chore: experiment with Remote Build Execution (RBE) @ Namespace

.github/workflows/bre-namespace-test.yml

@@ -0,0 +1,88 @@
+name: BRE Namespace Test
+
+# Experimental: run `bazel test` on Namespace runners using Bazel Remote
+# Execution (BRE). Actions execute on Namespace workers booted from a custom
+# worker image (a mirror of ic-build) that is built, optimized and pinned by the
+# `container-autobuild.yml` workflow.
+#
+# See: https://namespace.so/docs/bazel/execution
+
+on:
+  workflow_dispatch:
+    inputs:
+      targets:
+        description: 'Bazel target patterns to test'
+        required: false
+        default: '//...'
+        type: string
+  pull_request:
+    types: [opened, synchronize, reopened, labeled]
+  push:
+    branches:
+      - 'dev-gh-*'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  bazel-test-bre:
+    name: Bazel Test (Namespace BRE)
+    runs-on: namespace-profile-amd64-linux-32x64
+    timeout-minutes: 120
+    # Opt-in while experimental: manual dispatch, pushes to dev-gh-* branches, or
+    # non-fork pull requests labeled 'CI_BRE'. Only on the public repo, where
+    # Namespace runners are configured (otherwise the job would get stuck). Fork
+    # PRs are excluded because this job runs on a privileged Namespace runner with
+    # pre-authenticated 'nsc' and must never execute untrusted PR code.
+    if: >-
+      github.repository == 'dfinity/ic' &&
+      ( github.event_name != 'pull_request' ||
+        ( github.event.pull_request.head.repo.full_name == github.repository &&
+          contains(github.event.pull_request.labels.*.name, 'CI_BRE') ) )
+    steps:
+      - name: Set up Bazel Remote Execution
+        run: |
+          # Provisions the Namespace RBE cluster and writes a bazelrc fragment with
+          # the remote executor, remote cache, credentials and recommended defaults.
+          # 'nsc' is pre-authenticated on Namespace runners.
+          # NOTE: do not print this bazelrc -- it contains short-lived credentials
+          # that would leak into the Actions logs.
+          nsc bazel execution setup --bazelrc=/tmp/bazel-rbe.bazelrc
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ./.github/actions/netrc
+      - name: Bazel Test with BRE
+        shell: bash
+        env:
+          BAZEL_TARGETS: ${{ github.event.inputs.targets || '//...' }}
+        run: |
+          set -euo pipefail
+
+          # Custom worker image: a mirror of ic-build, pinned to an immutable digest
+          # and optimized for BRE. The ref below (Namespace tenant registry + digest)
+          # is kept up to date automatically by the 'update-image-references' job in
+          # container-autobuild.yml.
+          # NOTE: the placeholder digest below is replaced on the first ic-build
+          # rebuild after this workflow is introduced; until then this job will fail.
+          worker_image="docker://nscr.io/c9ptjuknd7oc6/ic-build-worker@sha256:0000000000000000000000000000000000000000000000000000000000000000"
+
+          targets="$BAZEL_TARGETS"
+          # Split the (space-separated) target patterns into an array so each is passed
+          # as a single, quoted argument -- avoids word-splitting/glob surprises. The
+          # 'targets' input is workflow_dispatch-only and this job is gated to non-fork.
+          read -ra target_patterns <<<"$targets"
+          # We deliberately bypass the workspace .bazelrc (which pulls in the
+          # DFINITY-internal cache / remote-execution config) and instead pass the
+          # build config plus the Namespace RBE config explicitly, mirroring the
+          # bazel-test-arm64 job in ci-main.yml.
+          bazel \
+            --noworkspace_rc \
+            --bazelrc=./bazel/conf/.bazelrc.build --bazelrc=/tmp/bazel-rbe.bazelrc \
+            test \
+            --test_tag_filters=-farm_system_test,-system_test_large,-system_test_benchmark,-fuzz_test,-fi_tests_nightly,-nns_tests_nightly,-pocketic_tests_nightly \
+            --remote_default_exec_properties=container-image="$worker_image" \
+            --keep_going \
+            "${target_patterns[@]}"

.github/workflows/container-autobuild.yml

@@ -103,10 +103,75 @@ jobs:
             exit 1
           fi
 
+  bre-worker-image:
+    name: Build BRE Worker Image
+    # Runs on a Namespace runner where 'nsc' is pre-authenticated. 'update-image-references'
+    # waits for this job and pins the resulting digest in the same commit. Like
+    # 'ic-build-image', this job is required: if it fails, that's a bug to fix.
+    runs-on: namespace-profile-default
+    # nsc authenticates via the runner's Namespace workspace identity, not the
+    # GITHUB_TOKEN, so this job needs no GitHub permissions (least privilege).
+    permissions: {}
+    needs: [build-image-prep, ic-build-image]
+    # Restricted to the dfinity/ic repo and, for pull_request events, to non-fork
+    # PRs -- this job runs on a privileged Namespace runner with pre-authenticated
+    # 'nsc', so it must never run untrusted code from a fork.
+    if: |
+      needs.build-image-prep.outputs.build_image == 'true' &&
+      github.repository == 'dfinity/ic' &&
+      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
+    timeout-minutes: 30
+    outputs:
+      worker-image: ${{ steps.worker.outputs.worker-image }}
+    steps:
+      - name: Mirror ic-build to nscr.io and optimize for Bazel Remote Execution
+        id: worker
+        shell: bash
+        run: |
+          set -xeuo pipefail
+
+          # 'nsc base-image upload' pushes a *relative* name into the Namespace tenant
+          # registry, prepending $NSC_CONTAINER_REGISTRY (e.g. nscr.io/<tenant>). Do NOT
+          # pass a fully-qualified ref here or it gets double-prefixed.
+          : "${NSC_CONTAINER_REGISTRY:?NSC_CONTAINER_REGISTRY is not set on this runner}"
+
+          # Mirror the (unchanged) ic-build image -- just pushed to GHCR and pinned by
+          # digest -- into the Namespace tenant registry. Namespace BRE workers boot
+          # from this image.
+          src="ghcr.io/dfinity/ic-build@${{ needs.ic-build-image.outputs.ic-build-imageid }}"
+          worker_repo="${NSC_CONTAINER_REGISTRY}/ic-build-worker"
+          worker_tag="${{ needs.build-image-prep.outputs.image_tag }}"
+
+          nsc docker login
+
+          # Upload, then read the pushed digest from nsc's own "Uploaded base image:"
+          # line. We parse the upload output rather than 'docker buildx imagetools
+          # inspect', whose --format prints the whole manifest for the multi-platform
+          # attestation index that docker/build-push-action emits. BRE needs an
+          # immutable digest (mutable tags are rejected).
+          upload_log="$(nsc base-image upload "$src" "ic-build-worker:$worker_tag" 2>&1)"
+          echo "$upload_log"
+          worker_digest="$(printf '%s\n' "$upload_log" | grep -i 'Uploaded base image' | grep -oE 'sha256:[0-9a-f]{64}' | tail -n1 || true)"
+          : "${worker_digest:?could not parse pushed image digest from nsc base-image upload output}"
+          worker_image="${worker_repo}@${worker_digest}"
+          echo "Resolved worker image: $worker_image"
+
+          # Optimize the pinned digest into a fast-booting worker variant. This blocks
+          # until ready and only needs to be done once per digest.
+          # NOTE: requires the 'baseimage:optimize' permission on the tenant registry.
+          nsc base-image optimize --image_ref "$worker_image"
+
+          echo "worker-image=$worker_image" >> "$GITHUB_OUTPUT"
+
   update-image-references:
     name: Update Image References in Repo
     runs-on: ubuntu-latest
-    needs: [build-image-prep, ic-build-image]
+    # Waits for the (slower) 'bre-worker-image' to finish before committing: the push
+    # this job makes triggers a new workflow run, and 'cancel-in-progress' in the
+    # concurrency group would otherwise cancel 'bre-worker-image' mid-optimize.
+    # Both 'ic-build-image' and 'bre-worker-image' are required (default 'needs'
+    # semantics): if either fails, that's a bug to fix.
+    needs: [build-image-prep, ic-build-image, bre-worker-image]
     if: ${{ needs.build-image-prep.outputs.build_image == 'true' }}
     steps:
       - name: Create GitHub App Token
@@ -119,7 +184,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          ref: ${{ github.head_ref }}
+          # head_ref is only set for pull_request; fall back to ref_name for push /
+          # workflow_dispatch so the checkout and git push target the right branch.
+          ref: ${{ github.head_ref || github.ref_name }}
           token: ${{ steps.app-token.outputs.token }}
 
       - name: Update Image References
@@ -141,13 +208,20 @@ jobs:
           sed -i -E "s|${IMAGE_PREFIX}ic-build(:\|@)[^\"]{5,}|$IMG_NAME_IC_BUILD|g" -- workflow*/*
           popd
 
+          # Pin the BRE worker image (always produced by the required 'bre-worker-image')
+          # in the experimental BRE test workflow. Match any tenant in the registry path
+          # so this keeps working if the Namespace tenant ever changes.
+          WORKER_IMAGE='${{ needs.bre-worker-image.outputs.worker-image }}'
+          sed -i -E "s|nscr\.io/[^\"/]+/ic-build-worker@sha256:[0-9a-f]{64}|${WORKER_IMAGE}|g" .github/workflows/bre-namespace-test.yml
+
           git config --global user.name "IDX GitHub Automation"
           git config --global user.email "<>"
           git add .
           git commit \
             -m 'Updating container images to tag: ${{ needs.build-image-prep.outputs.image_tag }}' \
             -m 'ic-build: ${{ needs.ic-build-image.outputs.ic-build-imageid }}' \
-            -m 'ic-dev:   ${{ needs.ic-build-image.outputs.ic-dev-imageid }}'
+            -m 'ic-dev:   ${{ needs.ic-build-image.outputs.ic-dev-imageid }}' \
+            -m 'ic-build-worker: ${{ needs.bre-worker-image.outputs.worker-image }}'
           git push
 
       - name: Add PR Comment
@@ -162,6 +236,7 @@ jobs:
             message += 'New container images with tag: `${{ needs.build-image-prep.outputs.image_tag }}`\n'
             message += 'ic-build: `${{ needs.ic-build-image.outputs.ic-build-imageid }}`\n'
             message += 'ic-dev: `${{ needs.ic-build-image.outputs.ic-dev-imageid }}`\n'
+            message += 'ic-build-worker: `${{ needs.bre-worker-image.outputs.worker-image }}`\n'
 
             // Find existing comment from this workflow
             const comments = await github.rest.issues.listComments({

ci/container/TAG

@@ -1 +1 @@
-daa25a4984be312c1cf51c5a932a200fa2fac895bdd550cac7bacb9dad553bae
+0000000000000000000000000000000000000000000000000000000000000000