bazel/ci: Prepare repo for using Engflow RBE (#36293)

Signed-off-by: Ryan Northey <ryan@synca.io>

.bazelrc

@@ -46,7 +46,6 @@ build --action_env=BAZEL_VOLATILE_DIRTY --host_action_env=BAZEL_VOLATILE_DIRTY
 # Prevent stamped caches from busting (eg in PRs)
 # Requires setting `BAZEL_FAKE_SCM_REVISION` in the env.
 build --action_env=BAZEL_FAKE_SCM_REVISION --host_action_env=BAZEL_FAKE_SCM_REVISION
-
 build --test_summary=terse
 
 build:docs-ci --action_env=DOCS_RST_CHECK=1 --host_action_env=DOCS_RST_CHECK=1
@@ -515,19 +514,27 @@ build:rbe-engflow --bes_timeout=3600s
 build:rbe-engflow --bes_upload_mode=fully_async
 build:rbe-engflow --nolegacy_important_outputs
 
-build:cache-envoy-engflow --google_default_credentials=false
+# RBE (Engflow Envoy)
+build:common-envoy-engflow --google_default_credentials=false
+build:common-envoy-engflow --credential_helper=*.engflow.com=%workspace%/bazel/engflow-bazel-credential-helper.sh
+build:common-envoy-engflow --grpc_keepalive_time=30s
+
 build:cache-envoy-engflow --remote_cache=grpcs://morganite.cluster.engflow.com
 build:cache-envoy-engflow --remote_timeout=3600s
-build:cache-envoy-engflow --credential_helper=*.engflow.com=%workspace%/bazel/engflow-bazel-credential-helper.sh
-build:cache-envoy-engflow --grpc_keepalive_time=30s
 build:bes-envoy-engflow --bes_backend=grpcs://morganite.cluster.engflow.com/
 build:bes-envoy-engflow --bes_results_url=https://morganite.cluster.engflow.com/invocation/
 build:bes-envoy-engflow --bes_timeout=3600s
 build:bes-envoy-engflow --bes_upload_mode=fully_async
-build:rbe-envoy-engflow --config=cache-envoy-engflow
-build:rbe-envoy-engflow --config=bes-envoy-engflow
+build:bes-envoy-engflow --nolegacy_important_outputs
 build:rbe-envoy-engflow --remote_executor=grpcs://morganite.cluster.engflow.com
 build:rbe-envoy-engflow --remote_default_exec_properties=container-image=docker://gcr.io/envoy-ci/envoy-build@sha256:7adc40c09508f957624c4d2e0f5aeecb73a59207ee6ded53b107eac828c091b2
+build:rbe-envoy-engflow --jobs=200
+build:rbe-envoy-engflow --define=engflow_rbe=true
+
+build:remote-envoy-engflow --config=common-envoy-engflow
+build:remote-envoy-engflow --config=cache-envoy-engflow
+build:remote-envoy-engflow --config=bes-envoy-engflow
+build:remote-envoy-engflow --config=rbe-envoy-engflow
 
 #############################################################################
 # debug: Various Bazel debugging flags

.github/workflows/_precheck_deps.yml

@@ -29,7 +29,7 @@ jobs:
     uses: ./.github/workflows/_run.yml
     name: ${{ matrix.target }}
     with:
-      bazel-extra: '--config=rbe-envoy-engflow'
+      bazel-extra: '--config=remote-envoy-engflow'
       cache-build-image: ${{ fromJSON(inputs.request).request.build-image.default }}
       request: ${{ inputs.request }}
       error-match: |

.github/workflows/_publish_build.yml

@@ -59,7 +59,7 @@ jobs:
           name: Release (x64)
           arch: x64
           bazel-extra: >-
-            --config=rbe-envoy-engflow
+            --config=remote-envoy-engflow
           rbe: true
           runs-on: ubuntu-24.04
         - target: release.server_only

.github/workflows/_publish_verify.yml

@@ -30,7 +30,7 @@ jobs:
     name: ${{ matrix.name || matrix.target }}
     uses: ./.github/workflows/_run.yml
     with:
-      bazel-extra: ${{ matrix.bazel-extra || '--config=rbe-envoy-engflow' }}
+      bazel-extra: ${{ matrix.bazel-extra || '--config=remote-envoy-engflow' }}
       cache-build-image: ${{ matrix.cache-build-image }}
       cache-build-image-key-suffix: ${{ matrix.arch == 'arm64' && format('-{0}', matrix.arch) || '' }}
       container-command: ${{ matrix.container-command }}
@@ -85,7 +85,7 @@ jobs:
     name: ${{ matrix.name || matrix.target }}
     uses: ./.github/workflows/_run.yml
     with:
-      bazel-extra: ${{ matrix.bazel-extra || '--config=rbe-envoy-engflow' }}
+      bazel-extra: ${{ matrix.bazel-extra || '--config=remote-envoy-engflow' }}
       cache-build-image: ${{ fromJSON(inputs.request).request.build-image.default }}
       cache-build-image-key-suffix: ${{ matrix.arch == 'arm64' && format('-{0}', matrix.arch) || '' }}
       container-command: ./ci/run_envoy_docker.sh

.github/workflows/envoy-macos.yml

@@ -66,6 +66,7 @@ jobs:
               --flaky_test_attempts=2
               --config=bes-envoy-engflow
               --config=cache-envoy-engflow
+              --config=common-envoy-engflow
               --config=ci)
             export BAZEL_BUILD_EXTRA_OPTIONS=${_BAZEL_BUILD_EXTRA_OPTIONS[*]}
 

bazel/BUILD

@@ -744,6 +744,11 @@ alias(
     }),
 )
 
+config_setting(
+    name = "engflow_rbe",
+    define_values = {"engflow_rbe": "true"},
+)
+
 selects.config_setting_group(
     name = "apple",
     match_any = [

bazel/envoy_binary.bzl

@@ -18,6 +18,8 @@ def envoy_cc_binary(
         data = [],
         testonly = 0,
         visibility = None,
+        engflow_pool = None,
+        exec_properties = {},
         external_deps = [],
         repository = "",
         stamp = 1,
@@ -27,6 +29,10 @@ def envoy_cc_binary(
         tags = [],
         features = [],
         linkstatic = True):
+    exec_properties = exec_properties | select({
+        repository + "//bazel:engflow_rbe": {"Pool": engflow_pool} if engflow_pool else {},
+        "//conditions:default": {},
+    })
     linker_inputs = envoy_exported_symbols_input()
 
     if not linkopts:
@@ -42,6 +48,7 @@ def envoy_cc_binary(
         data = data,
         additional_linker_inputs = linker_inputs,
         copts = envoy_copts(repository),
+        exec_properties = exec_properties,
         linkopts = linkopts,
         testonly = testonly,
         linkstatic = linkstatic,

bazel/envoy_library.bzl

@@ -98,6 +98,8 @@ def envoy_cc_library(
         hdrs = [],
         copts = [],
         visibility = None,
+        engflow_pool = None,
+        exec_properties = {},
         external_deps = [],
         tcmalloc_dep = None,
         repository = "",
@@ -112,6 +114,10 @@ def envoy_cc_library(
         linkopts = []):
     if tcmalloc_dep:
         deps += tcmalloc_external_deps(repository)
+    exec_properties = exec_properties | select({
+        repository + "//bazel:engflow_rbe": {"Pool": engflow_pool} if engflow_pool else {},
+        "//conditions:default": {},
+    })
 
     # If alwayslink is not specified, allow turning it off via --define=library_autolink=disabled
     # alwayslink is defaulted on for envoy_cc_extensions to ensure the REGISTRY macros work.
@@ -132,6 +138,7 @@ def envoy_cc_library(
         textual_hdrs = textual_hdrs,
         deps = deps + [envoy_external_dep_path(dep) for dep in external_deps] +
                envoy_pch_deps(repository, "//source/common/common:common_pch"),
+        exec_properties = exec_properties,
         alwayslink = alwayslink,
         linkstatic = envoy_linkstatic(),
         strip_include_prefix = strip_include_prefix,

bazel/envoy_test.bzl

@@ -80,11 +80,17 @@ def envoy_cc_fuzz_test(
         name,
         corpus,
         dictionaries = [],
+        engflow_pool = None,
+        exec_properties = {},
         repository = "",
         size = "medium",
         deps = [],
         tags = [],
         **kwargs):
+    exec_properties = exec_properties | select({
+        repository + "//bazel:engflow_rbe": {"Pool": engflow_pool} if engflow_pool else {},
+        "//conditions:default": {},
+    })
     if not (corpus.startswith("//") or corpus.startswith(":") or corpus.startswith("@")):
         corpus_name = name + "_corpus_files"
         native.filegroup(
@@ -97,6 +103,7 @@ def envoy_cc_fuzz_test(
     test_lib_name = name + "_lib"
     envoy_cc_test_library(
         name = test_lib_name,
+        exec_properties = exec_properties,
         deps = deps + envoy_stdlib_deps() + [
             repository + "//test/fuzz:fuzz_runner_lib",
             repository + "//test/test_common:test_version_linkstamp",
@@ -121,6 +128,7 @@ def envoy_cc_fuzz_test(
             "//conditions:default": ["$(locations %s)" % corpus_name],
         }),
         data = [corpus_name],
+        exec_properties = exec_properties,
         # No fuzzing on macOS or Windows
         deps = select({
             "@envoy//bazel:apple": [repository + "//test:dummy_main"],
@@ -163,9 +171,13 @@ def envoy_cc_test(
         size = "medium",
         flaky = False,
         env = {},
+        engflow_pool = None,
         exec_properties = {}):
     coverage_tags = tags + ([] if coverage else ["nocoverage"])
-
+    exec_properties = exec_properties | select({
+        repository + "//bazel:engflow_rbe": {"Pool": engflow_pool} if engflow_pool else {},
+        "//conditions:default": {},
+    })
     native.cc_test(
         name = name,
         srcs = srcs,
@@ -199,6 +211,8 @@ def envoy_cc_test_library(
         srcs = [],
         hdrs = [],
         data = [],
+        engflow_pool = None,
+        exec_properties = {},
         external_deps = [],
         deps = [],
         repository = "",
@@ -207,6 +221,10 @@ def envoy_cc_test_library(
         copts = [],
         alwayslink = 1,
         **kargs):
+    exec_properties = exec_properties | select({
+        repository + "//bazel:engflow_rbe": {"Pool": engflow_pool} if engflow_pool else {},
+        "//conditions:default": {},
+    })
     disable_pch = kargs.pop("disable_pch", True)
     _envoy_cc_test_infrastructure_library(
         name,
@@ -267,13 +285,20 @@ def envoy_benchmark_test(
         name,
         benchmark_binary,
         data = [],
+        engflow_pool = None,
+        exec_properties = {},
         tags = [],
         repository = "",
         **kargs):
+    exec_properties = exec_properties | select({
+        repository + "//bazel:engflow_rbe": {"Pool": engflow_pool} if engflow_pool else {},
+        "//conditions:default": {},
+    })
     native.sh_test(
         name = name,
         srcs = [repository + "//bazel:test_for_benchmark_wrapper.sh"],
         data = [":" + benchmark_binary] + data,
+        exec_properties = exec_properties,
         args = ["%s/%s" % (native.package_name(), benchmark_binary)],
         tags = tags + ["nocoverage"],
         **kargs

ci/mac_ci_steps.sh

@@ -17,6 +17,8 @@ BAZEL_BUILD_OPTIONS=(
     "${BAZEL_BUILD_EXTRA_OPTIONS[@]}"
     "${BAZEL_EXTRA_TEST_OPTIONS[@]}")
 
+echo "RUN MAC: ${BAZEL_BUILD_OPTIONS[*]}"
+
 NCPU=$(sysctl -n hw.ncpu)
 if [[ $NCPU -gt 0 ]]; then
     echo "limiting build to $NCPU jobs, based on CPU count"