Summary

The nightly Evergreen unit_tests tasks (including the IBM PPC64LE/s390x nightly variants) currently build in developer mode: they pass -define=MONGO_VERSION=9.1.0-alpha-patch-nogitversion and never set -//bazel/config:release=True. The only place release=True is set is the public-release config (.bazelrc).

We want the nightly unit_tests to build with -release=True so the code under test matches what we ship (e.g. MONGO_CONFIG_EXT_SIG_SECURE is defined, production hardening flags apply), while keeping dynamic linking (-linkstatic=False) and RBE execution, since test artifacts are not released products.

Why

• Secure-mode behavior (signature verification, MONGO_CONFIG_EXT_SIG_SECURE guards) is currently only exercised in real public-release builds, so unit tests can silently diverge from production code paths.
• Example surfaced in PR 10gen/mongo#62074 review: load_extension_test overrides serverGlobalParams.extensionsSignaturePublicKeyPath at runtime in all builds. In secure/release builds that override must be compiled out — the test then cannot load test-key-signed fixtures at all (see the MONGO_CONFIG_EXT_SIG_SECURE guards and the extensions_signature_verification_secure_* target_compatible_with exclusion added in that PR).

Work items

• Add a config (e.g. public-test) that sets -//bazel/config:release=True while keeping linkstatic=False, -config=evg/RBE flags, and tolerating the nogitversion MONGO_VERSION defines that test tasks pass. The commented-out opt_release block in .bazelrc is a starting point.
• Wire the nightly unit_tests (and the IBM nightly variants' unittest_compile_flags) to use it.
• Audit unit tests that rely on non-release behavior:
  • Tests that swap production settings at runtime (like the extensions signature public key override) will break once MONGO_CONFIG_EXT_SIG_SECURE is defined. Prefer making them secure-mode-aware (e.g. assert that test-key-signed fixtures are rejected) over excluding them.
  • Fix the load_extension_test coverage gap: it is tagged mongo_unittest_seventh_group so it never runs on the IBM nightly variants (they only run the monolithic unit_tests task, not the unit_test_group7 split).

Related

• Review discussion: 10gen/mongo#62074 comments (sroches asking whether nightly builds run in release mode and whether excluding load_extension_test removes coverage)