chore: add CI on RBE (aspect-build#137)

.bazelrc

@@ -1,7 +1,5 @@
-# Bazel settings that apply to this repository.
-# Take care to document any settings that you expect users to apply.
-# Settings that apply only to CI are in .github/workflows/ci.bazelrc
-
+# import common bazelrc settings used in this repository and in nested workspaces
+import %workspace%/.bazelrc.common
 
 # Load any settings specific to the current user.
 # .bazelrc.user should appear in .gitignore so that settings are not shared with team members

.bazelrc.common

@@ -0,0 +1,49 @@
+# Bazel settings that apply to this repository.
+# Take care to document any settings that you expect users to apply.
+# Settings that apply only to CI are in .github/workflows/ci.bazelrc
+
+# Allow the Bazel server to check directory sources for changes.
+# Recommended when using copy_directory, see
+# https://github.com/aspect-build/bazel-lib/blob/main/docs/copy_directory.md
+startup --host_jvm_args=-DBAZEL_TRACK_SOURCE_DIRECTORIES=1
+
+# In general, the rules in this repository assume that runfiles
+# are enabled as we do not support no runfiles case.
+#
+# If you are developing on Windows, you must either run bazel
+# with administrator priviledges or enable developer mode. If
+# you do not you may hit this error on Windows:
+#
+#   Bazel needs to create symlinks to build the runfiles tree.
+#   Creating symlinks on Windows requires one of the following:
+#       1. Bazel is run with administrator privileges.
+#       2. The system version is Windows 10 Creators Update (1703) or later
+#          and developer mode is enabled.
+build --enable_runfiles
+
+build --incompatible_allow_tags_propagation
+
+common --enable_platform_specific_config
+
+# Turn off legacy external runfiles on all platforms except Windows.
+# This prevents accidentally depending on this feature, which Bazel will remove.
+# Skylib's diff_test implementation for Windows depends on legacy external
+# runfiles so we cannot disable it fully. TODO: disable for all platforms and
+# remove the platform-specific config once the following fix is released:
+# https://github.com/bazelbuild/bazel-skylib/commit/872e9b06e18ae8ba2897cb65b9aaa172aa6279f3
+
+build:linux --nolegacy_external_runfiles
+build:macos --nolegacy_external_runfiles
+build:freebsd --nolegacy_external_runfiles
+build:openbsd --nolegacy_external_runfiles
+
+# Turn on --incompatible_strict_action_env which was on by default
+# in Bazel 0.21.0 but turned off again in 0.22.0. Follow
+# https://github.com/bazelbuild/bazel/issues/7026 for more details.
+# This flag is needed to so that postinstall scripts can be executed
+# on the host.
+# See https://github.com/angular/angular/issues/27514.
+build --incompatible_strict_action_env
+
+# TODO: enable once this is supported in Bazel
+build:rbe --experimental_allow_unresolved_symlinks

.github/workflows/ci.bazelrc

@@ -11,3 +11,34 @@ build --repository_cache=~/.cache/bazel-repo
 test --test_output=errors
 # Allows tests to run bazelisk-in-bazel, since this is the cache folder used
 test --test_env=XDG_CACHE_HOME
+
+# When no remote cache, use a local one
+build:local --disk_cache=~/.cache/bazel
+
+# Generic remote cache
+build --remote_local_fallback
+build --remote_download_toplevel
+build --remote_timeout=3600
+build --remote_upload_local_results
+## Fixes builds hanging on CI that get the TCP connection closed without sending RST packets.
+build --grpc_keepalive_time=30s
+
+# Generic remote build execution
+build:rbe --extra_execution_platforms=@aspect_rules_js//platforms:x86_64_linux_remote
+build:rbe --genrule_strategy=remote
+build:rbe --host_platform=@aspect_rules_js//platforms:x86_64_linux_remote
+build:rbe --jobs=32
+
+# EngFlow remote cache
+build:rbe --bes_backend=grpcs://tourmaline.cluster.engflow.com
+build:rbe --bes_results_url=https://tourmaline.cluster.engflow.com/invocation/
+build:rbe --remote_cache=grpcs://tourmaline.cluster.engflow.com
+
+# EngFlow remote build execution
+build:rbe --remote_executor=grpcs://tourmaline.cluster.engflow.com
+
+# TODO: remove workaround for failure
+build:rbe --modify_execution_info=GoCompilePkg=+no-remote-exec
+
+# These files are written during CI setup, using secrets registered with the CI platforms
+build:rbe --tls_client_certificate=engflow.crt --tls_client_key=engflow.key

.github/workflows/ci.yaml

@@ -17,12 +17,23 @@ jobs:
         runs-on: ubuntu-latest
 
         strategy:
+            fail-fast: false
             matrix:
+                config:
+                    - 'local'
+                    - 'rbe'
                 folder:
                     - '.'
                     - 'e2e/bzlmod'
                     - 'e2e/workspace'
                     - 'e2e/worker'
+                exclude:
+                    # bzlmod broken at 5.3.0 which the RBE bazel fork is bazed on
+                    - config: rbe
+                      folder: e2e/bzlmod
+                    # TODO: e2e/worker needs a bit of to be configured for RBE
+                    - config: rbe
+                      folder: e2e/worker
 
         # Steps represent a sequence of tasks that will be executed as part of the job
         steps:
@@ -47,17 +58,29 @@ jobs:
                       "~/.cache/bazel-repo"
                   key: bazel-cache-${{ hashFiles('**/BUILD.bazel', '**/*.bzl', 'WORKSPACE') }}
                   restore-keys: bazel-cache-
+            - name: Write engflow credentials
+              if: ${{ matrix.config == 'rbe' }}
+              working-directory: ${{ matrix.folder }}
+              run: |
+                  touch engflow.crt engflow.key
+                  chmod 0600 engflow.crt engflow.key
+                  echo "$ENGFLOW_CLIENT_CRT" > engflow.crt
+                  echo "$ENGFLOW_PRIVATE_KEY" > engflow.key
+                  echo "USE_BAZEL_VERSION=aspect-build/6.0.0-aspect1" >> $GITHUB_ENV
+              env:
+                  ENGFLOW_CLIENT_CRT: ${{ secrets.ENGFLOW_CLIENT_CRT }}
+                  ENGFLOW_PRIVATE_KEY: ${{ secrets.ENGFLOW_PRIVATE_KEY }}
             - name: bazel test //...
               env:
                   # Bazelisk will download bazel to here, ensure it is cached between runs.
                   XDG_CACHE_HOME: ~/.cache/bazel-repo
               working-directory: ${{ matrix.folder }}
-              run: bazel --bazelrc=$GITHUB_WORKSPACE/.github/workflows/ci.bazelrc --bazelrc=.bazelrc test //...
+              run: bazel --bazelrc=$GITHUB_WORKSPACE/.github/workflows/ci.bazelrc --bazelrc=.bazelrc test --config=${{ matrix.config }} //...
             # Some tests need buildozer to manipulate BUILD files.
             - uses: actions/setup-go@v3
               if: ${{ hashFiles(format('{0}/test.sh', matrix.folder)) != '' }}
               with:
-                go-version: '1.17.0'
+                  go-version: '1.17.0'
             - run: go install github.com/bazelbuild/buildtools/buildozer@latest
               if: ${{ hashFiles(format('{0}/test.sh', matrix.folder)) != '' }}
             - name: run ./test.sh

e2e/bzlmod/.bazelrc

@@ -1,2 +1,5 @@
+# import common bazelrc shared with e2e workspaces
+import %workspace%/../../.bazelrc.common
+
 common --experimental_enable_bzlmod
 common --registry=https://raw.githubusercontent.com/aspect-build/bazel-central-registry/main/

e2e/worker/.bazelrc

@@ -1 +1,4 @@
+# import common bazelrc shared with e2e workspaces
+import %workspace%/../../.bazelrc.common
+
 build:verbose --define=VERBOSE_LOGS=1

e2e/workspace/.bazelrc

@@ -0,0 +1,2 @@
+# import common bazelrc shared with e2e workspaces
+import %workspace%/../../.bazelrc.common