build: use worker for ts_project to enable fast DX and avoid no-sandbox issues

For the `rules_js` migration we are introducing a new ruleset for
Angular rules. These rules are not used here by the CLI as we don't use
`ng_module`, but we are building the rules in a way where we expose a
worker binary that can also work with vanilla TS.

The worker significantly speeds up compilations, bringing them to
equivalent speeds of `ts_library`, and **importantly** fixes/avoids
issues when actions are executing outside sandbox. E.g. on Windows where
the tsc compilation currently can see many other files that aren't
action inputs; and accidentally picks them up.

.aspect/rules/external_repository_action_cache/npm_translate_lock_MzA5NzUwNzMx

@@ -2,7 +2,7 @@
 # Input hashes for repository rule npm_translate_lock(name = "npm2", pnpm_lock = "@//:pnpm-lock.yaml").
 # This file should be checked into version control along with the pnpm-lock.yaml file.
 .npmrc=-2023857461
-package.json=1474377014
-pnpm-lock.yaml=1733416088
+package.json=-429967005
+pnpm-lock.yaml=-1164942040
 pnpm-workspace.yaml=1711114604
-yarn.lock=-607783516
+yarn.lock=80564211

WORKSPACE

@@ -8,7 +8,7 @@ register_toolchains(
     "//tools:windows_tar_system_toolchain",
 )
 
-load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive", "http_file")
 
 http_archive(
     name = "bazel_skylib",
@@ -37,9 +37,9 @@ build_bazel_rules_nodejs_dependencies()
 
 http_archive(
     name = "aspect_rules_js",
-    sha256 = "75c25a0f15a9e4592bbda45b57aa089e4bf17f9176fd735351e8c6444df87b52",
-    strip_prefix = "rules_js-2.1.0",
-    url = "https://github.com/aspect-build/rules_js/releases/download/v2.1.0/rules_js-v2.1.0.tar.gz",
+    sha256 = "3388abe9b9728ef68ea8d8301f932b11b2c9a271d74741ddd5f3b34d1db843ac",
+    strip_prefix = "rules_js-2.1.1",
+    url = "https://github.com/aspect-build/rules_js/releases/download/v2.1.1/rules_js-v2.1.1.tar.gz",
 )
 
 load("@aspect_rules_js//js:repositories.bzl", "rules_js_dependencies")
@@ -218,3 +218,9 @@ rules_ts_dependencies(
     # TODO: Support in https://github.com/aspect-build/rules_ts/blob/main/ts/private/npm_repositories.bzl
     ts_version = "5.6.2",
 )
+
+http_file(
+    name = "tsc_worker",
+    sha256 = "",
+    urls = ["https://raw.githubusercontent.com/devversion/rules_angular/a270a74d1e64577bddba96a5484c7c5d2c5d2770/dist/worker.mjs"],
+)

tools/BUILD.bazel

@@ -1,4 +1,6 @@
 load("@aspect_bazel_lib//lib/private:tar_toolchain.bzl", "tar_toolchain")
+load("@aspect_rules_js//js:defs.bzl", "js_binary")
+load("@bazel_skylib//rules:copy_file.bzl", "copy_file")
 
 # Copyright Google Inc. All Rights Reserved.
 #
@@ -42,4 +44,22 @@ toolchain(
     toolchain = ":system_tar_exec",
     toolchain_type = "@aspect_bazel_lib//lib:tar_toolchain_type",
 )
+
+# TODO(devversion): Improve this by potentially sharing this common block.
+copy_file(
+    name = "copy_worker_js",
+    src = "@tsc_worker//file",
+    out = "ts_worker.mjs",
+)
+
+js_binary(
+    name = "vanilla_ts_worker",
+    data = [
+        ":copy_worker_js",
+        "//:root_modules/@angular/compiler-cli",
+        "//:root_modules/typescript",
+    ],
+    entry_point = ":copy_worker_js",
+    fixed_args = ["--vanilla-ts"],
+)
 # @external_end

tools/interop.bzl

@@ -94,6 +94,11 @@ def ts_project(name, module_name = None, interop_deps = [], deps = [], testonly
         testonly = testonly,
         tsconfig = "//:test-tsconfig" if testonly else "//:build-tsconfig",
         declaration = True,
+        # Use the worker from our own Angular rules, as the default worker
+        # from `rules_ts` is incompatible with TS5+ and abandoned. We need
+        # worker for efficient, fast DX and avoiding Windows no-sandbox issues.
+        supports_workers = 1,
+        tsc_worker = "//tools:vanilla_ts_worker",
         deps = ["%s_interop_deps" % name] + deps,
         **kwargs
     )