build: enforce frozen lockfile mode, enable user-specific Bazel configuration, and disable package manager caching in CI/PR workflows

Author: alan-agius4

.bazelrc

@@ -1,13 +1,16 @@
 common --@aspect_rules_ts//ts:skipLibCheck=always
 common --@aspect_rules_ts//ts:default_to_tsc_transpiler
-common --enable_bzlmod
 build --symlink_prefix=dist/
 
 # Needed as otherwise `env` of TS actions would be ignored.
 common --incompatible_merge_fixed_and_default_shell_env
 
-# For remote testing
-# -----
+# Frozen lockfile
+common --lockfile_mode=error
+
+################################
+# Remote Execution Setup       #
+################################
 
 # The following --define=EXECUTOR=remote will be able to be removed
 # once https://github.com/bazelbuild/bazel/issues/7254 is fixed
@@ -30,11 +33,38 @@ build:remote --host_cpu=k8
 build:remote --host_platform=@devinfra//bazel/remote-execution:platform
 build:remote --platforms=@devinfra//bazel/remote-execution:platform
 
-# Remote instance and caching
+# Use the Angular team internal GCP instance for remote execution.
 build:remote --remote_instance_name=projects/internal-200822/instances/primary_instance
 build:remote --bes_instance_name=internal-200822
+
+# Starting with Bazel 0.27.0 strategies do not need to be explicitly
+# defined. See https://github.com/bazelbuild/bazel/issues/7480
+build:remote --define=EXECUTOR=remote
+
+# Setup the remote build execution servers.
 build:remote --remote_cache=remotebuildexecution.googleapis.com
 build:remote --remote_executor=remotebuildexecution.googleapis.com
 
+# Set up authentication mechanism for RBE
+build:remote --google_default_credentials
+
+# Use HTTP remote cache
+build:remote-cache --remote_cache=https://storage.googleapis.com/angular-team-cache
+build:remote-cache --remote_accept_cached=true
+build:remote-cache --remote_upload_local_results=false
+build:remote-cache --google_default_credentials
+
+# Additional flags added when running a "trusted build" with additional access
+build:trusted-build --remote_upload_local_results=true
+
 # Flag for validation/demonstration of partial compilation usage.
 build --flag_alias=partial_compilation=//src/ng_project/config:partial_compilation
+
+####################################################
+# User bazel configuration
+# NOTE: This needs to be the *last* entry in the config.
+####################################################
+
+# Load any settings which are specific to the current user. Needs to be *last* statement
+# in this config, as the user configuration should be able to overwrite flags from this file.
+try-import .bazelrc.user

.bazelversion

@@ -1 +1 @@
-8.4.0
+8.6.0

.github/workflows/ci.yml

@@ -21,11 +21,13 @@ jobs:
     steps:
       - name: Initialize environment
         uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@c4344a4e20dbdf9cb8eeb7a7eb91431b98eabd99
+        with:
+          disable-package-manager-cache: true
       - name: Setup Bazel
         uses: angular/dev-infra/github-actions/bazel/setup@c4344a4e20dbdf9cb8eeb7a7eb91431b98eabd99
       - name: Setup Bazel Remote Caching
         uses: angular/dev-infra/github-actions/bazel/configure-remote@c4344a4e20dbdf9cb8eeb7a7eb91431b98eabd99
         with:
           google_credential: ${{ secrets.RBE_TRUSTED_BUILDS_USER }}
-      - name: Install node modules
+      - name: Test
         run: pnpm bazel test --build_tests_only //...

.github/workflows/pr.yml

@@ -32,11 +32,11 @@ jobs:
     steps:
       - name: Initialize environment
         uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@c4344a4e20dbdf9cb8eeb7a7eb91431b98eabd99
+        with:
+          disable-package-manager-cache: true
       - name: Setup Bazel
         uses: angular/dev-infra/github-actions/bazel/setup@c4344a4e20dbdf9cb8eeb7a7eb91431b98eabd99
       - name: Setup Bazel Remote Caching
         uses: angular/dev-infra/github-actions/bazel/configure-remote@c4344a4e20dbdf9cb8eeb7a7eb91431b98eabd99
-        with:
-          google_credential: ${{ secrets.RBE_TRUSTED_BUILDS_USER }}
-      - name: Install node modules
+      - name: Test
         run: pnpm bazel test --build_tests_only //...