Allow locally build actions with scrubbed inputs

src/main/java/com/google/devtools/build/lib/remote/RemoteExecutionService.java

@@ -341,7 +341,8 @@ public CachePolicy getWriteCachePolicy(Spawn spawn) {
   public boolean mayBeExecutedRemotely(Spawn spawn) {
     return remoteCache instanceof RemoteExecutionCache
         && remoteExecutor != null
-        && Spawns.mayBeExecutedRemotely(spawn);
+        && Spawns.mayBeExecutedRemotely(spawn)
+        && !hasScrubbedInput(spawn, scrubber);
   }
 
   @VisibleForTesting
@@ -1574,6 +1575,31 @@ void report(Event evt) {
     }
   }
 
+  private static boolean hasScrubbedInput(Spawn spawn, @Nullable Scrubber scrubber) {
+    if (scrubber == null) {
+      return false;
+    }
+    SpawnScrubber spawnScrubber = scrubber.forSpawn(spawn);
+    if (spawnScrubber == null) {
+      return false;
+    }
+    if (!spawnScrubber.getSalt().isEmpty()) {
+      return true;
+    }
+    for (String arg : spawn.getArguments()) {
+      if (!arg.equals(spawnScrubber.transformArgument(arg))) {
+        return true;
+      }
+    }
+    var inputFiles = spawn.getInputFiles();
+    for (ActionInput inputFile : inputFiles.getLeaves()) {
+      if (spawnScrubber.shouldOmitInput(inputFile)) {
+        return true;
+      }
+    }
+    return false;
+  }
+
   /**
    * A simple value class combining a hash of the tool inputs (and their digests) as well as a set
    * of the relative paths of all tool inputs.

src/main/java/com/google/devtools/build/lib/remote/RemoteModule.java

@@ -314,10 +314,7 @@ public void beforeCommand(CommandEnvironment env) throws AbruptExitException {
 
     boolean enableScrubbing = remoteOptions.scrubber != null;
     if (enableScrubbing && enableRemoteExecution) {
-
-      throw createOptionsExitException(
-          "Cannot combine remote cache key scrubbing with remote execution",
-          FailureDetails.RemoteOptions.Code.EXECUTION_WITH_SCRUBBING);
+      env.getReporter().handle(Event.warn("Cannot combine remote cache key scrubbing with remote execution. All actions with cache key scrubbing will be executed locally"));
     }
 
     // TODO(bazel-team): Consider adding a warning or more validation if the remoteDownloadRegex is