Hi All:
As you pointed out in your initial post, @kisg, the goal is a controlled, traceable, and reproducible build as it is necessary for safety critical systems. Using Bazel for this purpose might be the most obvious approach, but is strictly speaking an implementation detail.
Spoiler alert: from here on my post is biased!
After deciding to go with Bazel (in absence of other practical solutions) we can pinpoint the goals more precisely. For a PEP we can then select from these:
- completely build from source
- precisely pin all external dependencies
- have complete knowledge about what was used to build an application
- have an efficient and precise caching mechanism
A few of these goals are fulfilled simply by using Bazel correctly, instead of Colcon and CMake. Some other topics require a careful design that will support those goals (repo setup, message generation, ament plugin magic). Those designs are potentially in opposition to solutions currently in place in the ROS ecosystem
One critical point I see is the additional maintenance burden for repo maintainers, since they would have to maintain the build configuration twice, once for CMake and once for Bazel.
Kind regards
Kilian