ci: enable GitHub actions for tests (#2953)

Summary:
This commit adds a GitHub Actions workflow definition for our main CI
build and tests. This new workflow will replace our use of Travis CI.
GitHub Actions has much better latency, on the order of seconds instead
of Travis’s minutes (usually) or hours (recently); better concurrency;
comparable incremental build times; and notably faster (30%) clean build
times. Travis is also turning down travis-ci.org in favor of
travis-ci.com, which requires overly broad repository permissions, so we
couldn’t continue with Travis even if we wanted to.

Build artifacts are cached with [Bazel remote caching] talking to a GCS
bucket, `gs://tensorboard-build-cache`. This bucket is publicly
readable, so PRs from untrusted forks may freely read from it. Only
trusted commits will be authorized to write to the build cache. Commits
to master are always trusted, so most of the time, the cache should be
fairly fresh.

[Bazel remote caching]: https://docs.bazel.build/versions/master/remote-caching.html

To proceed, we should merge this commit, make sure that its master build
works, then make it required and make Travis not required. After a few
days of soaking, disable Travis entirely. If something goes wrong, we
can just roll back by making Travis required again.

This does not yet have daily scheduled runs.

Test Plan:
Note that this commit triggers a GitHub Actions workflow that succeeds.

wchargin-branch: gh-actions

.github/workflows/ci.yml

@@ -6,9 +6,6 @@
 # Helpful YAML parser to clarify YAML syntax:
 # https://yaml-online-parser.appspot.com/
 
-# For now, we only use GitHub Actions for lint checks, pending better
-# support for hermetic-style caching. See:
-# https://github.com/actions/cache/issues/109
 name: CI
 
 on:
@@ -20,11 +17,86 @@ on:
   pull_request: {}
 
 env:
+  # Keep this Bazel version in sync with the `versions.check` directive
+  # in our WORKSPACE file.
+  BAZEL_VERSION: '3.7.0'
+  BAZEL_SHA256SUM: 'b7583eec83cc38302997098a40b8c870c37e0ab971a83cb3364c754a178b74ec'
   BUILDTOOLS_VERSION: '3.0.0'
   BUILDIFIER_SHA256SUM: 'e92a6793c7134c5431c58fbc34700664f101e5c9b1c1fcd93b97978e8b7f88db'
   BUILDOZER_SHA256SUM: '3d58a0b6972e4535718cdd6c12778170ea7382de7c75bc3728f5719437ffb84d'
 
 jobs:
+  build:
+    runs-on: ubuntu-16.04
+    needs: lint-python-flake8 # fail fast in case of "undefined variable" errors
+    strategy:
+      fail-fast: false
+      matrix:
+        tf_version_id: ['tf-nightly', 'notf']
+        python_version: ['3.7']
+    steps:
+      - uses: actions/checkout@v1
+      - uses: actions/setup-python@v1
+        with:
+          python-version: ${{ matrix.python_version }}
+          architecture: 'x64'
+      - name: 'Set up Bazel'
+        run: |
+          ci/download_bazel.sh "${BAZEL_VERSION}" "${BAZEL_SHA256SUM}" ~/bazel
+          sudo mv ~/bazel /usr/local/bin/bazel
+          sudo chmod +x /usr/local/bin/bazel
+          cp ./ci/bazelrc ~/.bazelrc
+      - name: 'Configure build cache write credentials'
+        env:
+          CREDS: ${{ secrets.BAZEL_CACHE_SERVICE_ACCOUNT_CREDS }}
+          EVENT_TYPE: ${{ github.event_name }}
+        run: |
+          if [ -z "${CREDS}" ]; then
+            printf 'Using read-only cache (no credentials)\n'
+            exit
+          fi
+          if [ "${EVENT_TYPE}" = pull_request ]; then
+            printf 'Using read-only cache (PR build)\n'
+            exit
+          fi
+          printf 'Using writable cache\n'
+          creds_file=/tmp/service_account_creds.json
+          printf '%s\n' "${CREDS}" >"${creds_file}"
+          printf '%s\n' >>~/.bazelrc \
+            "common --google_credentials=${creds_file}" \
+            "common --remote_upload_local_results=true" \
+            ;
+      - name: 'Install Python dependencies'
+        run: |
+          python -m pip install -U pip
+          pip install \
+            -r ./tensorboard/pip_package/requirements.txt \
+            -r ./tensorboard/pip_package/requirements_dev.txt \
+            ;
+      - name: 'Install TensorFlow'
+        run: pip install "${{ matrix.tf_version_id }}"
+        if: matrix.tf_version_id != 'notf'
+      - name: 'Check Pip state'
+        run: pip freeze --all
+      - name: 'Bazel: fetch'
+        run: bazel fetch //tensorboard/...
+      - name: 'Bazel: build'
+        run: bazel build //tensorboard/...
+      - name: 'Bazel: test (with TensorFlow support)'
+        run: bazel test //tensorboard/...
+        if: matrix.tf_version_id != 'notf'
+      - name: 'Bazel: test (non-TensorFlow only)'
+        run: bazel test //tensorboard/... --test_tag_filters="support_notf"
+        if: matrix.tf_version_id == 'notf'
+      - name: 'Bazel: run Pip package test'
+        run: |
+          bazel run //tensorboard/pip_package:test_pip_package -- \
+            --tf-version "${{ matrix.tf_version_id }}"
+      - name: 'Bazel: run manual tests'
+        run: |
+          bazel test //tensorboard/compat/tensorflow_stub:gfile_s3_test &&
+          bazel test //tensorboard/summary/writer:event_file_writer_s3_test
+
   lint-python-flake8:
     runs-on: ubuntu-16.04
     strategy:

.travis.yml

@@ -22,7 +22,7 @@ cache:
   # every day, and Pip caches are never evicted, so this quickly bloats
   # to many gigabytes and adds minutes to the CI time.
   pip: false
-  # Cache directories for Bazel. See ci/bazelrc for details.
+  # Cache directories for Bazel. See ci/bazelrc_travis for details.
   directories:
     - $HOME/.cache/tb-bazel-repo
     - $HOME/.cache/tb-bazel-disk
@@ -44,7 +44,7 @@ before_install:
   - export BAZEL_SHA256SUM=b7583eec83cc38302997098a40b8c870c37e0ab971a83cb3364c754a178b74ec
   - ci/download_bazel.sh "${BAZEL}" "${BAZEL_SHA256SUM}" ~/bazel
   - sudo mv ~/bazel /usr/local/bin/bazel
-  - cp ci/bazelrc ~/.bazelrc
+  - cp ci/bazelrc_travis ~/.bazelrc
   - elapsed "before_install (done)"
 
 install:

WORKSPACE

@@ -88,7 +88,7 @@ tf_workspace()
 
 load("@bazel_skylib//lib:versions.bzl", "versions")
 # Keep this version in sync with the BAZEL environment variable defined
-# in our .travis.yml config.
+# in our .travis.yml and .github/workflows/ci.yml configs.
 versions.check(minimum_bazel_version = "3.7.0")
 
 load("@io_bazel_rules_sass//:package.bzl", "rules_sass_dependencies")

ci/bazelrc

@@ -1,4 +1,4 @@
-# Limit resources since Travis Trusty GCE VMs have 2 cores and 7.5 GB RAM.
+# Limit resources since GitHub Actions VMs have 2 cores and 7 GB RAM.
 build --local_cpu_resources=2
 build --local_ram_resources=4000
 build --worker_max_instances=2
@@ -18,18 +18,17 @@ build --worker_sandboxing
 # https://github.com/bazelbuild/bazel/issues/7026 (future of action_env)
 build --action_env=PATH
 
-# Set up caching on local disk so incremental builds are faster.
-# See https://bazel.build/designs/2016/09/30/repository-cache.html
-build --repository_cache=~/.cache/tb-bazel-repo
-fetch --repository_cache=~/.cache/tb-bazel-repo
-query --repository_cache=~/.cache/tb-bazel-repo
-# See https://docs.bazel.build/versions/master/remote-caching.html#disk-cache
-build --disk_cache=~/.cache/tb-bazel-disk
-
-# Log more information to help with debugging, and disable curses output which
-# just adds more clutter to the log. (Travis spoofs an interactive terminal.)
-common --curses=no
+# Log more information to help with debugging.
 build --verbose_failures
 build --worker_verbose
 test --test_output=errors
 test --test_verbose_timeout_warnings
+
+# Enable remote caching. This cache is publicly readable, but only writable on
+# trusted commits (e.g., commits to master). We don't write the actual test
+# statuses (or read them if they happen to be there) because not all tests are
+# actually hermetic, and they run pretty quickly, anyway.
+common --remote_cache=https://storage.googleapis.com/tensorboard-build-cache
+common --remote_upload_local_results=false
+test --remote_upload_local_results=false
+test --cache_test_results=false

ci/bazelrc_travis

@@ -0,0 +1,35 @@
+# Limit resources since Travis Trusty GCE VMs have 2 cores and 7.5 GB RAM.
+build --local_cpu_resources=2
+build --local_ram_resources=4000
+build --worker_max_instances=2
+
+# Ensure sandboxing is on to increase hermeticity.
+build --spawn_strategy=sandboxed
+build --worker_sandboxing
+
+# Ensure the PATH env var from our virtualenv propagates into tests, which is
+# no longer on by default in Bazel 0.21.0 and possibly again in the future.
+# We set this flag for "build" since "test" inherits it, but if we don't set
+# it for build too, this causes a rebuild at test time, and if we set it for
+# both we hit https://github.com/bazelbuild/bazel/issues/8237.
+#
+# See also:
+# https://github.com/bazelbuild/bazel/issues/7095 (protobuf PATH sensitivity)
+# https://github.com/bazelbuild/bazel/issues/7026 (future of action_env)
+build --action_env=PATH
+
+# Set up caching on local disk so incremental builds are faster.
+# See https://bazel.build/designs/2016/09/30/repository-cache.html
+build --repository_cache=~/.cache/tb-bazel-repo
+fetch --repository_cache=~/.cache/tb-bazel-repo
+query --repository_cache=~/.cache/tb-bazel-repo
+# See https://docs.bazel.build/versions/master/remote-caching.html#disk-cache
+build --disk_cache=~/.cache/tb-bazel-disk
+
+# Log more information to help with debugging, and disable curses output which
+# just adds more clutter to the log. (Travis spoofs an interactive terminal.)
+common --curses=no
+build --verbose_failures
+build --worker_verbose
+test --test_output=errors
+test --test_verbose_timeout_warnings

tensorboard/pip_package/test_pip_package.sh

@@ -24,7 +24,7 @@ Test pre-built TensorBoard Pip packages.
 Options:
   --tf-version VERSION: Test against the provided version of TensorFlow,
       given as a Pip package specifier like "tensorflow==2.0.0a0" or
-      "tf-nightly". If empty, will test without installing TensorFlow.
+      "tf-nightly". If empty or "notf", will test without installing TensorFlow.
       Defaults to "tf-nightly".
 EOF
 }
@@ -104,6 +104,9 @@ smoke() (
   smoke_venv="${virtualenvs_root}/venv-${smoke_python}/"
   set +x
   printf '\n\n%70s\n' '' | tr ' ' '='
+  if [ "${tf_version}" = notf ]; then
+      tf_version=
+  fi
   if [ -z "${tf_version}" ]; then
     echo "Smoke testing with ${smoke_python} and no tensorflow..."
   else