforcement.
+# Docs: https://bazel.build/reference/command-line-reference#flag--sandbox_default_allow_network
+build --sandbox_default_allow_network=false
+test --sandbox_default_allow_network=false
+
+# Warn if a test's timeout is significantly longer than the test's actual execution time.
+# Bazel's default for test_timeout is medium (5 min), but most tests should instead be short (1 min).
+# While a test's timeout should be set such that it is not flaky, a test that has a highly
+# over-generous timeout can hide real problems that crop up unexpectedly.
+# For instance, a test that normally executes in a minute or two should not have a timeout of
+# ETERNAL or LONG as these are much, much too generous.
+# Docs: https://bazel.build/docs/user-manual#test-verbose-timeout-warnings
+test --test_verbose_timeout_warnings
+
+# Allow the Bazel server to check directory sources for changes. Ensures that the Bazel server
+# notices when a directory changes, if you have a directory listed in the srcs of some target.
+# Recommended when using
+# [copy_directory](https://github.com/aspect-build/bazel-lib/blob/main/docs/copy_directory.md) and
+# [rules_js](https://github.com/aspect-build/rules_js) since npm package are source directories
+# inputs to copy_directory actions.
+# Docs: https://bazel.build/reference/command-line-reference#flag--host_jvm_args
+startup --host_jvm_args=-DBAZEL_TRACK_SOURCE_DIRECTORIES=1
+
+# Allow exclusive tests to run in the sandbox. Fixes a bug where Bazel doesn't enable sandboxing for
+# tests with `tags=["exclusive"]`.
+# Docs: https://bazel.build/reference/command-line-reference#flag--incompatible_exclusive_test_sandboxed
+test --incompatible_exclusive_test_sandboxed
+
+# Use a static value for `PATH` and does not inherit `LD_LIBRARY_PATH`. Doesn't let environment
+# variables like `PATH` sneak into the build, which can cause massive cache misses when they change.
+# Use `--action_env=ENV_VARIABLE` if you want to inherit specific environment variables from the
+# client, but note that doing so can prevent cross-user caching if a shared cache is used.
+# Docs: https://bazel.build/reference/command-line-reference#flag--incompatible_strict_action_env
+build --incompatible_strict_action_env
+
+# Propagate tags from a target declaration to the actions' execution requirements.
+# Ensures that tags applied in your BUILD file, like `tags=["no-remote"]`
+# get propagated to actions created by the rule.
+# Without this option, you rely on rules authors to manually check the tags you passed 
+# and apply relevant ones to the actions they create.
+# See https://github.com/bazelbuild/bazel/issues/8830 for details.
+# Docs: https://bazel.build/reference/command-line-reference#flag--experimental_allow_tags_propagation
+build --experimental_allow_tags_propagation
+fetch --experimental_allow_tags_propagation
+query --experimental_allow_tags_propagation
+
+# Checking the ctime of input files of an action before uploading it to a remote cache. Prevents
+# concurrent local file modification from poisoning the build cache.
+# Docs: https://bazel.build/reference/command-line-reference#flag--experimental_guard_against_concurrent_changes
+build --experimental_guard_against_concurrent_changes
+
+# Do not automatically create `__init__.py` files in the runfiles of Python targets. Fixes the wrong
+# default that comes from Google's internal monorepo by using `__init__.py` to delimit a Python
+# package. Precisely, when a `py_binary` or `py_test` target has `legacy_create_init` set to `auto (the
+# default), it is treated as false if and only if this flag is set. See
+# https://github.com/bazelbuild/bazel/issues/10076.
+# Docs: https://bazel.build/reference/command-line-reference#flag--incompatible_default_to_explicit_init_py
+build --incompatible_default_to_explicit_init_py
diff --git a/.aspect/bazelrc/debug.bazelrc b/.aspect/bazelrc/debug.bazelrc
new file mode 100644
index 000000000..bfb0bdd4a
--- /dev/null
+++ b/.aspect/bazelrc/debug.bazelrc
@@ -0,0 +1,19 @@
+############################################################
+# Use `bazel test --config=debug` to enable these settings #
+############################################################
+
+# Stream stdout/stderr output from each test in real-time.
+# Docs: https://bazel.build/docs/user-manual#test-output
+test:debug --test_output=streamed
+
+# Run one test at a time.
+# Docs: https://bazel.build/reference/command-line-reference#flag--test_strategy
+test:debug --test_strategy=exclusive
+
+# Prevent long running tests from timing out.
+# Docs: https://bazel.build/docs/user-manual#test-timeout
+test:debug --test_timeout=9999
+
+# Always run tests even if they have cached results.
+# Docs: https://bazel.build/docs/user-manual#cache-test-results
+test:debug --nocache_test_results
diff --git a/.aspect/bazelrc/javascript.bazelrc b/.aspect/bazelrc/javascript.bazelrc
new file mode 100644
index 000000000..dc768641e
--- /dev/null
+++ b/.aspect/bazelrc/javascript.bazelrc
@@ -0,0 +1,28 @@
+# Aspect recommended Bazel flags when using Aspect's JavaScript rules: https://github.com/aspect-build/rules_js
+# Docs for Node.js flags: https://nodejs.org/en/docs/guides/debugging-getting-started/#command-line-options
+
+# Support for debugging Node.js tests. Use bazel run with `--config=debug` to turn on the NodeJS
+# inspector agent. The node process will break before user code starts and wait for the debugger to
+# connect. Pass the --inspect-brk option to all tests which enables the node inspector agent. See
+# https://nodejs.org/de/docs/guides/debugging-getting-started/#command-line-options for more
+# details.
+# Docs: https://nodejs.org/en/docs/guides/debugging-getting-started/#command-line-options
+run:debug -- --node_options=--inspect-brk
+
+# Enable runfiles on all platforms. Runfiles are on by default on Linux and MacOS but off on
+# Windows.
+#
+# In general, rules_js and derivate rule sets assume that runfiles are enabled and do not support no
+# runfiles case because it does not scale to teach all Node.js tools to use the runfiles manifest.
+#
+# If you are developing on Windows, you must either run bazel with administrator privileges or
+# enable developer mode. If you do not you may hit this error on Windows:
+#
+#   Bazel needs to create symlinks to build the runfiles tree.
+#   Creating symlinks on Windows requires one of the following:
+#       1. Bazel is run with administrator privileges.
+#       2. The system version is Windows 10 Creators Update (1703) or later
+#          and developer mode is enabled.
+#
+# Docs: https://bazel.build/reference/command-line-reference#flag--enable_runfiles
+build --enable_runfiles
diff --git a/.aspect/bazelrc/performance.bazelrc b/.aspect/bazelrc/performance.bazelrc
new file mode 100644
index 000000000..bc11a3f43
--- /dev/null
+++ b/.aspect/bazelrc/performance.bazelrc
@@ -0,0 +1,54 @@
+# Merkle tree calculations will be memoized to improve the remote cache hit checking speed. The
+# memory foot print of the cache is controlled by `--experimental_remote_merkle_tree_cache_size`.
+# Docs: https://bazel.build/reference/command-line-reference#flag--experimental_remote_merkle_tree_cache
+build --experimental_remote_merkle_tree_cache
+query --experimental_remote_merkle_tree_cache
+
+# The number of Merkle trees to memoize to improve the remote cache hit checking speed. Even though
+# the cache is automatically pruned according to Java's handling of soft references, out-of-memory
+# errors can occur if set too high. If set to 0 the cache size is unlimited. Optimal value varies
+# depending on project's size.
+# Docs: https://bazel.build/reference/command-line-reference#flag--experimental_remote_merkle_tree_cache_size
+build --experimental_remote_merkle_tree_cache_size=1000
+query --experimental_remote_merkle_tree_cache_size=1000
+
+# Speed up all builds by not checking if output files have been modified. Lets you make changes to
+# the output tree without triggering a build for local debugging. For example, you can modify
+# [rules_js](https://github.com/aspect-build/rules_js) 3rd party npm packages in the output tree
+# when local debugging.
+# Docs: https://github.com/bazelbuild/bazel/blob/1af61b21df99edc2fc66939cdf14449c2661f873/src/main/java/com/google/devtools/build/lib/pkgcache/PackageOptions.java#L185
+build --noexperimental_check_output_files
+fetch --noexperimental_check_output_files
+query --noexperimental_check_output_files
+
+# Don't apply `--noremote_upload_local_results` and `--noremote_accept_cached` to the disk cache.
+# If you have both `--noremote_upload_local_results` and `--disk_cache`, then this fixes a bug where
+# Bazel doesn't write to the local disk cache as it treats as a remote cache.
+# Docs: https://bazel.build/reference/command-line-reference#flag--incompatible_remote_results_ignore_disk
+build --incompatible_remote_results_ignore_disk
+
+# Directories used by sandboxed non-worker execution may be reused to avoid unnecessary setup costs.
+# Save time on Sandbox creation and deletion when many of the same kind of action run during the
+# build.
+# No longer experimental in Bazel 6: https://github.com/bazelbuild/bazel/commit/c1a95501a5611878e5cc43a3cc531f2b9e47835b
+# Docs: https://bazel.build/reference/command-line-reference#flag--reuse_sandbox_directories
+build --experimental_reuse_sandbox_directories
+
+# Do not build runfiles symlink forests for external repositories under
+# `.runfiles/wsname/external/repo` (in addition to `.runfiles/repo`). This reduces runfiles &
+# sandbox creation times & prevents accidentally depending on this feature which may flip to off by
+# default in the future. Note, some rules may fail under this flag, please file issues with the rule
+# author.
+# Docs: https://bazel.build/reference/command-line-reference#flag--legacy_external_runfiles
+build --nolegacy_external_runfiles
+run --nolegacy_external_runfiles
+test --nolegacy_external_runfiles
+
+# Some actions are always IO-intensive but require little compute. It's wasteful to put the output
+# in the remote cache, it just saturates the network and fills the cache storage causing earlier
+# evictions. It's also not worth sending them for remote execution.
+# For actions like PackageTar it's usually faster to just re-run the work locally every time.
+# You'll have to look at an execution log to figure out what other action mnemonics you care about.
+# In some cases you may need to patch rulesets to add a mnemonic to actions that don't have one.
+# https://bazel.build/reference/command-line-reference#flag--modify_execution_info
+build --modify_execution_info=PackageTar=+no-remote
diff --git a/.bazelrc b/.bazelrc
index ed57f1df0..b822f530a 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -1,27 +1,24 @@
 # Bazel settings that apply to this repository.
-# Take care to document any settings that you expect users to apply.
-# Settings that apply only to CI are in .github/workflows/ci.bazelrc.
-
-# Allow the Bazel server to check directory sources for changes.
-# Avoids warning spam with rules_nodejs feature that models node_modules as directories.
-# See https://github.com/bazelbuild/rules_nodejs/releases/tag/3.6.0.
-startup --host_jvm_args=-DBAZEL_TRACK_SOURCE_DIRECTORIES=1
-
-# In general, the rules in this repository assume that runfiles
-# are enabled as we do not support no runfiles case.
-#
-# If you are developing on Windows, you must either run bazel
-# with administrator privileges or enable developer mode. If
-# you do not you may hit this error on Windows:
-#
-#   Bazel needs to create symlinks to build the runfiles tree.
-#   Creating symlinks on Windows requires one of the following:
-#       1. Bazel is run with administrator privileges.
-#       2. The system version is Windows 10 Creators Update (1703) or later
-#          and developer mode is enabled.
-build --enable_runfiles
-
-common --enable_platform_specific_config
+# Settings that apply only to CI are in .aspect/bazelrc/ci.bazelrc
+
+# Import Aspect recommended Bazel convenience settings for all projects
+import %workspace%/.aspect/bazelrc/convenience.bazelrc
+
+# Import Aspect recommended Bazel correctness settings for all projects
+import %workspace%/.aspect/bazelrc/correctness.bazelrc
+
+# Import Aspect recommended Bazel performance settings for all projects
+import %workspace%/.aspect/bazelrc/performance.bazelrc
+
+# Import Aspect recommended Bazel debug settings for all projects
+import %workspace%/.aspect/bazelrc/debug.bazelrc
+
+# Import Aspect recommended Bazel javascript settings for all projects
+import %workspace%/.aspect/bazelrc/javascript.bazelrc
+
+# Import Aspect recommended Bazel 6 settings for all projects;
+# using a try-import here since this repository is also tested against Bazel 5 on CI
+try-import %workspace%/.aspect/bazelrc/bazel6.bazelrc
 
 # For testing our --stamp behavior.
 # Normally users would use a --workspace_status_command with a script that calls `git describe`.
@@ -31,25 +28,8 @@ build --embed_label=v1.2.3
 build:release --workspace_status_command "${PWD}/workspace_status.sh"
 build:release -c opt --stamp
 
-# Turn off legacy external runfiles on all platforms except Windows.
-# This allows our users to turn on this flag as well, which is a performance win.
-# Skylib's diff_test implementation for Windows depends on legacy external
-# runfiles so we cannot disable it fully.
-build:linux --nolegacy_external_runfiles
-build:macos --nolegacy_external_runfiles
-build:freebsd --nolegacy_external_runfiles
-build:openbsd --nolegacy_external_runfiles
-
-# Print error messages on test failure.
-test --test_output=errors
-# Remind us to set quick tests to short
-test --test_verbose_timeout_warnings
-
-# Load any settings specific to the current user.
-# .bazelrc.user should appear in .gitignore so that settings are not shared with team members.
-# This needs to be last statement in this config, as the user configuration should be able to
-# overwrite flags from this file.
-# See https://docs.bazel.build/versions/master/best-practices.html#bazelrc.
-# Note that we use .bazelrc.user so the file appears next to .bazelrc in directory listing,
-# rather than user.bazelrc as suggested in the Bazel docs.
-try-import %workspace%/.bazelrc.user
+# Load any settings & overrides specific to the current user from `.aspect/bazelrc/user.bazelrc`.
+# This file should appear in `.gitignore` so that settings are not shared with team members. This
+# should be last statement in this config so the user configuration is able to overwrite flags from
+# this file. See https://bazel.build/configure/best-practices#bazelrc-file.
+try-import %workspace%/.aspect/bazelrc/user.bazelrc
diff --git a/.github/workflows/ci.bazelrc b/.github/workflows/ci.bazelrc
index 5f326b2f5..c5e73e539 100644
--- a/.github/workflows/ci.bazelrc
+++ b/.github/workflows/ci.bazelrc
@@ -1,22 +1,13 @@
-# Bazel settings to apply on CI only
-# Included with a --bazelrc option in the call to bazel
-build --announce_rc
-test --test_output=errors
+# Bazel options included on CI using the --bazelrc Bazel flag
+
+# CI specific caching options
 build --repository_cache=~/.cache/bazel-repo
 test --test_env=XDG_CACHE_HOME
 
 # When no remote cache, use a local one
 build:local --disk_cache=~/.cache/bazel
 
-# Generic remote cache
-build --remote_local_fallback
-# build --remote_download_toplevel # BREAKS BUILD in Bazel 6.0.0rc1
-build --remote_timeout=3600
-build --remote_upload_local_results
-## Fixes builds hanging on CI that get the TCP connection closed without sending RST packets.
-build --grpc_keepalive_time=30s
-
-# Generic remote build execution
+# Remote build execution
 build:rbe --extra_execution_platforms=@aspect_bazel_lib//platforms:x86_64_linux_remote
 build:rbe --genrule_strategy=remote
 build:rbe --host_platform=@aspect_bazel_lib//platforms:x86_64_linux_remote
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 441bcdc0c..c889ec394 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -44,7 +44,7 @@ jobs:
       - id: bazel_5
         run: echo "bazelversion=5.3.2" >> $GITHUB_OUTPUT
     outputs:
-      # Will look like '["6.0.0rc1", "5.3.2"]'
+      # Will look like '["6.0.0", "5.3.2"]'
       bazelversions: ${{ toJSON(steps.*.outputs.bazelversion) }}
 
   test:
@@ -95,8 +95,13 @@ jobs:
         working-directory: ${{ matrix.folder }}
         # Overwrite the .bazelversion instead of using USE_BAZEL_VERSION so that Bazelisk
         # still bootstraps Aspect CLI from configuration in .bazeliskrc. Aspect CLI will
-        # then use .bazelversion to determine which Bazel version to use
-        run: echo "${{ matrix.bazelversion }}" > .bazelversion
+        # then use .bazelversion to determine which Bazel version to use.
+        # Also delete the .aspect/bazelrc/bazel6.bazelrc file if we are not testing
+        # against Bazel 6 which has a try-import in the root .bazelrc for local development.
+        run: |
+          BAZEL_VERSION=${{ matrix.bazelversion }}
+          echo "${{ matrix.bazelversion }}" > .bazelversion
+          if [ ${BAZEL_VERSION::1} != "6" ]; then rm -f .aspect/bazelrc/bazel6.bazelrc; fi
 
       - name: Write engflow credentials
         if: ${{ matrix.config == 'rbe' }}
@@ -112,7 +117,13 @@ jobs:
 
       - name: bazel test //...
         working-directory: ${{ matrix.folder }}
-        run: bazel --bazelrc=$GITHUB_WORKSPACE/.github/workflows/ci.bazelrc --bazelrc=.bazelrc test --config=${{ matrix.config }} //...
+        run: |
+          BAZEL_VERSION=${{ matrix.bazelversion }}
+          bazel --bazelrc=$GITHUB_WORKSPACE/.aspect/bazelrc/ci.bazelrc \
+            --bazelrc=$GITHUB_WORKSPACE/.github/workflows/ci.bazelrc \
+            --bazelrc=$GITHUB_WORKSPACE/.aspect/bazelrc/bazel${BAZEL_VERSION::1}.bazelrc \
+            --bazelrc=.bazelrc \
+            test --config=${{ matrix.config }} //...
         env:
           # Bazelisk will download bazel to here
           XDG_CACHE_HOME: ~/.cache/bazel-repo
diff --git a/BUILD.bazel b/BUILD.bazel
index 3620d483b..318ea40cd 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -46,8 +46,8 @@ bzl_library(
 # write_source_files() to a git ignored subdirectory of the root
 genrule(
     name = "write_source_file_root",
-    outs = ["write_source_file-root_directory"],
-    cmd = "mkdir -p $@ && echo 'test' > $@/test.txt",
+    outs = ["write_source_file-root_directory/test.txt"],
+    cmd = "mkdir -p $$(dirname $@) && echo 'test' > $@",
     visibility = ["//visibility:private"],
 )
 
@@ -55,8 +55,8 @@ write_source_files(
     name = "write_source_file_root-test",
     diff_test = False,
     files = {
-        "test-out/dist/write_source_file_root-test": ":write_source_file_root",
-        "test-out/dist/write_source_file_root-test_b": ":write_source_file_root",
+        "test-out/dist/write_source_file_root-test/test.txt": ":write_source_file_root",
+        "test-out/dist/write_source_file_root-test_b/test.txt": ":write_source_file_root",
     },
 )
 
diff --git a/e2e/bzlmod/.aspect/bazelrc b/e2e/bzlmod/.aspect/bazelrc
new file mode 120000
index 000000000..2d2e61f06
--- /dev/null
+++ b/e2e/bzlmod/.aspect/bazelrc
@@ -0,0 +1 @@
+../../../.aspect/bazelrc
\ No newline at end of file
diff --git a/e2e/bzlmod/.aspect/cli b/e2e/bzlmod/.aspect/cli
new file mode 120000
index 000000000..0754375d1
--- /dev/null
+++ b/e2e/bzlmod/.aspect/cli
@@ -0,0 +1 @@
+../../../.aspect/cli
\ No newline at end of file
diff --git a/e2e/copy_to_directory/.aspect/bazelrc b/e2e/copy_to_directory/.aspect/bazelrc
new file mode 120000
index 000000000..2d2e61f06
--- /dev/null
+++ b/e2e/copy_to_directory/.aspect/bazelrc
@@ -0,0 +1 @@
+../../../.aspect/bazelrc
\ No newline at end of file
diff --git a/e2e/copy_to_directory/.aspect/cli b/e2e/copy_to_directory/.aspect/cli
new file mode 120000
index 000000000..0754375d1
--- /dev/null
+++ b/e2e/copy_to_directory/.aspect/cli
@@ -0,0 +1 @@
+../../../.aspect/cli
\ No newline at end of file
diff --git a/e2e/workspace/.aspect/bazelrc b/e2e/workspace/.aspect/bazelrc
new file mode 120000
index 000000000..2d2e61f06
--- /dev/null
+++ b/e2e/workspace/.aspect/bazelrc
@@ -0,0 +1 @@
+../../../.aspect/bazelrc
\ No newline at end of file
diff --git a/e2e/workspace/.aspect/cli b/e2e/workspace/.aspect/cli
new file mode 120000
index 000000000..0754375d1
--- /dev/null
+++ b/e2e/workspace/.aspect/cli
@@ -0,0 +1 @@
+../../../.aspect/cli
\ No newline at end of file
diff --git a/e2e/write_source_files_root.sh b/e2e/write_source_files_root.sh
index 5b8b8c53f..1dd39a089 100755
--- a/e2e/write_source_files_root.sh
+++ b/e2e/write_source_files_root.sh
@@ -12,6 +12,15 @@ function run_test {
     echo "ERROR: expected $expected_out to not be executable"
     exit 1
   fi
+  expected_out="test-out/dist/write_source_file_root-test_b/test.txt"
+  if [ ! -e "$expected_out" ]; then
+    echo "ERROR: expected $expected_out to exist"
+    exit 1
+  fi
+  if [ -x "$expected_out" ]; then
+    echo "ERROR: expected $expected_out to not be executable"
+    exit 1
+  fi
 }
 
 # Run twice to make sure we can have permission to overwrite the outputs of a previous run
diff --git a/lib/tests/write_source_files/BUILD.bazel b/lib/tests/write_source_files/BUILD.bazel
index c6285f956..410768a94 100644
--- a/lib/tests/write_source_files/BUILD.bazel
+++ b/lib/tests/write_source_files/BUILD.bazel
@@ -187,22 +187,12 @@ write_source_files(
     files = {"dist_executable.js": ":dist"},
 )
 
-# Generate a file in nested directories
-genrule(
-    name = "subdir",
-    outs = ["subdir_test"],
-    cmd = ";".join([
-        "mkdir -p $@/a/b/c",
-        "echo 'test' > $@/a/b/c/test.txt",
-    ]),
-)
-
 # Write nested subdirectories to source
 # See e2e/write_source_files_subdir_multiple_runs
 write_source_files(
     name = "write_subdir",
     diff_test = False,
-    files = {"subdir_test": ":subdir"},
+    files = {"subdir_test": ":subdir_test_input"},
 )
 
 # Write nested subdirectories to source
@@ -211,19 +201,7 @@ write_source_files(
     name = "write_subdir_executable",
     diff_test = False,
     executable = True,
-    files = {"subdir_executable_test": ":subdir"},
-)
-
-# Generate some directories including symlinks
-genrule(
-    name = "symlinks",
-    outs = ["symlink_test"],
-    cmd = ";".join([
-        "mkdir -p $@/a $@/b",
-        "echo 'test' > $@/a/test.txt",
-        "pushd $@/b",
-        "ln -s ../a/test.txt",
-    ]),
+    files = {"subdir_executable_test": ":subdir_test_input"},
 )
 
 # Write symlinks to source
@@ -231,7 +209,7 @@ genrule(
 write_source_files(
     name = "write_symlinks",
     diff_test = False,
-    files = {"symlink_test": ":symlinks"},
+    files = {"symlink_test": ":symlinks_input"},
 )
 
 write_source_files(
diff --git a/lib/tests/write_source_files/subdir_test_input/a/b/c/test.txt b/lib/tests/write_source_files/subdir_test_input/a/b/c/test.txt
new file mode 100644
index 000000000..30d74d258
--- /dev/null
+++ b/lib/tests/write_source_files/subdir_test_input/a/b/c/test.txt
@@ -0,0 +1 @@
+test
\ No newline at end of file
diff --git a/lib/tests/write_source_files/symlinks_input/a/test.txt b/lib/tests/write_source_files/symlinks_input/a/test.txt
new file mode 100644
index 000000000..e69de29bb
diff --git a/lib/tests/write_source_files/symlinks_input/b/test.txt b/lib/tests/write_source_files/symlinks_input/b/test.txt
new file mode 120000
index 000000000..51c51934e
--- /dev/null
+++ b/lib/tests/write_source_files/symlinks_input/b/test.txt
@@ -0,0 +1 @@
+../a/test.txt
\ No newline at end of file