Add a raw_allowlist_include_directories cc_toolchain top argument

Copybara Import from #450

BEGIN_PUBLIC
Add a raw_allowlist_include_directories cc_toolchain top argument (#450)

Apple toolchain declaration in bazel are inherently non-hermetic from a bazel perspective, as they rely on the system's Xcode installation. As a result, apple_support currently make use of
cxx_builtin_include_directories to add known system directories, as seen in the toolchain declaration here:
https://github.com/bazelbuild/apple_support/blob/master/crosstool/osx_cc_configure.bzl#L136

This currently cannot be done in rules based toolchain, as the allowlist_include_directories argument in cc_args() requires a DirectoryInfo provider.

In this change, we're adding a new top-level
raw_allowlist_include_directories parameter to the cc_toolchain() macro and to the underlying cc_toolchain_config() rule. This parameter will act just like the existing one, but will accept raw strings that will be added directly to cxx_builtin_include_directories.

Fixes #242

Closes #450
END_PUBLIC

COPYBARA_INTEGRATE_REVIEW=#450 from ma-oli:raw_allowlist_include_directories d4076e4
PiperOrigin-RevId: 794358089
Change-Id: I92e622b549fb38fd1f798efaeb119afcefc4ccb7

Author: ma-oli

cc/toolchains/args.bzl

@@ -47,6 +47,10 @@ def _cc_args_impl(ctx):
         format = {k: v for v, k in ctx.attr.format.items()},
     )
 
+    for path in ctx.attr.allowlist_absolute_include_directories:
+        if not path.startswith("/"):
+            fail("`{}` is not an absolute paths".format(path))
+
     nested = None
     if ctx.attr.args or ctx.attr.nested:
         # Forward the format variables used by the env formatting so they don't trigger
@@ -74,6 +78,9 @@ def _cc_args_impl(ctx):
         allowlist_include_directories = depset(
             direct = [d[DirectoryInfo] for d in ctx.attr.allowlist_include_directories],
         ),
+        allowlist_absolute_include_directories = depset(
+            direct = ctx.attr.allowlist_absolute_include_directories,
+        ),
     )
 
     return [
@@ -87,6 +94,7 @@ def _cc_args_impl(ctx):
                 for action in actions.to_list()
             ]),
             allowlist_include_directories = args.allowlist_include_directories,
+            allowlist_absolute_include_directories = args.allowlist_absolute_include_directories,
         ),
     ]
 
@@ -98,6 +106,9 @@ _cc_args = rule(
             mandatory = True,
             doc = """See documentation for cc_args macro wrapper.""",
         ),
+        "allowlist_absolute_include_directories": attr.string_list(
+            doc = """See documentation for cc_args macro wrapper.""",
+        ),
         "allowlist_include_directories": attr.label_list(
             providers = [DirectoryInfo],
             doc = """See documentation for cc_args macro wrapper.""",
@@ -131,6 +142,7 @@ def cc_args(
         name,
         actions = None,
         allowlist_include_directories = None,
+        allowlist_absolute_include_directories = None,
         args = None,
         data = None,
         env = None,
@@ -238,6 +250,12 @@ def cc_args(
             This can help work around errors like:
             `the source file 'main.c' includes the following non-builtin files with absolute paths
             (if these are builtin files, make sure these paths are in your toolchain)`.
+        allowlist_absolute_include_directories: (List[str]) Allowlists absolute include directories,
+            preventing Bazel from emitting errors when an #include of local system files in the
+            directory occurs. Be careful when adding directories to this list, as it inherently
+            causes leaks in hermeticity. Prefer to reserve use of this for cases like Xcode, where
+            the conventional expectation is to allowlist well-known system-absolute include paths
+            rather than redistributing the SDK.
         args: (List[str]) The command-line arguments that are applied by using this rule. This is
             mutually exclusive with [nested](#cc_args-nested).
         data: (List[Label]) A list of runtime data dependencies that are required for these
@@ -282,6 +300,7 @@ def cc_args(
         name = name,
         actions = actions,
         allowlist_include_directories = allowlist_include_directories,
+        allowlist_absolute_include_directories = allowlist_absolute_include_directories,
         args = args,
         data = data,
         env = env,

cc/toolchains/cc_toolchain_info.bzl

@@ -108,6 +108,7 @@ ArgsInfo = provider(
         "files": "(depset[File]) Files required for the args",
         "env": "(dict[str, str]) Environment variables to apply",
         "allowlist_include_directories": "(depset[DirectoryInfo]) Include directories implied by these arguments that should be allowlisted in Bazel's include checker",
+        "allowlist_absolute_include_directories": "(depset[str]) Absolute include directories implied by these arguments that should be allowlisted in Bazel's include checker",
     },
 )
 ArgsListInfo = provider(
@@ -119,6 +120,7 @@ ArgsListInfo = provider(
         "files": "(depset[File]) The files required for all of the arguments",
         "by_action": "(Sequence[struct(action=ActionTypeInfo, args=List[ArgsInfo], files=depset[Files])]) Relevant information about the args keyed by the action type.",
         "allowlist_include_directories": "(depset[DirectoryInfo]) Include directories implied by these arguments that should be allowlisted in Bazel's include checker",
+        "allowlist_absolute_include_directories": "(depset[str]) Absolute include directories implied by these arguments that should be allowlisted in Bazel's include checker",
     },
 )
 
@@ -137,6 +139,7 @@ FeatureInfo = provider(
         "overridable": "(bool) Whether the feature is an overridable feature.",
         "overrides": "(Optional[FeatureInfo]) The feature that this overrides. Must be a known feature",
         "allowlist_include_directories": "(depset[DirectoryInfo]) Include directories implied by this feature that should be allowlisted in Bazel's include checker",
+        "allowlist_absolute_include_directories": "(depset[str]) Absolute include directories implied by these arguments that should be allowlisted in Bazel's include checker",
     },
 )
 FeatureSetInfo = provider(
@@ -221,5 +224,6 @@ ToolchainConfigInfo = provider(
         "make_variables": "Sequence[MakeVariableInfo] Make variable substitutions for this toolchain",
         "files": "(dict[ActionTypeInfo, depset[File]]) Files required for the toolchain, keyed by the action type.",
         "allowlist_include_directories": "(depset[DirectoryInfo]) Built-in include directories implied by this toolchain's args and tools that should be allowlisted in Bazel's include checker",
+        "allowlist_absolute_include_directories": "(List[str]) Built-in include directories allowed the sandbox. Use with care",
     },
 )

cc/toolchains/feature.bzl

@@ -83,6 +83,7 @@ def _cc_feature_impl(ctx):
         overridable = False,
         overrides = overrides,
         allowlist_include_directories = args.allowlist_include_directories,
+        allowlist_absolute_include_directories = args.allowlist_absolute_include_directories,
     )
 
     return [

cc/toolchains/impl/collect.bzl

@@ -146,6 +146,9 @@ def collect_args_lists(targets, label):
         allowlist_include_directories = depset(
             transitive = [a.allowlist_include_directories for a in args],
         ),
+        allowlist_absolute_include_directories = depset(
+            transitive = [a.allowlist_absolute_include_directories for a in args],
+        ),
         by_action = tuple([
             struct(
                 action = k,

cc/toolchains/impl/external_feature.bzl

@@ -44,6 +44,7 @@ def _cc_external_feature_impl(ctx):
         overridable = ctx.attr.overridable,
         overrides = None,
         allowlist_include_directories = depset(),
+        allowlist_absolute_include_directories = depset(),
     )
     providers = [
         feature,

cc/toolchains/impl/legacy_converter.bzl

@@ -202,6 +202,7 @@ def convert_toolchain(toolchain):
         d.path
         for d in toolchain.allowlist_include_directories.to_list()
     ]
+    cxx_builtin_include_directories += toolchain.allowlist_absolute_include_directories.to_list()
 
     artifact_name_patterns = [
         legacy_artifact_name_pattern(

cc/toolchains/impl/toolchain_config_info.bzl

@@ -205,6 +205,12 @@ def toolchain_config_info(label, known_features = [], enabled_features = [], arg
             for src in features + tools.values()
         ] + [args.allowlist_include_directories],
     )
+    allowlist_absolute_include_directories = depset(
+        transitive = [
+            src.allowlist_absolute_include_directories
+            for src in features
+        ] + [args.allowlist_absolute_include_directories],
+    )
     toolchain_config = ToolchainConfigInfo(
         label = label,
         features = features,
@@ -213,6 +219,7 @@ def toolchain_config_info(label, known_features = [], enabled_features = [], arg
         args = args,
         files = files,
         allowlist_include_directories = allowlist_include_directories,
+        allowlist_absolute_include_directories = allowlist_absolute_include_directories,
         artifact_name_patterns = _collect_artifact_name_patterns(artifact_name_patterns, fail),
         make_variables = _collect_make_variables(make_variables, fail),
     )

docs/toolchain_api.md

@@ -573,9 +573,10 @@ tool that supports PIC.
 <pre>
 load("@rules_cc//cc/toolchains/impl:documented_api.bzl", "cc_args")
 
-cc_args(*, <a href="#cc_args-name">name</a>, <a href="#cc_args-actions">actions</a>, <a href="#cc_args-allowlist_include_directories">allowlist_include_directories</a>, <a href="#cc_args-args">args</a>, <a href="#cc_args-data">data</a>, <a href="#cc_args-env">env</a>, <a href="#cc_args-format">format</a>, <a href="#cc_args-iterate_over">iterate_over</a>,
-        <a href="#cc_args-nested">nested</a>, <a href="#cc_args-requires_not_none">requires_not_none</a>, <a href="#cc_args-requires_none">requires_none</a>, <a href="#cc_args-requires_true">requires_true</a>, <a href="#cc_args-requires_false">requires_false</a>, <a href="#cc_args-requires_equal">requires_equal</a>,
-        <a href="#cc_args-requires_equal_value">requires_equal_value</a>, <a href="#cc_args-requires_any_of">requires_any_of</a>, <a href="#cc_args-kwargs">**kwargs</a>)
+cc_args(*, <a href="#cc_args-name">name</a>, <a href="#cc_args-actions">actions</a>, <a href="#cc_args-allowlist_include_directories">allowlist_include_directories</a>, <a href="#cc_args-allowlist_absolute_include_directories">allowlist_absolute_include_directories</a>,
+        <a href="#cc_args-args">args</a>, <a href="#cc_args-data">data</a>, <a href="#cc_args-env">env</a>, <a href="#cc_args-format">format</a>, <a href="#cc_args-iterate_over">iterate_over</a>, <a href="#cc_args-nested">nested</a>, <a href="#cc_args-requires_not_none">requires_not_none</a>, <a href="#cc_args-requires_none">requires_none</a>,
+        <a href="#cc_args-requires_true">requires_true</a>, <a href="#cc_args-requires_false">requires_false</a>, <a href="#cc_args-requires_equal">requires_equal</a>, <a href="#cc_args-requires_equal_value">requires_equal_value</a>, <a href="#cc_args-requires_any_of">requires_any_of</a>,
+        <a href="#cc_args-kwargs">**kwargs</a>)
 </pre>
 
 Action-specific arguments for use with a [`cc_toolchain`](#cc_toolchain).
@@ -659,6 +660,7 @@ For more extensive examples, see the usages here:
 | <a id="cc_args-name"></a>name |  (str) The name of the target.   |  none |
 | <a id="cc_args-actions"></a>actions |  (List[Label]) A list of labels of [`cc_action_type`](#cc_action_type) or [`cc_action_type_set`](#cc_action_type_set) rules that dictate which actions these arguments should be applied to.   |  `None` |
 | <a id="cc_args-allowlist_include_directories"></a>allowlist_include_directories |  (List[Label]) A list of include paths that are implied by using this rule. These must point to a skylib [directory](https://github.com/bazelbuild/bazel-skylib/tree/main/docs/directory_doc.md#directory) or [subdirectory](https://github.com/bazelbuild/bazel-skylib/tree/main/docs/directory_subdirectory_doc.md#subdirectory) rule. Some flags (e.g. --sysroot) imply certain include paths are available despite not explicitly specifying a normal include path flag (`-I`, `-isystem`, etc.). Bazel checks that all included headers are properly provided by a dependency or allowlisted through this mechanism.<br><br>As a rule of thumb, only use this if Bazel is complaining about absolute paths in your toolchain and you've ensured that the toolchain is compiling with the `-no-canonical-prefixes` and/or `-fno-canonical-system-headers` arguments.<br><br>This can help work around errors like: `the source file 'main.c' includes the following non-builtin files with absolute paths (if these are builtin files, make sure these paths are in your toolchain)`.   |  `None` |
+| <a id="cc_args-allowlist_absolute_include_directories"></a>allowlist_absolute_include_directories |  (List[str]) Allowlists absolute include directories, preventing Bazel from emitting errors when an #include of local system files in the directory occurs. Be careful when adding directories to this list, as it inherently causes leaks in hermeticity. Prefer to reserve use of this for cases like Xcode, where the conventional expectation is to allowlist well-known system-absolute include paths rather than redistributing the SDK.   |  `None` |
 | <a id="cc_args-args"></a>args |  (List[str]) The command-line arguments that are applied by using this rule. This is mutually exclusive with [nested](#cc_args-nested).   |  `None` |
 | <a id="cc_args-data"></a>data |  (List[Label]) A list of runtime data dependencies that are required for these arguments to work as intended.   |  `None` |
 | <a id="cc_args-env"></a>env |  (Dict[str, str]) Environment variables that should be set when the tool is invoked.   |  `None` |

tests/rule_based_toolchain/subjects.bzl

@@ -84,6 +84,7 @@ _FEATURE_FLAGS = dict(
     external = _subjects.bool,
     overrides = None,
     allowlist_include_directories = _FakeDirectoryDepset,
+    allowlist_absolute_include_directories = ProviderDepset(_subjects.str),
 )
 
 # Break the dependency loop.
@@ -148,6 +149,7 @@ _ArgsFactory = generate_factory(
         nested = optional_subject(_NestedArgsFactory.factory),
         requires_any_of = ProviderSequence(_FeatureConstraintFactory),
         allowlist_include_directories = _FakeDirectoryDepset,
+        allowlist_absolute_include_directories = ProviderDepset(_subjects.str),
     ),
 )
 
@@ -163,6 +165,7 @@ _ArgsListFactory = generate_factory(
         ))({value.action: value for value in values}, meta = meta),
         files = _subjects.depset_file,
         allowlist_include_directories = _FakeDirectoryDepset,
+        allowlist_absolute_include_directories = ProviderDepset(_subjects.str),
     ),
 )
 
@@ -221,6 +224,7 @@ _ToolchainConfigFactory = generate_factory(
         args = ProviderSequence(_ArgsFactory),
         files = dict_key_subject(_subjects.depset_file),
         allowlist_include_directories = _FakeDirectoryDepset,
+        allowlist_absolute_include_directories = ProviderDepset(_subjects.str),
         artifact_name_patterns = [],
         make_variables = [],
     ),