bazel: add explicit rust test shard labels

Generate separate Bazel test labels for selected large Rust test targets so BuildBuddy can report timing and flakiness per shard. Keep the original aggregate target names as test_suites over the generated shard targets.

For integration tests, compile one manual *-all-test-bin rust_test and make each shard label a lightweight wrapper around that binary. This preserves distinct BuildBuddy labels without compiling the same test crate once per shard.

Patch the pinned rules_rust archive with the stable name-hash sharding, explicit RULES_RUST_TEST_* env support, Windows manifest fallback, Windows-safe PowerShell UInt32 masking, and isolated Windows shard temp files from hermeticbuild/rules_rust#14 until Codex can bump to a merged rules_rust commit that contains it.

Co-authored-by: Codex <noreply@openai.com>

Author: bolinfest

BUILD.bazel

@@ -37,6 +37,8 @@ alias(
 
 exports_files([
     "AGENTS.md",
+    "test_binary_test_launcher.bat.tpl",
+    "test_binary_test_launcher.sh.tpl",
     "workspace_root_test_launcher.bat.tpl",
     "workspace_root_test_launcher.sh.tpl",
 ])

MODULE.bazel

@@ -94,25 +94,40 @@ single_version_override(
 )
 
 rules_rust = use_extension("@rules_rs//rs/experimental:rules_rust.bzl", "rules_rust")
-# Build-script probe binaries inherit CFLAGS/CXXFLAGS from Bazel's C++
-# toolchain. On `windows-gnullvm`, llvm-mingw does not ship
-# `libssp_nonshared`, so strip the forwarded stack-protector flags there.
-rules_rust.patch(
+
+bazel_dep(name = "rules_rust", version = "0.69.0")
+
+# `rules_rs` 0.0.43 pins an older hermeticbuild/rules_rust commit. Override the
+# extension-created repo so Codex can use rust_test sharding from #14 without
+# updating the entire rules_rs module.
+#
+# Build-script probe binaries inherit CFLAGS/CXXFLAGS from Bazel's C++ toolchain.
+# On `windows-gnullvm`, llvm-mingw does not ship `libssp_nonshared`, so strip the
+# forwarded stack-protector flags there.
+archive_override(
+    module_name = "rules_rust",
+    integrity = "sha256-q37yA5WS3++LIgdkThIhxsQkoZ5F/+DD4GhTWkY1rkE=",
+    patch_strip = 1,
     patches = [
         "//patches:rules_rust_windows_gnullvm_build_script.patch",
         "//patches:rules_rust_windows_exec_msvc_build_script_env.patch",
         "//patches:rules_rust_windows_bootstrap_process_wrapper_linker.patch",
         "//patches:rules_rust_windows_build_script_runner_paths.patch",
         "//patches:rules_rust_windows_msvc_direct_link_args.patch",
         "//patches:rules_rust_windows_process_wrapper_skip_temp_outputs.patch",
+        "//patches:rules_rust_stable_explicit_test_shards.patch",
         "//patches:rules_rust_windows_exec_bin_target.patch",
         "//patches:rules_rust_windows_exec_std.patch",
         "//patches:rules_rust_windows_exec_rustc_dev_rlib.patch",
-        "//patches:rules_rust_repository_set_exec_constraints.patch",
     ],
-    strip = 1,
+    strip_prefix = "rules_rust-10825e1a40b8f6d979c51bc795c9d3fa7f78cc6f",
+    urls = ["https://github.com/hermeticbuild/rules_rust/archive/10825e1a40b8f6d979c51bc795c9d3fa7f78cc6f.tar.gz"],
+)
+
+override_repo(
+    rules_rust,
+    rules_rust = "rules_rust",
 )
-use_repo(rules_rust, "rules_rust")
 
 nightly_rust = use_extension(
     "@rules_rs//rs/experimental:rules_rust_reexported_extensions.bzl",

MODULE.bazel.lock

@@ -4,5 +4,9 @@ codex_rust_crate(
     name = "app-server",
     crate_name = "codex_app_server",
     integration_test_timeout = "long",
+    test_shard_counts = {
+        "app-server-all-test": 8,
+        "app-server-unit-tests": 8,
+    },
     test_tags = ["no-sandbox"],
 )

codex-rs/app-server/BUILD.bazel

@@ -47,6 +47,10 @@ codex_rust_crate(
         # succeeds without this workaround.
         "//:AGENTS.md",
     ],
+    test_shard_counts = {
+        "core-all-test": 8,
+        "core-unit-tests": 8,
+    },
     test_tags = ["no-sandbox"],
     unit_test_timeout = "long",
     extra_binaries = [

codex-rs/core/BUILD.bazel

@@ -19,6 +19,9 @@ codex_rust_crate(
         "src/**/*.rs",
         "src/**/snapshots/**",
     ]) + ["//codex-rs/core:model_availability_nux_fixtures"],
+    test_shard_counts = {
+        "tui-unit-tests": 8,
+    },
     integration_compile_data_extra = ["src/test_backend.rs"],
     extra_binaries = [
         "//codex-rs/cli:codex",