How to Use a Bazel Remote Cache in GitHub Actions

A Bazel remote cache stores action outputs keyed by their inputs, so CI downloads results instead of rebuilding.

Point --remote_cache at your cache endpoint in .bazelrc or on the command line, authenticate with a header flag, and Bazel reuses any action whose inputs are unchanged.

Steps

• Add the remote cache URL and auth to a CI bazelrc.
• Store the auth token as a secret and inject it as a header.
• Run the build; cache hits skip recompilation.

Workflow

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: |
          bazel build //... \
            --remote_cache=grpcs://cache.example.com \
            --remote_header=authorization="Bearer ${{ secrets.BAZEL_CACHE_TOKEN }}" \
            --remote_upload_local_results=true

Gotchas

• PRs from forks should not upload results; gate --remote_upload_local_results to trusted refs.
• Non-hermetic actions poison the cache; pin toolchains so inputs are reproducible.

Related guides