ci: enable engflow RBE for github actions

.bazelci/presubmit.yml

@@ -1,18 +0,0 @@
----
-buildifier: latest
-tasks:
-  ubuntu2004:
-    build_targets:
-      - "//..."
-    test_targets:
-      - "//..."
-  macos:
-    build_targets:
-      - "//..."
-    test_targets:
-      - "//..."
-  windows:
-    build_targets:
-      - "//..."
-    test_targets:
-      - "//..."

.bazelrc

@@ -11,7 +11,7 @@ startup --host_jvm_args=-DBAZEL_TRACK_SOURCE_DIRECTORIES=1
 # are enabled as we do not support no runfiles case.
 #
 # If you are developing on Windows, you must either run bazel
-# with administrator priviledges or enable developer mode. If
+# with administrator privileges or enable developer mode. If
 # you do not you may hit this error on Windows:
 #
 #   Bazel needs to create symlinks to build the runfiles tree.
@@ -24,7 +24,7 @@ build --enable_runfiles
 common --enable_platform_specific_config
 
 # Turn off legacy external runfiles on all platforms except Windows.
-# This prevents accidentally dependening on this feature, which Bazel will remove.
+# This allows our users to turn on this flag as well, which is a performance win.
 # Skylib's diff_test implementation for Windows depends on legacy external
 # runfiles so we cannot disable it fully.
 build:linux --nolegacy_external_runfiles
@@ -34,6 +34,8 @@ build:openbsd --nolegacy_external_runfiles
 
 # Print error messages on test failure.
 test --test_output=errors
+# Remind us to set quick tests to short
+test --test_verbose_timeout_warnings
 
 # Load any settings specific to the current user.
 # .bazelrc.user should appear in .gitignore so that settings are not shared with team members.

.github/workflows/ci.bazelrc

@@ -2,6 +2,36 @@
 # Included with a --bazelrc option in the call to bazel
 build --announce_rc
 test --test_output=errors
-build --disk_cache=~/.cache/bazel
 build --repository_cache=~/.cache/bazel-repo
 test --test_env=XDG_CACHE_HOME
+
+# When no remote cache, use a local one
+build:local --disk_cache=~/.cache/bazel
+
+# Generic remote cache
+build --remote_local_fallback
+build --remote_download_toplevel
+build --remote_timeout=3600
+build --remote_upload_local_results
+## Fixes builds hanging on CI that get the TCP connection closed without sending RST packets.
+build --grpc_keepalive_time=30s
+
+# Generic remote build execution
+build:rbe --extra_execution_platforms=@aspect_bazel_lib//platforms:x86_64_linux_remote
+build:rbe --genrule_strategy=remote
+build:rbe --host_platform=@aspect_bazel_lib//platforms:x86_64_linux_remote
+build:rbe --jobs=32
+
+# EngFlow remote cache
+build:rbe --bes_backend=grpcs://tourmaline.cluster.engflow.com
+build:rbe --bes_results_url=https://tourmaline.cluster.engflow.com/invocation/
+build:rbe --remote_cache=grpcs://tourmaline.cluster.engflow.com
+
+# EngFlow remote build execution
+build:rbe --remote_executor=grpcs://tourmaline.cluster.engflow.com
+
+# TODO: remove workaround for failure
+build:rbe --modify_execution_info=GoCompilePkg=+no-remote-exec
+
+# These files are written during CI setup, using secrets registered with the CI platforms
+build:rbe --tls_client_certificate=engflow.crt --tls_client_key=engflow.key

.github/workflows/ci.yaml

@@ -18,6 +18,9 @@ jobs:
 
     strategy:
       matrix:
+        config:
+          - "local"
+          - "rbe"
         folder:
           - "."
           - "e2e/bzlmod"
@@ -35,12 +38,25 @@ jobs:
             "~/.cache/bazel-repo"
           key: bazel-cache-${{ hashFiles('**/BUILD.bazel', '**/*.bzl', 'WORKSPACE') }}
           restore-keys: bazel-cache-
+      - name: Write engflow credentials
+        if: ${{ matrix.config == 'rbe' }}
+        working-directory: ${{ matrix.folder }}
+        run: |
+          touch engflow.crt
+          chmod 0600 engflow.crt
+          echo "$ENGFLOW_CLIENT_CRT" > engflow.crt
+          touch engflow.key
+          chmod 0600 engflow.key
+          echo "$ENGFLOW_PRIVATE_KEY" > engflow.key
+        env:
+          ENGFLOW_CLIENT_CRT: ${{ secrets.ENGFLOW_CLIENT_CRT }}
+          ENGFLOW_PRIVATE_KEY: ${{ secrets.ENGFLOW_PRIVATE_KEY }}
       - name: bazel test //...
         env:
           # Bazelisk will download bazel to here
           XDG_CACHE_HOME: ~/.cache/bazel-repo
         working-directory: ${{ matrix.folder }}
-        run: bazel --bazelrc=$GITHUB_WORKSPACE/.github/workflows/ci.bazelrc --bazelrc=.bazelrc test //...
+        run: bazel --bazelrc=$GITHUB_WORKSPACE/.github/workflows/ci.bazelrc --bazelrc=.bazelrc test --config=${{ matrix.config }} //...
       - name: integration tests
         if: ${{ matrix.folder == '.' }}
         # Find all shell scripts within e2e, echo the filename, execute, fail on error

e2e/copy_to_directory/BUILD.bazel

@@ -1,6 +1,9 @@
 load("@aspect_bazel_lib//lib:copy_to_directory.bzl", "copy_to_directory")
 load("@aspect_bazel_lib//lib:diff_test.bzl", "diff_test")
 
+# TODO: figure out ERROR: cannot compare a directory against a file
+_TODO = ["no-remote-exec"]
+
 # Test special cases of using "." and "./**" patterns in the root package
 
 copy_to_directory(
@@ -27,12 +30,14 @@ diff_test(
     name = "test1",
     file1 = ":dir1",
     file2 = ":expected1",
+    tags = _TODO,
 )
 
 diff_test(
     name = "test1b",
     file1 = ":dir1b",
     file2 = ":expected1",
+    tags = _TODO,
 )
 
 copy_to_directory(
@@ -61,12 +66,14 @@ diff_test(
     name = "test2",
     file1 = ":dir2",
     file2 = ":expected2",
+    tags = _TODO,
 )
 
 diff_test(
     name = "test2b",
     file1 = ":dir2b",
     file2 = ":expected2",
+    tags = _TODO,
 )
 
 copy_to_directory(
@@ -95,10 +102,12 @@ diff_test(
     name = "test3",
     file1 = ":dir3",
     file2 = ":expected3",
+    tags = _TODO,
 )
 
 diff_test(
     name = "test3b",
     file1 = ":dir3b",
     file2 = ":expected3",
+    tags = _TODO,
 )

internal_deps.bzl

@@ -49,10 +49,7 @@ def bazel_lib_internal_deps():
         name = "bazel_skylib",
         sha256 = "07b4117379dde7ab382345c3b0f5edfc6b7cff6c93756eac63da121e0bbcc5de",
         strip_prefix = "bazel-skylib-1.1.1",
-        urls = [
+        urls = ["https://github.com/bazelbuild/bazel-skylib/archive/refs/tags/1.1.1.tar.gz"],
-            "https://mirror.bazel.build/github.com/bazelbuild/bazel-skylib/archive/1.1.1.tar.gz",
-            "https://github.com/bazelbuild/bazel-skylib/archive/refs/tags/1.1.1.tar.gz",
-        ],
     )
 
     http_archive(

lib/tests/write_source_files/BUILD.bazel

@@ -118,6 +118,8 @@ write_source_files(
         "f2.js": ":f-desired",
         "g2.js": ":g-desired",
     },
+    # TODO: figure out ERROR: cannot compare a directory against a file
+    tags = ["no-remote-exec"],
 )
 
 genrule(
@@ -176,6 +178,6 @@ write_source_files(
 write_source_files(
     name = "write_from_external_repo",
     files = {
-        "skylib_LICENSE": "@bazel_skylib//:LICENSE"
+        "skylib_LICENSE": "@bazel_skylib//:LICENSE",
-    }
+    },
 )

platforms/BUILD.bazel

@@ -0,0 +1,12 @@
+platform(
+    name = "x86_64_linux_remote",
+    constraint_values = [
+        "@platforms//os:linux",
+        "@platforms//cpu:x86_64",
+    ],
+    exec_properties = {
+        "OSFamily": "Linux",
+        "container-image": "docker://public.ecr.aws/docker/library/python@sha256:247105bbbe7f7afc7c12ac893be65b5a32951c1d0276392dc2bf09861ba288a6",
+    },
+    visibility = ["//visibility:public"],
+)