fix(ci): allow sandbox network access for Algolia during SSR prerendering

origin's .bazelrc disables Bazel sandbox network access by default
(--nosandbox_default_allow_network), which makes the adev SSR bundling
step fail (RetryError: Unreachable hosts) because it needs to reach
Algolia during prerendering. This is a known issue also hit by
angular/angular-ja; this mirrors their fix.

- CI: add --sandbox_default_allow_network and CI resource limits to
  the Bazel config in ci.yml and adev-staging-deploy.yml
- Local: add a root .bazelrc (general Bazel diagnostics) and an
  optional .bazelrc.user.example (macOS network workaround via
  --spawn_strategy=local); tools/lib/common.mjs now propagates both
  into build/.bazelrc.user on every build, since Bazel only reads
  .bazelrc.user from its own workspace root
- Bump actions/checkout, actions/setup-node, pnpm/action-setup, and
  bazel-contrib/setup-bazel to their first Node 24 releases, clearing
  the Node 20 deprecation warning on every run
- Migrate deprecated --local_ram_resources/--local_cpu_resources to
  --local_resources=memory=/cpu=, and drop the _JAVA_OPTIONS env var
  since Bazel was silently ignoring it
- Use a per-workflow disk-cache key (disk-cache: ${{ github.workflow }})
  instead of one shared across workflows, matching angular-ja
- Verified green in CI at memory=4096 (Bazel) + NODE_OPTIONS=4096
  (Node), --jobs=2, all within the free ubuntu-latest runner's 7GB RAM;
  the earlier OOM-shaped failures at this same budget were during a
  documented GitHub-wide Actions outage, not a resource shortfall

Author: ricardochl

.bazelrc

@@ -0,0 +1,10 @@
+# Print all the options that apply to the build.
+# This helps us diagnose which options override others
+# (e.g. /etc/bazel.bazelrc vs. tools/bazel.rc)
+build --announce_rc
+
+# More details on failures
+build --verbose_failures=true
+
+# CI supports colors but Bazel does not detect it.
+common --color=yes

.bazelrc.user.example

@@ -0,0 +1,5 @@
+# Local development settings for macOS
+# Copy this file to .bazelrc.user to enable these settings.
+# macOS sandbox blocks network access during prerendering (Algolia API calls).
+# Use local spawn strategy to allow network access.
+build --spawn_strategy=local

.github/workflows/adev-staging-deploy.yml

@@ -13,38 +13,39 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           submodules: true
       - name: Setup Node JS
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version-file: '.node-version'
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # 4.1.0
+        uses: pnpm/action-setup@b307475762933b98ed359c036b0e51f26b63b74b # v5.0.0
         with:
           version: 10.17.1
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@4fd964a13a440a8aeb0be47350db2fc640f19ca8 # 0.15.0
+        uses: bazel-contrib/setup-bazel@8cb04a772ab4c1eb984e9c1b493a182e96c5e425 # 0.19.0
         with:
           bazelisk-cache: true
-          disk-cache: true
+          disk-cache: ${{ github.workflow }}
           repository-cache: true
           bazelrc: |
-            # Print all the options that apply to the build.
-            # This helps us diagnose which options override others
-            # (e.g. /etc/bazel.bazelrc vs. tools/bazel.rc)
-            build --announce_rc
+            # Limit resources for CI runners (ubuntu-latest: 7GB RAM, 2 CPUs)
+            build --local_resources=memory=4096
+            build --local_resources=cpu=2
+            build --jobs=2
+            build --discard_analysis_cache
+            build --nokeep_state_after_build
 
-            # More details on failures
-            build --verbose_failures=true
-
-            # CI supports colors but Bazel does not detect it.
-            common --color=yes
+            # Allow network access in sandbox for Algolia API calls during SSR prerendering.
+            build --sandbox_default_allow_network
       - name: Install Dependencies
         run: npm ci
       - name: Build Docs
         run: npm run build
+        env:
+          NODE_OPTIONS: --max-old-space-size=4096
       - name: Deploy to Firebase Hosting
         uses: FirebaseExtended/action-hosting-deploy@v0
         with:

.github/workflows/ci.yml

@@ -10,24 +10,35 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           submodules: true
       - name: Setup Node JS
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version-file: '.node-version'
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # 4.1.0
+        uses: pnpm/action-setup@b307475762933b98ed359c036b0e51f26b63b74b # v5.0.0
         with:
           version: 10.17.1
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@4fd964a13a440a8aeb0be47350db2fc640f19ca8 # 0.15.0
+        uses: bazel-contrib/setup-bazel@8cb04a772ab4c1eb984e9c1b493a182e96c5e425 # 0.19.0
         with:
           bazelisk-cache: true
-          disk-cache: true
+          disk-cache: ${{ github.workflow }}
           repository-cache: true
+          bazelrc: |
+            # Limit resources for CI runners (ubuntu-latest: 7GB RAM, 2 CPUs)
+            build --local_resources=memory=4096
+            build --local_resources=cpu=2
+            build --jobs=2
+            build --discard_analysis_cache
+            build --nokeep_state_after_build
+            # Allow network access in sandbox for Algolia API calls during SSR prerendering.
+            build --sandbox_default_allow_network
       - name: Install Dependencies
         run: npm ci
       - name: Build Docs
-        run: npm run build
+        run: npm run build
+        env:
+          NODE_OPTIONS: --max-old-space-size=4096

.gitignore

@@ -2,6 +2,9 @@
 /build
 /tmp
 
+# Personal local Bazel overrides (see .bazelrc.user.example)
+.bazelrc.user
+
 # Node
 /node_modules
 npm-debug.log

tools/lib/common.mjs

@@ -1,4 +1,5 @@
 import { watch } from 'chokidar';
+import { appendFile, readFile } from 'node:fs/promises';
 import { resolve } from 'node:path';
 import { $, cd, chalk, glob, within } from 'zx';
 import { initDir, cpRf, exists } from './fileutiles.mjs';
@@ -19,6 +20,25 @@ export async function resetBuildDir({ init = false }) {
     await initDir(outDir);
     console.log(chalk.cyan('copying origin files to build directory...'));
     await cpRf(resolve(rootDir, 'origin'), outDir);
+    await applyRootBazelrc();
+  }
+}
+
+/**
+ * Propagates this repo's own .bazelrc, plus the personal .bazelrc.user (see
+ * .bazelrc.user.example) if present, into the build directory as .bazelrc.user.
+ * Bazel only reads .bazelrc.user from its own workspace root (build/), not from this repo's
+ * root, and build/ is recreated on every run, so both must be copied in each time.
+ */
+async function applyRootBazelrc() {
+  const dest = resolve(outDir, '.bazelrc.user');
+  await cpRf(resolve(rootDir, '.bazelrc'), dest);
+
+  const userBazelrc = resolve(rootDir, '.bazelrc.user');
+  if (await exists(userBazelrc)) {
+    console.log(chalk.cyan('applying local .bazelrc.user overrides...'));
+    const content = await readFile(userBazelrc, 'utf-8');
+    await appendFile(dest, '\n' + content);
   }
 }