Bazel Remote Cache Serves Stale Artifacts After External Repository Update

Resolution

Bazel relies on the digest of action inputs to generate cache keys. If an external repository is updated but the WORKSPACE or MODULE.bazel definition remains unchanged (e.g., using a mutable branch name or a moving tag), Bazel continues to use the locally cached version of that repository. Because the input files do not change from Bazel's perspective, the action digest remains identical, and the remote cache serves the stale artifact.

Likely Cause vs. Confirmed Behavior

It is a confirmed behavior that Bazel's remote cache is content-addressable; it does not know that a remote URL has changed if the rule defining that URL has not changed. The "stale" behavior usually stems from mutable references. If you use a branch like master or a tag that was force-pushed, Bazel will not automatically re-fetch the repository unless the rule's attributes change or the local repository cache is invalidated.

Steps to Ensure Fresh Artifacts

To force Bazel to recognize the update and bypass the stale remote cache entries, use one of the following methods:

1. Pin to Immutable References (Recommended): Replace branch names or tags with specific commit SHAs in your git_repository or http_archive rules. Changing the SHA changes the rule definition, which alters the input digest and forces a cache miss.
   • Example: Change tag = "v1.0" to commit = "a1b2c3d...".
2. Force a Repository Sync: If you must use mutable references, force Bazel to re-fetch the external repository before building:

   bazel sync --only=//external:your_repo_name

3. Clear Local Repository Cache: In extreme cases where sync does not trigger a refresh, remove the external repository directory from the Bazel output base (typically found under external/ in your user_root) and rebuild.

Verification

To verify that the cache is no longer serving stale data, run your build with the following flag to observe if the action is being executed locally or fetched from the cache:

bazel build //your:target --remote_upload_local_results=false --verbose_failures

If the build is still hitting the cache despite a repository update, check if the sha256 attribute in your http_archive is still matching the old artifact; if the checksum is the same, Bazel will treat the files as identical.

Required Diagnostic

Are you using http_archive with a fixed sha256 checksum? If the checksum is explicitly defined and matches the old artifact, Bazel will never fetch the new version regardless of the URL change.