Description of the bug:

We have multiple CI servers that build the different PRs that developers have in flight. We have noticed that, when switching between branches, and going from a branch using 8.5.0 to a branch using 8.4.2 we encounter a permission problem in the cache, such as this one;

Error in download: java.io.IOException: Error downloading [https://bcr.bazel.build/modules/spdlog/1.16.0.bcr.2/MODULE.bazel] to /home/ghrunner/.cache/bazel/_bazel_ghrunner/bf8118e5e05bc2539a317a3423fb7820/external/spdlog+/MODULE.bazel: /home/ghrunner/.cache/bazel/_bazel_ghrunner/bf8118e5e05bc2539a317a3423fb7820/external/spdlog+/MODULE.bazel (Permission denied)

Looking at the referenced MODULE.bazel file, it has been created without write permissions, which seems to be the cause of the permission denied error.

Which category does this issue belong to?

Core

What's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

A top level MODULES.bazel file with the following dependency;

bazel_dep(name = "spdlog", version = "1.16.0.bcr.2")

Build with 8.5.0, then switch to building the same repo, with 8.4.2, without clearing bazel-out.

Which operating system are you running Bazel on?

Linux (Ubuntu 24.04 on X86 and ARM64) and MacOS (ARM64)

What is the output of bazel info release?

release 8.5.0 and release 8.4.2.

If bazel info release returns development version or (@non-git), tell us how you built Bazel.

No response

What's the output of git remote get-url origin; git rev-parse HEAD ?

A private repo.

If this is a regression, please try to identify the Bazel commit where the bug was introduced with bazelisk --bisect.

No response

Have you found anything relevant by searching the web?

No

Any other information, logs, or outputs that you want to share?

This is not 100% reproducible, but we've hit it 5 times, on different machines, in 3 days. The only fix appears to be deleting the cache (/home/ghrunner/.cache/bazel/ in our case)