Update Bazel to 6.3.2 (#225)

Also minor improvements to the integration test image. The size is
reduced from 4.17G to 4.05G.

Author: faximan

.github/ci/Dockerfile.integration-test-image

@@ -9,22 +9,25 @@ RUN \
     curl -fsSL https://bazel.build/bazel-release.pub.gpg | gpg --dearmor >bazel-archive-keyring.gpg && \
     mv bazel-archive-keyring.gpg /usr/share/keyrings && \
     echo "deb [arch=amd64 signed-by=/usr/share/keyrings/bazel-archive-keyring.gpg] https://storage.googleapis.com/bazel-apt stable jdk1.8" | tee /etc/apt/sources.list.d/bazel.list && \
-
     apt-get update && \
     apt-get install -y \
-      bazel-6.2.0 \
+      bazel-6.3.2 \
       git \
       jq && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
+    ln -s /usr/bin/bazel-6.3.2 /usr/bin/bazel
 
-    ln -s /usr/bin/bazel-6.2.0 /usr/bin/bazel && \
-    # Unpack Bazel for future use.
-    bazel version
+RUN mkdir -p /builder /output /workspace && chmod -R 777 /output
 
 # rules_python is not happy if bazel runs as root so create a new user
 # https://github.com/bazelbuild/rules_python/pull/713
 # https://github.com/GoogleCloudPlatform/cloud-builders/issues/641
-RUN mkdir -p /builder /output /workspace && chmod -R 777 /output
 RUN adduser builder
+
+# Allow running sudo without password
+RUN apt-get update && apt-get install -y sudo && apt-get clean && rm -rf /var/lib/apt/lists/* && \
+    usermod -aG sudo builder && \
+    echo "builder ALL=(ALL) NOPASSWD:ALL" > "/etc/sudoers.d/builder" && chmod 440 "/etc/sudoers.d/builder"
+
 USER builder

.github/ci/integration_test_cloudbuild.yaml

@@ -12,7 +12,7 @@ steps:
 
   # This runs on a custom image that has kubectl, gcloud and bazel installed.
   # See Dockerfile.integration-test-image.
-  - name: "gcr.io/robco-integration-test/integration-test-image@sha256:928573eb6eae7033efd0d62bda58a0e94c4142a3c319eded4a32940c6776a556"
+  - name: "gcr.io/robco-integration-test/integration-test-image@sha256:4861a46d7079ffa53d54999a3df080cb4a919505bb2b4803416ff5fad13efb5f"
     entrypoint: "bash"
     args: ["./.github/ci/integration_test.sh"]
     env:

.github/workflows/check-bazel.yml

@@ -9,6 +9,9 @@ on:
 permissions:
   contents: read
 
+env:
+  USE_BAZEL_VERSION: "6.3.2"
+
 jobs:
   check-bazel:
     runs-on: ubuntu-20.04
@@ -31,8 +34,6 @@ jobs:
           fi
           echo "$ROBCO_INTEGRATION_TEST_GITHUB_ROBOT_JSON_KEY" > robco_integration_test_credentials.json
       - name: Run .github/ci/presubmit.sh
-        env:
-          USE_BAZEL_VERSION: "6.2.0"
         run: ./.github/ci/presubmit.sh
       - name: Get bazel server logs
         if: success() || failure()

.github/workflows/release.yml

@@ -16,6 +16,9 @@ concurrency:
   group: ${{ github.ref }}
   cancel-in-progress: true
 
+env:
+  USE_BAZEL_VERSION: "6.3.2"
+
 jobs:
   create_release:
     runs-on: ubuntu-20.04
@@ -48,8 +51,6 @@ jobs:
           echo $ROBCO_NAVTEST_GITHUB_ROBOT_JSON_KEY > robco_navtest_credentials.json
 
       - name: Deploy Navtest
-        env:
-          USE_BAZEL_VERSION: "6.2.0"
         run: |
           set -euo pipefail
 
@@ -67,7 +68,6 @@ jobs:
       # Now we are ready to create the release.
       - name: Run release_binary.sh
         env:
-          USE_BAZEL_VERSION: "6.2.0"
           REPO: ${{ github.repository }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           FULL_SHA: ${{ steps.latest-green.outputs.latest_green }}