From 02d1e47091a62e86ba81c7f3506430def1b2f2ed Mon Sep 17 00:00:00 2001 From: Quoc Truong Date: Tue, 20 Oct 2026 22:50:35 +0000 Subject: [PATCH 1/2] Replace linux-x86-n2-32 runner label with linux-x86-n4-32 --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 82bb5fb7d3..c6f1c9e002 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -42,7 +42,7 @@ jobs: # Other workflows are likely ok to use standard GH runners for now. # Googlers, see b/460874304. # Bazel build and test support is currently validated on Linux only. - runs-on: linux-x86-n2-32 + runs-on: linux-x86-n4-32 # Pinned to a digest because zizmor's unpinned-images check rejects tags. # To refresh: crane digest :latest container: us-docker.pkg.dev/ml-oss-artifacts-published/ml-public-container/ml-build@sha256:5544b5920fb9773007a2d61400dc70ba24ef03339cc521ac5ce89abc59b40eb7 From a9600d0120c1af5bb5531e2f0b1b70566404cb68 Mon Sep 17 00:00:00 2001 From: Quoc Truong Date: Wed, 21 Oct 2026 00:41:21 +0000 Subject: [PATCH 2/2] Use processwrapper-sandbox in ci/bazelrc --- ci/bazelrc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ci/bazelrc b/ci/bazelrc index f77a4073ac..b9a54a4be9 100644 --- a/ci/bazelrc +++ b/ci/bazelrc @@ -4,7 +4,7 @@ build --local_resources=memory=4000 build --worker_max_instances=2 # Ensure sandboxing is on to increase hermeticity. -build --spawn_strategy=sandboxed +build --spawn_strategy=processwrapper-sandbox build --worker_sandboxing # Bazel may materialize frontend/npm assets with CopyFile/CopyDirectory # actions that are not executable under processwrapper-sandbox alone.