ci: setup RBE on CI

Author: josephperrott

.bazelrc

@@ -6,3 +6,57 @@ build --strategy=TypeScriptCompile=worker
 build --watchfs
 
 test --test_output=errors
+
+################################
+# Remote Execution Setup       #
+################################
+
+ # Use the Angular team internal GCP instance for remote execution.
+build:remote --remote_instance_name=projects/internal-200822/instances/default_instance
+build:remote --project_id=internal-200822
+
+ # Setup the build strategy for various types of actions. Mixing "local" and "remote"
+# can cause unexpected results and we want to run everything remotely if possible.
+build:remote --spawn_strategy=remote
+build:remote --strategy=Javac=remote
+build:remote --strategy=Closure=remote
+build:remote --strategy=Genrule=remote
+build:remote --define=EXECUTOR=remote
+
+ # Setup the remote build execution servers.
+build:remote --remote_cache=remotebuildexecution.googleapis.com
+build:remote --remote_executor=remotebuildexecution.googleapis.com
+build:remote --tls_enabled=true
+build:remote --auth_enabled=true
+build:remote --remote_timeout=3600
+build:remote --jobs=50
+
+ # Setup the toolchain and platform for the remote build execution. The platform
+# is automatically configured by the "rbe_autoconfig" rule in the project workpsace.
+build:remote --host_javabase=@rbe_ubuntu1604_angular//java:jdk
+build:remote --javabase=@rbe_ubuntu1604_angular//java:jdk
+build:remote --host_java_toolchain=@bazel_tools//tools/jdk:toolchain_hostjdk8
+build:remote --java_toolchain=@bazel_tools//tools/jdk:toolchain_hostjdk8
+build:remote --crosstool_top=@rbe_ubuntu1604_angular//cc:toolchain
+build:remote --action_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
+build:remote --extra_toolchains=@rbe_ubuntu1604_angular//config:cc-toolchain
+build:remote --extra_execution_platforms=//tools:rbe_ubuntu1604-angular
+build:remote --host_platform=//tools:rbe_ubuntu1604-angular
+build:remote --platforms=//tools:rbe_ubuntu1604-angular
+
+  # Setup Build Event Service
+build:remote --bes_backend=buildeventservice.googleapis.com
+build:remote --bes_timeout=30s
+build:remote --bes_results_url="https://source.cloud.google.com/results/invocations/"
+
+ # Set remote caching settings
+build:remote --remote_accept_cached=true
+
+####################################################
+# User bazel configuration
+# NOTE: This needs to be the *last* entry in the config.
+####################################################
+
+# Load any settings which are specific to the current user. Needs to be *last* statement
+# in this config, as the user configuration should be able to overwrite flags from this file.
+try-import .bazelrc.user

.circleci/config.yml

@@ -71,6 +71,27 @@ anchor_6: &ignore_pull_requests
     branches:
       ignore:
         - /pull\/.*/
+anchor_7: &setup_bazel_remote_execution
+  run:
+    name: "Setup bazel RBE remote execution"
+    command: |
+      touch .bazelrc.user;
+      # We need ensure that the same default digest is used for encoding and decoding
+      # with openssl. Openssl versions might have different default digests which can
+      # cause decryption failures based on the openssl version. https://stackoverflow.com/a/39641378/4317734
+      openssl aes-256-cbc -d -in .circleci/gcp_token -md md5 -k "${CIRCLE_PROJECT_REPONAME}" -out /home/circleci/.gcp_credentials;
+      sudo bash -c "echo -e 'build --google_credentials=/home/circleci/.gcp_credentials' >> .bazelrc.user";
+      # Upload/don't upload local results to cache based on environment
+      if [[ -n "{$CIRCLE_PR_NUMBER}" ]]; then
+        sudo bash -c "echo -e 'build:remote --remote_upload_local_results=false\n' >> .bazelrc.user";
+        echo "Not uploading local build results to remote cache.";
+      else
+        sudo bash -c "echo -e 'build:remote --remote_upload_local_results=true\n' >> .bazelrc.user";
+        echo "Uploading local build results to remote cache.";
+      fi
+      # Enable remote builds
+      sudo bash -c "echo -e 'build --config=remote' >> .bazelrc.user";
+      echo "Reading from remote cache for bazel remote jobs.";
 
 # Job definitions
 version: 2.1
@@ -204,6 +225,7 @@ jobs:
     resource_class: xlarge
     steps:
       - attach_workspace: *attach_options
+      - *setup_bazel_remote_execution
       - run: sudo cp .circleci/bazel.rc /etc/bazel.bazelrc
       - run: yarn bazel:test
 

.circleci/gcp_token

@@ -80,3 +80,34 @@ rules_karma_dependencies()
 load("@io_bazel_rules_webtesting//web:repositories.bzl", "web_test_repositories")
 
 web_test_repositories()
+
+##########################
+# Remote Execution Setup #
+##########################
+# Bring in bazel_toolchains for RBE setup configuration.
+http_archive(
+    name = "bazel_toolchains",
+    sha256 = "142bcbd8cb751ce1193a1d7fef4e328493cd0a69cc0555183ad237f81418ba40",
+    strip_prefix = "bazel-toolchains-628224f6cf48e81116d0ee0bf65424eaa630d5b3",
+    urls = ["https://github.com/xingao267/bazel-toolchains/archive/628224f6cf48e81116d0ee0bf65424eaa630d5b3.tar.gz"],
+)
+
+load("@bazel_toolchains//rules:environments.bzl", "clang_env")
+load("@bazel_toolchains//rules:rbe_repo.bzl", "rbe_autoconfig")
+
+rbe_autoconfig(
+    name = "rbe_ubuntu1604_angular",
+    # The sha256 of marketplace.gcr.io/google/rbe-ubuntu16-04 container that is
+    # used by rbe_autoconfig() to pair toolchain configs in the @bazel_toolchains repo.
+    base_container_digest = "sha256:677c1317f14c6fd5eba2fd8ec645bfdc5119f64b3e5e944e13c89e0525cc8ad1",
+    # Note that if you change the `digest`, you might also need to update the
+    # `base_container_digest` to make sure marketplace.gcr.io/google/rbe-ubuntu16-04-webtest:<digest>
+    # and marketplace.gcr.io/google/rbe-ubuntu16-04:<base_container_digest> have
+    # the same Clang and JDK installed.
+    # Clang is needed because of the dependency on @com_google_protobuf.
+    # Java is needed for the Bazel's test executor Java tool.
+    digest = "sha256:74a8e9dca4781d5f277a7bd8e7ea7ed0f5906c79c9cd996205b6d32f090c62f3",
+    env = clang_env(),
+    registry = "marketplace.gcr.io",
+    repository = "google/rbe-ubuntu16-04-webtest",
+)

WORKSPACE

@@ -70,6 +70,8 @@ ts_library(
 jasmine_node_test(
     name = "core_test",
     srcs = [":core_test_lib"],
+    # TODO: Audit tests to determine if tests can be run in RBE environments
+    local = True,
     deps = [
         "@npm//jasmine",
         "@npm//source-map",

packages/angular_devkit/core/BUILD

@@ -79,6 +79,8 @@ ts_library(
 jasmine_node_test(
     name = "update_test",
     srcs = [":update_test_lib"],
+    # TODO: Audit tests to determine if tests can be run in RBE environments
+    local = True,
     deps = [
         "@npm//jasmine",
         "@npm//npm-registry-client",

packages/schematics/update/BUILD

@@ -21,4 +21,17 @@ nodejs_binary(
         "--node_options=--preserve-symlinks",
     ],
 )
+
+platform(
+    name = "rbe_ubuntu1604-angular",
+    parents = ["@rbe_ubuntu1604_angular//config:platform"],
+    remote_execution_properties = """
+        {PARENT_REMOTE_EXECUTION_PROPERTIES}
+        properties: {
+            name: "dockerAddCapabilities"
+            value: "SYS_ADMIN"
+        }
+        """,
+)
+
 # @external_end