Skip cloning the repo in the first step of Google Bazel Presubmit (#2930)

By default, all "command" steps in a Buildkite job will clone the git
repo associated with the Buildkite pipeline. We can skip this checkout
by setting `checkout: skip: true` in the step config.

We do this for the first step of Google Bazel Presubmit, which doesn't
actually need more than the presubmit.yml file (except for checking if
modified files include sensitive yaml files -- which we now disable with
an environment variable). To get the presubmit.yml, we directly fetch it
from googlesource, though it's base64-encoded -- so we decode it.

buildkite/bazelci.py

diff --git a/buildkite/bazelci.py b/buildkite/bazelci.py
index d319210..37f70ff 100755
--- a/buildkite/bazelci.py
+++ b/buildkite/bazelci.py
@@ -3705,6 +3705,8 @@
 
 
 def get_modified_files(git_commit):
+    if is_trueish(os.environ.get("DISABLE_MODIFIED_FILES_DETECTION", "false")):
+        return []
     fetch_base_branch()
     merge_base_commit = execute_command_and_get_output(
         ["git", "merge-base", git_commit, "FETCH_HEAD"]

buildkite/bazelci_test.py

diff --git a/buildkite/bazelci_test.py b/buildkite/bazelci_test.py
index d766125..4dc1e4f 100755
--- a/buildkite/bazelci_test.py
+++ b/buildkite/bazelci_test.py
@@ -570,6 +570,13 @@
         with mock.patch.dict(os.environ, {"BUILDKITE_PULL_REQUEST_LABELS": "foo,CI:run,bar"}):
             self.assertTrue(bazelci.has_presubmit_auto_run_label())
 
+    def test_disable_modified_files_detection(self):
+        with mock.patch.dict(
+            os.environ, {"DISABLE_MODIFIED_FILES_DETECTION": "true"}
+        ), mock.patch.object(bazelci, "fetch_base_branch") as fetch_base_branch:
+            self.assertEqual(bazelci.get_modified_files("abc1234"), [])
+            fetch_base_branch.assert_not_called()
+
 class FetchCiScripts(unittest.TestCase):
     def test_curl_download_command(self):
         cmd = bazelci.curl_download_command("https://example.com/foo.py", "foo.py")

buildkite/terraform/bazel/pipeline.yml.tpl

diff --git a/buildkite/terraform/bazel/pipeline.yml.tpl b/buildkite/terraform/bazel/pipeline.yml.tpl
index 74702f1..b651729 100644
--- a/buildkite/terraform/bazel/pipeline.yml.tpl
+++ b/buildkite/terraform/bazel/pipeline.yml.tpl
@@ -12,6 +12,8 @@
       ${command}
 %{ endfor ~}
     label: "${try(steps.label, ":pipeline:")}"
+    checkout:
+      skip: ${try(steps.skip_checkout, false)}
     %{~ if try(steps.priority, null) != null ~}
     priority: ${steps.priority}
     %{~ endif ~}

buildkite/terraform/bazel/pipelines_bazel.tf

diff --git a/buildkite/terraform/bazel/pipelines_bazel.tf b/buildkite/terraform/bazel/pipelines_bazel.tf
index b4c0a37..c4f04ee 100644
--- a/buildkite/terraform/bazel/pipelines_bazel.tf
+++ b/buildkite/terraform/bazel/pipelines_bazel.tf
@@ -56,12 +56,15 @@
   default_branch = "master"
   steps = templatefile("pipeline.yml.tpl", {
     envs = {
-      ENABLE_METRICS_COLLECTION = "true"
+      DISABLE_MODIFIED_FILES_DETECTION = "true"
+      ENABLE_METRICS_COLLECTION        = "true"
     },
     steps = {
+      skip_checkout = true,
       commands = [
         "curl -sS \"https://raw.githubusercontent.com/bazelbuild/continuous-integration/master/buildkite/bazelci.py?$(date +%s)\" -o bazelci.py",
-        "bash -c 'set -euo pipefail; python3 bazelci.py project_pipeline --print_shard_summary --file_config=.bazelci/presubmit.yml | tee /dev/tty | buildkite-agent pipeline upload'"
+        "curl -sS \"https://bazel.googlesource.com/bazel/+/$BUILDKITE_COMMIT/.bazelci/presubmit.yml?format=TEXT\" | base64 -d > presubmit.yml",
+        "bash -c 'set -euo pipefail; python3 bazelci.py project_pipeline --print_shard_summary --file_config=presubmit.yml | tee /dev/tty | buildkite-agent pipeline upload'"
       ],
       priority = 99
     }