build: use worker for ts_project to enable fast DX and avoid no-sandbox issues

For the `rules_js` migration we are introducing a new ruleset for
Angular rules. These rules are not used here by the CLI as we don't use
`ng_module`, but we are building the rules in a way where we expose a
worker binary that can also work with vanilla TS.

The worker significantly speeds up compilations, bringing them to
equivalent speeds of `ts_library`, and **importantly** fixes/avoids
issues when actions are executing outside sandbox. E.g. on Windows where
the tsc compilation currently can see many other files that aren't
action inputs; and accidentally picks them up.

Author: devversion

WORKSPACE

@@ -8,7 +8,7 @@ register_toolchains(
     "//tools:windows_tar_system_toolchain",
 )
 
-load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive", "http_file")
 
 http_archive(
     name = "bazel_skylib",
@@ -37,9 +37,9 @@ build_bazel_rules_nodejs_dependencies()
 
 http_archive(
     name = "aspect_rules_js",
-    sha256 = "75c25a0f15a9e4592bbda45b57aa089e4bf17f9176fd735351e8c6444df87b52",
-    strip_prefix = "rules_js-2.1.0",
-    url = "https://github.com/aspect-build/rules_js/releases/download/v2.1.0/rules_js-v2.1.0.tar.gz",
+    sha256 = "3388abe9b9728ef68ea8d8301f932b11b2c9a271d74741ddd5f3b34d1db843ac",
+    strip_prefix = "rules_js-2.1.1",
+    url = "https://github.com/aspect-build/rules_js/releases/download/v2.1.1/rules_js-v2.1.1.tar.gz",
 )
 
 load("@aspect_rules_js//js:repositories.bzl", "rules_js_dependencies")
@@ -218,3 +218,9 @@ rules_ts_dependencies(
     # TODO: Support in https://github.com/aspect-build/rules_ts/blob/main/ts/private/npm_repositories.bzl
     ts_version = "5.6.2",
 )
+
+http_file(
+    name = "tsc_worker",
+    sha256 = "4fb116945734840d6097998a25e5b88fdd22be2b5395570f2fa0baee2d47b4e0",
+    urls = ["https://raw.githubusercontent.com/devversion/rules_angular/e9045b9fc89304a12d9e1f97a40dab9b5b793e77/dist/worker.mjs"],
+)

tools/BUILD.bazel

@@ -1,4 +1,6 @@
 load("@aspect_bazel_lib//lib/private:tar_toolchain.bzl", "tar_toolchain")
+load("@aspect_rules_js//js:defs.bzl", "js_binary")
+load("@bazel_skylib//rules:copy_file.bzl", "copy_file")
 
 # Copyright Google Inc. All Rights Reserved.
 #
@@ -42,4 +44,22 @@ toolchain(
     toolchain = ":system_tar_exec",
     toolchain_type = "@aspect_bazel_lib//lib:tar_toolchain_type",
 )
+
+# TODO(devversion): Improve this by potentially sharing this common block.
+copy_file(
+    name = "copy_worker_js",
+    src = "@tsc_worker//file",
+    out = "ts_worker.mjs",
+)
+
+js_binary(
+    name = "vanilla_ts_worker",
+    data = [
+        ":copy_worker_js",
+        "//:root_modules/@angular/compiler-cli",
+        "//:root_modules/typescript",
+    ],
+    entry_point = ":copy_worker_js",
+    fixed_args = ["--vanilla-ts"],
+)
 # @external_end

tools/interop.bzl

@@ -94,6 +94,11 @@ def ts_project(name, module_name = None, interop_deps = [], deps = [], testonly
         testonly = testonly,
         tsconfig = "//:test-tsconfig" if testonly else "//:build-tsconfig",
         declaration = True,
+        # Use the worker from our own Angular rules, as the default worker
+        # from `rules_ts` is incompatible with TS5+ and abandoned. We need
+        # worker for efficient, fast DX and avoiding Windows no-sandbox issues.
+        supports_workers = 1,
+        tsc_worker = "//tools:vanilla_ts_worker",
         deps = ["%s_interop_deps" % name] + deps,
         **kwargs
     )