chore: switch from Engflow to Buildbuddy

.github/workflows/ci.bazelrc

@@ -23,16 +23,8 @@ build:rbe --genrule_strategy=remote,local
 build:rbe --host_platform=@aspect_rules_js//platforms:x86_64_linux_remote
 build:rbe --jobs=32
 
-# EngFlow remote cache
-build:rbe --bes_backend=grpcs://tourmaline.cluster.engflow.com
-build:rbe --bes_results_url=https://tourmaline.cluster.engflow.com/invocation/
-build:rbe --remote_cache=grpcs://tourmaline.cluster.engflow.com
-
-# EngFlow remote build execution
-build:rbe --remote_executor=grpcs://tourmaline.cluster.engflow.com
-
-# TODO: remove workaround for failure
-build:rbe --modify_execution_info=GoCompilePkg=+no-remote-exec
-
-# These files are written during CI setup, using secrets registered with the CI platforms
-build:rbe --tls_client_certificate=engflow.crt --tls_client_key=engflow.key
+# BuildBuddy remote exec
+build:rbe --bes_results_url=https://app.buildbuddy.io/invocation/
+build:rbe --bes_backend=grpcs://remote.buildbuddy.io
+build:rbe --remote_timeout=3600
+build:rbe --remote_executor=grpcs://remote.buildbuddy.io

.github/workflows/ci.yaml

@@ -46,15 +46,15 @@ jobs:
         # Prepares the 'config' axis of the test matrix
         runs-on: ubuntu-latest
         env:
-            ENGFLOW_PRIVATE_KEY: ${{ secrets.ENGFLOW_PRIVATE_KEY }}
+            BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
         steps:
             - id: local
               run: echo "config=local" >> $GITHUB_OUTPUT
             - id: rbe
               run: echo "config=rbe" >> $GITHUB_OUTPUT
               # Only run on main branch (or PR branches that contain 'rbe') to reduce the matrix size for PRs
-              # Don't run RBE if there are no EngFlow creds which is the case on forks
-              if: (github.ref == 'refs/heads/main' || contains(github.head_ref, 'rbe')) && env.ENGFLOW_PRIVATE_KEY != ''
+              # Don't run RBE if there is no API key which is the case on forks
+              if: (github.ref == 'refs/heads/main' || contains(github.head_ref, 'rbe')) && env.BUILDBUDDY_API_KEY != ''
         outputs:
             # Will look like ["local", "rbe"]
             config: ${{ toJSON(steps.*.outputs.config) }}
@@ -288,13 +288,11 @@ jobs:
               if: matrix.config == 'rbe'
               working-directory: ${{ matrix.folder }}
               run: |
-                  touch engflow.crt engflow.key
-                  chmod 0600 engflow.crt engflow.key
-                  echo "$ENGFLOW_CLIENT_CRT" > engflow.crt
-                  echo "$ENGFLOW_PRIVATE_KEY" > engflow.key
+                  touch $HOME/.bazelrc
+                  chmod 0600 $HOME/.bazelrc
+                  echo "build --remote_header=x-buildbuddy-api-key=$BUILDBUDDY_API_KEY" > $HOME/.bazelrc
               env:
-                  ENGFLOW_CLIENT_CRT: ${{ secrets.ENGFLOW_CLIENT_CRT }}
-                  ENGFLOW_PRIVATE_KEY: ${{ secrets.ENGFLOW_PRIVATE_KEY }}
+                  BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
 
             - name: Set bzlmod flag (for integration tests)
               # Store the --enable_bzlmod flag that we add to the test command below

MODULE.bazel

@@ -140,26 +140,18 @@ npm.npm_translate_lock(
         "@kubernetes/client-node": [],
         "@figma/nodegit": [
             "no-sandbox",
-            # Workaround Engflow not honoring requires-network on build actions
-            "no-remote-exec",
             "requires-network",
         ],
         "esbuild": [
             "no-sandbox",
-            # Workaround Engflow not honoring requires-network on build actions
-            "no-remote-exec",
             "requires-network",
         ],
         "segfault-handler": [
             "no-sandbox",
-            # Workaround Engflow not honoring requires-network on build actions
-            "no-remote-exec",
             "requires-network",
         ],
         "puppeteer": [
             "no-sandbox",
-            # Workaround Engflow not honoring requires-network on build actions
-            "no-remote-exec",
             "requires-network",
         ],
     },

WORKSPACE

@@ -120,26 +120,18 @@ npm_translate_lock(
         "@kubernetes/client-node": [],
         "@figma/nodegit": [
             "no-sandbox",
-            # Workaround Engflow not honoring requires-network on build actions
-            "no-remote-exec",
             "requires-network",
         ],
         "esbuild": [
             "no-sandbox",
-            # Workaround Engflow not honoring requires-network on build actions
-            "no-remote-exec",
             "requires-network",
         ],
         "segfault-handler": [
             "no-sandbox",
-            # Workaround Engflow not honoring requires-network on build actions
-            "no-remote-exec",
             "requires-network",
         ],
         "puppeteer": [
             "no-sandbox",
-            # Workaround Engflow not honoring requires-network on build actions
-            "no-remote-exec",
             "requires-network",
         ],
     },

e2e/npm_link_package-esm/WORKSPACE

@@ -28,11 +28,7 @@ npm_translate_lock(
         "sharp": ["APPDATA=."],
     },
     lifecycle_hooks_execution_requirements = {
-        "sharp": [
-            # Workaround Engflow not honoring requires-network on build actions
-            "no-remote-exec",
-            "requires-network",
-        ],
+        "sharp": ["requires-network"],
     },
     pnpm_lock = "//:pnpm-lock.yaml",
     verify_node_modules_ignored = "//:.bazelignore",

e2e/npm_link_package/WORKSPACE

@@ -28,11 +28,7 @@ npm_translate_lock(
         "sharp": ["APPDATA=."],
     },
     lifecycle_hooks_execution_requirements = {
-        "sharp": [
-            # Workaround Engflow not honoring requires-network on build actions
-            "no-remote-exec",
-            "requires-network",
-        ],
+        "sharp": ["requires-network"],
     },
     npm_package_target_name = "{dirname}_pkg",
     pnpm_lock = "//:pnpm-lock.yaml",

js/private/test/image/structure/BUILD.bazel

@@ -26,6 +26,8 @@ js_image_layer(
     compression = "none",
     platform = ":amd64_linux",
     root = "/app",
+    # TODO: figure out why the digests_generated.sum is different on buildbuddy executors
+    tags = ["no-remote-exec"],
 )
 
 filegroup(

js/private/test/image/structure/digests.sum

@@ -1,2 +1,2 @@
-020eddc540c3859f483447afe6934e735e830b644db4cab77117bb1e3ac4d16c
+38599e1bb75e2446121490c4e4fac2a1256c2f35ef0805daa432ab2935f19291
 da1b55242e360edac2456ec4e1e7cd0a88b052ee075bef7ef620d62985751f30

js/private/test/image/structure/main.js

@@ -1,2 +1,2 @@
 const acorn = require('acorn')
-console.log(acorn.version)
+console.log('acorn version:', acorn.version)

npm/private/test/repositories_checked.bzl

@@ -1650,7 +1650,7 @@ def npm_repositories():
             "universalify": ["0.1.2"],
         },
         lifecycle_hooks = ["preinstall", "install", "postinstall"],
-        lifecycle_hooks_execution_requirements = ["no-sandbox", "no-remote-exec", "requires-network"],
+        lifecycle_hooks_execution_requirements = ["no-sandbox", "requires-network"],
     )
 
     npm_import(
@@ -9448,7 +9448,7 @@ def npm_repositories():
             "esbuild-windows-arm64": ["0.14.38"],
         },
         lifecycle_hooks = ["preinstall", "install", "postinstall"],
-        lifecycle_hooks_execution_requirements = ["no-sandbox", "no-remote-exec", "requires-network"],
+        lifecycle_hooks_execution_requirements = ["no-sandbox", "requires-network"],
     )
 
     npm_import(
@@ -9513,7 +9513,7 @@ def npm_repositories():
             "@esbuild/win32-x64": ["0.16.17"],
         },
         lifecycle_hooks = ["preinstall", "install", "postinstall"],
-        lifecycle_hooks_execution_requirements = ["no-sandbox", "no-remote-exec", "requires-network"],
+        lifecycle_hooks_execution_requirements = ["no-sandbox", "requires-network"],
     )
 
     npm_import(
@@ -18595,7 +18595,7 @@ def npm_repositories():
             "wrap-ansi": ["7.0.0"],
         },
         lifecycle_hooks = ["preinstall", "install", "postinstall"],
-        lifecycle_hooks_execution_requirements = ["no-sandbox", "no-remote-exec", "requires-network"],
+        lifecycle_hooks_execution_requirements = ["no-sandbox", "requires-network"],
     )
 
     npm_import(
@@ -20318,7 +20318,7 @@ def npm_repositories():
             "file-uri-to-path": ["1.0.0"],
         },
         lifecycle_hooks = ["preinstall", "install", "postinstall"],
-        lifecycle_hooks_execution_requirements = ["no-sandbox", "no-remote-exec", "requires-network"],
+        lifecycle_hooks_execution_requirements = ["no-sandbox", "requires-network"],
     )
 
     npm_import(