Fix most cases of nondeterminism.

Author: benradf

.bazelrc

@@ -1,3 +1,10 @@
+# Use hermetic C++ toolchain from nixpkgs
+build --host_platform=@io_tweag_rules_nixpkgs//nixpkgs/platforms:host
+build --incompatible_enable_cc_toolchain_resolution
+
+# Ensure no environment variables leak into actions
+build --incompatible_strict_action_env
+
 # EngFlow recommended flags
 build --grpc_keepalive_time=30s
 build --nolegacy_important_outputs

WORKSPACE.bazel

@@ -92,13 +92,23 @@ new_git_repository(
     remote = "https://github.com/emikulic/darkhttpd.git",
 )
 
+# https://github.com/bazel-contrib/rules_oci/pull/385
+
 http_archive(
     name = "rules_oci",
     sha256 = "21a7d14f6ddfcb8ca7c5fc9ffa667c937ce4622c7d2b3e17aea1ffbc90c96bed",
     strip_prefix = "rules_oci-1.4.0",
     url = "https://github.com/bazel-contrib/rules_oci/releases/download/v1.4.0/rules_oci-v1.4.0.tar.gz",
 )
 
+#load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
+#
+#git_repository(
+#    name = "rules_oci",
+#    commit = "495b9b592b963c37959dbcac4e68153185b6a580",
+#    remote = "https://github.com/bazel-contrib/rules_oci.git",
+#)
+
 load("@rules_oci//oci:dependencies.bzl", "rules_oci_dependencies")
 
 rules_oci_dependencies()
@@ -140,3 +150,8 @@ load("//docker:defs.bzl", "generate_entrypoint")
 generate_entrypoint(
     name = "docker_entrypoint",
 )
+
+nixpkgs_package(
+    name = "ffmpeg",
+    repository = "@nixpkgs",
+)

diff.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -e
+
+hashes() {
+  sha256sum \
+    bazel-bin/src/life_/life \
+    bazel-bin/gif/animated.gif \
+    bazel-bin/httpd/darkhttpd \
+    bazel-bin/httpd/closure.tar \
+    bazel-bin/docker/overlay.tar \
+    bazel-bin/docker/tarball/tarball.tar
+}
+
+build() {
+  bazel clean
+  bazel shutdown
+  bazel build //...
+}
+
+build; hashes1="$(hashes)"
+build; hashes2="$(hashes)"
+diff <(echo "$hashes1") <(echo "$hashes2")

docker/BUILD.bazel

@@ -1,17 +1,12 @@
 load("@rules_oci//oci:defs.bzl", "oci_image", "oci_tarball")
+load("@rules_pkg//:pkg.bzl", "pkg_tar")
 
-genrule(
+pkg_tar(
     name = "overlay",
     srcs = [
         "@docker_entrypoint//:entrypoint",
         "//gif:animated",
     ],
-    outs = ["overlay.tar"],
-    cmd = """
-        mkdir overlay
-        cp $(SRCS) overlay
-        tar -cf $@ -C overlay .
-    """,
 )
 
 oci_image(

gif/BUILD.bazel

@@ -16,13 +16,16 @@ genrule(
     outs = FRAMES,
 )
 
+FFMPEG = "@ffmpeg//:bin/ffmpeg"
+
 genrule(
     name = "animated",
     srcs = FRAMES,
+    tools = [FFMPEG],
     cmd = """
         vfopts="fps=10,scale=512:-1:flags=lanczos,split[s0][s1];[s0]palettegen[p];[s1][p]paletteuse"
-        ffmpeg -i "$$(dirname $(execpath frame1.png))/frame%d.png" -vf "$$vfopts" $@
-    """,
+        $(execpath {ffmpeg}) -i "$$(dirname $(execpath frame1.png))/frame%d.png" -vf "$$vfopts" $@
+    """.format(ffmpeg = FFMPEG),
     outs = ["animated.gif"],
     visibility = ["//visibility:public"],
 )

httpd/BUILD.bazel

@@ -17,7 +17,7 @@ genrule(
         }
         mkdir closure
         cp $$(closure $< | sort -u) closure
-        tar -cf $@ closure
+        tar --sort=name --mtime=0 --owner=0 --group=0 --numeric-owner -cf $@ closure
     """,
     visibility = ["//visibility:public"],
 )

src/life.go

@@ -7,7 +7,6 @@ import  (
     "math/rand"
     "os"
     "strconv"
-    "time"
 )
 
 type Grid [][]bool
@@ -83,7 +82,7 @@ func (cells Grid) render(dc *gg.Context) {
 }
 
 func main() {
-    rand.Seed(time.Now().UnixNano())
+    rand.Seed(0)
     cellSize, _ := strconv.Atoi(os.Args[1])
     cellCount, _ := strconv.Atoi(os.Args[2])
     frameCount, _ := strconv.Atoi(os.Args[3])