Pin terraform images

[ted-xie]

No description provided.

[Wyverald]

I'm a bit worried that there are now too many places where we have to update the hashes. Maybe it's time to switch to a tag (like "golden")?

[github-actions]

Terraform Plan for bazel 📖

Plan: 0 to add, 117 to change, 0 to destroy.

Show Plan

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # buildkite_pipeline.abseil-c-plus-plus will be updated in-place
  ~ resource "buildkite_pipeline" "abseil-c-plus-plus" {
      + cluster_name                             = (known after apply)
        id                                       = "UGlwZWxpbmUtLS1lNmRmYTdiYS0xODZhLTQ0NDgtYjc4YS04NGI2ZDk1MWE3ODU="
        name                                     = "Abseil C++"
      ~ provider_settings                        = {
          ~ build_branches                                = false -> (known after apply)
          ~ build_merge_group_checks_requested            = false -> (known after apply)
          ~ build_pull_request_base_branch_changed        = false -> (known after apply)
          ~ build_pull_request_forks                      = false -> (known after apply)
          ~ build_pull_request_labels_changed             = false -> (known after apply)
          ~ build_pull_request_ready_for_review           = false -> (known after apply)
          ~ build_pull_requests                           = false -> (known after apply)
          ~ build_tags                                    = false -> (known after apply)
          ~ cancel_deleted_branch_builds                  = false -> (known after apply)
          ~ cancel_when_merge_group_destroyed             = false -> (known after apply)
          ~ filter_condition                              = null -> (known after apply)
          ~ filter_enabled                                = false -> (known after apply)
          ~ ignore_default_branch_pull_requests           = false -> (known after apply)
          ~ prefix_pull_request_fork_branch_names         = false -> (known after apply)
          ~ publish_blocked_as_pending                    = false -> (known after apply)
          ~ publish_commit_status                         = false -> (known after apply)
          ~ publish_commit_status_per_step                = false -> (known after apply)
          ~ pull_request_branch_filter_configuration      = null -> (known after apply)
          ~ pull_request_branch_filter_enabled            = false -> (known after apply)
          ~ separate_pull_request_statuses                = false -> (known after apply)
          ~ skip_builds_for_existing_commits              = false -> (known after apply)
          ~ skip_pull_request_builds_for_existing_commits = false -> (known after apply)
          ~ use_merge_group_base_commit_for_git_diff_base = false -> (known after apply)
            # (1 unchanged attribute hidden)
        }
      ~ slug                                     = "abseil-c-plus-plus" -> (known after apply)
      ~ steps                                    = <<-EOT
            ---
            env:
              GIT_HTTP_LOW_SPEED_LIMIT: "102400"
              GIT_HTTP_LOW_SPEED_TIME: "180"
            
            steps:
              - command: |-
                  curl -sS "https://raw.githubusercontent.com/bazelbuild/continuous-integration/master/buildkite/bazelci.py?$(date +%s)" -o bazelci.py
                  bash -c 'set -euo pipefail; python3 bazelci.py project_pipeline --http_config=https://raw.githubusercontent.com/bazelbuild/continuous-integration/master/pipelines/abseil-cpp.yml?$(date +%s) | tee /dev/tty | buildkite-agent pipeline upload'
                label: ":pipeline:"
                agents:
                  - "queue=default"
                plugins:
                  - docker#v3.8.0:
                      always-pull: true
                      environment:
                        - "ANDROID_HOME"
                        - "ANDROID_NDK_HOME"
                        - "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION"
          -           image: "gcr.io/bazel-public/ubuntu2404"
          +           image: "gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c"
                      network: "host"
                      privileged: true
                      propagate-environment: true
                      propagate-uid-gid: true
                      volumes:
                        - "/etc/group:/etc/group:ro"
                        - "/etc/passwd:/etc/passwd:ro"
                        - "/etc/shadow:/etc/shadow:ro"
                        - "/opt/android-ndk-r15c:/opt/android-ndk-r15c:ro"
                        - "/opt/android-ndk-r25b:/opt/android-ndk-r25b:ro"
                        - "/opt/android-sdk-linux:/opt/android-sdk-linux:ro"
                        - "/var/lib/buildkite-agent:/var/lib/buildkite-agent"
                        - "/var/lib/gitmirrors:/var/lib/gitmirrors:ro"
        EOT
        tags                                     = []
        # (11 unchanged attributes hidden)
    }

  # buildkite_pipeline.abseil-python will be updated in-place
  ~ resource "buildkite_pipeline" "abseil-python" {
      + cluster_name                             = (known after apply)
        id                                       = "UGlwZWxpbmUtLS1hYjc4MmU5Yy01ZTc3LTQxMjQtYWI0My03YTliMGUzZTEyNTY="
        name                                     = "Abseil Python"
      ~ provider_settings                        = {
          ~ build_branches                                = false -> (known after apply)
          ~ build_merge_group_checks_requested            = false -> (known after apply)
          ~ build_pull_request_base_branch_changed        = false -> (known after apply)
          ~ build_pull_request_forks                      = false -> (known after apply)
          ~ build_pull_request_labels_changed             = false -> (known after apply)
          ~ build_pull_request_ready_for_review           = false -> (known after apply)
          ~ build_pull_requests                           = false -> (known after apply)
          ~ build_tags                                    = false -> (known after apply)
          ~ cancel_deleted_branch_builds                  = false -> (known after apply)
          ~ cancel_when_merge_group_destroyed             = false -> (known after apply)
          ~ filter_condition                              = null -> (known after apply)
          ~ filter_enabled                                = false -> (known after apply)
          ~ ignore_default_branch_pull_requests           = false -> (known after apply)
          ~ prefix_pull_request_fork_branch_names         = false -> (known after apply)
          ~ publish_blocked_as_pending                    = false -> (known after apply)
          ~ publish_commit_status                         = false -> (known after apply)
          ~ publish_commit_status_per_step                = false -> (known after apply)
          ~ pull_request_branch_filter_configuration      = null -> (known after apply)
          ~ pull_request_branch_filter_enabled            = false -> (known after apply)
          ~ separate_pull_request_statuses                = false -> (known after apply)
          ~ skip_builds_for_existing_commits              = false -> (known after apply)
          ~ skip_pull_request_builds_for_existing_commits = false -> (known after apply)
          ~ use_merge_group_base_commit_for_git_diff_base = false -> (known after apply)
            # (1 unchanged attribute hidden)
        }
      ~ slug                                     = "abseil-python" -> (known after apply)
      ~ steps                                    = <<-EOT
            ---
            env:
              GIT_HTTP_LOW_SPEED_LIMIT: "102400"
              GIT_HTTP_LOW_SPEED_TIME: "180"
            
            steps:
              - command: |-
                  curl -sS "https://raw.githubusercontent.com/bazelbuild/continuous-integration/master/buildkite/bazelci.py?$(date +%s)" -o bazelci.py
                  bash -c 'set -euo pipefail; python3 bazelci.py project_pipeline --http_config=https://raw.githubusercontent.com/bazelbuild/continuous-integration/master/pipelines/abseil-py.yml?$(date +%s) | tee /dev/tty | buildkite-agent pipeline upload'
                label: ":pipeline:"
                agents:
                  - "queue=default"
                plugins:
                  - docker#v3.8.0:
                      always-pull: true
                      environment:
                        - "ANDROID_HOME"
                        - "ANDROID_NDK_HOME"
                        - "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION"
          -           image: "gcr.io/bazel-public/ubuntu2404"
          +           image: "gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c"
                      network: "host"
                      privileged: true
                      propagate-environment: true
                      propagate-uid-gid: true
                      volumes:
                        - "/etc/group:/etc/group:ro"
                        - "/etc/passwd:/etc/passwd:ro"
                        - "/etc/shadow:/etc/shadow:ro"
                        - "/opt/android-ndk-r15c:/opt/android-ndk-r15c:ro"
                        - "/opt/android-ndk-r25b:/opt/android-ndk-r25b:ro"
                        - "/opt/android-sdk-linux:/opt/android-sdk-linux:ro"
                        - "/var/lib/buildkite-agent:/var/lib/buildkite-agent"
                        - "/var/lib/gitmirrors:/var/lib/gitmirrors:ro"
        EOT
        tags                                     = []
        # (11 unchanged attributes hidden)
    }

  # buildkite_pipeline.android-testing will be updated in-place
  ~ resource "buildkite_pipeline" "android-testing" {
      + cluster_name                             = (known after apply)
        id                                       = "UGlwZWxpbmUtLS02Y2ZhNTNhMS03ZWNjLTRkMjctYTFiOS01NDJmYTU1OWYyMGY="
        name                                     = "Android Testing"
      ~ slug                                     = "android-testing" -> (known after apply)
      ~ steps                                    = <<-EOT
            ---
            env:
              GIT_HTTP_LOW_SPEED_LIMIT: "102400"
              GIT_HTTP_LOW_SPEED_TIME: "180"
            
            steps:
              - command: |-
                  curl -sS "https://raw.githubusercontent.com/bazelbuild/continuous-integration/master/buildkite/bazelci.py?$(date +%s)" -o bazelci.py
                  bash -c 'set -euo pipefail; python3 bazelci.py project_pipeline --file_config=bazelci/buildkite-pipeline.yml | tee /dev/tty | buildkite-agent pipeline upload'
                label: ":pipeline:"
                agents:
                  - "queue=default"
                plugins:
                  - docker#v3.8.0:
                      always-pull: true
                      environment:
                        - "ANDROID_HOME"
                        - "ANDROID_NDK_HOME"
                        - "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION"
          -           image: "gcr.io/bazel-public/ubuntu2404"
          +           image: "gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c"
                      network: "host"
                      privileged: true
                      propagate-environment: true
                      propagate-uid-gid: true
                      volumes:
                        - "/etc/group:/etc/group:ro"
                        - "/etc/passwd:/etc/passwd:ro"
                        - "/etc/shadow:/etc/shadow:ro"
                        - "/opt/android-ndk-r15c:/opt/android-ndk-r15c:ro"
                        - "/opt/android-ndk-r25b:/opt/android-ndk-r25b:ro"
                        - "/opt/android-sdk-linux:/opt/android-sdk-linux:ro"
                        - "/var/lib/buildkite-agent:/var/lib/buildkite-agent"
                        - "/var/lib/gitmirrors:/var/lib/gitmirrors:ro"
        EOT
        tags                                     = []
        # (12 unchanged attributes hidden)
    }

  # buildkite_pipeline.apple-rules-servicetalk will be updated in-place
  ~ resource "buildkite_pipeline" "apple-rules-servicetalk" {
      + cluster_name                             = (known after apply)
        id                                       = "UGlwZWxpbmUtLS0wMTlmOGU1MS1lYTBmLTQ5MTgtYjZkYy0zMzkzZTAwNjMzMGI="
        name                                     = "apple/rules_servicetalk"
      ~ slug                                     = "apple-rules-servicetalk" -> (known after apply)
      ~ steps                                    = <<-EOT
            ---
            env:
              GIT_HTTP_LOW_SPEED_LIMIT: "102400"
              GIT_HTTP_LOW_SPEED_TIME: "180"
            
            steps:
              - command: |-
                  curl -sS "https://raw.githubusercontent.com/bazelbuild/continuous-integration/master/buildkite/bazelci.py?$(date +%s)" -o bazelci.py
                  bash -c 'set -euo pipefail; python3 bazelci.py project_pipeline --file_config=.bazelci/presubmit.yml | tee /dev/tty | buildkite-agent pipeline upload'
                label: ":pipeline:"
                agents:
                  - "queue=default"
                plugins:
                  - docker#v3.8.0:
                      always-pull: true
                      environment:
                        - "ANDROID_HOME"
                        - "ANDROID_NDK_HOME"
                        - "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION"
          -           image: "gcr.io/bazel-public/ubuntu2404"
          +           image: "gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c"
                      network: "host"
                      privileged: true
                      propagate-environment: true
                      propagate-uid-gid: true
                      volumes:
                        - "/etc/group:/etc/group:ro"
                        - "/etc/passwd:/etc/passwd:ro"
                        - "/etc/shadow:/etc/shadow:ro"
                        - "/opt/android-ndk-r15c:/opt/android-ndk-r15c:ro"
                        - "/opt/android-ndk-r25b:/opt/android-ndk-r25b:ro"
                        - "/opt/android-sdk-linux:/opt/android-sdk-linux:ro"
                        - "/var/lib/buildkite-agent:/var/lib/buildkite-agent"
                        - "/var/lib/gitmirrors:/var/lib/gitmirrors:ro"
        EOT
        tags                                     = []
        # (15 unchanged attributes hidden)
    }

  # buildkite_pipeline.apple-support-darwin will be updated in-place
  ~ resource "buildkite_pipeline" "apple-support-darwin" {
      + cluster_name                             = (known after apply)
        id                                       = "UGlwZWxpbmUtLS1lMWQ5YjA4ZC0zNzFmLTRiYjItOTRmYy02M2FkYTc2YzNhNTU="
        name                                     = "apple_support :darwin:"
      ~ slug                                     = "apple-support-darwin" -> (known after apply)
      ~ steps                                    = <<-EOT
            ---
            env:
              GIT_HTTP_LOW_SPEED_LIMIT: "102400"
              GIT_HTTP_LOW_SPEED_TIME: "180"
            
            steps:
              - command: |-
                  curl -sS "https://raw.githubusercontent.com/bazelbuild/continuous-integration/master/buildkite/bazelci.py?$(date +%s)" -o bazelci.py
                  bash -c 'set -euo pipefail; python3 bazelci.py project_pipeline | tee /dev/tty | buildkite-agent pipeline upload'
                label: ":pipeline:"
                agents:
                  - "queue=default"
                plugins:
                  - docker#v3.8.0:
                      always-pull: true
                      environment:
                        - "ANDROID_HOME"
                        - "ANDROID_NDK_HOME"
                        - "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION"
          -           image: "gcr.io/bazel-public/ubuntu2404"
          +           image: "gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c"
                      network: "host"
                      privileged: true
                      propagate-environment: true
                      propagate-uid-gid: true
                      volumes:
                        - "/etc/group:/etc/group:ro"
                        - "/etc/passwd:/etc/passwd:ro"
                        - "/etc/shadow:/etc/shadow:ro"
                        - "/opt/android-ndk-r15c:/opt/android-ndk-r15c:ro"
                        - "/opt/android-ndk-r25b:/opt/android-ndk-r25b:ro"
                        - "/opt/android-sdk-linux:/opt/android-sdk-linux:ro"
                        - "/var/lib/buildkite-agent:/var/lib/buildkite-agent"
                        - "/var/lib/gitmirrors:/var/lib/gitmirrors:ro"
        EOT
        tags                                     = []
        # (13 unchanged attributes hidden)
    }

  # buildkite_pipeline.bazel-arm64 will be updated in-place
  ~ resource "buildkite_pipeline" "bazel-arm64" {
      + cluster_name                             = (known after apply)
        id                                       = "UGlwZWxpbmUtLS0yMmJkNWViMC03Y2NhLTRlOGUtOTRlOC0zMjMzZTlhMTQ4YTY="
        name                                     = "Bazel (arm64)"
      ~ slug                                     = "bazel-arm64" -> (known after apply)
      ~ steps                                    = <<-EOT
            ---
            env:
              GIT_HTTP_LOW_SPEED_LIMIT: "102400"
              GIT_HTTP_LOW_SPEED_TIME: "180"
            
            steps:
              - command: |-
                  curl -sS "https://raw.githubusercontent.com/bazelbuild/continuous-integration/master/buildkite/bazelci.py?$(date +%s)" -o bazelci.py
                  bash -c 'set -euo pipefail; python3 bazelci.py project_pipeline --http_config=https://raw.githubusercontent.com/bazelbuild/continuous-integration/master/pipelines/bazel-linux-arm64.yml?$(date +%s) | tee /dev/tty | buildkite-agent pipeline upload'
                label: ":pipeline:"
                agents:
                  - "queue=default"
                plugins:
                  - docker#v3.8.0:
                      always-pull: true
                      environment:
                        - "ANDROID_HOME"
                        - "ANDROID_NDK_HOME"
                        - "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION"
          -           image: "gcr.io/bazel-public/ubuntu2404"
          +           image: "gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c"
                      network: "host"
                      privileged: true
                      propagate-environment: true
                      propagate-uid-gid: true
                      volumes:
                        - "/etc/group:/etc/group:ro"
                        - "/etc/passwd:/etc/passwd:ro"
                        - "/etc/shadow:/etc/shadow:ro"
                        - "/opt/android-ndk-r15c:/opt/android-ndk-r15c:ro"
                        - "/opt/android-ndk-r25b:/opt/android-ndk-r25b:ro"
                        - "/opt/android-sdk-linux:/opt/android-sdk-linux:ro"
                        - "/var/lib/buildkite-agent:/var/lib/buildkite-agent"
                        - "/var/lib/gitmirrors:/var/lib/gitmirrors:ro"
        EOT
        tags                                     = []
        # (12 unchanged attributes hidden)
    }

  # buildkite_pipeline.bazel-at-head-plus-disabled will be updated in-place
  ~ resource "buildkite_pipeline" "bazel-at-head-plus-disabled" {
      + cluster_name                             = (known after apply)
        id                                       = "UGlwZWxpbmUtLS1kNjgzMTUzOC00ODRlLTQ3ZjAtOGMyMy1mMGNlMTBlM2UyMGY="
        name                                     = "Bazel@HEAD + Disabled"
      ~ provider_settings                        = {
          ~ build_branches                                = false -> (known after apply)
          ~ build_merge_group_checks_requested            = false -> (known after apply)
          ~ build_pull_request_base_branch_changed        = false -> (known after apply)
          ~ build_pull_request_forks                      = false -> (known after apply)
          ~ build_pull_request_labels_changed             = false -> (known after apply)
          ~ build_pull_request_ready_for_review           = false -> (known after apply)
          ~ build_pull_requests                           = false -> (known after apply)
          ~ build_tags                                    = false -> (known after apply)
          ~ cancel_deleted_branch_builds                  = false -> (known after apply)
          ~ cancel_when_merge_group_destroyed             = false -> (known after apply)
          ~ filter_condition                              = null -> (known after apply)
          ~ filter_enabled                                = false -> (known after apply)
          ~ ignore_default_branch_pull_requests           = false -> (known after apply)
          ~ prefix_pull_request_fork_branch_names         = false -> (known after apply)
          ~ publish_blocked_as_pending                    = false -> (known after apply)
          ~ publish_commit_status                         = false -> (known after apply)
          ~ publish_commit_status_per_step                = false -> (known after apply)
          ~ pull_request_branch_filter_configuration      = null -> (known after apply)
          ~ pull_request_branch_filter_enabled            = false -> (known after apply)
          ~ separate_pull_request_statuses                = false -> (known after apply)
          ~ skip_builds_for_existing_commits              = false -> (known after apply)
          ~ skip_pull_request_builds_for_existing_commits = false -> (known after apply)
          ~ use_merge_group_base_commit_for_git_diff_base = false -> (known after apply)
            # (1 unchanged attribute hidden)
        }
      ~ slug                                     = "bazel-at-head-plus-disabled" -> (known after apply)
      ~ steps                                    = <<-EOT
            ---
            env:
              GIT_HTTP_LOW_SPEED_LIMIT: "102400"
              GIT_HTTP_LOW_SPEED_TIME: "180"
              BAZELCI_DOWNSTREAM_PIPELINE: "true"
            
            steps:
              - command: |-
                  curl -sS "https://raw.githubusercontent.com/bazelbuild/continuous-integration/master/buildkite/bazelci.py?$(date +%s)" -o bazelci.py
                  bash -c 'set -euo pipefail; python3 bazelci.py bazel_downstream_pipeline --file_config=.bazelci/build_bazel_binaries.yml --test_disabled_projects | tee /dev/tty | buildkite-agent pipeline upload'
                label: ":pipeline:"
                agents:
                  - "queue=default"
                plugins:
                  - docker#v3.8.0:
                      always-pull: true
                      environment:
                        - "ANDROID_HOME"
                        - "ANDROID_NDK_HOME"
                        - "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION"
          -           image: "gcr.io/bazel-public/ubuntu2404"
          +           image: "gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c"
                      network: "host"
                      privileged: true
                      propagate-environment: true
                      propagate-uid-gid: true
                      volumes:
                        - "/etc/group:/etc/group:ro"
                        - "/etc/passwd:/etc/passwd:ro"
                        - "/etc/shadow:/etc/shadow:ro"
                        - "/opt/android-ndk-r15c:/opt/android-ndk-r15c:ro"
                        - "/opt/android-ndk-r25b:/opt/android-ndk-r25b:ro"
                        - "/opt/android-sdk-linux:/opt/android-sdk-linux:ro"
                        - "/var/lib/buildkite-agent:/var/lib/buildkite-agent"
                        - "/var/lib/gitmirrors:/var/lib/gitmirrors:ro"
        EOT
        tags                                     = []
        # (11 unchanged attributes hidden)
    }

  # buildkite_pipeline.bazel-at-head-plus-downstream will be updated in-place
  ~ resource "buildkite_pipeline" "bazel-at-head-plus-downstream" {
      + cluster_name                             = (known after apply)
        id                                       = "UGlwZWxpbmUtLS1jYWQ1NTgwYy1hZTIxLTRkZjctOTAxYi1jOTk2YzNiYWY1N2I="
        name                                     = "Bazel@HEAD + Downstream"
      ~ provider_settings                        = {
          ~ build_branches                                = false -> (known after apply)
          ~ build_merge_group_checks_requested            = false -> (known after apply)
          ~ build_pull_request_base_branch_changed        = false -> (known after apply)
          ~ build_pull_request_forks                      = false -> (known after apply)
          ~ build_pull_request_labels_changed             = false -> (known after apply)
          ~ build_pull_request_ready_for_review           = false -> (known after apply)
          ~ build_pull_requests                           = false -> (known after apply)
          ~ build_tags                                    = false -> (known after apply)
          ~ cancel_deleted_branch_builds                  = false -> (known after apply)
          ~ cancel_when_merge_group_destroyed             = false -> (known after apply)
          ~ filter_condition                              = null -> (known after apply)
          ~ filter_enabled                                = false -> (known after apply)
          ~ ignore_default_branch_pull_requests           = false -> (known after apply)
          ~ prefix_pull_request_fork_branch_names         = false -> (known after apply)
          ~ publish_blocked_as_pending                    = false -> (known after apply)
          ~ publish_commit_status                         = false -> (known after apply)
          ~ publish_commit_status_per_step                = false -> (known after apply)
          ~ pull_request_branch_filter_configuration      = null -> (known after apply)
          ~ pull_request_branch_filter_enabled            = false -> (known after apply)
          ~ separate_pull_request_statuses                = false -> (known after apply)
          ~ skip_builds_for_existing_commits              = false -> (known after apply)
          ~ skip_pull_request_builds_for_existing_commits = false -> (known after apply)
          ~ use_merge_group_base_commit_for_git_diff_base = false -> (known after apply)
            # (1 unchanged attribute hidden)
        }
      ~ slug                                     = "bazel-at-head-plus-downstream" -> (known after apply)
      ~ steps                                    = <<-EOT
            ---
            env:
              GIT_HTTP_LOW_SPEED_LIMIT: "102400"
              GIT_HTTP_LOW_SPEED_TIME: "180"
              BAZELCI_DOWNSTREAM_PIPELINE: "true"
              UPDATE_BAZEL_LOCK_FILE: "true"
            
            steps:
              - command: |-
                  curl -sS "https://raw.githubusercontent.com/bazelbuild/continuous-integration/master/buildkite/bazelci.py?$(date +%s)" -o bazelci.py
                  bash -c 'set -euo pipefail; python3 bazelci.py bazel_downstream_pipeline --file_config=.bazelci/build_bazel_binaries.yml | tee /dev/tty | buildkite-agent pipeline upload'
                label: ":pipeline:"
                agents:
                  - "queue=default"
                plugins:
                  - docker#v3.8.0:
                      always-pull: true
                      environment:
                        - "ANDROID_HOME"
                        - "ANDROID_NDK_HOME"
                        - "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION"
          -           image: "gcr.io/bazel-public/ubuntu2404"
          +           image: "gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c"
                      network: "host"
                      privileged: true
                      propagate-environment: true
                      propagate-uid-gid: true
                      volumes:
                        - "/etc/group:/etc/group:ro"
                        - "/etc/passwd:/etc/passwd:ro"
                        - "/etc/shadow:/etc/shadow:ro"
                        - "/opt/android-ndk-r15c:/opt/android-ndk-r15c:ro"
                        - "/opt/android-ndk-r25b:/opt/android-ndk-r25b:ro"
                        - "/opt/android-sdk-linux:/opt/android-sdk-linux:ro"
                        - "/var/lib/buildkite-agent:/var/lib/buildkite-agent"
                        - "/var/lib/gitmirrors:/var/lib/gitmirrors:ro"
        EOT
        tags                                     = []
        # (11 unchanged attributes hidden)
    }

  # buildkite_pipeline.bazel-auto-sheriff-face-with-cowboy-hat will be updated in-place
  ~ resource "buildkite_pipeline" "bazel-auto-sheriff-face-with-cowboy-hat" {
      + cluster_name                             = (known after apply)
        id                                       = "UGlwZWxpbmUtLS1lNTYyYjAzNS1mNzU1LTQzYTMtYjRhMi0zNTU2NDkyNDEyNmY="
        name                                     = "Bazel Auto Sheriff :face_with_cowboy_hat:"
      ~ provider_settings                        = {
          ~ build_branches                                = false -> (known after apply)
          ~ build_merge_group_checks_requested            = false -> (known after apply)
          ~ build_pull_request_base_branch_changed        = false -> (known after apply)
          ~ build_pull_request_forks                      = false -> (known after apply)
          ~ build_pull_request_labels_changed             = false -> (known after apply)
          ~ build_pull_request_ready_for_review           = false -> (known after apply)
          ~ build_pull_requests                           = false -> (known after apply)
          ~ build_tags                                    = false -> (known after apply)
          ~ cancel_deleted_branch_builds                  = false -> (known after apply)
          ~ cancel_when_merge_group_destroyed             = false -> (known after apply)
          ~ filter_condition                              = null -> (known after apply)
          ~ filter_enabled                                = false -> (known after apply)
          ~ ignore_default_branch_pull_requests           = false -> (known after apply)
          ~ prefix_pull_request_fork_branch_names         = false -> (known after apply)
          ~ publish_blocked_as_pending                    = false -> (known after apply)
          ~ publish_commit_status                         = false -> (known after apply)
          ~ publish_commit_status_per_step                = false -> (known after apply)
          ~ pull_request_branch_filter_configuration      = null -> (known after apply)
          ~ pull_request_branch_filter_enabled            = false -> (known after apply)
          ~ separate_pull_request_statuses                = false -> (known after apply)
          ~ skip_builds_for_existing_commits              = false -> (known after apply)
          ~ skip_pull_request_builds_for_existing_commits = false -> (known after apply)
          ~ use_merge_group_base_commit_for_git_diff_base = false -> (known after apply)
            # (1 unchanged attribute hidden)
        }
      ~ slug                                     = "bazel-auto-sheriff-face-with-cowboy-hat" -> (known after apply)
      ~ steps                                    = <<-EOT
            ---
            env:
              GIT_HTTP_LOW_SPEED_LIMIT: "102400"
              GIT_HTTP_LOW_SPEED_TIME: "180"
            
            steps:
              - command: |-
                  cd buildkite
                  python3 bazel_auto_sheriff.py
                label: ":male-police-officer: :female-police-officer: :police_car:"
                agents:
                  - "queue=default"
                plugins:
                  - docker#v3.8.0:
                      always-pull: true
                      environment:
                        - "ANDROID_HOME"
                        - "ANDROID_NDK_HOME"
                        - "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION"
          -           image: "gcr.io/bazel-public/ubuntu2404"
          +           image: "gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c"
                      network: "host"
                      privileged: true
                      propagate-environment: true
                      propagate-uid-gid: true
                      volumes:
                        - "/etc/group:/etc/group:ro"
                        - "/etc/passwd:/etc/passwd:ro"
                        - "/etc/shadow:/etc/shadow:ro"
                        - "/opt/android-ndk-r15c:/opt/android-ndk-r15c:ro"
                        - "/opt/android-ndk-r25b:/opt/android-ndk-r25b:ro"
                        - "/opt/android-sdk-linux:/opt/android-sdk-linux:ro"
                        - "/var/lib/buildkite-agent:/var/lib/buildkite-agent"
                        - "/var/lib/gitmirrors:/var/lib/gitmirrors:ro"
        EOT
        tags                                     = []
        # (11 unchanged attributes hidden)
    }

  # buildkite_pipeline.bazel-bazel will be updated in-place
  ~ resource "buildkite_pipeline" "bazel-bazel" {
      + cluster_name                             = (known after apply)
        id                                       = "UGlwZWxpbmUtLS1lYWFiNWZjNC0yODQzLTRhZDMtOWQ1Ni1lMDc5ZGVlMzRjOTk="
        name                                     = "Bazel :bazel:"
      ~ slug                                     = "bazel-bazel" -> (known after apply)
      ~ steps                                    = <<-EOT
            ---
            env:
              GIT_HTTP_LOW_SPEED_LIMIT: "102400"
              GIT_HTTP_LOW_SPEED_TIME: "180"
              DOCS_DIR: "docs"
              ENABLE_METRICS_COLLECTION: "true"
            
            steps:
              - command: |-
                  curl -sS "https://raw.githubusercontent.com/bazelbuild/continuous-integration/master/buildkite/bazelci.py?$(date +%s)" -o bazelci.py
                  bash -c 'set -euo pipefail; python3 bazelci.py project_pipeline --file_config=.bazelci/postsubmit.yml --print_shard_summary | tee /dev/tty | buildkite-agent pipeline upload'
                label: ":pipeline:"
                agents:
                  - "queue=default"
                plugins:
                  - docker#v3.8.0:
                      always-pull: true
                      environment:
                        - "ANDROID_HOME"
                        - "ANDROID_NDK_HOME"
                        - "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION"
          -           image: "gcr.io/bazel-public/ubuntu2404"
          +           image: "gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c"
                      network: "host"
                      privileged: true
                      propagate-environment: true
                      propagate-uid-gid: true
                      volumes:
                        - "/etc/group:/etc/group:ro"
                        - "/etc/passwd:/etc/passwd:ro"
                        - "/etc/shadow:/etc/shadow:ro"
                        - "/opt/android-ndk-r15c:/opt/android-ndk-r15c:ro"
                        - "/opt/android-ndk-r25b:/opt/android-ndk-r25b:ro"
                        - "/opt/android-sdk-linux:/opt/android-sdk-linux:ro"
                        - "/var/lib/buildkite-agent:/var/lib/buildkite-agent"
                        - "/var/lib/gitmirrors:/var/lib/gitmirrors:ro"
        EOT
        tags                                     = []
        # (13 unchanged attributes hidden)
    }

  # buildkite_pipeline.bazel-bazel-examples will be updated in-place
  ~ resource "buildkite_pipeline" "bazel-bazel-examples" {
      + cluster_name                             = (known after apply)
        id                                       = "UGlwZWxpbmUtLS00ZmYzODhhZi03MDAxLTRlMjQtOTNlYy03YmI0ZWNlYjQ1MWI="
        name                                     = "Bazel :bazel: Examples"
      ~ slug                                     = "bazel-bazel-examples" -> (known after apply)
      ~ steps                                    = <<-EOT
            ---
            env:
              GIT_HTTP_LOW_SPEED_LIMIT: "102400"
              GIT_HTTP_LOW_SPEED_TIME: "180"
            
            steps:
              - command: |-
                  curl -sS "https://raw.githubusercontent.com/bazelbuild/continuous-integration/master/buildkite/bazelci.py?$(date +%s)" -o bazelci.py
                  bash -c 'set -euo pipefail; python3 bazelci.py project_pipeline --file_config=.bazelci/presubmit.yml | tee /dev/tty | buildkite-agent pipeline upload'
                label: ":pipeline:"
                agents:
                  - "queue=default"
                plugins:
                  - docker#v3.8.0:
                      always-pull: true
                      environment:
                        - "ANDROID_HOME"
                        - "ANDROID_NDK_HOME"
                        - "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION"
          -           image: "gcr.io/bazel-public/ubuntu2404"
          +           image: "gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c"
                      network: "host"
                      privileged: true
                      propagate-environment: true
                      propagate-uid-gid: true
                      volumes:
                        - "/etc/group:/etc/group:ro"
                        - "/etc/passwd:/etc/passwd:ro"
                        - "/etc/shadow:/etc/shadow:ro"
                        - "/opt/android-ndk-r15c:/opt/android-ndk-r15c:ro"
                        - "/opt/android-ndk-r25b:/opt/android-ndk-r25b:ro"
                        - "/opt/android-sdk-linux:/opt/android-sdk-linux:ro"
                        - "/var/lib/buildkite-agent:/var/lib/buildkite-agent"
                        - "/var/lib/gitmirrors:/var/lib/gitmirrors:ro"
        EOT
        tags                                     = []
        # (12 unchanged attributes hidden)
    }

  # buildkite_pipeline.bazel-bazel-github-presubmit will be updated in-place
  ~ resource "buildkite_pipeline" "bazel-bazel-github-presubmit" {
      + cluster_name                             = (known after apply)
        id                                       = "UGlwZWxpbmUtLS0xODFlN2NmYS04YTM4LTQ4NGMtYjdlNS01ODg2M2U2NGMwNzE="
        name                                     = "Bazel :bazel: Github Presubmit"
      ~ slug                                     = "bazel-bazel-github-presubmit" -> (known after apply)
      ~ steps                                    = <<-EOT
            ---
            env:
              GIT_HTTP_LOW_SPEED_LIMIT: "102400"
              GIT_HTTP_LOW_SPEED_TIME: "180"
              ENABLE_METRICS_COLLECTION: "true"
              USE_BAZEL_DIFF: "true"
            
            steps:
              - command: |-
                  curl -sS "https://raw.githubusercontent.com/bazelbuild/continuous-integration/master/buildkite/bazelci.py?$(date +%s)" -o bazelci.py
                  bash -c 'set -euo pipefail; python3 bazelci.py project_pipeline --file_config=.bazelci/presubmit.yml | tee /dev/tty | buildkite-agent pipeline upload'
                label: ":pipeline:"
                agents:
                  - "queue=default"
                plugins:
                  - docker#v3.8.0:
                      always-pull: true
                      environment:
                        - "ANDROID_HOME"
                        - "ANDROID_NDK_HOME"
                        - "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION"
          -           image: "gcr.io/bazel-public/ubuntu2404"
          +           image: "gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c"
                      network: "host"
                      privileged: true
                      propagate-environment: true
                      propagate-uid-gid: true
                      volumes:
                        - "/etc/group:/etc/group:ro"
                        - "/etc/passwd:/etc/passwd:ro"
                        - "/etc/shadow:/etc/shadow:ro"
                        - "/opt/android-ndk-r15c:/opt/android-ndk-r15c:ro"
                        - "/opt/android-ndk-r25b:/opt/android-ndk-r25b:ro"
                        - "/opt/android-sdk-linux:/opt/android-sdk-linux:ro"
                        - "/var/lib/buildkite-agent:/var/lib/buildkite-agent"
                        - "/var/lib/gitmirrors:/var/lib/gitmirrors:ro"
        EOT
        tags                                     = []
        # (13 unchanged attributes hidden)
    }

  # buildkite_pipeline.bazel-bazel-macos-ninja will be updated in-place
  ~ resource "buildkite_pipeline" "bazel-bazel-macos-ninja" {
      + cluster_name                             = (known after apply)
        id                                       = "UGlwZWxpbmUtLS0wMThjNGI0NS00YzVmLTRhZWYtYTczNy0xMTMzMTcxOGYyYmY="
        name                                     = "Bazel :bazel: :macos: :ninja:"
      ~ provider_settings                        = {
          ~ build_branches                                = false -> (known after apply)
          ~ build_merge_group_checks_requested            = false -> (known after apply)
          ~ build_pull_request_base_branch_changed        = false -> (known after apply)
          ~ build_pull_request_forks                      = false -> (known after apply)
          ~ build_pull_request_labels_changed             = false -> (known after apply)
          ~ build_pull_request_ready_for_review           = false -> (known after apply)
          ~ build_pull_requests                           = false -> (known after apply)
          ~ build_tags                                    = false -> (known after apply)
          ~ cancel_deleted_branch_builds                  = false -> (known after apply)
          ~ cancel_when_merge_group_destroyed             = false -> (known after apply)
          ~ filter_condition                              = null -> (known after apply)
          ~ filter_enabled                                = false -> (known after apply)
          ~ ignore_default_branch_pull_requests           = false -> (known after apply)
          ~ prefix_pull_request_fork_branch_names         = false -> (known after apply)
          ~ publish_blocked_as_pending                    = false -> (known after apply)
          ~ publish_commit_status                         = false -> (known after apply)
          ~ publish_commit_status_per_step                = false -> (known after apply)
          ~ pull_request_branch_filter_configuration      = null -> (known after apply)
          ~ pull_request_branch_filter_enabled            = false -> (known after apply)
          ~ separate_pull_request_statuses                = false -> (known after apply)
          ~ skip_builds_for_existing_commits              = false -> (known after apply)
          ~ skip_pull_request_builds_for_existing_commits = false -> (known after apply)
          ~ use_merge_group_base_commit_for_git_diff_base = false -> (known after apply)
            # (1 unchanged attribute hidden)
        }
      ~ slug                                     = "bazel-bazel-macos-ninja" -> (known after apply)
      ~ steps                                    = <<-EOT
            ---
            env:
              GIT_HTTP_LOW_SPEED_LIMIT: "102400"
              GIT_HTTP_LOW_SPEED_TIME: "180"
              ENCRYPTED_BUILDKITE_ANALYTICS_TOKEN: "CiQA4DEB9rzbux2bc8Cn1JvZIggsEeEq0GCnh1xykjNdwcgN/YESQgAqwcvXqhZ5FkGlrfoeE5/7JLEqQ0vYCfVIKPI9JR0cuo8s3oYZTyxBjbHEhsnh31+LnK2K3GiLyc+vDP7EyNx0ww=="
            
            steps:
              - command: |-
                  curl -sS "https://raw.githubusercontent.com/fweikert/continuous-integration/token/buildkite/bazelci.py?$(date +%s)" -o bazelci.py
                  bash -c 'set -euo pipefail; python3 bazelci.py --script https://raw.githubusercontent.com/fweikert/continuous-integration/token/buildkite/bazelci.py project_pipeline --print_shard_summary --http_config=https://raw.githubusercontent.com/fweikert/bazel/macos_v2/.bazelci/postsubmit.yml | tee /dev/tty | buildkite-agent pipeline upload'
                label: ":pipeline:"
                agents:
                  - "queue=default"
                plugins:
                  - docker#v3.8.0:
                      always-pull: true
                      environment:
                        - "ANDROID_HOME"
                        - "ANDROID_NDK_HOME"
                        - "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION"
          -           image: "gcr.io/bazel-public/ubuntu2404"
          +           image: "gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c"
                      network: "host"
                      privileged: true
                      propagate-environment: true
                      propagate-uid-gid: true
                      volumes:
                        - "/etc/group:/etc/group:ro"
                        - "/etc/passwd:/etc/passwd:ro"
                        - "/etc/shadow:/etc/shadow:ro"
                        - "/opt/android-ndk-r15c:/opt/android-ndk-r15c:ro"
                        - "/opt/android-ndk-r25b:/opt/android-ndk-r25b:ro"
                        - "/opt/android-sdk-linux:/opt/android-sdk-linux:ro"
                        - "/var/lib/buildkite-agent:/var/lib/buildkite-agent"
                        - "/var/lib/gitmirrors:/var/lib/gitmirrors:ro"
        EOT
        tags                                     = []
        # (12 unchanged attributes hidden)
    }

  # buildkite_pipeline.bazel-bench will be updated in-place
  ~ resource "buildkite_pipeline" "bazel-bench" {
      + cluster_name                             = (known after apply)
        id                                       = "UGlwZWxpbmUtLS04YmMyZWRlMC03MTI3LTQxNjEtYWEwMy1kZTBmMjYxMWQ1NTc="
        name                                     = "bazel-bench"
      ~ slug                                     = "bazel-bench" -> (known after apply)
      ~ steps                                    = <<-EOT
            ---
            env:
              GIT_HTTP_LOW_SPEED_LIMIT: "102400"
              GIT_HTTP_LOW_SPEED_TIME: "180"
            
            steps:
              - command: |-
                  curl -sS "https://raw.githubusercontent.com/bazelbuild/continuous-integration/master/buildkite/bazelci.py?$(date +%s)" -o bazelci.py
                  bash -c 'set -euo pipefail; python3 bazelci.py project_pipeline | tee /dev/tty | buildkite-agent pipeline upload'
                label: ":pipeline:"
                agents:
                  - "queue=default"
                plugins:
                  - docker#v3.8.0:
                      always-pull: true
                      environment:
                        - "ANDROID_HOME"
                        - "ANDROID_NDK_HOME"
                        - "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION"
          -           image: "gcr.io/bazel-public/ubuntu2404"
          +           image: "gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c"
                      network: "host"
                      privileged: true
                      propagate-environment: true
                      propagate-uid-gid: true
                      volumes:
                        - "/etc/group:/etc/group:ro"
                        - "/etc/passwd:/etc/passwd:ro"
                        - "/etc/shadow:/etc/shadow:ro"
                        - "/opt/android-ndk-r15c:/opt/android-ndk-r15c:ro"
                        - "/opt/android-ndk-r25b:/opt/android-ndk-r25b:ro"
                        - "/opt/android-sdk-linux:/opt/android-sdk-linux:ro"
                        - "/var/lib/buildkite-agent:/var/lib/buildkite-agent"
                        - "/var/lib/gitmirrors:/var/lib/gitmirrors:ro"
        EOT
        tags                                     = []
        # (12 unchanged attributes hidden)
    }

  # buildkite_pipeline.bazel-central-registry will be updated in-place
  ~ resource "buildkite_pipeline" "bazel-central-registry" {
      + cluster_name                             = (known after apply)
        id                                       = "UGlwZWxpbmUtLS0wMThiZmNkOC1lYzcwLTQ1Y2EtOGQwYS05YzRiN2Y2ODk5ZDI="
        name                                     = "Bazel Central Registry"
      ~ slug                                     = "bazel-central-registry" -> (known after apply)
      ~ steps                                    = <<-EOT
            ---
            env:
              GIT_HTTP_LOW_SPEED_LIMIT: "102400"
              GIT_HTTP_LOW_SPEED_TIME: "180"
            
            steps:
              - command: |-
                  curl -sS "https://raw.githubusercontent.com/bazelbuild/continuous-integration/master/buildkite/bazelci.py?$(date +%s)" -o bazelci.py
                  bash -c 'set -euo pipefail; python3 bazelci.py project_pipeline | tee /dev/tty | buildkite-agent pipeline upload'
                label: ":pipeline:"
                agents:
                  - "queue=default"
                plugins:
                  - docker#v3.8.0:
                      always-pull: true
                      environment:
                        - "ANDROID_HOME"
                        - "ANDROID_NDK_HOME"
                        - "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION"
          -           image: "gcr.io/bazel-public/ubuntu2404"
          +           image: "gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c"
                      network: "host"
                      privileged: true
                      propagate-environment: true
                      propagate-uid-gid: true
                      volumes:
                        - "/etc/group:/etc/group:ro"
                        - "/etc/passwd:/etc/passwd:ro"
                        - "/etc/shadow:/etc/shadow:ro"
                        - "/opt/android-ndk-r15c:/opt/android-ndk-r15c:ro"
                        - "/opt/android-ndk-r25b:/opt/android-ndk-r25b:ro"
                        - "/opt/android-sdk-linux:/opt/android-sdk-linux:ro"
                        - "/var/lib/buildkite-agent:/var/lib/buildkite-agent"
                        - "/var/lib/gitmirrors:/var/lib/gitmirrors:ro"
        EOT
        tags                                     = []
        # (13 unchanged attributes hidden)
    }

  # buildkite_pipeline.bazel-codelabs will be updated in-place
  ~ resource "buildkite_pipeline" "bazel-codelabs" {
      + cluster_name                             = (known after apply)
        id                                       = "UGlwZWxpbmUtLS1iMGVhOTFlZC1hNzViLTRiZjUtYjcwYy04ZWU4NjMyMTM4NmY="
        name                                     = "Bazel Codelabs"
      ~ slug                                     = "bazel-codelabs" -> (known after apply)
      ~ steps                                    = <<-EOT
            ---
            env:
              GIT_HTTP_LOW_SPEED_LIMIT: "102400"
              GIT_HTTP_LOW_SPEED_TIME: "180"
            
            steps:
              - command: |-
                  curl -sS "https://raw.githubusercontent.com/bazelbuild/continuous-integration/master/buildkite/bazelci.py?$(date +%s)" -o bazelci.py
                  bash -c 'set -euo pipefail; python3 bazelci.py project_pipeline --file_config=.bazelci/presubmit.yml | tee /dev/tty | buildkite-agent pipeline upload'
                label: ":pipeline:"
                agents:
                  - "queue=default"
                plugins:
                  - docker#v3.8.0:
                      always-pull: true
                      environment:
                        - "ANDROID_HOME"
                        - "ANDROID_NDK_HOME"
                        - "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION"
          -           image: "gcr.io/bazel-public/ubuntu2404"
          +           image: "gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c"
                      network: "host"
                      privileged: true
                      propagate-environment: true
                      propagate-uid-gid: true
                      volumes:
                        - "/etc/group:/etc/group:ro"
                        - "/etc/passwd:/etc/passwd:ro"
                        - "/etc/shadow:/etc/shadow:ro"
                        - "/opt/android-ndk-r15c:/opt/android-ndk-r15c:ro"
                        - "/opt/android-ndk-r25b:/opt/android-ndk-r25b:ro"
                        - "/opt/android-sdk-linux:/opt/android-sdk-linux:ro"
                        - "/var/lib/buildkite-agent:/var/lib/buildkite-agent"
                        - "/var/lib/gitmirrors:/var/lib/gitmirrors:ro"
        EOT
        tags                                     = []
        # (12 unchanged attributes hidden)
    }

  # buildkite_pipeline.bazel-gazelle will be updated in-place
  ~ resource "buildkite_pipeline" "bazel-gazelle" {
      + cluster_name                             = (known after apply)
        id                                       = "UGlwZWxpbmUtLS1jZmY0NWU0NS03OWM4LTQ0NzItYjE3My00YzlkODExY2ExODQ="
        name                                     = "Bazel Gazelle"
      ~ slug                                     = "bazel-gazelle" -> (known after apply)
      ~ steps                                    = <<-EOT
            ---
            env:
              GIT_HTTP_LOW_SPEED_LIMIT: "102400"
              GIT_HTTP_LOW_SPEED_TIME: "180"
            
            steps:
              - command: |-
                  curl -sS "https://raw.githubusercontent.com/bazelbuild/continuous-integration/master/buildkite/bazelci.py?$(date +%s)" -o bazelci.py
                  bash -c 'set -euo pipefail; python3 bazelci.py project_pipeline --file_config=.bazelci/presubmit.yml | tee /dev/tty | buildkite-agent pipeline upload'
                label: ":pipeline:"
                agents:
                  - "queue=default"
                plugins:
                  - docker#v3.8.0:
                      always-pull: true
                      environment:
                        - "ANDROID_HOME"
                        - "ANDROID_NDK_HOME"
                        - "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION"
          -           image: "gcr.io/bazel-public/ubuntu2404"
          +           image: "gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c"
                      network: "host"
                      privileged: true
                      propagate-environment: true
                      propagate-uid-gid: true
                      volumes:
                        - "/etc/group:/etc/group:ro"
                        - "/etc/passwd:/etc/passwd:ro"
                        - "/etc/shadow:/etc/shadow:ro"
                        - "/opt/android-ndk-r15c:/opt/android-ndk-r15c:ro"
                        - "/opt/android-ndk-r25b:/opt/android-ndk-r25b:ro"
                        - "/opt/android-sdk-linux:/opt/android-sdk-linux:ro"
                        - "/var/lib/buildkite-agent:/var/lib/buildkite-agent"
                        - "/var/lib/gitmirrors:/var/lib/gitmirrors:ro"
        EOT
        tags                                     = []
        # (12 unchanged attributes hidden)
    }

  # buildkite_pipeline.bazel-platforms-bazel will be updated in-place
  ~ resource "buildkite_pipeline" "bazel-platforms-bazel" {
      + cluster_name                             = (known after apply)
        id                                       = "UGlwZWxpbmUtLS00N2Y5Y2VlOC02OWE5LTRlZDUtOTA0Mi05MTNkYmU2Mzg4MmQ="
        name                                     = "Bazel Platforms :bazel:"
      ~ slug                                     = "bazel-platforms-bazel" -> (known after apply)
      ~ steps                                    = <<-EOT
            ---
            env:
              GIT_HTTP_LOW_SPEED_LIMIT: "102400"
              GIT_HTTP_LOW_SPEED_TIME: "180"
            
            steps:
              - command: |-
                  curl -sS "https://raw.githubusercontent.com/bazelbuild/continuous-integration/master/buildkite/bazelci.py?$(date +%s)" -o bazelci.py
                  bash -c 'set -euo pipefail; python3 bazelci.py project_pipeline | tee /dev/tty | buildkite-agent pipeline upload'
                label: ":pipeline:"
                agents:
                  - "queue=default"
                plugins:
                  - docker#v3.8.0:
                      always-pull: true
                      environment:
                        - "ANDROID_HOME"
                        - "ANDROID_NDK_HOME"
                        - "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION"
          -           image: "gcr.io/bazel-public/ubuntu2404"
          +           image: "gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c"
                      network: "host"
                      privileged: true
                      propagate-environment: true
                      propagate-uid-gid: true
                      volumes:
                        - "/etc/group:/etc/group:ro"
                        - "/etc/passwd:/etc/passwd:ro"
                        - "/etc/shadow:/etc/shadow:ro"
                        - "/opt/android-ndk-r15c:/opt/android-ndk-r15c:ro"
                        - "/opt/android-ndk-r25b:/opt/android-ndk-r25b:ro"
                        - "/opt/android-sdk-linux:/opt/android-sdk-linux:ro"
                        - "/var/lib/buildkite-agent:/var/lib/buildkite-agent"
                        - "/var/lib/gitmirrors:/var/lib/gitmirrors:ro"
        EOT
        tags                                     = []
        # (12 unchanged attributes hidden)
    }

  # buildkite_pipeline.bazel-remote-cache will be updated in-place
  ~ resource "buildkite_pipeline" "bazel-remote-cache" {
      + cluster_name                             = (known after apply)
        id                                       = "UGlwZWxpbmUtLS1hYTk0ZGVlMy0yMTdhLTQ3ODgtYmI3Ni03MmIwMDlkOTk3ZWU="
        name                                     = "Bazel Remote Cache"
      ~ slug                                     = "bazel-remote-cache" -> (known after apply)
      ~ steps                                    = <<-EOT
            ---
            env:
              GIT_HTTP_LOW_SPEED_LIMIT: "102400"
              GIT_HTTP_LOW_SPEED_TIME: "180"
            
            steps:
              - command: |-
                  curl -sS "https://raw.githubusercontent.com/bazelbuild/continuous-integration/master/buildkite/bazelci.py?$(date +%s)" -o bazelci.py
                  bash -c 'set -euo pipefail; python3 bazelci.py project_pipeline | tee /dev/tty | buildkite-agent pipeline upload'
                label: ":pipeline:"
                agents:
                  - "queue=default"
                plugins:
                  - docker#v3.8.0:
                      always-pull: true
                      environment:
                        - "ANDROID_HOME"
                        - "ANDROID_NDK_HOME"
                        - "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION"
          -           image: "gcr.io/bazel-public/ubuntu2404"
          +           image: "gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c"
                      network: "host"
                      privileged: true
                      propagate-environment: true
                      propagate-uid-gid: true
                      volumes:
                        - "/etc/group:/etc/group:ro"
                        - "/etc/passwd:/etc/passwd:ro"
                        - "/etc/shadow:/etc/shadow:ro"
                        - "/opt/android-ndk-r15c:/opt/android-ndk-r15c:ro"
                        - "/opt/android-ndk-r25b:/opt/android-ndk-r25b:ro"
                        - "/opt/android-sdk-linux:/opt/android-sdk-linux:ro"
                        - "/var/lib/buildkite-agent:/var/lib/buildkite-agent"
                        - "/var/lib/gitmirrors:/var/lib/gitmirrors:ro"
        EOT
        tags                                     = []
        # (12 unchanged attributes hidden)
    }

  # buildkite_pipeline.bazel-skylib will be updated in-place
  ~ resource "buildkite_pipeline" "bazel-skylib" {
      + cluster_name                             = (known after apply)
        id                                       = "UGlwZWxpbmUtLS1kZjFmNDc3Yy04ZDgzLTQ4NjMtYTdhOS1iNWYwZmY0N2E3ZDg="
        name                                     = "Bazel skylib"
      ~ slug                                     = "bazel-skylib" -> (known after apply)
      ~ steps                                    = <<-EOT
            ---
            env:
              GIT_HTTP_LOW_SPEED_LIMIT: "102400"
              GIT_HTTP_LOW_SPEED_TIME: "180"
            
            steps:
              - command: |-
                  curl -sS "https://raw.githubusercontent.com/bazelbuild/continuous-integration/master/buildkite/bazelci.py?$(date +%s)" -o bazelci.py
                  bash -c 'set -euo pipefail; python3 bazelci.py project_pipeline | tee /dev/tty | buildkite-agent pipeline upload'
                label: ":pipeline:"
                agents:
                  - "queue=default"
                plugins:
                  - docker#v3.8.0:
                      always-pull: true
                      environment:
                        - "ANDROID_HOME"
                        - "ANDROID_NDK_HOME"
                        - "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION"
          -           image: "gcr.io/bazel-public/ubuntu2404"
          +           image: "gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c"
                      network: "host"
                      privileged: true
                      propagate-environment: true
                      propagate-uid-gid: true
                      volumes:
                        - "/etc/group:/etc/group:ro"
                        - "/etc/passwd:/etc/passwd:ro"
                        - "/etc/shadow:/etc/shadow:ro"
                        - "/opt/android-ndk-r15c:/opt/android-ndk-r15c:ro"
                        - "/opt/android-ndk-r25b:/opt/android-ndk-r25b:ro"
                        - "/opt/android-sdk-linux:/opt/android-sdk-linux:ro"
                        - "/var/lib/buildkite-agent:/var/lib/buildkite-agent"
                        - "/var/lib/gitmirrors:/var/lib/gitmirrors:ro"
        EOT
        tags                                     = []
        # (12 unchanged attributes hidden)
    }

  # buildkite_pipeline.bazel-toolchains will be updated in-place
  ~ resource "buildkite_pipeline" "bazel-toolchains" {
      + cluster_name                             = (known after apply)
        id                                       = "UGlwZWxpbmUtLS05MWZhODIyNC1kMTE1LTRkYjktODA0OS00YTZhM2RkMTYzMjc="
        name                                     = "Bazel toolchains"
      ~ slug                                     = "bazel-toolchains" -> (known af
... (truncated due to length. Read full plan in 'Terraform Plan' step of GitHub Actions run) ...

[meteorcloudy]

Maybe it's time to switch to a tag (like "golden")?

How does a rollback look like with tag? We'd forget which version it was previously?

[ted-xie]

Agreed with Yun - rolling back with a floating tag can be error-prone (granted, we could write some kind of fancy script that makes a bunch of API calls to the GCP Artifact Registry).

I have a script that auto-updates the hashes. I'll check that in internally and share with the team. We can use that going forward to auto-update hashes.

In the future I think we could pursue a middle ground solution, like tag the newly-built images with unique read-only human-readable names (e.g. 20260827-1).