build: run integration tests in sandbox and with RBE

Runs the integration tests in sandbox and with RBE. This should
improve the stability of the integration tests significantly. i.e.
solving the issue/conflicts with a system-global Yarn cache.

Author: devversion

.bazelrc

@@ -86,9 +86,18 @@ build:remote --auth_enabled=true
 # is provided by the shared dev-infra package and targets k8 remote containers.
 build:remote --crosstool_top=@npm//@angular/dev-infra-private/bazel/remote-execution/cpp:cc_toolchain_suite
 build:remote --extra_toolchains=@npm//@angular/dev-infra-private/bazel/remote-execution/cpp:cc_toolchain
-build:remote --extra_execution_platforms=@npm//@angular/dev-infra-private/bazel/remote-execution:platform
-build:remote --host_platform=@npm//@angular/dev-infra-private/bazel/remote-execution:platform
-build:remote --platforms=@npm//@angular/dev-infra-private/bazel/remote-execution:platform
+build:remote --extra_execution_platforms=@npm//@angular/dev-infra-private/bazel/remote-execution:platform_with_network
+build:remote --host_platform=@npm//@angular/dev-infra-private/bazel/remote-execution:platform_with_network
+build:remote --platforms=@npm//@angular/dev-infra-private/bazel/remote-execution:platform_with_network
+
+################################
+#  Sandbox settings            #
+################################
+
+# By default, network access should be disabled unless explicitly granted for certain targets
+# using the `requires-network` tag. https://docs.bazel.build/versions/main/be/common-definitions.html
+build --sandbox_default_allow_network=false
+test --sandbox_default_allow_network=false
 
 ################################
 # --config=build-results       #

integration/ng-add/BUILD.bazel

@@ -23,12 +23,10 @@ node_integration_test(
         "yarn test",
     ],
     npm_packages = npmPackageMappings,
+    setup_chromium = True,
     tags = [
-        # Chromium cannot run in Sandbox. For this test, sandbox is disabled.
-        # Additionally, we need to disable RBE as this test relies on internet
-        # access for installing the NPM packages.
-        "no-sandbox",
-        "no-remote-exec",
+        # This test relies on `yarn` so there needs to be internet access.
+        "requires-network",
     ],
 )
 
@@ -41,18 +39,14 @@ node_integration_test(
         # See: https://github.com/yarnpkg/yarn/issues/2165.
         # TODO(devversion): determine if a solution/workaround could live in the test runner.
         "yarn install --cache-folder .yarn_cache_folder/",
-        "node --version",
-        "yarn node --version",
         "yarn ng add @angular/material",
         "yarn test",
     ],
     npm_packages = npmPackageMappings,
+    setup_chromium = True,
     tags = [
-        # Chromium cannot run in Sandbox. For this test, sandbox is disabled.
-        # Additionally, we need to disable RBE as this test relies on internet
-        # access for installing the NPM packages.
-        "no-sandbox",
-        "no-remote-exec",
+        # This test relies on `yarn` so there needs to be internet access.
+        "requires-network",
     ],
     tool_mappings = {
         "@node12_host//:yarn_bin": "yarn",

integration/ng-add/karma.conf.js

@@ -1,11 +1,6 @@
 // Karma configuration file, see link for more information
 // https://karma-runner.github.io/1.0/config/configuration-file.html
 
-// This code runs within Bazel where the environment does not have access to
-// the system Chrome browser. To workaround this we use Puppeteer to provide
-// a local version of Chromium that can run within Bazel.
-process.env.CHROME_BIN = require('puppeteer').executablePath();
-
 module.exports = function (config) {
   config.set({
     basePath: '',
@@ -34,12 +29,20 @@ module.exports = function (config) {
       subdir: '.',
       reporters: [{type: 'html'}, {type: 'text-summary'}],
     },
+    customLaunchers: {
+      ChromeHeadlessNoSandbox: {
+        base: 'ChromeHeadless',
+        flags: ['--no-sandbox'],
+      },
+    },
     reporters: ['progress', 'kjhtml'],
     port: 9876,
     colors: true,
     logLevel: config.LOG_INFO,
     autoWatch: true,
-    browsers: ['ChromeHeadless'],
+    // Chrome cannot run with sandbox enabled as this test already runs within
+    // the Bazel sandbox environment and the sandboxes would conflict otherwise.
+    browsers: ['ChromeHeadlessNoSandbox'],
     singleRun: false,
     restartOnFileChange: true,
   });

integration/ng-add/package.json

@@ -37,7 +37,6 @@
     "karma-coverage": "~2.0.3",
     "karma-jasmine": "~4.0.0",
     "karma-jasmine-html-reporter": "~1.7.0",
-    "puppeteer": "^10.4.0",
     "typescript": "file:../../node_modules/typescript"
   }
 }