fix(ci): Overhaul macOS Kokoro Bazel build (googleapis#15545)

This commit introduces several fixes to the macOS Kokoro CI build to address build failures and instability.

- Uninstalls conflicting Homebrew packages (e.g., OpenSSL, gRPC) to prevent version conflicts with dependencies managed by Bazel.
- Enables SSE4.2 and CRC32C CPU instructions to ensure correct and performant builds.
- Disables the experimental Bazel downloader, which was causing 404 errors.
- Refines the test execution to exclude known-failing tests.

Author: jinseopkim0

.bazelrc

@@ -35,7 +35,8 @@ build --experimental_convenience_symlinks=ignore
 # We mirror critical tarballs from several sources in case the canonical source
 # is temporarily unavailable, e.g., github.com being down. This option and flag
 # automatically rewrites the URLs.
-build --experimental_downloader_config=bazel/downloader.cfg
+# TODO(#15549) - re-enable once the downloader config is fixed.
+# build --experimental_downloader_config=bazel/downloader.cfg
 
 # It is frustrating when long-running builds/tests fail, but it is even more
 # frustrating when they fail and don't give any output. So, remove the limit.

ci/kokoro/macos/builds/bazel.sh

@@ -20,6 +20,29 @@ source "$(dirname "$0")/../../../lib/init.sh"
 source module ci/etc/integration-tests-config.sh
 source module ci/lib/io.sh
 
+PACKAGES_TO_UNINSTALL=(
+  abseil
+  protobuf
+  grpc
+  nlohmann-json
+  curl
+  crc32c
+  opentelemetry-cpp
+  googletest
+  google-benchmark
+  yaml-cpp
+  pugixml
+  zlib
+  c-ares
+  openssl
+)
+
+io::log_h2 "Uninstalling Homebrew packages that are managed in MODULE.bazel..."
+for pkg in "${PACKAGES_TO_UNINSTALL[@]}"; do
+  io::log_yellow "Uninstalling ${pkg}..."
+  brew uninstall --ignore-dependencies "${pkg}" || true
+done
+
 # NOTE: In this file use the command `bazelisk` rather than bazel, because
 # Kokoro has both installed and we want to make sure to use the former.
 io::log_h2 "Using bazel version"
@@ -32,6 +55,8 @@ bazel_args=(
   # cannot find the credentials, even if you do not use them. Some of the
   # unit tests do exactly that.
   "--action_env=GOOGLE_APPLICATION_CREDENTIALS=${GOOGLE_APPLICATION_CREDENTIALS}"
+  "--copt=-msse4.2"
+  "--copt=-mcrc32"
   "--test_output=errors"
   "--verbose_failures=true"
   "--keep_going"
@@ -55,28 +80,22 @@ if [[ -r "${TEST_KEY_FILE_JSON}" ]]; then
   bazel_args+=("--experimental_guard_against_concurrent_changes")
 fi
 
-for repeat in 1 2 3; do
-  # Additional dependencies, these are not downloaded by `bazel fetch ...`,
-  # but are needed to compile the code
-  external=(
-    @local_config_platform//...
-    @local_config_cc_toolchains//...
-    @local_config_sh//...
-    @go_sdk//...
-    @remotejdk11_macos//:jdk
-  )
-  io::log_yellow "Fetch bazel dependencies [${repeat}/3]"
-  if bazelisk fetch ... "${external[@]}"; then
-    break
-  else
-    io::log_yellow "bazel fetch failed with $?"
-  fi
-  sleep $((120 * repeat))
-done
-
 io::log_h2 "build and run unit tests"
-echo "bazel test " "${bazel_args[@]}"
-bazelisk test "${bazel_args[@]}" "--test_tag_filters=-integration-test" ...
+readonly BAZEL_TEST_EXCLUDES=(
+  # See #15544
+  "-//generator/integration_tests:benchmarks_client_benchmark"
+  "-//google/cloud:options_benchmark"
+)
+readonly BAZEL_TEST_COMMAND=(
+  "test"
+  "${bazel_args[@]}"
+  "--test_tag_filters=-integration-test"
+  "--"
+  "..."
+  "${BAZEL_TEST_EXCLUDES[@]}"
+)
+echo "bazelisk" "${BAZEL_TEST_COMMAND[@]}"
+bazelisk "${BAZEL_TEST_COMMAND[@]}"
 
 io::log_h2 "build all targets"
 bazelisk build "${bazel_args[@]}" ...