Skip to content

chore: use a dedicated RBE cluster for release builds - #11046

Draft
basvandijk wants to merge 1 commit into
masterfrom
basvandijk/use-a-dedicated-rbe-cluster-for-release-builds
Draft

chore: use a dedicated RBE cluster for release builds#11046
basvandijk wants to merge 1 commit into
masterfrom
basvandijk/use-a-dedicated-rbe-cluster-for-release-builds

Conversation

@basvandijk

@basvandijk basvandijk commented Aug 6, 2026

Copy link
Copy Markdown
Collaborator

See slack thread.

To reduce cache poisoning attacks we would like release builds to be executed on a different RBE cluster than the one used for PRs. This is accomplished by configuring nsc bazel execution setup with a --key=<SECRET_RBE_CLUSTER_KEY> documented as:

$ nsc bazel setup --help
...
      --key string  Stable identifier that disambiguates multiple parallel execution clusters for the same workspace. Defaults to 'default'.

secrets.SECRET_RBE_CLUSTER_KEY is only provided by the GitHub environment release-remote-build-execution-cluster which is only accessible on the protected branches: hotfix-*, master and rc--* which only a selected number of authorised users can push to.

There's one current issue: public-hotfix-* branches set release-build to true but they are not protected in the same way as the before mentioned branches, i.e. anybody with Write access can push to them. This means that the RBE job will fail on them. I'll probably fix this by not setting release-build to true for public-hotfix-* branches. I don't think they need it. But I need to confirm with the relevant engineers. See: #11047.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the RBE evaluation GitHub Actions workflow to ensure release builds use a dedicated Namespace RBE cluster (selected via a secret --key) instead of sharing the same cluster as PR builds, reducing cache poisoning risk.

Changes:

  • Select the release-remote-build-execution-cluster GitHub Environment when release-build == 'true'.
  • Update the RBE setup step to conditionally pass --key=$SECRET_RBE_CLUSTER_KEY for release builds and hard-fail if the key is missing (to avoid silently falling back to the shared cluster).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines 172 to +174
needs: [config, infer-bazel-targets]
environment:
name: ${{ case(needs.config.outputs.release-build == 'true', 'release-remote-build-execution-cluster', '') }}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants