fix(ci): allow sandbox network access for Algolia during SSR prerendering

origin's .bazelrc disables Bazel sandbox network access by default
(--nosandbox_default_allow_network), which makes the adev SSR bundling
step fail (RetryError: Unreachable hosts) because it needs to reach
Algolia during prerendering. This is a known issue also hit by
angular/angular-ja; this mirrors their fix.

- CI: add --sandbox_default_allow_network and CI resource limits to
  the Bazel config in ci.yml and adev-staging-deploy.yml
- Local: add a root .bazelrc (general Bazel diagnostics) and an
  optional .bazelrc.user.example (macOS network workaround via
  --spawn_strategy=local); tools/lib/common.mjs now propagates both
  into build/.bazelrc.user on every build, since Bazel only reads
  .bazelrc.user from its own workspace root

Author: ricardochl

.bazelrc

@@ -0,0 +1,10 @@
+# Print all the options that apply to the build.
+# This helps us diagnose which options override others
+# (e.g. /etc/bazel.bazelrc vs. tools/bazel.rc)
+build --announce_rc
+
+# More details on failures
+build --verbose_failures=true
+
+# CI supports colors but Bazel does not detect it.
+common --color=yes

.bazelrc.user.example

@@ -0,0 +1,5 @@
+# Local development settings for macOS
+# Copy this file to .bazelrc.user to enable these settings.
+# macOS sandbox blocks network access during prerendering (Algolia API calls).
+# Use local spawn strategy to allow network access.
+build --spawn_strategy=local

.github/workflows/adev-staging-deploy.yml

@@ -31,20 +31,22 @@ jobs:
           disk-cache: true
           repository-cache: true
           bazelrc: |
-            # Print all the options that apply to the build.
-            # This helps us diagnose which options override others
-            # (e.g. /etc/bazel.bazelrc vs. tools/bazel.rc)
-            build --announce_rc
+            # Limit resources for CI runners (ubuntu-latest: 7GB RAM, 2 CPUs)
+            build --local_ram_resources=4096
+            build --local_cpu_resources=2
+            build --jobs=2
+            build --discard_analysis_cache
+            build --nokeep_state_after_build
 
-            # More details on failures
-            build --verbose_failures=true
-
-            # CI supports colors but Bazel does not detect it.
-            common --color=yes
+            # Allow network access in sandbox for Algolia API calls during SSR prerendering.
+            build --sandbox_default_allow_network
       - name: Install Dependencies
         run: npm ci
       - name: Build Docs
         run: npm run build
+        env:
+          _JAVA_OPTIONS: -Xms512m -Xmx2g
+          NODE_OPTIONS: --max-old-space-size=4096
       - name: Deploy to Firebase Hosting
         uses: FirebaseExtended/action-hosting-deploy@v0
         with:

.github/workflows/ci.yml

@@ -27,7 +27,19 @@ jobs:
           bazelisk-cache: true
           disk-cache: true
           repository-cache: true
+          bazelrc: |
+            # Limit resources for CI runners (ubuntu-latest: 7GB RAM, 2 CPUs)
+            build --local_ram_resources=4096
+            build --local_cpu_resources=2
+            build --jobs=2
+            build --discard_analysis_cache
+            build --nokeep_state_after_build
+            # Allow network access in sandbox for Algolia API calls during SSR prerendering.
+            build --sandbox_default_allow_network
       - name: Install Dependencies
         run: npm ci
       - name: Build Docs
-        run: npm run build
+        run: npm run build
+        env:
+          _JAVA_OPTIONS: -Xms512m -Xmx2g
+          NODE_OPTIONS: --max-old-space-size=4096

.gitignore

@@ -2,6 +2,9 @@
 /build
 /tmp
 
+# Personal local Bazel overrides (see .bazelrc.user.example)
+.bazelrc.user
+
 # Node
 /node_modules
 npm-debug.log

tools/lib/common.mjs

@@ -1,4 +1,5 @@
 import { watch } from 'chokidar';
+import { appendFile, readFile } from 'node:fs/promises';
 import { resolve } from 'node:path';
 import { $, cd, chalk, glob, within } from 'zx';
 import { initDir, cpRf, exists } from './fileutiles.mjs';
@@ -19,6 +20,25 @@ export async function resetBuildDir({ init = false }) {
     await initDir(outDir);
     console.log(chalk.cyan('copying origin files to build directory...'));
     await cpRf(resolve(rootDir, 'origin'), outDir);
+    await applyRootBazelrc();
+  }
+}
+
+/**
+ * Propagates this repo's own .bazelrc, plus the personal .bazelrc.user (see
+ * .bazelrc.user.example) if present, into the build directory as .bazelrc.user.
+ * Bazel only reads .bazelrc.user from its own workspace root (build/), not from this repo's
+ * root, and build/ is recreated on every run, so both must be copied in each time.
+ */
+async function applyRootBazelrc() {
+  const dest = resolve(outDir, '.bazelrc.user');
+  await cpRf(resolve(rootDir, '.bazelrc'), dest);
+
+  const userBazelrc = resolve(rootDir, '.bazelrc.user');
+  if (await exists(userBazelrc)) {
+    console.log(chalk.cyan('applying local .bazelrc.user overrides...'));
+    const content = await readFile(userBazelrc, 'utf-8');
+    await appendFile(dest, '\n' + content);
   }
 }