Will two machines build the same bytes, and share the cache?
Paste or drop one Bazel workspace's build configuration - .bazelversion, .bazelrc,
MODULE.bazel or WORKSPACE, and the BUILD and .bzl files that matter.
Your browser reads every rc line, repository rule and target and checks what makes a build reproducible
and its cache shared: downloads with no checksum or a placeholder one, git dependencies on a branch,
absolute local paths, curl or the clock inside a genrule, a --config no rc line
defines, and credentials in .bazelrc, the sandbox switched off, an action environment
that leaks into cache keys, every laptop writing the shared cache, plaintext endpoints, stamping on every
build, uncached tests, glob() in deps and WORKSPACE-only dependencies. Free, before you sign in,
and nothing is uploaded. Then pick a lane: the audit gives exact edits for each finding, or
the fix lane writes the whole fixed files - and the page re-checks both.
The companies, hosts, keys and paths in the examples are invented. The first three are audits (the first also carries a saved fix run of its edited files, one click after the audit), the last a fix run; each comes with a saved model reply, so you can see the whole page without signing in or spending a credit.
The audit rates hermeticity, caching, the build graph and the configuration, confirms or dismisses every flag below, adds what rules cannot see, and gives exact before/after edits for each finding - which the page applies to your paste and re-checks.
What this does, and what it does not
The check is a reading of the text, not Bazel: nothing is fetched, analysed or built. Starlark files are
lexed so strings and comments are never mistaken for calls, every top-level call is read with its
attributes, every rc line is read with its command, config and flags (line continuations and quotes
included), and --config chains are followed so a flag that reaches every build through a
config counts. Each flag carries the catalogue id it comes from and the line it points at. The remote
cache, the CI runner, the machines and the files you did not paste are not visible: whether a checksum is
right, which commit was tested, or how many cores CI has is a question you answer in the note, not
something the page assumes. bazel build --profile and the Build Event Protocol - cache hits,
the critical path - remain the ground truth.
The paid lanes see your paste and the page's facts. Every quote and edit they return is checked against your paste, every edit and every returned file is put back and re-checked, and a reply that repeats a credential from your paste is called out. A paste stays in this browser unless you run a lane. Derived from the agent skill @wshobson/bazel-build-optimization by Seth Hobson (wshobson/agents, MIT). Sources are listed in llms.txt.