build: run integration tests in sandbox and with RBE

.bazelrc

@@ -86,9 +86,18 @@ build:remote --auth_enabled=true
 # is provided by the shared dev-infra package and targets k8 remote containers.
 build:remote --crosstool_top=@npm//@angular/dev-infra-private/bazel/remote-execution/cpp:cc_toolchain_suite
 build:remote --extra_toolchains=@npm//@angular/dev-infra-private/bazel/remote-execution/cpp:cc_toolchain
-build:remote --extra_execution_platforms=@npm//@angular/dev-infra-private/bazel/remote-execution:platform
-build:remote --host_platform=@npm//@angular/dev-infra-private/bazel/remote-execution:platform
-build:remote --platforms=@npm//@angular/dev-infra-private/bazel/remote-execution:platform
+build:remote --extra_execution_platforms=@npm//@angular/dev-infra-private/bazel/remote-execution:platform_with_network
+build:remote --host_platform=@npm//@angular/dev-infra-private/bazel/remote-execution:platform_with_network
+build:remote --platforms=@npm//@angular/dev-infra-private/bazel/remote-execution:platform_with_network
+
+################################
+#  Sandbox settings            #
+################################
+
+# By default, network access should be disabled unless explicitly granted for certain targets
+# using the `requires-network` tag. https://docs.bazel.build/versions/main/be/common-definitions.html
+build --sandbox_default_allow_network=false
+test --sandbox_default_allow_network=false
 
 ################################
 # --config=build-results       #

integration/ng-add/BUILD.bazel

@@ -23,12 +23,10 @@ node_integration_test(
         "yarn test",
     ],
     npm_packages = npmPackageMappings,
+    setup_chromium = True,
     tags = [
-        # Chromium cannot run in Sandbox. For this test, sandbox is disabled.
-        # Additionally, we need to disable RBE as this test relies on internet
-        # access for installing the NPM packages.
-        "no-sandbox",
-        "no-remote-exec",
+        # This test relies on `yarn` so there needs to be internet access.
+        "requires-network",
     ],
 )
 
@@ -41,21 +39,14 @@ node_integration_test(
         # See: https://github.com/yarnpkg/yarn/issues/2165.
         # TODO(devversion): determine if a solution/workaround could live in the test runner.
         "yarn install --cache-folder .yarn_cache_folder/",
-        "node --version",
-        "yarn node --version",
         "yarn ng add @angular/material",
         "yarn test",
     ],
+    node_repository = "node12_host",
     npm_packages = npmPackageMappings,
+    setup_chromium = True,
     tags = [
-        # Chromium cannot run in Sandbox. For this test, sandbox is disabled.
-        # Additionally, we need to disable RBE as this test relies on internet
-        # access for installing the NPM packages.
-        "no-sandbox",
-        "no-remote-exec",
+        # This test relies on `yarn` so there needs to be internet access.
+        "requires-network",
     ],
-    tool_mappings = {
-        "@node12_host//:yarn_bin": "yarn",
-        "@node12_host//:node_bin": "node",
-    },
 )

integration/ng-add/karma.conf.js

@@ -1,11 +1,6 @@
 // Karma configuration file, see link for more information
 // https://karma-runner.github.io/1.0/config/configuration-file.html
 
-// This code runs within Bazel where the environment does not have access to
-// the system Chrome browser. To workaround this we use Puppeteer to provide
-// a local version of Chromium that can run within Bazel.
-process.env.CHROME_BIN = require('puppeteer').executablePath();
-
 module.exports = function (config) {
   config.set({
     basePath: '',
@@ -34,12 +29,20 @@ module.exports = function (config) {
       subdir: '.',
       reporters: [{type: 'html'}, {type: 'text-summary'}],
     },
+    customLaunchers: {
+      ChromeHeadlessNoSandbox: {
+        base: 'ChromeHeadless',
+        flags: ['--no-sandbox'],
+      },
+    },
     reporters: ['progress', 'kjhtml'],
     port: 9876,
     colors: true,
     logLevel: config.LOG_INFO,
     autoWatch: true,
-    browsers: ['ChromeHeadless'],
+    // Chrome cannot run with sandbox enabled as this test already runs within
+    // the Bazel sandbox environment and the sandboxes would conflict otherwise.
+    browsers: ['ChromeHeadlessNoSandbox'],
     singleRun: false,
     restartOnFileChange: true,
   });

integration/ng-add/package.json

@@ -37,7 +37,6 @@
     "karma-coverage": "~2.0.3",
     "karma-jasmine": "~4.0.0",
     "karma-jasmine-html-reporter": "~1.7.0",
-    "puppeteer": "^10.4.0",
     "typescript": "file:../../node_modules/typescript"
   }
 }