DR8 integration workflow

.bazelignore

@@ -1 +1 @@
-build
+build_module_tests

.bazelrc

@@ -14,11 +14,6 @@ common --http_connector_attempts=10
 common --http_connector_retry_max_timeout=30s
 common --http_timeout_scaling=4.0
 
-# Clear ANDROID_HOME for repository rules. rules_android (pulled transitively via
-# grpc-java -> rules_jvm_external) evaluates android_sdk_repository, which fails
-# when ANDROID_HOME points at an incomplete SDK (as on CI runners). None of our
-# code uses Android, so forcing it empty makes the rule emit an empty stub repo.
-common --repo_env=ANDROID_HOME=
 common --extra_toolchains=@score_toolchains_rust//toolchains/ferrocene:ferrocene_x86_64_unknown_linux_gnu
 
 # Java
@@ -34,7 +29,7 @@ build:_common --@score_config_management//score/config_management/config_daemon/
 build:_common --@score_baselibs//score/analysis/tracing/generic_trace_library:implementation=@score_baselibs//score/analysis/tracing/generic_trace_library/stub_implementation
 build:_common --cxxopt=-Wno-error=mismatched-new-delete
 build:_common --host_platform=@score_bazel_platforms//:x86_64-linux-gcc_12.2.0-posix
-build:_common --extra_toolchains=@score_gcc_x86_64_toolchain//:x86_64-linux-gcc_12.2.0
+build:_common --extra_toolchains=@unified_gcc_x86_64_toolchain//:x86_64-linux-gcc_12.2.0
 build:_common --extra_toolchains=//bazel/toolchains:score_ref_int_libclang_toolchain
 
 # Flags needed by datarouter
@@ -71,8 +66,7 @@ build:qnx-aarch64 --extra_toolchains=@score_qnx_aarch64_ifs_toolchain//:ifs-aarc
 
 
 build:linux-x86_64 --config=_common
-build:linux-x86_64 --extra_toolchains=@score_gcc_x86_64_toolchain//:x86_64-linux-gcc_12.2.0
-build:linux-x86_64 --platforms=@score_bazel_platforms//:x86_64-linux-gcc_12.2.0-posix
+build:linux-x86_64 --config=unified
 
 build:eb-aarch64 --config=_common
 build:eb-aarch64 --extra_toolchains=@score_ebclfsa_toolchain//:aarch64-linux-sdk_2.0.0-beta2-ebclfsa
@@ -84,20 +78,6 @@ build:autosd-x86_64 --force_pic
 build:autosd-x86_64 --platforms=@score_bazel_platforms//:x86_64-linux-autosd10
 build:autosd-x86_64 --extra_toolchains=@score_autosd10_x86_64_toolchain//:x86_64-linux-autosd10
 
-# Ferrocene Rust coverage config
-build:ferrocene-coverage --@rules_rust//rust/settings:extra_rustc_flag=-Cinstrument-coverage
-build:ferrocene-coverage --@rules_rust//rust/settings:extra_rustc_flag=-Clink-dead-code
-build:ferrocene-coverage --@rules_rust//rust/settings:extra_rustc_flag=-Ccodegen-units=1
-build:ferrocene-coverage --@rules_rust//rust/settings:extra_rustc_flag=-Cdebuginfo=2
-build:ferrocene-coverage --@rules_rust//rust/settings:extra_exec_rustc_flag=-Cinstrument-coverage
-build:ferrocene-coverage --@rules_rust//rust/settings:extra_exec_rustc_flag=-Clink-dead-code
-build:ferrocene-coverage --@rules_rust//rust/settings:extra_exec_rustc_flag=-Ccodegen-units=1
-build:ferrocene-coverage --@rules_rust//rust/settings:extra_exec_rustc_flag=-Cdebuginfo=2
-test:ferrocene-coverage --run_under=@score_tooling//coverage:llvm_profile_wrapper
-
-# Coverage needs to have all intermediate .rlibs to be able to proceed
-build:ferrocene-coverage --remote_download_all
-
 # Persistency specific flags
 build:ferrocene-coverage-per --config=ferrocene-coverage
 build:ferrocene-coverage-per --@score_baselibs//score/log_rust:safety_level=qm
@@ -118,5 +98,7 @@ test:unit-tests --test_tag_filters=-manual,-miri
 coverage --features=coverage
 coverage --combined_report=lcov
 
+import %workspace%/bazel_common/unified.bazelrc
+
 # user specific overrides (like proxy settings)
 try-import %workspace%/user.bazelrc

.github/workflows/internal_tests.yml

@@ -21,4 +21,4 @@ jobs:
   internal_tests:
     uses: eclipse-score/cicd-workflows/.github/workflows/tests.yml@37eaadadfefc263d94a858d25665735659e916fa
     with:
-      bazel-target: "test //scripts/tooling:tooling_tests //scripts/known_good:known_good_tests"
+      bazel-target: "test //scripts/tooling:tooling_tests //scripts/known_good:known_good_tests //scripts:module_tests_tests"

.github/workflows/module_tests.yml

@@ -0,0 +1,71 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+# Runs every target_sw module's own unit tests against the dependency versions ref_int resolves
+# (known_good.json pins + Bazel MVS for everything else), with ref_int's unified bazelrc config.
+# See scripts/module_tests.py. Called by test_and_docs.yml, which feeds the reports into the docs.
+name: Module Tests
+on:
+  workflow_call:
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  modules:
+    name: List modules
+    runs-on: ubuntu-latest
+    outputs:
+      modules: ${{ steps.modules.outputs.modules }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ github.head_ref || github.event.pull_request.head.ref || github.ref }}
+          repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
+      - name: List modules
+        id: modules
+        run: echo "modules=$(jq -c '.modules.target_sw | keys' known_good.json)" >> "$GITHUB_OUTPUT"
+  test:
+    name: Test ${{ matrix.module }}
+    needs: modules
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        module: ${{ fromJSON(needs.modules.outputs.modules) }}
+    steps:
+      - name: Clean disk space
+        uses: eclipse-score/more-disk-space@v1.1
+        with:
+          level: 4
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ github.head_ref || github.event.pull_request.head.ref || github.ref }}
+          repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
+      - name: Setup Bazel
+        uses: bazel-contrib/setup-bazel@0.18.0
+        with:
+          bazelisk-cache: true
+          disk-cache: ${{ github.workflow }}-${{ matrix.module }}
+          repository-cache: true
+          cache-save: ${{ github.event_name == 'push' && github.ref_name == 'main' }}
+      - name: Run module tests
+        run: python3 scripts/module_tests.py run ${{ matrix.module }}
+      - name: Upload test reports and coverage
+        if: always()
+        uses: actions/upload-artifact@604373da6381bf24206979c74d06a550515601b9 # v4.4.1
+        with:
+          name: module-tests-${{ matrix.module }}
+          # The reports/ root keeps the <module>/ folder, so a merged download has one per module.
+          path: _module_tests/reports/
+          if-no-files-found: warn

.github/workflows/test_and_docs.yml

@@ -33,8 +33,12 @@ concurrency:
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 jobs:
+  module_tests:
+    uses: ./.github/workflows/module_tests.yml
   test_and_docs:
     runs-on: ubuntu-latest
+    needs: module_tests
+    if: ${{ !cancelled() }}
     permissions:
       contents: write # required to upload release assets
       pull-requests: write
@@ -80,33 +84,20 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: '3.12'
-      - name: Install lcov
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y lcov
       - name: Install Graphviz
         uses: eclipse-score/apt-install@main
         with:
           packages: graphviz
           cache: false
-      - name: Execute Unit Tests with Coverage Analysis
-        # Only tag runs are authoritative and re-execute every test from scratch, because they
-        # attach the test-report ZIP and the SBOM as official release assets. The condition is
-        # deliberately the same one those upload steps use, so the two can never drift apart.
-        # Every other event (including push to main) trusts the cache: --nocache_test_results
-        # suppresses not only reading but also WRITING test results into the disk-cache, so a
-        # push run without --trust-cache would save a cache that contains zero test results,
-        # leaving every later PR run with nothing to hit.
-        run: |
-          python ./scripts/quality_runners.py \
-            ${{ github.ref_type != 'tag' && '--trust-cache' || '' }}
       - name: Execute Feature Integration Tests
         run: |
           bazel test --config=linux-x86_64 //feature_integration_tests/test_cases:fit
       - name: Execute Platform Integration Tests
         # Runs in this job - and before the documentation build below - on purpose:
-        # the source code linker of the documentation build scans `bazel-testlogs`
-        # of this very workspace. Only tests executed here contribute their
+        # the source code linker of the documentation build reads the test.xml files
+        # in `tests-report/` of this very workspace, which is filled from this job's
+        # `bazel-testlogs` and the module test reports (see "Collect test reports").
+        # Only tests whose results land there contribute their
         # PartiallyVerifies/FullyVerifies properties as `testlink` attributes to
         # the stakeholder requirement needs, and therefore to the test coverage
         # figures of the platform verification report.
@@ -130,12 +121,35 @@ jobs:
       - name: Build build tools SBOM
         run: |
           bazel build --lockfile_mode=error //:build_tools_sbom
+      - name: Download module test reports
+        uses: actions/download-artifact@v4.1.8
+        with:
+          pattern: module-tests-*
+          path: _module_reports
+          merge-multiple: true
+      - name: Write unit test and coverage summaries
+        # Module unit tests and their coverage come only from module_tests.yml, which runs each
+        # module's own tests against ref_int's resolved dependency versions.
+        run: python ./scripts/module_tests.py report _module_reports
+      - name: Collect test reports for the documentation
+        # The source code linker reads tests-report/ instead of bazel-testlogs/ when it exists, so
+        # ref_int's own results (feature, platform and module integration tests) go in too. Module
+        # unit test results land where ref_int's would (external/<module>+/...), which is how the
+        # linker maps them to known_good.json.
+        run: |
+          rsync -a --copy-links --include='*/' --include='test.xml' --exclude='*' --prune-empty-dirs bazel-testlogs/ tests-report/
+          for report in _module_reports/*; do
+            module="${report##*/}"
+            [ -d "$report/tests" ] || continue
+            mkdir -p "tests-report/external/$module+"
+            cp -r "$report/tests/." "tests-report/external/$module+/"
+          done
       - name: Create archive of test reports
         if: github.ref_type == 'tag'
         run: |
           mkdir -p artifacts
           find bazel-testlogs/external -name 'test.xml' -print0 | xargs -0 -I{} cp --parents {} artifacts/
-          cp -r "$(bazel info --lockfile_mode=error bazel-bin)/coverage/rust-tests" artifacts/rust
+          cp -r _module_reports artifacts/module-tests
           zip -r ${{ github.event.repository.name }}_test_reports.zip artifacts/
         shell: bash
       - name: Upload release asset (attach ZIP to GitHub Release)

.gitignore

@@ -32,3 +32,4 @@ artifacts
 
 #Macos
 .DS_Store
+_module_tests/

MODULE.bazel

@@ -17,6 +17,9 @@ module(
 # Include common modules
 include("//bazel_common:score_basic_bazel.MODULE.bazel")
 
+# Toolchains of the unified config, shared with scripts/module_tests.py
+include("//bazel_common:unified_toolchains.MODULE.bazel")
+
 # GCC toolchains
 include("//bazel_common:score_gcc_toolchains.MODULE.bazel")  # WIP: Not used yet as have problems with IFS toolchain
 

bazel_common/score_gcc_toolchains.MODULE.bazel

@@ -12,13 +12,6 @@
 # *******************************************************************************
 
 gcc = use_extension("@score_bazel_cpp_toolchains//extensions:gcc.bzl", "gcc", dev_dependency = True)
-gcc.toolchain(
-    name = "score_gcc_x86_64_toolchain",
-    target_cpu = "x86_64",
-    target_os = "linux",
-    use_default_package = True,
-    version = "12.2.0",
-)
 gcc.toolchain(
     name = "score_ebclfsa_toolchain",
     runtime_ecosystem = "ebclfsa",
@@ -40,5 +33,4 @@ use_repo(
     gcc,
     "score_autosd10_x86_64_toolchain",
     "score_ebclfsa_toolchain",
-    "score_gcc_x86_64_toolchain",
 )

bazel_common/score_modules_target_sw.MODULE.bazel

@@ -88,6 +88,8 @@ git_override(
     patch_strip = 1,
     patches = [
         "//patches/time:003-disable-broken-qnx-ifs-target.patch",
+        "//patches/time:004-rename-ubuntu-image-pull.patch",
+        "//patches/time:005-use-sanitizer-bool-flags.patch",
     ],
     remote = "https://github.com/eclipse-score/time.git",
 )

bazel_common/score_modules_tooling.MODULE.bazel

@@ -37,11 +37,7 @@ git_override(
 bazel_dep(name = "score_tooling")
 git_override(
     module_name = "score_tooling",
-    commit = "4736b5655f3a73dd353da1bdbeced5febd669664",
-    patch_strip = 1,
-    patches = [
-        "//patches/tooling:001-expose-aspect-rules-lint-non-dev.patch",
-    ],
+    commit = "026e0983a9d65454b449199557ab655f82f5e81a",
     remote = "https://github.com/eclipse-score/tooling.git",
 )
 

bazel_common/score_rust_toolchains.MODULE.bazel

@@ -12,7 +12,7 @@
 # *******************************************************************************
 bazel_dep(name = "rules_rust", version = "0.68.1-score")
 
-bazel_dep(name = "score_toolchains_rust", version = "0.8.0", dev_dependency = True)
+bazel_dep(name = "score_toolchains_rust", version = "0.10.0", dev_dependency = True)
 
 ferrocene = use_extension(
     "@score_toolchains_rust//extensions:ferrocene_toolchain_ext.bzl",

bazel_common/score_test_artifact_versions.MODULE.bazel

@@ -37,5 +37,5 @@ single_version_override(
 # Ferrocene coverage tooling behind those .profraw files.
 single_version_override(
     module_name = "score_toolchains_rust",
-    version = "0.8.0",
+    version = "0.10.0",
 )

bazel_common/unified.bazelrc

@@ -0,0 +1,41 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+# Platform, toolchains and coverage setup shared by ref_int itself (imported from .bazelrc) and
+# by the per-module test runs of scripts/module_tests.py, so every module is tested the same way.
+# Only labels every S-CORE module can see belong here; ref_int-only flags stay in .bazelrc.
+
+# Clear ANDROID_HOME for repository rules. rules_android (pulled transitively via
+# grpc-java -> rules_jvm_external) evaluates android_sdk_repository, which fails
+# when ANDROID_HOME points at an incomplete SDK (as on CI runners). None of our
+# code uses Android, so forcing it empty makes the rule emit an empty stub repo.
+common --repo_env=ANDROID_HOME=
+
+build:unified --host_platform=@score_bazel_platforms//:x86_64-linux-gcc_12.2.0-posix
+build:unified --platforms=@score_bazel_platforms//:x86_64-linux-gcc_12.2.0-posix
+build:unified --extra_toolchains=@unified_gcc_x86_64_toolchain//:x86_64-linux-gcc_12.2.0
+# Only for Rust modules: a C++-only module has no @score_toolchains_rust to resolve it in.
+build:unified-rust --extra_toolchains=@score_toolchains_rust//toolchains/ferrocene:ferrocene_x86_64_unknown_linux_gnu
+
+# Ferrocene Rust coverage config
+build:ferrocene-coverage --@rules_rust//rust/settings:extra_rustc_flag=-Cinstrument-coverage
+build:ferrocene-coverage --@rules_rust//rust/settings:extra_rustc_flag=-Clink-dead-code
+build:ferrocene-coverage --@rules_rust//rust/settings:extra_rustc_flag=-Ccodegen-units=1
+build:ferrocene-coverage --@rules_rust//rust/settings:extra_rustc_flag=-Cdebuginfo=2
+build:ferrocene-coverage --@rules_rust//rust/settings:extra_exec_rustc_flag=-Cinstrument-coverage
+build:ferrocene-coverage --@rules_rust//rust/settings:extra_exec_rustc_flag=-Clink-dead-code
+build:ferrocene-coverage --@rules_rust//rust/settings:extra_exec_rustc_flag=-Ccodegen-units=1
+build:ferrocene-coverage --@rules_rust//rust/settings:extra_exec_rustc_flag=-Cdebuginfo=2
+test:ferrocene-coverage --run_under=@score_tooling//coverage:llvm_profile_wrapper
+
+# Coverage needs to have all intermediate .rlibs to be able to proceed
+build:ferrocene-coverage --remote_download_all

bazel_common/unified_toolchains.MODULE.bazel

@@ -0,0 +1,25 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+# Toolchain definitions of the unified config (unified.bazelrc registers them). Toolchains are
+# defined by module extension tags, which no flag can set, so scripts/module_tests.py includes this
+# file in every tested module's MODULE.bazel too. The unified_ prefix keeps the repos apart from a
+# module's own definitions, which often reuse ref_int's names with other settings.
+unified_gcc = use_extension("@score_bazel_cpp_toolchains//extensions:gcc.bzl", "gcc", dev_dependency = True)
+unified_gcc.toolchain(
+    name = "unified_gcc_x86_64_toolchain",
+    target_cpu = "x86_64",
+    target_os = "linux",
+    use_default_package = True,
+    version = "12.2.0",
+)
+use_repo(unified_gcc, "unified_gcc_x86_64_toolchain")