RBE: Build buck2 with BuildBuddy RBE

.buckconfig

@@ -19,3 +19,25 @@ ignore = \
 
 [rust]
 default_edition = 2024
+
+[buck2]
+digest_algorithms         = SHA256
+materializations          = deferred
+sqlite_materializer_state = true
+defer_write_actions       = true
+clean_stale_enabled       = true
+restarter                 = true
+hash_all_commands         = true
+
+[build]
+execution_platforms = //platforms:platforms
+
+[buck2_re_client]
+use_fbcode_metadata = false
+capabilities         = true
+tls                  = true
+engine_address       = grpc://remote.buildbuddy.io
+action_cache_address = grpc://remote.buildbuddy.io
+cas_address          = grpc://remote.buildbuddy.io
+http_headers         = x-buildbuddy-api-key:$BUILDBUDDY_API_KEY
+instance_name        = $REMOTE_INSTANCE_NAME

Dockerfile

@@ -0,0 +1,35 @@
+FROM ubuntu:24.04
+
+# Note that the system_rust_toolchain assume that "rustc" is available in the PATH
+ENV DEBIAN_FRONTEND=noninteractive \
+    PATH=/root/.cargo/bin:$PATH
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        ca-certificates \
+        build-essential \
+        gpg \
+        git \
+        curl \
+        wget \
+        unzip \
+        libssl-dev \
+        libzstd-dev \
+        python3 \
+        clang \
+      && rm -rf /var/lib/apt/lists/*
+
+# The rust toolchain version in the container should be consistent with
+# the one declared in //:rust-toolchain file.
+COPY rust-toolchain /tmp/rust-toolchain
+RUN set -e; \
+    RUST_CHANNEL="$(grep -E '^[[:space:]]*channel' /tmp/rust-toolchain \
+                     | head -1 \
+                     | cut -d'=' -f2 \
+                     | tr -d ' \"')" && \
+    echo "Installing Rust toolchain ${RUST_CHANNEL}" && \
+    curl -sSf https://sh.rustup.rs \
+      | sh -s -- -y --profile minimal --default-toolchain "${RUST_CHANNEL}" && \
+    rustup component add clippy
+
+CMD [ "bash" ]

platforms/BUCK

@@ -0,0 +1,3 @@
+load(":defs.bzl", "platforms")
+
+platforms(name = "platforms")

platforms/defs.bzl

@@ -0,0 +1,64 @@
+# Copyright (c) Meta Platforms, Inc. and affiliates.
+#
+# This source code is licensed under both the MIT license found in the
+# LICENSE-MIT file in the root directory of this source tree and the Apache
+# License, Version 2.0 found in the LICENSE-APACHE file in the root directory
+# of this source tree.
+
+# See //:Dockerfile for more information
+_DEFAULT_IMAGE = "docker://ghcr.io/sluongng/buck2-toolchains@sha256:51dbccd962018fe862322362d884b340e7386c6485d437e562b5f3c5f0e7cf80"
+
+def _platforms(ctx):
+    constraints = dict()
+    constraints.update(ctx.attrs.cpu_configuration[ConfigurationInfo].constraints)
+    constraints.update(ctx.attrs.os_configuration[ConfigurationInfo].constraints)
+    cfg = ConfigurationInfo(constraints = constraints, values = {})
+    name = ctx.label.raw_target()
+
+    platform = ExecutionPlatformInfo(
+        label = ctx.label.raw_target(),
+        configuration = cfg,
+        executor_config = CommandExecutorConfig(
+            # Note: There are 3 git_fetch targets with `local_only = True` set in their actions.
+            # Currently we patch prelude and build a new buck2 binary with cargo to make them
+            # remote-compatible. However, that does require external network access in the RBE
+            # worker. In BuildBuddy, that's controlled by the `dockerNetwork` exec property below.
+            #
+            # If the RBE worker does not have the ability to access external network, we will
+            # need to run the git_fetch targets locally.
+            local_enabled = False,
+            remote_enabled = True,
+            use_limited_hybrid = False,
+            remote_cache_enabled = True,
+            allow_cache_uploads = True,
+            remote_execution_properties = {
+                "OSFamily": "Linux",
+                "Arch": "amd64",
+                "container-image": ctx.attrs.container_image,
+                # Prefer BuildBuddy-managed executors
+                "use-self-hosted-executors": "false",
+                # Typically we disable external network access with "off" value for a performance boost.
+                # However, we want to enable external network access here so that git_fetch action
+                # can run remotely.
+                "dockerNetwork": "bridge",
+            },
+            remote_execution_use_case = "buck2-default",
+            remote_output_paths = "output_paths",
+        ),
+    )
+
+    return [
+        DefaultInfo(),
+        platform,
+        PlatformInfo(label = str(name), configuration = cfg),
+        ExecutionPlatformRegistrationInfo(platforms = [platform]),
+    ]
+
+platforms = rule(
+    impl = _platforms,
+    attrs = {
+        "container_image": attrs.string(default = _DEFAULT_IMAGE),
+        "cpu_configuration": attrs.dep(providers = [ConfigurationInfo], default = "prelude//cpu:x86_64"),
+        "os_configuration": attrs.dep(providers = [ConfigurationInfo], default = "prelude//os:linux"),
+    },
+)

prelude/git/git_fetch.bzl

@@ -38,7 +38,7 @@ def git_fetch_impl(ctx: AnalysisContext) -> list[Provider]:
     ctx.actions.run(
         cmd,
         category = "git_fetch",
-        local_only = True,
+        # local_only = True,
         allow_cache_upload = ctx.attrs.allow_cache_upload,
     )