CI: use EngFlow Opal for remote caching

.bazelrc

@@ -3,3 +3,13 @@ common --enable_platform_specific_config
 # Needed for "@grpc//:grpc++" used by language/cc/testdata/cc_grpc_library.
 # Fixes "aligned allocation/deallocation function of type '...' is only available on macOS 10.13 or newer" errors.
 build:macos --cxxopt=-mmacosx-version-min=10.13
+
+# EngFlow remote cluster configuration
+build:engflow --remote_instance_name=gazelle_cc
+build:engflow --remote_cache=grpcs://opal.cluster.engflow.com
+build:engflow --bes_instance_name=gazelle_cc
+build:engflow --bes_backend=grpcs://opal.cluster.engflow.com
+build:engflow --bes_results_url=https://opal.cluster.engflow.com/invocations/gazelle_cc/
+
+# Add authentication flags to this file, not checked in.
+try-import .bazelrc.user

.bazelrc.ci

@@ -0,0 +1 @@
+build:engflow --credential_helper=opal.cluster.engflow.com=%workspace%/scripts/bazel_credential_helper.sh

.github/workflows/ci.yaml

@@ -10,12 +10,16 @@ concurrency:
   group: ci-${{ github.head_ref }}-${{ github.event_name }}
   cancel-in-progress: true
 
+env:
+  OPAL_RPC_CREDENTIALS: ${{ secrets.OPAL_RPC_CREDENTIALS }}
+
 jobs:
   build:
     strategy:
       # Keep in sync with configurations in .bcr/presubmit.yml. We cannot run
       # those tests in CI: they are post-release only. So we need to cover the
       # same configurations here.
+      fail-fast: false
       matrix:
         os: [ubuntu-24.04, macos-26]
         # "" means use the version in .bazelversion. Add 8.x if that changes.
@@ -31,16 +35,20 @@ jobs:
       BAZELRC: ${{ matrix.custom-bazelrc }}
     steps:
       - uses: actions/checkout@v6
+      - name: "Set up authentication"
+        shell: bash
+        run: "cp .bazelrc.ci .bazelrc.user"
       - name: Build
         run: |
-          bazel build //...
+          bazel build --config=engflow //...
       - name: Test
         run: |
-          bazel test --test_output=errors //...
+          bazel test --config=engflow --test_output=errors //...
 
   # Imitate the BCR test in .bcr/presubmit.yml. Keep in sync.
   bcr_test_module:
     strategy:
+      fail-fast: false
       matrix:
         os: [ubuntu-24.04, macos-26]
         bazel-version: ["7.*", "8.*", "9.*"]
@@ -53,30 +61,39 @@ jobs:
         working-directory: "example/bzlmod"
     steps:
       - uses: actions/checkout@v6
+      - name: "Set up authentication"
+        shell: bash
+        run: "cp .bazelrc.ci .bazelrc.user && cp ../../scripts/bazel_credential_helper.sh ."
       - name: Run Gazelle
-        run: "bazel run //:gazelle"
+        run: "bazel run --config=engflow //:gazelle"
       - name: Build
-        run: "bazel build //..."
+        run: "bazel build --config=engflow //..."
       - name: Test
-        run: "bazel test //..."
+        run: "bazel test --config=engflow //..."
 
   test-indexers:
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v6
+      - name: "Set up authentication"
+        shell: bash
+        run: "cp .bazelrc.ci .bazelrc.user"
       - name: Install Conan
         run: |
           python3 -m pip install --upgrade pip
           pip install conan
       - name: Execute manual integration tests
-        run: bazel test --test_output=errors //index:integration_tests
+        run: bazel test --config=engflow --test_output=errors //index:integration_tests
 
   test-e2e:
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v6
+      - name: "Set up authentication"
+        shell: bash
+        run: "cp .bazelrc.ci .bazelrc.user"
       - name: Execute end to end tests
         run: bash .github/workflows/test_e2e.sh
 

.github/workflows/test_e2e.sh

@@ -5,14 +5,18 @@ set -o errexit -o nounset -o pipefail
 scriptDir="$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
 rootDir=$(realpath "$scriptDir/../..")
 
+BAZEL_CONFIG_FLAGS=(
+  --config=engflow
+)
+
 function runBazelCommandTreatingWarningsAsErrors() {
   local OUTPUT_BASE_DIR=$(bazel info output_base)
   local BAZEL_COMMAND_LOG_FILE="$OUTPUT_BASE_DIR/command.log"
   local BAZEL_CMD="$1"
   shift
 
   # Disable colors and control characters to make grep work properly
-  command bazel "$BAZEL_CMD" --color=no --curses=no "$@"
+  command bazel "$BAZEL_CMD" "${BAZEL_CONFIG_FLAGS[@]}" "$@"
 
   # Expect no warnings in the command output
   local COLLECTED_WARNINGS=$(grep "^WARNING" "$BAZEL_COMMAND_LOG_FILE" || true)

.gitignore

@@ -5,6 +5,7 @@ sandbox/*
 .scala-build
 .metals
 .bsp
+.bazelrc.user
 
 # macOS
 .DS_Store

example/bzlmod/.bazelrc

@@ -0,0 +1,9 @@
+# EngFlow remote cluster configuration
+build:engflow --remote_instance_name=gazelle_cc
+build:engflow --remote_cache=grpcs://opal.cluster.engflow.com
+build:engflow --bes_instance_name=gazelle_cc
+build:engflow --bes_backend=grpcs://opal.cluster.engflow.com
+build:engflow --bes_results_url=https://opal.cluster.engflow.com/invocations/gazelle_cc/
+
+# Add authentication flags to this file, not checked in.
+try-import .bazelrc.user

example/bzlmod/.bazelrc.ci

@@ -0,0 +1 @@
+build:engflow --credential_helper=opal.cluster.engflow.com=%workspace%/bazel_credential_helper.sh

scripts/bazel_credential_helper.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+
+# Bazel expects the helper to read stdin.
+cat /dev/stdin > /dev/null
+
+# `OPAL_RPC_CREDENTIALS` is provided as a secret.
+echo "${OPAL_RPC_CREDENTIALS}"