build: setup RBE caching and remote build event service on CI (#16370)

Author: josephperrott

.circleci/base-rbe-bazelrc

@@ -12,6 +12,11 @@ build:remote --remote_executor=remotebuildexecution.googleapis.com
 build:remote --tls_enabled=true
 build:remote --auth_enabled=true
 
+# Setup Build Event Service
+build:remote --bes_backend=buildeventservice.googleapis.com
+build:remote --bes_timeout=30s
+build:remote --bes_results_url="https://source.cloud.google.com/results/invocations/"	
+
 # Setup the toolchain and platform for the remote build execution. The platform
 # is automatically configured by the "rbe_autoconfig" rule in the project workpsace.
 build:remote --crosstool_top=@rbe_default//cc:toolchain

.circleci/bazel.rc

@@ -15,8 +15,7 @@ import %workspace%/.circleci/base-rbe-bazelrc
 
 # Use the Angular team internal GCP instance for remote execution.
 build:remote --remote_instance_name=projects/internal-200822/instances/default_instance
+build:remote --project_id=internal-200822
 
-# We want to accept remote cached build artifacts to speed up our builds incrementally.
-# TODO(devversion): Temporary disabled since we don't have much insight on possible security
-# issues. Enable this once we investigated this further and talked to the RBE team.
-build:remote --remote_accept_cached=false
+# Always read from remote cache on CI.
+build:remote --remote_accept_cached=true

scripts/circleci/bazel/setup-remote-execution.sh

@@ -19,4 +19,11 @@ openssl aes-256-cbc -d -in .circleci/gcp_token -md md5 -k ${GCP_DECRYPT_TOKEN} \
 echo "export GOOGLE_APPLICATION_CREDENTIALS=$HOME/.gcp_credentials" >> $BASH_ENV
 
 # Update the CircleCI Bazel configuration to always use remote execution.
-echo 'build --config=remote' >> .circleci/bazel.rc
+echo "build --config=remote" >> .circleci/bazel.rc
+
+# Only upload locally built results to the cache if we are running already commited code.
+if [[ -n "${CIRCLE_PR_NUMBER}" ]]; then
+  echo "build --remote_upload_local_results=false" >> .circleci/bazel.rc
+else
+  echo "build --remote_upload_local_results=true" >> .circleci/bazel.rc
+fi