---
id: scan-bazel
priority: medium
status: unscanned
created: 2026-03-23
---

## Target

**Repo:** `https://github.com/bazelbuild/bazel`
**Language:** Java
**Why:** Used by Google and large tech companies for builds — linear list membership in dependency graph or action graph traversal inflates analysis phase on large monorepos.

## Scan command

```bash
# Shallow clone
git clone --depth 1 https://github.com/bazelbuild/bazel /tmp/bazel

# Submit to unsandbox
cat > /tmp/scan-bazel.sh << 'EOF'
#!/usr/bin/env bash
set -euo pipefail
GRAPH_KW="tarjan|strongly.connected|dfs|scc|topolog|topo.sort|cycle|reachab|postorder|dominator|liveness|digraph|shortest.path|path.find"
MEM="\.contains\(|ArrayList.*contains|List.*contains|visited\.contains|path\.contains|stack\.contains"
find /tmp/bazel/src/main/java/com/google/devtools/build/lib -name "*.java" | sort | while read f; do
  graph_lines=$(grep -inE "$GRAPH_KW" "$f" 2>/dev/null | cut -d: -f1 | head -5 || true)
  [ -z "$graph_lines" ] && continue
  while IFS= read -r lineno; do
    s=$(( lineno > 20 ? lineno - 20 : 1 )); e=$(( lineno + 20 ))
    hit=$(sed -n "${s},${e}p" "$f" 2>/dev/null | grep -iE "$MEM" | head -1 | sed 's/^\s*//' || true)
    [ -n "$hit" ] && echo "CANDIDATE\t${f}:${lineno}\t${hit}"
  done <<< "$graph_lines"
done
EOF
export UNSANDBOX_PUBLIC_KEY=unsb-pk-russ-test-isth-best
export UNSANDBOX_SECRET_KEY=unsb-sk-rk46c-3zvpg-zjf6z-hjrge
~/git/un-inception/build/un /tmp/scan-bazel.sh
```

## Key files to check

- `src/main/java/com/google/devtools/build/lib/graph/` — Core graph data structure; DFS and SCC implementations
- `src/main/java/com/google/devtools/build/lib/analysis/` — Analysis phase; action graph traversal and cycle detection
- `src/main/java/com/google/devtools/build/lib/skyframe/` — Skyframe incremental evaluation; dependency graph membership

## Expected pattern

`visited.contains(node)` or `cycle.contains(target)` where `visited` or `cycle` is an `ArrayList` (or `List`) rather than a `HashSet` inside `DFS` or `findCycles` in the graph or analysis packages — O(V) per check in what should be an O(V+E) traversal.

## Acceptance criteria

- [ ] Scan run and results saved to `tools/scan-results/bazel.txt`
- [ ] All CANDIDATE hits triaged (confirmed defect or false positive)
- [ ] If confirmed: defect ticket created in `tools/tickets/defects/`