Add sandbox mode to CI testing matrix

.bazelrc

@@ -2,7 +2,7 @@
 common --enable_bzlmod
 
 # Spawn strategy required for some tests
-build --spawn_strategy=standalone
+build --spawn_strategy=local
 
 # Setup Xcode configuration.
 build --xcode_version_config=//:host_xcodes
@@ -62,6 +62,16 @@ build:remote_cache --noslim_profile
 build:remote_cache --remote_cache=grpcs://remote.buildbuddy.io
 build:remote_cache --remote_timeout=3600
 
+build:sandboxed --spawn_strategy=sandboxed
+# Otherwise it still use the worker strategy
+build:sandboxed --strategy=SwiftCompile=sandboxed
+build:sandboxed --strategy=Genrule=sandboxed,local
+build:sandboxed --strategy=StoryboardCompile=sandboxed,local
+build:sandboxed --strategy=CleaningFramework=sandboxed,local
+build:sandboxed --strategy=StoryboardLink=sandboxed,local
+build:sandboxed --strategy=ProcessAndSign=sandboxed,local
+build:sandboxed --strategy=AssetCatalogCompile=sandboxed,local
+
 # By default don't upload local results to remote cache, only CI does this.
 build --noremote_upload_local_results
 build:ci --remote_upload_local_results

.github/workflows/tests.yml

@@ -15,14 +15,15 @@ concurrency:
 #       when adding a new job / changing the matrix, make sure to update all jobs
 jobs:
   integration_tests:
-    name: Build and test (Bazel ${{ matrix.bazel_version }} / Xcode ${{ matrix.xcode_version }} / Virtual Frameworks ${{ matrix.virtual_frameworks }})
+    name: Build and test (Bazel ${{ matrix.bazel_version }} / Xcode ${{ matrix.xcode_version }} / Virtual Frameworks ${{ matrix.virtual_frameworks }}) / Sandbox ${{ matrix.sandbox }}
     runs-on: macos-14
     strategy:
       fail-fast: false
       matrix:
         bazel_version: [6.5.0, 7.1.0]
         xcode_version: [15.2]
         virtual_frameworks: [true, false]
+        sandbox: [true, false]
     env:
         XCODE_VERSION: ${{ matrix.xcode_version }}
         USE_BAZEL_VERSION: ${{ matrix.bazel_version }}
@@ -34,6 +35,10 @@ jobs:
         name: Add vfs config
         run: |
           echo "build --config=vfs" >> user.bazelrc
+      - if: matrix.sandbox
+        name: Enable sandbox mode
+        run: |
+          echo "build --config=sandboxed" >> user.bazelrcc
       - name: Build and Test
         run: |
           # non-iOS tests

rules/library.bzl

@@ -953,8 +953,6 @@ def apple_library(
         generated_swift_header_name = module_name + "-Swift.h"
 
         if module_map:
-            # TODO: now that we always add module_map as a swiftc_input,
-            # we should consider removing this one if it's not needed
             extend_modulemap(
                 name = module_map + ".extended." + name,
                 destination = "%s.extended.modulemap" % name,

tests/ios/unit-test/test-imports-app/TestImports-Unit-Tests-Bridging-Header.h

@@ -1,2 +1 @@
 #import <TestImports-Unit-Tests/testhelper.h>
-#import <TestImports-App/Header2.h>

tests/ios/unit-test/test-imports-app/test.swift

@@ -5,6 +5,6 @@ class SwiftTests : XCTestCase {
   func testPasses() {
       _ = EmptyStruct()
       XCTAssertTrue(true)
-      XCTAssertEqual(TestHelper.createString(), "ObjcTestHelperString_EnumValue=1")
+      XCTAssertEqual(TestHelper.createString(), "ObjcTestHelperString_EnumValue=\(AppErrorCode.unknown.rawValue)")
   }
 }