CI: no local actions

MODULE.bazel

@@ -320,6 +320,13 @@ use_repo(
 # Note that this is 'rules_nodejs-core'
 # Keep in sync with build_bazel_rules_nodejs in WORKSPACE.bzlmod
 bazel_dep(name = "rules_nodejs", version = "5.8.2")
+single_version_override(
+    module_name = "rules_nodejs",
+    patch_strip = 1,
+    patches = [
+        "@@//buildpatches:build_bazel_rules_nodejs.patch",
+    ],
+)
 
 node = use_extension("@rules_nodejs//nodejs:extensions.bzl", "node")
 node.toolchain(

WORKSPACE

@@ -180,10 +180,24 @@ staticcheck()
 
 http_archive(
     name = "build_bazel_rules_nodejs",
+    patch_args = ["-p1"],
+    patches = [
+        "//buildpatches:build_bazel_rules_nodejs.patch",
+    ],
     sha256 = "94070eff79305be05b7699207fbac5d2608054dd53e6109f7d00d923919ff45a",
     urls = ["https://github.com/bazelbuild/rules_nodejs/releases/download/5.8.2/rules_nodejs-5.8.2.tar.gz"],
 )
 
+http_archive(
+    name = "rules_nodejs",
+    patch_args = ["-p1"],
+    patches = [
+        "//buildpatches:build_bazel_rules_nodejs.patch",
+    ],
+    sha256 = "764a3b3757bb8c3c6a02ba3344731a3d71e558220adcb0cf7e43c9bba2c37ba8",
+    urls = ["https://github.com/bazelbuild/rules_nodejs/releases/download/5.8.2/rules_nodejs-core-5.8.2.tar.gz"],
+)
+
 load("@build_bazel_rules_nodejs//:repositories.bzl", "build_bazel_rules_nodejs_dependencies")
 
 build_bazel_rules_nodejs_dependencies()

WORKSPACE.bzlmod

@@ -41,6 +41,10 @@ http_archive(
 # Since there is no build_bazel_rules_nodejs in BCR, we still want to load it here.
 http_archive(
     name = "build_bazel_rules_nodejs",
+    patch_args = ["-p1"],
+    patches = [
+        "//buildpatches:build_bazel_rules_nodejs.patch",
+    ],
     sha256 = "94070eff79305be05b7699207fbac5d2608054dd53e6109f7d00d923919ff45a",
     urls = ["https://github.com/bazelbuild/rules_nodejs/releases/download/5.8.2/rules_nodejs-5.8.2.tar.gz"],
 )

buildpatches/build_bazel_rules_nodejs.patch

@@ -0,0 +1,19 @@
+--- a/third_party/github.com/bazelbuild/bazel-skylib/rules/private/copy_common_private.bzl
++++ b/third_party/github.com/bazelbuild/bazel-skylib/rules/private/copy_common_private.bzl
+@@ -64,10 +64,10 @@
+     # Sandboxing for this action is wasteful as well since there is a 1:1 mapping of input
+     # file/directory to output file/directory and no room for non-hermetic inputs to sneak in to the
+     # input.
+-    "no-remote": "1",
+-    "no-remote-cache": "1",
+-    "no-remote-exec": "1",
+-    "no-cache": "1",
+-    "no-sandbox": "1",
+-    "local": "1",
++    # "no-remote": "1",
++    # "no-remote-cache": "1",
++    # "no-remote-exec": "1",
++    # "no-cache": "1",
++    # "no-sandbox": "1",
++    # "local": "1",
+ }

rules/sha/index.bzl

@@ -12,6 +12,5 @@ def sha(name, srcs, **kwargs):
         }
         find $(SRCS) -type f | sort | xargs shasum | normalize_config_paths | shasum | awk '{ print $$1 }' > $@
         """,
-        local = 1,
         **kwargs
     )

rules/typescript/index.bzl

@@ -64,7 +64,6 @@ def ts_jasmine_node_test(name, srcs, deps = [], size = "small", **kwargs):
         srcs = [":%s_commonjs.js" % name],
         outs = [":%s_commonjs.test.js" % name],
         cmd_bash = "cp $(SRCS) $@",
-        tags = ["local"],
     )
 
     jasmine_node_test(