From c8b70ae8e4a878c8855249df82bf3a46ce6ea0e5 Mon Sep 17 00:00:00 2001
From: Wei Huang <huangwe@google.com>
Date: Tue, 7 Aug 2018 19:41:58 -0400
Subject: [PATCH] build(bazel): Run build-packages-dist on RBE (#25237)

PR Close #25237
---
 .circleci/bazel.rc     |  12 -------
 .circleci/config.yml   |  18 +++++++---
 .circleci/gcp_token    | Bin 0 -> 2368 bytes
 .circleci/rbe-bazel.rc |  77 +++++++++++++++++++++++++++++++++++++++++
 WORKSPACE              |  10 ++++++
 5 files changed, 100 insertions(+), 17 deletions(-)
 create mode 100644 .circleci/gcp_token
 create mode 100644 .circleci/rbe-bazel.rc

diff --git a/.circleci/bazel.rc b/.circleci/bazel.rc
index b63cdfecbd..da0906c648 100644
--- a/.circleci/bazel.rc
+++ b/.circleci/bazel.rc
@@ -20,18 +20,6 @@ build --announce_rc
 # We use this when uploading artifacts after the build finishes
 build --symlink_prefix=dist/
 
-# Enable experimental CircleCI bazel remote cache proxy
-# See remote cache documentation in /docs/BAZEL.md
-build --experimental_remote_spawn_cache --remote_rest_cache=http://localhost:7643
-
-# Prevent unstable environment variables from tainting cache keys
-build --experimental_strict_action_env
-
-# Save downloaded repositories such as the go toolchain
-# This directory can then be included in the CircleCI cache
-# It should save time running the first build
-build --experimental_repository_cache=/home/circleci/bazel_repository_cache
-
 # Workaround https://github.com/bazelbuild/bazel/issues/3645
 # Bazel doesn't calculate the memory ceiling correctly when running under Docker.
 # Limit Bazel to consuming resources that fit in CircleCI "xlarge" class
diff --git a/.circleci/config.yml b/.circleci/config.yml
index 9514d30e92..f936f29bde 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -180,12 +180,20 @@ jobs:
       - checkout:
           <<: *post_checkout
       # See remote cache documentation in /docs/BAZEL.md
-      - run: .circleci/setup_cache.sh
       - run: sudo cp .circleci/bazel.rc /etc/bazel.bazelrc
-      - *setup-bazel-remote-cache
-
       - run: bazel run @nodejs//:yarn
-      - run: scripts/build-packages-dist.sh
+      - run:
+          # RBE is enabled by appending rbe-bazel.rc.
+          name: Enable RBE
+          command: 'sudo bash -c "cat .circleci/rbe-bazel.rc >> /etc/bazel.bazelrc"'
+      - run:
+          name: "Setup GCP environment"
+          command: 'openssl aes-256-cbc -d -in .circleci/gcp_token -k "${CIRCLE_PROJECT_REPONAME}" -out /home/circleci/.gcp_credentials'
+      - run:
+          name: build-packages-dist
+          command: scripts/build-packages-dist.sh
+          environment:
+            GOOGLE_APPLICATION_CREDENTIALS: /home/circleci/.gcp_credentials
 
       # Save the npm packages from //packages/... for other workflow jobs to read
       # https://circleci.com/docs/2.0/workflows/#using-workspaces-to-share-data-among-jobs
@@ -293,4 +301,4 @@ workflows:
                 - master
 notify:
   webhooks:
-    - url: https://ngbuilds.io/circle-build
\ No newline at end of file
+    - url: https://ngbuilds.io/circle-build
diff --git a/.circleci/gcp_token b/.circleci/gcp_token
new file mode 100644
index 0000000000000000000000000000000000000000..c77bcf6345231be66581d8f0ef7e0520add36ef7
GIT binary patch
literal 2368
zcmV-G3BUGJVQh3|WM5y<7N>s7?N@Nri!1*7OqCin;t7*3C8RzB&@(|8tTy5lvE%Cv
zR+T{fy1h;!C|og;)}HyV*}bm`&r#5geDLh~#};AO3g$`R`cE4jzC`F7H6N)MzH%6(
zC~C)}sPGcYw%>bbgTD0JgPMqzCrv9rOknU!okC%N<AIw&$x+F6u*3$@AMMKLj}$w5
zL)IY8QU>xvD5Jn<zrq6#aLfwkAf&lzMT_05F$$b(bBLFYwAgmn08|K*$L%Np+mjv+
zfK_)JlaXHjHtuy)(iWJTP}IqlTqc53BUkp!rlhiP*)6XUAi1A&pMPYwez}7tZP`o?
z_dpapa6ow|6hd%2&#`7-dDe|ev^wl`v0hzPbW{xjG?za>E}H4Re#I;v{8;tXm7*=f
z2+Z{9wKNnSvwvYh117bcsz={Mp`W*PGd(LYT*gp^nK3FBNe+SC<P7<Fz@!d2yXLDP
z95cQlF(opG_{#Q6!FD41&EmjYxX0Y)_}u|0KpOUZqr*i%s$38w(mfQ7{${@HJ0cHF
zZ}iE`R39xsP^7U#?JZWpv9mK0f43IpV?Rq3iGFAc3#`H-N5~h$eVU7+-k?aQDVH1f
z#+Q@aPh>Vw&iN1!=0Yrjn1$^hJ4+F{b=smOXc05OihM1ZxIkL)Y%8p#dQk0Fr?7C7
zhOTc}2*g)zh|2Svhj2B(XI{8nP;DN`#FFkS1^-F(qHZA~*?3R0iDtqHV^l%4bd=m{
zg9}qJjKm(d`CMjMO*rwUt1>1P8<cV24nuzWHR&k9PNYc={!%gqoQKNA+_ekoBc+3?
zn^L$7s8;lg|6XKWoTb#+(3n6a{o1GBtfKowt?&<+2ryACnzWJitfA?NJrUfkLKC0`
zWZ{>|myz{7v;)cH$-Yi1R3XU$c})$_(@>k%^PH*6695x2+GI+Q5e{_==|j;~8;2#`
z41j?c&IqQg-?>n-)$Fs5l9t+4^BIa6M29^+dnZf3m~BrBD6Ecvx?kj1A5s*uV5gwo
zMV+(!&2qx`{1B3=YTUWc8Zwiv$U0|<a0m)3S4CYOei-s04#Lg1d=C)T4Uj;GX++IJ
zVcVU5$`#r_<2(B>T9J_qOQ@SqM5ZD4=UDnX;ycX-WkdsEbb(%1869T@i-$&nL-8P~
zObgasS*k=jtDR`&A6Rx-JVV&d+yW7daZriLXt-q0n{0y+pVI)095d~t-|pr$P0-7N
z!_9W2!e}&|9u=G~89@Fb!t)K{-gsFTXKAznI!&6al>HWC@3UggZg1~j$`K%ES*?4G
zn&>pU-W;>2ul+Jbso|sn&SvuMZo4&`+WbvJr&sN8r}d|ppusZbOozflS23o%A-U%W
ztQY0UP=~5G=0o8K_6jZ>%BKl9q#B?CjzT!a!5Rm1<45D_@v2^vF+uVwA12dC@2U#o
zCo2UZPh!u)?#@zh4VUUv<KuLovQXhYUU6U0Ry1j+D|mUiGr5)!LM;GbH_-Z0;BSC_
zNnPj#;Ar-(inzL)8gUP;z1615kRKs^K|a2MFU{K5rTy70qNnNN**^04`y<w38(d`?
z(;%dl2=0$xcj4osFrYyi#?DoUX9`grpnVX15EY53ztt4bBVGc3J5ApF+6Sr!CtvRg
zYoEC~t|V_)v*j|-(ZXeV!Sett+A6>5py<S3s5s5gy`sizI^fORFH<s@8tylwmf35k
zp+b3dUL*cMb<*P9x(K4)G?O}4{$myGY%=W(z-}Wx@lkhenRS>ywj9H}MkOITTGP`Z
z0*?Xbo7WzHoM28g)<}{(hSMbDl}ahK5)_DUaHoe`gnIjN<OtRgD2L?CvI?9YK89#}
zaj)*!t9#v5=E<B=iF>*8l?G)GL-N7E=9?NQ9=K9wJG=Tfe#|~WQn7@wf6ws{1nYID
zw@jkXHqELS0~xU)f*KXh!Wy(y{mpPqLv`w_CGX*vLi~cZ^u-h|tjO9pcf&W-F8yFn
z{$34jU}c?@e^KMQ1=Dvrd;U<>0DFHIUq~Y+>IN#9w7vx)^3J($FHi8(*3j4N1Yqzz
zqX}W9vOfErvR+_~xNp~r?==dWgNJ6?IpT=iG*xq9NAqVsMUnp$jxOSyl!+79>I3az
zh(WH!Ot*JW_{DYX>~tW-B%G`2G{Ym6S+q{A<u0B!EbSf4G(W(E9}AppzYg!${#8vk
zc^!REsE>im&f^Y6ZL1A_VcQ9Y3*ze+{v$iKkzw*b_O&PXr|e{=)>D~l-sUh4#ZgY7
z8$zvzYAyeUki*`2+}0XVn0-o@q$>dNl$lXt$FKeTK0*JqHC4HTo~J2m@%y}$Jqqq}
zJD;Y?9RmW{&dyfu!!#iN?;6$ZJ(^yICg@W^L}%AJK9Z{)jR)Go*+Ux|Q@{{4Bh&oD
zR0^Dx^skg?f#1H(fXG)@V8qqn@fzG+2-FNa+a9-lHr%$o62TfM{26pE#vu+1Bh}vV
zgoAc-gi5Pm9XvhZY#9HZqcNydGumni7lU|L^+sbkJ2%axZTC_p05tn;Un4{3ir|_s
zz7wgILj%A1up~%1wR=ymdLwk4Yet@BHqRI}j=D+e$2=rhmNSSvi`_5Mf}4xM%}+^0
z$}eb>3Cv+GIl=pS4g%vF(JCRWI8wQH*yYi4Vcy2C3=qGCi}WlfUIvCD5?V+r@C_j)
ziV|GnOTq?XEov?U=WcVVmp7_{?VI2<e>UT$x@kX82d-|yT4_zq@tSFf*a>->Dp>`_
zCOAdFV$SyQMPNPuanumd`WJdC$xXS9#%b1$VzGgqAl_yM(1vHh`7sh3J%Od$xbZO1
z5k}{z!FT)S`N+-f?9P1M5DePzsxTd)An_er63CdjI@Cc0@pfY9m)iez!Q~BG5toL$
z@48PL>k@8{UppxUd5ZyOy{A$}u#<Kf_;tR&su{POb7Sb~bZ1JI2P;VrXsrW9)hCT^
z_M?ZwQKPCjCmj_3Bgn=ETa21k+HH3}K{~-yENg0bMm>9`{0o4QmAxl`|C0G9Y8=o`
zCjED^Z12V(q1qBIcl&7g-%OYy`~XAz7m!uYQO?_#dPs{PTbSBc!Hm#T@$CSY!0}om
m{sAQ2Ff~xF*QH+*E%kSQC<P@Fj3GAR{C$1!=c+67JSXLk)sw~m

literal 0
HcmV?d00001

diff --git a/.circleci/rbe-bazel.rc b/.circleci/rbe-bazel.rc
new file mode 100644
index 0000000000..d76aaeffa1
--- /dev/null
+++ b/.circleci/rbe-bazel.rc
@@ -0,0 +1,77 @@
+# These options are enabled when running on CI with Remote Build Execution.
+
+################################################################
+# Toolchain related flags for remote build execution.          #
+################################################################
+# Remote Build Execution requires a strong hash function, such as SHA256.
+startup --host_jvm_args=-Dbazel.DigestFunction=SHA256
+
+# Depending on how many machines are in the remote execution instance, setting
+# this higher can make builds faster by allowing more jobs to run in parallel.
+# Setting it too high can result in jobs that timeout, however, while waiting
+# for a remote machine to execute them.
+build --jobs=150
+
+# Set several flags related to specifying the platform, toolchain and java
+# properties.
+# These flags are duplicated rather than imported from (for example)
+# %workspace%/configs/ubuntu16_04_clang/1.0/toolchain.bazelrc to make this
+# bazelrc a standalone file that can be copied more easily.
+# These flags should only be used as is for the rbe-ubuntu16-04 container
+# and need to be adapted to work with other toolchain containers.
+build --host_javabase=@bazel_toolchains//configs/ubuntu16_04_clang/1.0:jdk8
+build --javabase=@bazel_toolchains//configs/ubuntu16_04_clang/1.0:jdk8
+build --host_java_toolchain=@bazel_tools//tools/jdk:toolchain_hostjdk8
+build --java_toolchain=@bazel_tools//tools/jdk:toolchain_hostjdk8
+build --crosstool_top=@bazel_toolchains//configs/ubuntu16_04_clang/1.0/bazel_0.15.0/default:toolchain
+build --action_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
+# Platform flags:
+# The toolchain container used for execution is defined in the target indicated
+# by "extra_execution_platforms", "host_platform" and "platforms".
+# If you are using your own toolchain container, you need to create a platform
+# target with "constraint_values" that allow for the toolchain specified with
+# "extra_toolchains" to be selected (given constraints defined in
+# "exec_compatible_with").
+# More about platforms: https://docs.bazel.build/versions/master/platforms.html
+build --extra_toolchains=@bazel_toolchains//configs/ubuntu16_04_clang/1.0/bazel_0.15.0/cpp:cc-toolchain-clang-x86_64-default
+build --extra_execution_platforms=@bazel_toolchains//configs/ubuntu16_04_clang/1.0:rbe_ubuntu1604
+build --host_platform=@bazel_toolchains//configs/ubuntu16_04_clang/1.0:rbe_ubuntu1604
+build --platforms=@bazel_toolchains//configs/ubuntu16_04_clang/1.0:rbe_ubuntu1604
+
+# Set various strategies so that all actions execute remotely. Mixing remote
+# and local execution will lead to errors unless the toolchain and remote
+# machine exactly match the host machine.
+build --spawn_strategy=remote
+build --strategy=Javac=remote
+build --strategy=Closure=remote
+build --genrule_strategy=remote
+build --define=EXECUTOR=remote
+
+# Enable the remote cache so action results can be shared across machines,
+# developers, and workspaces.
+build --remote_cache=remotebuildexecution.googleapis.com
+
+# Enable remote execution so actions are performed on the remote systems.
+build --remote_executor=remotebuildexecution.googleapis.com
+
+# Remote instance.
+build --remote_instance_name=projects/internal-200822/instances/default_instance
+
+# Enable encryption.
+build --tls_enabled=true
+
+# Enforce stricter environment rules, which eliminates some non-hermetic
+# behavior and therefore improves both the remote cache hit rate and the
+# correctness and repeatability of the build.
+build --experimental_strict_action_env=true
+
+# Set a higher timeout value, just in case.
+build --remote_timeout=3600
+
+# Enable authentication. This will pick up application default credentials by
+# default. You can use --auth_credentials=some_file.json to use a service
+# account credential instead.
+build --auth_enabled=true
+
+# Do not accept remote cache.
+build --remote_accept_cached=false
diff --git a/WORKSPACE b/WORKSPACE
index 82057ef802..6dc1dd1ce0 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -18,6 +18,16 @@ http_archive(
     sha256 = "95518adafc9a2b656667bbf517a952e54ce7f350779d0dd95133db4eb5c27fb1",
 )
 
+http_archive(
+  name = "bazel_toolchains",
+  urls = [
+    "https://mirror.bazel.build/github.com/bazelbuild/bazel-toolchains/archive/5124557861ebf4c0b67f98180bff1f8551e0b421.tar.gz",
+    "https://github.com/bazelbuild/bazel-toolchains/archive/5124557861ebf4c0b67f98180bff1f8551e0b421.tar.gz",
+  ],
+  strip_prefix = "bazel-toolchains-5124557861ebf4c0b67f98180bff1f8551e0b421",
+  sha256 = "c3b08805602cd1d2b67ebe96407c1e8c6ed3d4ce55236ae2efe2f1948f38168d",
+)
+
 http_archive(
     name = "io_bazel_rules_webtesting",
     url = "https://github.com/bazelbuild/rules_webtesting/archive/0.2.1.zip",