fix: prevent Bazel OOM crash on CI runners

- Add resource limits to all CI workflows' bazelrc configuration:
  - Limit RAM to 6GB (GitHub Actions ubuntu-latest has 7GB)
  - Limit CPUs to 2
  - Limit parallel jobs to 4
  - Reduce JVM heap to 2GB max
  - Discard analysis cache after build to reduce memory pressure

- Add build output verification in adev.ts to detect silent failures
  when Bazel server is killed mid-build

Author: lacolaco

.github/workflows/adev-preview-build.yml

@@ -35,16 +35,14 @@ jobs:
           disk-cache: ${{ github.workflow }}
           repository-cache: true
           bazelrc: |
-            # Print all the options that apply to the build.
-            # This helps us diagnose which options override others
-            # (e.g. /etc/bazel.bazelrc vs. tools/bazel.rc)
-            build --announce_rc
-
-            # More details on failures
-            build --verbose_failures=true
-
-            # CI supports colors but Bazel does not detect it.
-            common --color=yes
+            # Limit resources for CI runners (ubuntu-latest: 7GB RAM, 2 CPUs)
+            build --local_ram_resources=6144
+            build --local_cpu_resources=2
+            build --jobs=4
+            startup --host_jvm_args=-Xms512m
+            startup --host_jvm_args=-Xmx2g
+            build --discard_analysis_cache
+            build --nokeep_state_after_build
       - run: pnpm install --frozen-lockfile
       - run: pnpm run build
       - uses: angular/dev-infra/github-actions/previews/pack-and-upload-artifact@0512a5b9381ccff00c278d7b4b6ee38e5c09654d

.github/workflows/adev-production-deploy.yml

@@ -27,16 +27,14 @@ jobs:
           disk-cache: ${{ github.workflow }}
           repository-cache: true
           bazelrc: |
-            # Print all the options that apply to the build.
-            # This helps us diagnose which options override others
-            # (e.g. /etc/bazel.bazelrc vs. tools/bazel.rc)
-            build --announce_rc
-
-            # More details on failures
-            build --verbose_failures=true
-
-            # CI supports colors but Bazel does not detect it.
-            common --color=yes
+            # Limit resources for CI runners (ubuntu-latest: 7GB RAM, 2 CPUs)
+            build --local_ram_resources=6144
+            build --local_cpu_resources=2
+            build --jobs=4
+            startup --host_jvm_args=-Xms512m
+            startup --host_jvm_args=-Xmx2g
+            build --discard_analysis_cache
+            build --nokeep_state_after_build
       - run: pnpm install --frozen-lockfile
       - run: pnpm run build
       - name: Deploy to Firebase Hosting

.github/workflows/ci.yml

@@ -38,6 +38,15 @@ jobs:
           bazelisk-cache: true
           disk-cache: ${{ github.workflow }}
           repository-cache: true
+          bazelrc: |
+            # Limit resources for CI runners (ubuntu-latest: 7GB RAM, 2 CPUs)
+            build --local_ram_resources=6144
+            build --local_cpu_resources=2
+            build --jobs=4
+            startup --host_jvm_args=-Xms512m
+            startup --host_jvm_args=-Xmx2g
+            build --discard_analysis_cache
+            build --nokeep_state_after_build
       - run: pnpm install
       - run: pnpm run build
   # build-windows:

tools/lib/adev.ts

@@ -1,6 +1,7 @@
 import { consola } from 'consola';
 import { $ } from 'execa';
-import { buildDir } from './workspace';
+import { existsSync } from 'node:fs';
+import { buildDir, buildOutputDir } from './workspace';
 
 const $$ = $({
   stdin: 'inherit',
@@ -13,6 +14,14 @@ export async function buildAdev() {
   const sh = $$({ cwd: buildDir });
   await sh`pnpm install --frozen-lockfile`;
   await sh`pnpm bazel build //adev:build.production --config=release`;
+
+  // Verify build output exists - Bazel may exit with code 0 even when interrupted
+  if (!existsSync(buildOutputDir)) {
+    throw new Error(
+      `Build output directory not found: ${buildOutputDir}\n` +
+        'Bazel build may have been interrupted or failed silently.'
+    );
+  }
 }
 
 export function serveAdev() {