Allow locally build actions with scrubber

src/main/java/com/google/devtools/build/lib/remote/RemoteExecutionService.java

@@ -341,7 +341,8 @@ public CachePolicy getWriteCachePolicy(Spawn spawn) {
   public boolean mayBeExecutedRemotely(Spawn spawn) {
     return remoteCache instanceof RemoteExecutionCache
         && remoteExecutor != null
-        && Spawns.mayBeExecutedRemotely(spawn);
+        && Spawns.mayBeExecutedRemotely(spawn)
+        && !scrubbedSpawn(spawn, scrubber);
   }
 
   @VisibleForTesting
@@ -1595,6 +1596,11 @@ void report(Event evt) {
     }
   }
 
+  private static boolean scrubbedSpawn(Spawn spawn, @Nullable Scrubber scrubber) {
+    return scrubber != null
+        && scrubber.forSpawn(spawn) != null;
+  }
+
   /**
    * A simple value class combining a hash of the tool inputs (and their digests) as well as a set
    * of the relative paths of all tool inputs.

src/main/java/com/google/devtools/build/lib/remote/RemoteModule.java

@@ -313,10 +313,7 @@ public void beforeCommand(CommandEnvironment env) throws AbruptExitException {
 
     boolean enableScrubbing = remoteOptions.scrubber != null;
     if (enableScrubbing && enableRemoteExecution) {
-
-      throw createOptionsExitException(
-          "Cannot combine remote cache key scrubbing with remote execution",
-          FailureDetails.RemoteOptions.Code.EXECUTION_WITH_SCRUBBING);
+      env.getReporter().handle(Event.warn("Cannot combine remote cache key scrubbing with remote execution. All actions with cache key scrubbing will be executed locally"));
     }
 
     // TODO(bazel-team): Consider adding a warning or more validation if the remoteDownloadRegex is

src/test/shell/bazel/remote/remote_execution_test.sh

@@ -3410,6 +3410,21 @@ EOF
       --disk_cache=$CACHEDIR --//:src=//:bar :gen &> $TEST_log \
       || fail "failed to build with input bar and a cache"
   expect_log "2 processes: 1 disk cache hit, 1 internal"
+
+  # Now build with a remote build. Even though Bazel considers the actions distinct,
+  # they will be looked up in the remote cache using the scrubbed key, so one
+  # can serve as a cache hit for the other.
+  # In this case, the scrubbed actions will be executed at local executor.
+
+  bazel build --experimental_remote_scrubbing_config=scrubbing.cfg \
+        --remote_executor=grpc://localhost:${worker_port} --//:src=//:foo :gen &> $TEST_log \
+        || fail "failed to build with input foo and a cache"
+  expect_log "2 processes: 1 internal, 1 .*-sandbox"
+
+  bazel build --experimental_remote_scrubbing_config=scrubbing.cfg \
+      --remote_executor=grpc://localhost:${worker_port} --//:src=//:bar :gen &> $TEST_log \
+      || fail "failed to build with input bar and a cache"
+  expect_log "2 processes: 1 remote cache hit, 1 internal"
 }
 
 run_suite "Remote execution and remote cache tests"