We're excited to announce end-to-end content-defined chunking (CDC) support for Bazel remote caching in BuildBuddy.

With Bazel 9.1 and 8.7 support for --experimental_remote_cache_chunking, large outputs like linker artifacts can be uploaded and downloaded in content-defined chunks instead of as monolithic blobs. That lets BuildBuddy deduplicate similar artifacts across builds, reducing upload bandwidth and storage usage. In one benchmark on the BuildBuddy repo, this showed roughly 40% less uploaded data and a roughly 40% smaller disk cache. Breaking large blobs into smaller reusable pieces also means fewer long-running RPCs and more granular retries.

To enable it, add this flag to your .bazelrc:

common --experimental_remote_cache_chunking

To see the download-side savings, you should also set --disk_cache, since the downloaded chunks need to be stored somewhere in order to be reused locally. We also recommend setting --experimental_disk_cache_gc_max_age to a value below your remote cache TTL—for example, 3h, or 1d if your remote TTL is longer.

Bazel 9.1 and 8.7 support this flag.

BuildBuddy has supported passing short-lived secrets to remote actions via the env-overrides platform property, which redacts values from action cache entries. The new secret-env-overrides and secret-env-overrides-base64 properties extend this protection by also redacting values from workflow logs.

Pass secrets via remote exec headers so they're injected at invocation time without affecting the action hash:

bazel build //my:target \
  --remote_exec_header=x-buildbuddy-platform.secret-env-overrides=API_KEY=sk-abc123,OTHER_KEY=val

For values containing commas or special characters, base64-encode each KEY=VALUE pair:

bazel build //my:target \
  --remote_exec_header=x-buildbuddy-platform.secret-env-overrides-base64=$(echo -n 'CREDS={"token": "abc"}' | base64)

bb explain shows a structural diff of two compact execution logs. It helps answer the common questions: "Why did Bazel re-execute that action?" and "What changed between these builds?"

It can highlight non-hermetic outputs and differences in inputs, environment variables, and arguments.

It works with your last two builds automatically, or you can point it at any invocation IDs:

bb explain
bb explain --old <OLD_INVOCATION_ID> --new <NEW_INVOCATION_ID>