chore: refactor Bazel remote cache config

.bazelrc

@@ -1,6 +1,9 @@
 import %workspace%/.bazelrc.common
 import %workspace%/.bazelrc.bzlmod
 
+# Remote Cache Authentication
+try-import %workspace%/.bazelrc.auth
+
 # User Configuration
 # ------------------
 try-import %workspace%/.bazelrc.local

.bazelrc.common

@@ -45,12 +45,23 @@ build:macos-bindist --test_tag_filters  -requires_nix,-dont_test_on_darwin,-dont
 build:windows-bindist --build_tag_filters -requires_nix,-dont_test_on_windows,-requires_lz4,-requires_shellcheck,-requires_threaded_rts,-dont_test_with_bindist
 build:windows-bindist --test_tag_filters -requires_nix,-dont_test_on_windows,-requires_lz4,-requires_shellcheck,-requires_threaded_rts,-dont_test_with_bindist
 
+# Remote Cache Configuration
+# --------------------------
+build:remote-cache --bes_results_url=https://app.buildbuddy.io/invocation/
+build:remote-cache --bes_backend=grpcs://remote.buildbuddy.io
+build:remote-cache --remote_cache=grpcs://remote.buildbuddy.io
+build:remote-cache --remote_timeout=3600
+# Avoid failures of the form `deadline exceeded after 14999958197ns DEADLINE_EXCEEDED`.
+# See https://github.com/tweag/rules_haskell/issues/1498.
+build:remote-cache --keep_backend_build_event_connections_alive=false
+# All clients except CI should be configured as read-only
+build:remote-cache --noremote_upload_local_results
+
 # CI Configuration
 # ----------------
 common:ci --config=ci-common
 build:ci --config=remote-cache
-build:ci --bes_results_url=https://app.buildbuddy.io/invocation/
-build:ci --bes_backend=grpcs://remote.buildbuddy.io
+build:ci --remote_upload_local_results
 
 common:ci-common --color=no
 
@@ -71,7 +82,6 @@ build:ci-windows-bindist --bes_upload_mode=wait_for_upload_complete --bes_timeou
 # (see https://github.com/buildbuddy-io/buildbuddy/issues/4467)
 # increase the retries as a workaround.
 build:ci-windows-bindist --experimental_build_event_upload_max_retries=256
-build:remote-cache --remote_cache=grpcs://remote.buildbuddy.io
 build:ci-common --remote_timeout=3600
 # Avoid failures of the form `deadline exceeded after 14999958197ns DEADLINE_EXCEEDED`.
 # See https://github.com/tweag/rules_haskell/issues/1498.

.github/workflows/workflow.yaml

@@ -88,7 +88,7 @@ jobs:
       - uses: tweag/configure-bazel-remote-cache-auth@v0
         with:
           buildbuddy_api_key: ${{ secrets.BUILDBUDDY_API_KEY }}
-          bazelrc_path: .bazelrc.local
+          bazelrc_path: .bazelrc.auth
       - name: Configure
         run: |
           # Avoid failures of the form `deadline exceeded after 14999958197ns DEADLINE_EXCEEDED`.
@@ -202,7 +202,7 @@ jobs:
       - uses: tweag/configure-bazel-remote-cache-auth@v0
         with:
           buildbuddy_api_key: ${{ secrets.BUILDBUDDY_API_KEY }}
-          bazelrc_path: .bazelrc.local
+          bazelrc_path: .bazelrc.auth
       - name: Configure
         shell: bash
         run: |

CONTRIBUTING.md

@@ -26,3 +26,15 @@ maintenance-like contributions.
 ## Setting Up Your Development Environment
 
 Read how to [set up your development environment](https://github.com/tweag/rules_haskell#for-rules_haskell-developers).
+
+## Bazel Remote Cache
+
+The remote cache configuration for this repository is stored in [.bazelrc](/.bazelrc) and grouped
+under the name, `remote-cache`. It is configured to allow read-only access for all clients and
+read-write for CI. 
+
+To enable the remote cache, 
+
+1. Add `build --remote_header=x-buildbuddy-api-key=${buildbuddy_api_key}` to `.bazelrc.auth`
+   at the root of the workspace, replacing `${buildbuddy_api_key}` with the actual API key value.
+1. Add `build --config=remote-cache` to `.bazelrc.local` at the root of the workspace.