Bazel Remote Cache

Before configuring Bazel Remote Cache, ensure you can access your BuildFetch dashboard and create resources in your account. The setup flow is sequential: create an Org first, then a Project of type Bazel, then generate Project-scoped tokens.

Configuring BuildFetch cache for Bazel is extremely beneficial because it saves time CI, developers, and AI Agents spend rebuilding the same code. When a PR is merged to the main branch, its build results are ready for new builds to consume.

For CI, generate a Project token with cache:readwrite scope. Use this token in your CI environment so pipelines can both read cached artifacts and upload new ones.

For local development, generate cache:readonly token access as well. You can issue one shared token for all developers, or create one token per developer.

Individual cache:readwrite tokens can also be generated, but the user generating them must be a Project admin or an Org admin.

If your build setup is extremely deterministic, it can be beneficial to use developer tokens with cache:readwrite access.

Per-developer tokens are usually preferred because they provide better operational control and make it possible to revoke access for one developer without impacting the rest of the team.

See the official Bazel Remote Caching documentation: https://bazel.build/remote/caching.

Bazel is flexible in how you pass remote cache configuration. BuildFetch recommended way is to keep cache flags in .bazelrc and control push behavior with Bazel configs:

build --remote_cache=https://token-auth:<TOKEN>@<CACHE_HOST>/<PROJECT_ID>/bazel/
build --remote_timeout=30

build:ci --remote_upload_local_results=true
build:dev --remote_upload_local_results=false

On CI, provide credentials through environment variables and build the remote cache URL at runtime, for example:

export BUILDFETCH_BAZEL_REMOTE_CACHE_HOST="cache.example.buildfetch.com"
export BUILDFETCH_BAZEL_PROJECT_ID="project-id"
export BUILDFETCH_BAZEL_REMOTE_CACHE_TOKEN="..."
export BUILDFETCH_BAZEL_REMOTE_CACHE_URL="https://token-auth:${BUILDFETCH_BAZEL_REMOTE_CACHE_TOKEN}@${BUILDFETCH_BAZEL_REMOTE_CACHE_HOST}/${BUILDFETCH_BAZEL_PROJECT_ID}/bazel/"

bazel build //... --config=ci --remote_cache="${BUILDFETCH_BAZEL_REMOTE_CACHE_URL}"

For Developer access, use a local token source (for example shell profile or secret manager) and run Bazel with --config=dev so local builds read from cache without uploading:

export BUILDFETCH_BAZEL_REMOTE_CACHE_HOST="cache.example.buildfetch.com"
export BUILDFETCH_BAZEL_PROJECT_ID="project-id"
export BUILDFETCH_BAZEL_REMOTE_CACHE_TOKEN="..."
export BUILDFETCH_BAZEL_REMOTE_CACHE_URL="https://token-auth:${BUILDFETCH_BAZEL_REMOTE_CACHE_TOKEN}@${BUILDFETCH_BAZEL_REMOTE_CACHE_HOST}/${BUILDFETCH_BAZEL_PROJECT_ID}/bazel/"

bazel test //... --config=dev --remote_cache="${BUILDFETCH_BAZEL_REMOTE_CACHE_URL}"