Merge remote-tracking branch 'upstream/master' into pr/18668

Author: mmalerba

.bazelrc

@@ -81,7 +81,6 @@ build:remote --host_cpu=k8
 # Setup the remote build execution servers.
 build:remote --remote_cache=remotebuildexecution.googleapis.com
 build:remote --remote_executor=remotebuildexecution.googleapis.com
-build:remote --tls_enabled=true
 build:remote --auth_enabled=true
 
 # Setup the toolchain and platform for the remote build execution. The platform

.bazelversion

@@ -1 +1 @@
-3.1.0
+3.6.0

.circleci/config.yml

@@ -26,14 +26,6 @@ var_5: &job_defaults
   docker:
     - image: *docker_image
 
-# Job step for checking out the source code from GitHub. This also ensures that the source code
-# is rebased on top of master.
-var_6: &checkout_code
-  checkout:
-    # After checkout, rebase on top of master. By default, PRs are not rebased on top of master,
-    # which we want. See https://discuss.circleci.com/t/1662
-    post: git pull --ff-only origin "refs/pull/${CI_PULL_REQUEST//*pull\//}/merge"
-
 # Restores the cache that could be available for the current Yarn lock file. The cache usually
 # includes the node modules and the Bazel repository cache.
 var_7: &restore_cache
@@ -159,12 +151,34 @@ orbs:
   # push conflicts.
   queue: eddiewebb/[email protected]
 
+
+commands:
+  checkout_and_rebase:
+    description: Checkout and rebase the repository
+    steps:
+      - checkout
+      - run:
+          name: Set up environment
+          environment:
+              CIRCLE_GIT_BASE_REVISION: << pipeline.git.base_revision >>
+              CIRCLE_GIT_REVISION: << pipeline.git.revision >>
+          command: ./.circleci/env.sh
+      - run:
+          name: Rebase PR on target branch
+          # After checkout, rebase on top of target branch.
+          command: |
+            if [ -n "$CIRCLE_PR_NUMBER" ]; then
+              # User is required for rebase.
+              git config user.name "angular-ci"
+              git config user.email "angular-ci"
+              node .circleci/rebase-pr.js
+            fi
+
 # -----------------------------------------------------------------------------------------
 # Job definitions. Jobs which are defined just here, will not run automatically. Each job
 # must be part of a workflow definition in order to run for PRs and push builds.
 # -----------------------------------------------------------------------------------------
 jobs:
-
   # -----------------------------------
   # Job to test that everything builds with Bazel
   # -----------------------------------
@@ -174,7 +188,7 @@ jobs:
     environment:
       GCP_DECRYPT_TOKEN: *gcp_decrypt_token
     steps:
-      - *checkout_code
+      - checkout_and_rebase
       - *restore_cache
       - *setup_bazel_ci_config
       - *setup_bazel_remote_execution
@@ -196,7 +210,7 @@ jobs:
     environment:
       GCP_DECRYPT_TOKEN: *gcp_decrypt_token
     steps:
-      - *checkout_code
+      - checkout_and_rebase
       - *restore_cache
       - *setup_bazel_ci_config
       - *setup_bazel_remote_execution
@@ -218,7 +232,7 @@ jobs:
     environment:
       GCP_DECRYPT_TOKEN: *gcp_decrypt_token
     steps:
-    - *checkout_code
+    - checkout_and_rebase
     - *restore_cache
     - *setup_bazel_ci_config
     - *setup_bazel_remote_execution
@@ -237,14 +251,17 @@ jobs:
     environment:
       GCP_DECRYPT_TOKEN: *gcp_decrypt_token
     steps:
-      - *checkout_code
+      - checkout_and_rebase
       - *restore_cache
       - *setup_bazel_ci_config
       - *setup_bazel_remote_execution
       - *yarn_install
       - *setup_bazel_binary
 
-      - run: bazel test src/... --build_tag_filters=e2e --test_tag_filters=e2e --build_tests_only
+      # Run e2e tests. Note that protractor test targets are flaky sometimes, so we run them
+      # with flaky test attempts. This means that Bazel will re-run a failed e2e test target
+      # a second time to ensure it's a real test failure. This improves CI stability.
+      - run: yarn e2e --flaky_test_attempts=2
       - *slack_notify_on_failure
 
   # ------------------------------------------------------------------------------------------
@@ -257,7 +274,7 @@ jobs:
     environment:
       GCP_DECRYPT_TOKEN: *gcp_decrypt_token
     steps:
-      - *checkout_code
+      - checkout_and_rebase
       - *restore_cache
       - *setup_bazel_ci_config
       - *setup_bazel_remote_execution
@@ -278,7 +295,7 @@ jobs:
       BROWSER_STACK_USERNAME: "angularteam1"
       BROWSER_STACK_ACCESS_KEY: "CaXMeMHD9pr5PHg8N7Jq"
     steps:
-      - *checkout_code
+      - checkout_and_rebase
       - *restore_cache
       - *setup_bazel_ci_config
       - *yarn_install
@@ -300,7 +317,7 @@ jobs:
       # a rate limit exception.
       KARMA_PARALLEL_BROWSERS: 2
     steps:
-    - *checkout_code
+    - checkout_and_rebase
     - *restore_cache
     - *setup_bazel_ci_config
     - *yarn_install
@@ -313,8 +330,11 @@ jobs:
   # ----------------------------------
   lint:
     <<: *job_defaults
+    environment:
+      CI_GIT_BASE_REVISION: << pipeline.git.base_revision >>
+      CI_GIT_REVISION: << pipeline.git.revision >>
     steps:
-      - *checkout_code
+      - checkout_and_rebase
       - *restore_cache
       - *setup_bazel_ci_config
       - *yarn_install
@@ -333,10 +353,20 @@ jobs:
             yarn check-entry-point-setup $(bazel info bazel-bin)/entry_points_manifest.json
 
       - run: yarn ng-dev format changed --check << pipeline.git.base_revision >>
+      - run:
+          name: Check Commit Message (PR Only)
+          # Only run the commit message checks on pull requests since we can't do
+          # much about any failures that have made it into the main branch.
+          command: |
+            if [ -n "$CIRCLE_PR_NUMBER" ]; then
+              yarn ng-dev commit-message validate-range --range $CI_COMMIT_RANGE
+            fi
       - run: yarn ownerslint
+      - run: yarn check-mdc-tests
       - run: yarn stylelint
       - run: yarn tslint
       - run: yarn -s ts-circular-deps:check
+      - run: yarn check-mdc-exports
 
       - *slack_notify_on_failure
       - *save_cache
@@ -351,7 +381,7 @@ jobs:
     environment:
       GCP_DECRYPT_TOKEN: *gcp_decrypt_token
     steps:
-      - *checkout_code
+      - checkout_and_rebase
       - *restore_cache
       - *setup_bazel_ci_config
       - *setup_bazel_remote_execution
@@ -403,7 +433,7 @@ jobs:
   upload_release_packages:
     <<: *job_defaults
     steps:
-      - *checkout_code
+      - checkout_and_rebase
       - *restore_cache
       - *attach_release_output
       - *yarn_install
@@ -424,7 +454,7 @@ jobs:
     environment:
       GCP_DECRYPT_TOKEN: *gcp_decrypt_token
     steps:
-      - *checkout_code
+      - checkout_and_rebase
       - *restore_cache
       - *attach_release_output
       - *setup_bazel_ci_config
@@ -440,7 +470,7 @@ jobs:
       # The components examples package is not a release package, but we publish it
       # as part of this job to the docs-content repository. It's not contained in the
       # attached release output, so we need to build it here.
-      - run: bazel build src/components-examples:npm_package --config=snapshot-build
+      - run: yarn build-docs-content
 
       # Ensures that we do not push the snapshot artifacts upstream until all previous
       # snapshot build jobs have completed. This helps avoiding conflicts when multiple
@@ -462,7 +492,7 @@ jobs:
     <<: *job_defaults
     resource_class: xlarge
     steps:
-      - *checkout_code
+      - checkout_and_rebase
       - *restore_cache
       - *attach_release_output
       - *yarn_install
@@ -486,7 +516,7 @@ jobs:
     <<: *job_defaults
     resource_class: xlarge
     steps:
-      - *checkout_code
+      - checkout_and_rebase
       - *restore_cache
       - *attach_release_output
       - *setup_snapshot_builds
@@ -513,7 +543,7 @@ jobs:
     environment:
       GCP_DECRYPT_TOKEN: *gcp_decrypt_token
     steps:
-    - *checkout_code
+    - checkout_and_rebase
     - *restore_cache
     - *setup_bazel_ci_config
     - *setup_bazel_remote_execution
@@ -534,7 +564,7 @@ jobs:
     environment:
       GCP_DECRYPT_TOKEN: *gcp_decrypt_token
     steps:
-      - *checkout_code
+      - checkout_and_rebase
       - *restore_cache
       - *setup_bazel_ci_config
       - *setup_bazel_remote_execution
@@ -554,7 +584,7 @@ jobs:
     environment:
       GCP_DECRYPT_TOKEN: *gcp_decrypt_token
     steps:
-      - *checkout_code
+      - checkout_and_rebase
       - *restore_cache
       - *setup_bazel_ci_config
       - *setup_bazel_remote_execution
@@ -575,7 +605,7 @@ jobs:
     environment:
       GCP_DECRYPT_TOKEN: *gcp_decrypt_token
     steps:
-      - *checkout_code
+      - checkout_and_rebase
       - *restore_cache
       - *setup_bazel_ci_config
       - *setup_bazel_remote_execution
@@ -601,7 +631,7 @@ jobs:
     environment:
       GCP_DECRYPT_TOKEN: *gcp_decrypt_token
     steps:
-      - *checkout_code
+      - checkout_and_rebase
       - *restore_cache
       - *setup_bazel_binary
       - *setup_bazel_ci_config

.circleci/env-helpers.inc.sh

@@ -0,0 +1,73 @@
+####################################################################################################
+# Helpers for defining environment variables for CircleCI.
+#
+# In CircleCI, each step runs in a new shell. The way to share ENV variables across steps is to
+# export them from `$BASH_ENV`, which is automatically sourced at the beginning of every step (for
+# the default `bash` shell).
+#
+# See also https://circleci.com/docs/2.0/env-vars/#using-bash_env-to-set-environment-variables.
+####################################################################################################
+
+# Set and print an environment variable.
+#
+# Use this function for setting environment variables that are public, i.e. it is OK for them to be
+# visible to anyone through the CI logs.
+#
+# Usage: `setPublicVar <name> <value>`
+function setPublicVar() {
+  setSecretVar $1 "$2";
+  echo "$1=$2";
+}
+
+# Set (without printing) an environment variable.
+#
+# Use this function for setting environment variables that are secret, i.e. should not be visible to
+# everyone through the CI logs.
+#
+# Usage: `setSecretVar <name> <value>`
+function setSecretVar() {
+  # WARNING: Secrets (e.g. passwords, access tokens) should NOT be printed.
+  # (Keep original shell options to restore at the end.)
+  local -r originalShellOptions=$(set +o);
+  set +x -eu -o pipefail;
+
+  echo "export $1=\"${2:-}\";" >> $BASH_ENV;
+
+  # Restore original shell options.
+  eval "$originalShellOptions";
+}
+
+
+# Create a function to set an environment variable, when called.
+#
+# Use this function for creating setter for public environment variables that require expensive or
+# time-consuming computaions and may not be needed. When needed, you can call this function to set
+# the environment variable (which will be available through `$BASH_ENV` from that point onwards).
+#
+# Arguments:
+# - `<name>`: The name of the environment variable. The generated setter function will be
+#   `setPublicVar_<name>`.
+# - `<code>`: The code to run to compute the value for the variable. Since this code should be
+#   executed lazily, it must be properly escaped. For example:
+#   ```sh
+#   # DO NOT do this:
+#   createPublicVarSetter MY_VAR "$(whoami)";  # `whoami` will be evaluated eagerly
+#
+#   # DO this isntead:
+#   createPublicVarSetter MY_VAR "\$(whoami)";  # `whoami` will NOT be evaluated eagerly
+#   ```
+#
+# Usage: `createPublicVarSetter <name> <code>`
+#
+# Example:
+# ```sh
+# createPublicVarSetter MY_VAR 'echo "FOO"';
+# echo $MY_VAR;  # Not defined
+#
+# setPublicVar_MY_VAR;
+# source $BASH_ENV;
+# echo $MY_VAR;  # FOO
+# ```
+function createPublicVarSetter() {
+  echo "setPublicVar_$1() { setPublicVar $1 \"$2\"; }" >> $BASH_ENV;
+}

.circleci/env.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+
+# Variables
+readonly projectDir=$(realpath "$(dirname ${BASH_SOURCE[0]})/..")
+readonly envHelpersPath="$projectDir/.circleci/env-helpers.inc.sh";
+readonly bashEnvCachePath="$projectDir/.circleci/bash_env_cache";
+
+# Load helpers and make them available everywhere (through `$BASH_ENV`).
+source $envHelpersPath;
+echo "source $envHelpersPath;" >> $BASH_ENV;
+
+
+####################################################################################################
+# Define PUBLIC environment variables for CircleCI.
+####################################################################################################
+# See https://circleci.com/docs/2.0/env-vars/#built-in-environment-variables for more info.
+####################################################################################################
+setPublicVar CI "$CI"
+setPublicVar PROJECT_ROOT "$projectDir";
+# This is the branch being built; e.g. `pull/12345` for PR builds.
+setPublicVar CI_BRANCH "$CIRCLE_BRANCH";
+setPublicVar CI_BUILD_URL "$CIRCLE_BUILD_URL";
+setPublicVar CI_COMMIT "$CIRCLE_SHA1";
+# `CI_COMMIT_RANGE` is only used on push builds (a.k.a. non-PR, non-scheduled builds and rerun
+# workflows of such builds).
+setPublicVar CI_GIT_BASE_REVISION "${CIRCLE_GIT_BASE_REVISION}";
+setPublicVar CI_GIT_REVISION "${CIRCLE_GIT_REVISION}";
+setPublicVar CI_COMMIT_RANGE "$CIRCLE_GIT_BASE_REVISION..$CIRCLE_GIT_REVISION";
+setPublicVar CI_PULL_REQUEST "${CIRCLE_PR_NUMBER:-false}";
+setPublicVar CI_REPO_NAME "$CIRCLE_PROJECT_REPONAME";
+setPublicVar CI_REPO_OWNER "$CIRCLE_PROJECT_USERNAME";
+setPublicVar CI_PR_REPONAME "$CIRCLE_PR_REPONAME";
+setPublicVar CI_PR_USERNAME "$CIRCLE_PR_USERNAME";
+
+####################################################################################################
+# Decrypt GCP Credentials and store them as the Google default credentials.
+####################################################################################################
+mkdir -p "$HOME/.config/gcloud";
+openssl aes-256-cbc -d -in "${projectDir}/.circleci/gcp_token" \
+        -md md5 -k "$CIRCLE_PROJECT_REPONAME" -out "$HOME/.config/gcloud/application_default_credentials.json"
+####################################################################################################
+# Set bazel configuration for CircleCI runs.
+####################################################################################################
+cp "${projectDir}/.circleci/bazel.linux.rc" "$HOME/.bazelrc";
+
+####################################################################################################
+####################################################################################################
+##                  Source `$BASH_ENV` to make the variables available immediately.               ##
+##                  ***NOTE: This must remain the the last action in this script***               ##
+####################################################################################################
+####################################################################################################
+source $BASH_ENV;