DR-008 Option 4: two-stage test-execution workflow (PR 2 of 2)

.github/workflows/internal_tests.yml

@@ -21,4 +21,6 @@ jobs:
   internal_tests:
     uses: eclipse-score/cicd-workflows/.github/workflows/tests.yml@main
     with:
-      bazel-target: "test //scripts/tooling:tooling_tests"
+      # Bundles tooling_tests with known_good_tests and quality_scripts_tests; previously only
+      # tooling_tests ran, so the DR-008 unit tests were never executed in CI.
+      bazel-target: "test //scripts:python_tests"

MODULE.bazel

@@ -41,6 +41,11 @@ include("//bazel_common:score_modules_target_sw.MODULE.bazel")
 # Score test images
 include("//bazel_common:score_images.MODULE.bazel")
 
+# Single-version locks for the deps Stage 2 collects test artifacts from (GTest, the Rust
+# test rules, the ferrocene coverage tooling). Read after the includes above so it pins the
+# versions they bring in transitively.
+include("//bazel_common:score_test_artifact_versions.MODULE.bazel")
+
 bazel_dep(name = "rules_boost", repo_name = "com_github_nelhage_rules_boost")
 archive_override(
     module_name = "rules_boost",

bazel_common/score_modules_target_sw.MODULE.bazel

@@ -15,13 +15,14 @@
 # Do not edit manually - use scripts/known_good/update_module_from_known_good.py
 
 bazel_dep(name = "score_baselibs")
-single_version_override(
+git_override(
     module_name = "score_baselibs",
+    commit = "ce204159f37ee7815907369a8f678583bf102306",
     patch_strip = 1,
     patches = [
         "//patches/baselibs:001-restore-trace-library-mock-visibility.patch",
     ],
-    version = "0.2.9",
+    remote = "https://github.com/eclipse-score/baselibs.git",
 )
 
 bazel_dep(name = "score_communication")

bazel_common/score_rust_toolchains.MODULE.bazel

@@ -12,7 +12,10 @@
 # *******************************************************************************
 bazel_dep(name = "rules_rust", version = "0.68.1-score")
 
-bazel_dep(name = "score_toolchains_rust", version = "0.8.0", dev_dependency = True)
+# 0.9.1 declares the four *_rules_rust_miri toolchains score_lifecycle_health and
+# score_persistency register in their own .bazelrc; 0.8.0 has none. ref_int cannot un-register
+# them, so the version must match here. Locked in score_test_artifact_versions.MODULE.bazel.
+bazel_dep(name = "score_toolchains_rust", version = "0.9.1", dev_dependency = True)
 
 ferrocene = use_extension(
     "@score_toolchains_rust//extensions:ferrocene_toolchain_ext.bzl",

bazel_common/score_test_artifact_versions.MODULE.bazel

@@ -0,0 +1,36 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+#
+# Single versions for the deps Stage 2 collects test artifacts from. A bazel_dep version is
+# only a floor that MVS raises silently; the override is what makes ref_int's version reach
+# resolved_versions.json and every downstream module. Deps nothing is collected from are
+# deliberately absent -- hedron_compile_commands never enters the resolved set at all.
+
+# C++ test binaries and the coverage .dat files genhtml reads.
+single_version_override(
+    module_name = "googletest",
+    version = "1.17.0.bcr.2",
+)
+
+# Rust test rules that build the .profraw-emitting binaries.
+single_version_override(
+    module_name = "rules_rust",
+    version = "0.68.2-score",
+)
+
+# Ferrocene coverage tooling behind those .profraw files. Must move in the same commit as the
+# bazel_dep in score_rust_toolchains.MODULE.bazel, or the bump is overruled back to this value.
+single_version_override(
+    module_name = "score_toolchains_rust",
+    version = "0.9.1",
+)

ci/stage2/module.bazelrc

@@ -0,0 +1,84 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+#
+# DR-008 Stage 2 configuration, owned by reference_integration. Layered ON TOP of the
+# module's own .bazelrc via --bazelrc, so ref_int defines the configs it names in
+# known_good.json instead of dangling a name whose meaning lives downstream.
+#
+# Read last, so single-valued flags here win; --extra_toolchains and other accumulating
+# flags add to what the module already registers. Do NOT add --noworkspace_rc: it was tried and
+# reverted because it discarded module settings unrelated to the configs ref_int names (stub
+# trace-library selection, sandbox settings, module-owned libclang/cc toolchains, Rust coverage
+# instrumentation, clippy aspects), leaving modules configured silently wrong instead of failing.
+# The "3 of 8 modules" figure behind that reversal is a single earlier observation, not re-measured.
+
+# rules_android is pulled in transitively (grpc-java -> rules_jvm_external) and evaluates
+# android_sdk_repository, which fails when ANDROID_HOME points at an incomplete SDK, as on
+# CI runners after the disk-cleanup step. Only score_baselibs guards against this itself.
+common --repo_env=ANDROID_HOME=
+
+# ─── stage2-linux-x86_64: emitted unconditionally by quality_runners.py ──────
+build:stage2-linux-x86_64 --host_platform=@score_bazel_platforms//:x86_64-linux-gcc_12.2.0-posix
+build:stage2-linux-x86_64 --platforms=@score_bazel_platforms//:x86_64-linux-gcc_12.2.0-posix
+
+# Test selection and coverage policy. `coverage` inherits `test` inherits `build`.
+# -miri: ref_int registers no miri toolchain. -no-coverage: gcov-instrumenting a TSAN
+# binary reports false races on the non-atomic __gcov* counters.
+test:stage2-linux-x86_64 --build_tests_only
+test:stage2-linux-x86_64 --test_tag_filters=-manual,-miri,-no-coverage
+test:stage2-linux-x86_64 --test_output=errors
+test:stage2-linux-x86_64 --test_summary=testcase
+test:stage2-linux-x86_64 --test_verbose_timeout_warnings
+test:stage2-linux-x86_64 --test_timeout=1200
+test:stage2-linux-x86_64 --nocache_test_results
+
+coverage:stage2-linux-x86_64 --features=coverage
+coverage:stage2-linux-x86_64 --combined_report=lcov
+# Make gcov counter updates atomic so a multithreaded coverage test is race-free.
+coverage:stage2-linux-x86_64 --copt=-fprofile-update=atomic
+coverage:stage2-linux-x86_64 --linkopt=-fprofile-update=atomic
+
+# ─── stage2-gcc: score's gcc x86_64 toolchain ────────────────────────────────
+# Opt-in because the target name is generated by each module's own gcc.toolchain() call:
+# score_communication passes use_base_constraints_only = True, which yields :x86_64-linux
+# instead, and it registers its own cc toolchain unconditionally — so it omits this.
+build:stage2-gcc --extra_toolchains=@score_gcc_x86_64_toolchain//:x86_64-linux-gcc_12.2.0
+
+# ─── stage2-rust: ferrocene Rust toolchain ───────────────────────────────────
+# Opt-in because score_time declares no score_toolchains_rust, so the apparent repo name
+# does not resolve in its graph. Folds into the base once Phase 1 injects a bazel_dep stub
+# for every module in the resolved set (PR #278).
+build:stage2-rust --extra_toolchains=@score_toolchains_rust//toolchains/ferrocene:ferrocene_x86_64_unknown_linux_gnu
+
+# ─── ferrocene-coverage: Rust coverage instrumentation ───────────────────────
+# Added in code by stage2_config_flags, never opted into via known_good.json: rustc must emit
+# .profraw during the same run ferrocene_report later reads. kyron/persistency/lifecycle_health
+# define this name identically themselves (layering repeats the same values, a no-op);
+# score_logging has no Rust instrumentation config, so this is its only source.
+build:ferrocene-coverage --@rules_rust//rust/settings:extra_rustc_flag=-Cinstrument-coverage
+build:ferrocene-coverage --@rules_rust//rust/settings:extra_rustc_flag=-Clink-dead-code
+build:ferrocene-coverage --@rules_rust//rust/settings:extra_rustc_flag=-Ccodegen-units=1
+build:ferrocene-coverage --@rules_rust//rust/settings:extra_rustc_flag=-Cdebuginfo=2
+build:ferrocene-coverage --@rules_rust//rust/settings:extra_exec_rustc_flag=-Cinstrument-coverage
+build:ferrocene-coverage --@rules_rust//rust/settings:extra_exec_rustc_flag=-Clink-dead-code
+build:ferrocene-coverage --@rules_rust//rust/settings:extra_exec_rustc_flag=-Ccodegen-units=1
+build:ferrocene-coverage --@rules_rust//rust/settings:extra_exec_rustc_flag=-Cdebuginfo=2
+test:ferrocene-coverage --run_under=@score_tooling//coverage:llvm_profile_wrapper
+
+# score_persistency's rust_coverage_config; its own .bazelrc does not define this name, so this
+# is the sole source. Only the two score_baselibs settings are ported -- deps persistency itself
+# declares, so they resolve in its checkout. ref_int's root .bazelrc has a third,
+# @score_logging-relative one, which persistency's `extra_test_config` already passes directly.
+build:ferrocene-coverage-per --config=ferrocene-coverage
+build:ferrocene-coverage-per --@score_baselibs//src/log:safety_level=qm
+build:ferrocene-coverage-per --@score_baselibs//score/json:base_library=nlohmann

known_good.json

@@ -3,7 +3,6 @@
         "target_sw": {
             "score_baselibs": {
                 "repo": "https://github.com/eclipse-score/baselibs.git",
-                "version": "0.2.9",
                 "bazel_patches": [
                     "//patches/baselibs:001-restore-trace-library-mock-visibility.patch"
                 ],
@@ -21,8 +20,13 @@
                     ],
                     "langs": [
                         "cpp"
+                    ],
+                    "bazel_config": [
+                        "stage2-gcc",
+                        "stage2-rust"
                     ]
-                }
+                },
+                "hash": "ce204159f37ee7815907369a8f678583bf102306"
             },
             "score_communication": {
                 "repo": "https://github.com/eclipse-score/communication.git",
@@ -41,6 +45,9 @@
                         "//score/mw/com/impl/tracing/configuration:tracing_filter_config_parser_test",
                         "//score/mw/com/impl/tracing:tracing_runtime_test",
                         "//score/mw/com/impl/bindings/lola/tracing:tracing_runtime_test"
+                    ],
+                    "bazel_config": [
+                        "stage2-rust"
                     ]
                 }
             },
@@ -60,7 +67,11 @@
                     "exclude_test_targets": [
                         "//src/cpp/tests:bm_kvs_cpp"
                     ],
-                    "rust_coverage_config": "ferrocene-coverage-per"
+                    "rust_coverage_config": "ferrocene-coverage-per",
+                    "bazel_config": [
+                        "stage2-gcc",
+                        "stage2-rust"
+                    ]
                 }
             },
             "score_orchestrator": {
@@ -70,6 +81,10 @@
                     "code_root_path": "//src/...",
                     "langs": [
                         "rust"
+                    ],
+                    "bazel_config": [
+                        "stage2-gcc",
+                        "stage2-rust"
                     ]
                 }
             },
@@ -80,6 +95,10 @@
                     "code_root_path": "//src/...",
                     "langs": [
                         "rust"
+                    ],
+                    "bazel_config": [
+                        "stage2-gcc",
+                        "stage2-rust"
                     ]
                 }
             },
@@ -92,6 +111,10 @@
                     "exclude_test_targets": [
                         "//score/health_monitor/src/rust:miri_tests",
                         "//score/launch_manager/src/daemon/src/common/concurrency:mpmc_concurrent_queue_tsan_test"
+                    ],
+                    "bazel_config": [
+                        "stage2-gcc",
+                        "stage2-rust"
                     ]
                 }
             },
@@ -102,7 +125,6 @@
                     "//patches/logging:002-needs-json-deps-not-dev-dependency.patch",
                     "//patches/logging:003-docs-as-code-not-dev-dependency.patch",
                     "//patches/logging:004-rules-pkg-not-dev-dependency.patch"
-
                 ],
                 "metadata": {
                     "code_root_path": "//score/mw/log/...",
@@ -116,6 +138,10 @@
                     ],
                     "exclude_test_targets": [
                         "//score/mw/log/legacy_non_verbose_api:unit_test"
+                    ],
+                    "bazel_config": [
+                        "stage2-gcc",
+                        "stage2-rust"
                     ]
                 }
             },
@@ -125,6 +151,9 @@
                 "metadata": {
                     "langs": [
                         "cpp"
+                    ],
+                    "bazel_config": [
+                        "stage2-gcc"
                     ]
                 }
             }
@@ -165,4 +194,4 @@
         }
     },
     "timestamp": "2026-07-03T00:00:00+00:00Z"
-}
+}

scripts/BUILD

@@ -0,0 +1,45 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+load("@rules_python//python:defs.bzl", "py_library")
+load("@score_tooling//python_basics:defs.bzl", "score_py_pytest")
+
+# The Stage-2 driver and the report aggregator.
+py_library(
+    name = "quality_scripts",
+    srcs = [
+        "aggregate_quality_report.py",
+        "quality_runners.py",
+    ],
+    visibility = ["//visibility:public"],
+    deps = ["//scripts/known_good:known_good"],
+)
+
+# No `data` needed: the tests point STAGE2_RC at a temp file rather than reading
+# ci/stage2/module.bazelrc, so they do not depend on runfiles layout.
+score_py_pytest(
+    name = "quality_scripts_tests",
+    srcs = glob(["tests/**/*.py"]),
+    pytest_config = "//:pyproject.toml",
+    deps = [":quality_scripts"],
+)
+
+# One label for every Python unit test, so CI runs all of them by naming a single target.
+test_suite(
+    name = "python_tests",
+    tests = [
+        ":quality_scripts_tests",
+        "//scripts/known_good:known_good_tests",
+        "//scripts/tooling:tooling_tests",
+    ],
+    visibility = ["//visibility:public"],
+)