Fix #335 fix #3: tighten canonical-repo match in queryTargetsDependingOnModules

[tinder-maxwellelliott]

Summary

Implements the "loose substring match" tail of #335 (fix #3 in the issue body) and supersedes #346. This branch contains the reproducer commit from #346 with @Ignore dropped, plus the production fix that makes it pass.

The bug

CalculateImpactedTargetsInteractor.queryTargetsDependingOnModules resolved each changed module key to canonical bzlmod repos with:

val matched = allTargets.keys
    .filter { it.startsWith("@@") && it.contains(moduleName) }
    .map { it.substring(2).substringBefore("//") }

it.contains(moduleName) is far too loose. A single changed module like aspect_bazel_lib matched every canonical repo whose name began with that string — @@aspect_bazel_lib+, @@aspect_bazel_lib++toolchains+bats_toolchains, @@aspect_bazel_lib++toolchains+yq_toolchains, etc. On older revisions each match became its own serial bazel query rdeps(//..., @@<repo>//...) subprocess; on the workspace in #335 that produced ~5,000 serial subprocesses and took multiple hours. After the union-into-a-single-query change the rdeps subprocess count dropped, but the over-large rdeps(//..., @@a+//... + @@a++toolchains+x//... + @@a++toolchains+y//...) expression still over-fans-out inside Bazel and pollutes the impacted set.

The fix

Tighten the match to the module's base canonical repo only. The base repo has the shape <moduleName><sep><versionSegment> where <sep> is + or ~ and the remainder contains no further separators. Module-extension repos always layer additional +/~ segments on top and are rejected.

Forms recognised as base:

• Bazel 7+ default: aspect_bazel_lib+
• Bazel <7 / multi-version: aspect_bazel_lib~2.22.5
• Bazel 7+ with version: aspect_bazel_lib+1.0.0

Forms rejected as extension repos:

• aspect_bazel_lib++toolchains+bats_toolchains
• rules_jvm_external~6.0~maven~maven

The narrowing is safe because extension-repo content changes already propagate to main-repo consumers through the per-target hash dep chain: computeSimpleImpactedTargets runs unconditionally for @@* labels and the build-graph hasher folds dep hashes into each rule's hash, so a consumer of a changed extension repo flips its own hash and is picked up without needing an rdeps query targeting the extension repo. The rdeps query exists to catch the harder case — MODULE.bazel-only bumps that don't flip any hash but do change which version of a base module repo is selected — and that's exactly what the base-repo match handles.

Implementation lives in a new private helper canonicalRepoIsBaseForModule(canonical, moduleName) with a doc comment that lays out the canonical-name forms and the safety argument.

Latent test bug fixed alongside

The reproducer's @Before had a Mockito misuse — the second whenever(queryService.query(any<String>())) stub omitted the default-argument matcher and was throwing InvalidUseOfMatchersException before any assertion ran. Because the test was @Ignored the bug was never observed. Dropped the redundant second stub; the first one (whenever(queryService.query(any<String>(), eq(false)))) covers the production caller, which always passes useCquery = false explicitly.

Verification

• bazel test //cli:CalculateImpactedTargetsInteractorTest — PASSED (21/21, including testUnionsRdepsAcrossChangedModules which exercises the ~ form through the same code path).
• bazel test //cli:CalculateImpactedTargetsInteractorIssue335Test — PASSED (the un-@Ignored reproducer now passes).
• Reverted just the production change locally — the reproducer failed with expected to not contain:<"toolchains+bats_toolchains"> but was:<"rdeps(//..., @@aspect_bazel_lib+//... + @@aspect_bazel_lib++toolchains+bats_toolchains//... + @@aspect_bazel_lib++toolchains+yq_toolchains//...)">, confirming the regression test guards the fix.

Test plan

• bazel test //cli:CalculateImpactedTargetsInteractorTest passes.
• bazel test //cli:CalculateImpactedTargetsInteractorIssue335Test passes with the fix; fails as expected without it.
• Spot-checked the helper against both + and ~ canonical forms (base and extension).
• Close #346 in favour of this PR once merged.

🤖 Generated with Claude Code