chore(bazel): configure build metadata

.bazelrc

@@ -3,4 +3,5 @@ build --bes_backend=grpcs://remote.buildbuddy.io
 build --remote_cache=grpcs://remote.buildbuddy.io
 build --noremote_upload_local_results # Uploads logs & artifacts without writing to cache
 build --remote_timeout=3600
-build --remote_header=x-buildbuddy-api-key=I5gSTxNI5ZvfXkxbkVgz
+build --remote_header=x-buildbuddy-api-key=I5gSTxNI5ZvfXkxbkVgz
+build --workspace_status_command=$(pwd)/workspace_status.sh

tools/latest_version_tag.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+set -e
+
+# Prints the latest BuildBuddy version tag, like "v2.12.8"
+git tag -l 'v*' --sort=creatordate |
+    perl -nle 'if (/^v\d+\.\d+\.\d+$/) { print $_ }' |
+    tail -n1

workspace_status.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+
+# This script will be run bazel when building process starts to
+# generate key-value information that represents the status of the
+# workspace. The output should be like
+#
+# KEY1 VALUE1
+# KEY2 VALUE2
+#
+# If the script exits with non-zero code, it's considered as a failure
+# and the output will be discarded.
+
+set -eo pipefail # exit immediately if any command fails.
+
+function remove_url_credentials() {
+  which perl >/dev/null && perl -pe 's#//.*?:.*?@#//#' || cat
+}
+
+repo_url=$(git config --get remote.origin.url | remove_url_credentials)
+echo "REPO_URL $repo_url"
+
+commit_sha=$(git rev-parse HEAD)
+echo "COMMIT_SHA $commit_sha"
+
+git_branch=$(git rev-parse --abbrev-ref HEAD)
+echo "GIT_BRANCH $git_branch"
+
+git_tree_status=$(git diff-index --quiet HEAD -- && echo 'Clean' || echo 'Modified')
+echo "GIT_TREE_STATUS $git_tree_status"
+
+# Note: the "STABLE_" suffix causes these to be part of the "stable" workspace
+# status, which may trigger rebuilds of certain targets if these values change
+# and you're building with the "--stamp" flag.
+latest_version_tag=$(./tools/latest_version_tag.sh)
+echo "STABLE_VERSION_TAG $latest_version_tag"
+echo "STABLE_COMMIT_SHA $commit_sha"