[7.4.0] Support for using the java rules from @rules_java (bazelbui…

…ld#23591)

Co-authored-by: Googler <[email protected]>
Co-authored-by: Googler <[email protected]>
Co-authored-by: Googler <[email protected]>
Co-authored-by: Googler <[email protected]>

src/main/java/com/google/devtools/build/lib/analysis/RuleConfiguredTargetBuilder.java

@@ -42,12 +42,14 @@
 import com.google.devtools.build.lib.analysis.test.TestProvider.TestParams;
 import com.google.devtools.build.lib.analysis.test.TestTagsProvider;
 import com.google.devtools.build.lib.cmdline.Label;
+import com.google.devtools.build.lib.cmdline.RepositoryMapping;
 import com.google.devtools.build.lib.collect.nestedset.NestedSet;
 import com.google.devtools.build.lib.collect.nestedset.NestedSetBuilder;
 import com.google.devtools.build.lib.collect.nestedset.Order;
 import com.google.devtools.build.lib.packages.AllowlistChecker;
 import com.google.devtools.build.lib.packages.Attribute;
 import com.google.devtools.build.lib.packages.BuildSetting;
+import com.google.devtools.build.lib.packages.BuiltinRestriction;
 import com.google.devtools.build.lib.packages.Info;
 import com.google.devtools.build.lib.packages.Provider;
 import com.google.devtools.build.lib.packages.TargetUtils;
@@ -344,7 +346,11 @@ private void propagateTransitiveValidationOutputGroups() {
       Label rdeLabel =
           ruleContext.getRule().getRuleClassObject().getRuleDefinitionEnvironmentLabel();
       // only allow native and builtins to override transitive validation propagation
-      if (rdeLabel != null && !rdeLabel.getRepository().getName().equals("_builtins")) {
+      if (rdeLabel != null
+          && BuiltinRestriction.isNotAllowed(
+              rdeLabel,
+              RepositoryMapping.ALWAYS_FALLBACK,
+              BuiltinRestriction.INTERNAL_STARLARK_API_ALLOWLIST)) {
         ruleContext.ruleError(rdeLabel + " cannot access the _transitive_validation private API");
         return;
       }

src/main/java/com/google/devtools/build/lib/analysis/config/BuildConfigurationValue.java

@@ -83,13 +83,6 @@ public class BuildConfigurationValue
   private static final Interner<ImmutableSortedMap<Class<? extends Fragment>, Fragment>>
       fragmentsInterner = BlazeInterners.newWeakInterner();
 
-  private static final ImmutableSet<BuiltinRestriction.AllowlistEntry> ANDROID_ALLOWLIST =
-      ImmutableSet.of(
-          BuiltinRestriction.allowlistEntry("", "third_party/bazel_rules/rules_android"),
-          BuiltinRestriction.allowlistEntry("build_bazel_rules_android", ""),
-          BuiltinRestriction.allowlistEntry("rules_android", ""),
-          BuiltinRestriction.allowlistEntry("", "tools/build_defs/android"));
-
   /** Global state necessary to build a BuildConfiguration. */
   public interface GlobalStateProvider {
     /** Computes the default shell environment for actions from the command line options. */
@@ -431,7 +424,7 @@ public boolean hasSeparateGenfilesDirectory() {
   @Override
   public boolean hasSeparateGenfilesDirectoryForStarlark(StarlarkThread thread)
       throws EvalException {
-    BuiltinRestriction.failIfCalledOutsideBuiltins(thread);
+    BuiltinRestriction.failIfCalledOutsideDefaultAllowlist(thread);
     return hasSeparateGenfilesDirectory();
   }
 
@@ -535,7 +528,7 @@ public boolean isSiblingRepositoryLayout() {
 
   @Override
   public boolean isSiblingRepositoryLayoutForStarlark(StarlarkThread thread) throws EvalException {
-    BuiltinRestriction.failIfCalledOutsideBuiltins(thread);
+    BuiltinRestriction.failIfCalledOutsideDefaultAllowlist(thread);
     return isSiblingRepositoryLayout();
   }
 
@@ -665,7 +658,7 @@ public boolean stampBinaries() {
 
   @Override
   public boolean stampBinariesForStarlark(StarlarkThread thread) throws EvalException {
-    BuiltinRestriction.failIfCalledOutsideBuiltins(thread);
+    BuiltinRestriction.failIfCalledOutsideDefaultAllowlist(thread);
     return stampBinaries();
   }
 
@@ -742,7 +735,7 @@ public boolean isToolConfiguration() {
 
   @Override
   public boolean isToolConfigurationForStarlark(StarlarkThread thread) throws EvalException {
-    BuiltinRestriction.failIfCalledOutsideAllowlist(thread, ANDROID_ALLOWLIST);
+    BuiltinRestriction.failIfCalledOutsideDefaultAllowlist(thread);
     return isToolConfiguration();
   }
 
@@ -885,7 +878,7 @@ public boolean runfilesEnabled() {
 
   @Override
   public boolean runfilesEnabledForStarlark(StarlarkThread thread) throws EvalException {
-    BuiltinRestriction.failIfCalledOutsideBuiltins(thread);
+    BuiltinRestriction.failIfCalledOutsideDefaultAllowlist(thread);
     return runfilesEnabled();
   }
 

src/main/java/com/google/devtools/build/lib/analysis/starlark/StarlarkActionFactory.java

@@ -13,13 +13,11 @@
 // limitations under the License.
 package com.google.devtools.build.lib.analysis.starlark;
 
-import static com.google.devtools.build.lib.analysis.starlark.StarlarkRuleContext.PRIVATE_STARLARKIFICATION_ALLOWLIST;
 import static com.google.devtools.build.lib.packages.semantics.BuildLanguageOptions.EXPERIMENTAL_SIBLING_REPOSITORY_LAYOUT;
 
 import com.google.common.base.Joiner;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
-import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.Sets;
 import com.google.devtools.build.lib.actions.Action;
 import com.google.devtools.build.lib.actions.ActionAnalysisMetadata;
@@ -111,16 +109,6 @@ public class StarlarkActionFactory implements StarlarkActionFactoryApi {
   private static final Set<String> validResources =
       new HashSet<>(Arrays.asList(ResourceSet.CPU, ResourceSet.MEMORY, "local_test"));
 
-  // TODO(gnish): This is a temporary allowlist while new BuildInfo API becomes stable enough to
-  // become public.
-  // After at least some of the builtin rules have been switched to the new API delete this.
-  private static final ImmutableSet<BuiltinRestriction.AllowlistEntry>
-      PRIVATE_BUILDINFO_API_ALLOWLIST =
-          ImmutableSet.of(
-              BuiltinRestriction.allowlistEntry("", "test"), // for tests
-              BuiltinRestriction.allowlistEntry("", "tools/build_defs/build_info"),
-              BuiltinRestriction.allowlistEntry("bazel_tools", "tools/build_defs/build_info"));
-
   public StarlarkActionFactory(StarlarkActionContext context) {
     this.context = context;
   }
@@ -291,7 +279,7 @@ public void symlink(
       throws EvalException {
     context.checkMutable("actions.symlink");
     if (useExecRootForSourceObject != Starlark.UNBOUND) {
-      BuiltinRestriction.failIfCalledOutsideAllowlist(thread, PRIVATE_STARLARKIFICATION_ALLOWLIST);
+      BuiltinRestriction.failIfCalledOutsideDefaultAllowlist(thread);
     }
     boolean useExecRootForSource =
         !Starlark.UNBOUND.equals(useExecRootForSourceObject)
@@ -468,7 +456,7 @@ public Artifact transformVersionFile(
       String outputFileName,
       StarlarkThread thread)
       throws InterruptedException, EvalException {
-    BuiltinRestriction.failIfCalledOutsideAllowlist(thread, PRIVATE_BUILDINFO_API_ALLOWLIST);
+    BuiltinRestriction.failIfCalledOutsideDefaultAllowlist(thread);
     return transformBuildInfoFile(
         transformFuncObject, templateObject, outputFileName, true, thread);
   }
@@ -480,7 +468,7 @@ public Artifact transformInfoFile(
       String outputFileName,
       StarlarkThread thread)
       throws InterruptedException, EvalException {
-    BuiltinRestriction.failIfCalledOutsideAllowlist(thread, PRIVATE_BUILDINFO_API_ALLOWLIST);
+    BuiltinRestriction.failIfCalledOutsideDefaultAllowlist(thread);
     return transformBuildInfoFile(
         transformFuncObject, templateObject, outputFileName, false, thread);
   }
@@ -1081,7 +1069,7 @@ public TemplateDictApi templateDict() {
   @Override
   public FileApi createShareableArtifact(String path, Object artifactRoot, StarlarkThread thread)
       throws EvalException {
-    BuiltinRestriction.failIfCalledOutsideAllowlist(thread, PRIVATE_STARLARKIFICATION_ALLOWLIST);
+    BuiltinRestriction.failIfCalledOutsideDefaultAllowlist(thread);
     ArtifactRoot root =
         artifactRoot == Starlark.UNBOUND
             ? getRuleContext().getBinDirectory()

src/main/java/com/google/devtools/build/lib/analysis/starlark/StarlarkAttrModule.java

@@ -31,7 +31,6 @@
 import com.google.devtools.build.lib.packages.AttributeTransitionData;
 import com.google.devtools.build.lib.packages.AttributeValueSource;
 import com.google.devtools.build.lib.packages.BuildType;
-import com.google.devtools.build.lib.packages.BuiltinRestriction;
 import com.google.devtools.build.lib.packages.BzlInitThreadContext;
 import com.google.devtools.build.lib.packages.LabelConverter;
 import com.google.devtools.build.lib.packages.Provider;
@@ -58,7 +57,6 @@
 import net.starlark.java.eval.Starlark;
 import net.starlark.java.eval.StarlarkFunction;
 import net.starlark.java.eval.StarlarkInt;
-import net.starlark.java.eval.StarlarkList;
 import net.starlark.java.eval.StarlarkThread;
 
 /**
@@ -512,20 +510,11 @@ public Descriptor labelAttribute(
       Object allowRules,
       Object cfg,
       Sequence<?> aspects,
-      Object flagsObject, // Sequence<String> expected
+      Sequence<?> flags,
       StarlarkThread thread)
       throws EvalException {
     checkContext(thread, "attr.label()");
 
-    if (flagsObject != Starlark.UNBOUND) {
-      BuiltinRestriction.failIfCalledOutsideBuiltins(thread);
-    }
-    @SuppressWarnings("unchecked")
-    Sequence<String> flags =
-        flagsObject == Starlark.UNBOUND
-            ? StarlarkList.immutableOf()
-            : ((Sequence<String>) flagsObject);
-
     ImmutableAttributeFactory attribute =
         createAttributeFactory(
             BuildType.LABEL,

src/main/java/com/google/devtools/build/lib/analysis/starlark/StarlarkRuleContext.java

@@ -121,15 +121,6 @@
 public final class StarlarkRuleContext
     implements StarlarkRuleContextApi<ConstraintValueInfo>, StarlarkActionContext {
 
-  public static final ImmutableSet<BuiltinRestriction.AllowlistEntry>
-      PRIVATE_STARLARKIFICATION_ALLOWLIST =
-          ImmutableSet.of(
-              BuiltinRestriction.allowlistEntry("", "test"), // for tests
-              BuiltinRestriction.allowlistEntry("", "third_party/bazel_rules/rules_android"),
-              BuiltinRestriction.allowlistEntry("build_bazel_rules_android", ""),
-              BuiltinRestriction.allowlistEntry("rules_android", ""),
-              BuiltinRestriction.allowlistEntry("", "tools/build_defs/android"));
-
   private static final String EXECUTABLE_OUTPUT_NAME = "executable";
 
   // This field is a copy of the info from ruleContext, stored separately so it can be accessed
@@ -1016,7 +1007,7 @@ public String expandLocation(
   }
 
   private static void checkPrivateAccess(StarlarkThread thread) throws EvalException {
-    BuiltinRestriction.failIfCalledOutsideAllowlist(thread, PRIVATE_STARLARKIFICATION_ALLOWLIST);
+    BuiltinRestriction.failIfCalledOutsideDefaultAllowlist(thread);
   }
 
   @Override

src/main/java/com/google/devtools/build/lib/analysis/test/CoverageCommon.java

@@ -103,7 +103,7 @@ public InstrumentedFilesInfoApi instrumentedFilesInfo(
     if (!supportFilesBuilder.isEmpty()
         || !reportedToActualSources.isEmpty()
         || !environmentPairs.isEmpty()) {
-      BuiltinRestriction.failIfCalledOutsideBuiltins(thread);
+      BuiltinRestriction.failIfCalledOutsideDefaultAllowlist(thread);
     }
     return createInstrumentedFilesInfo(
         starlarkRuleContext.getRuleContext(),

src/main/java/com/google/devtools/build/lib/packages/BuiltinRestriction.java

@@ -14,6 +14,7 @@
 package com.google.devtools.build.lib.packages;
 
 import com.google.auto.value.AutoValue;
+import com.google.common.collect.ImmutableList;
 import com.google.devtools.build.lib.cmdline.BazelModuleContext;
 import com.google.devtools.build.lib.cmdline.Label;
 import com.google.devtools.build.lib.cmdline.RepositoryMapping;
@@ -29,6 +30,38 @@
 // rule attributes rather than what .bzl you're in.
 public final class BuiltinRestriction {
 
+  /** The "default" allowlist for restricted APIs added to aid the Java to Starlark migration. */
+  public static final ImmutableList<BuiltinRestriction.AllowlistEntry>
+      INTERNAL_STARLARK_API_ALLOWLIST =
+          ImmutableList.of(
+              // Testing
+              BuiltinRestriction.allowlistEntry("", "test"),
+              BuiltinRestriction.allowlistEntry("", "bazel_internal/test_rules"),
+
+              // BuildInfo
+              BuiltinRestriction.allowlistEntry("", "tools/build_defs/build_info"),
+              BuiltinRestriction.allowlistEntry("bazel_tools", "tools/build_defs/build_info"),
+
+              // Android rules
+              BuiltinRestriction.allowlistEntry("", "bazel_internal/test_rules/cc"),
+              BuiltinRestriction.allowlistEntry("", "tools/build_defs/android"),
+              BuiltinRestriction.allowlistEntry("", "third_party/bazel_rules/rules_android"),
+              BuiltinRestriction.allowlistEntry("rules_android", ""),
+              BuiltinRestriction.allowlistEntry("build_bazel_rules_android", ""),
+
+              // Java rules
+              BuiltinRestriction.allowlistEntry("", "third_party/bazel_rules/rules_java"),
+              BuiltinRestriction.allowlistEntry("rules_java", ""),
+
+              // Rust rules
+              BuiltinRestriction.allowlistEntry(
+                  "", "third_party/bazel_rules/rules_rust/rust/private"),
+              BuiltinRestriction.allowlistEntry("", "third_party/crubit"),
+              BuiltinRestriction.allowlistEntry("rules_rust", "rust/private"),
+
+              // CUDA rules
+              BuiltinRestriction.allowlistEntry("", "third_party/gpus/cuda"));
+
   private BuiltinRestriction() {}
 
   /**
@@ -87,6 +120,18 @@ public static void failIfCalledOutsideAllowlist(
     failIfModuleOutsideAllowlist(BazelModuleContext.ofInnermostBzlOrThrow(thread), allowlist);
   }
 
+  /**
+   * Throws {@code EvalException} if the call is made outside of the default allowlist or outside of
+   * builtins.
+   *
+   * @throws NullPointerException if there is no currently executing Starlark function, or the
+   *     innermost Starlark function's module is not a .bzl file
+   */
+  public static void failIfCalledOutsideDefaultAllowlist(StarlarkThread thread)
+      throws EvalException {
+    failIfCalledOutsideAllowlist(thread, INTERNAL_STARLARK_API_ALLOWLIST);
+  }
+
   /**
    * Throws {@code EvalException} if the given {@link BazelModuleContext} is not within either 1)
    * the builtins repository, or 2) a package or subpackage of an entry in the given allowlist.
@@ -103,11 +148,20 @@ public static void failIfModuleOutsideAllowlist(
   public static void failIfLabelOutsideAllowlist(
       Label label, RepositoryMapping repoMapping, Collection<AllowlistEntry> allowlist)
       throws EvalException {
-    if (label.getRepository().getName().equals("_builtins")) {
-      return;
-    }
-    if (allowlist.stream().noneMatch(e -> e.allows(label, repoMapping))) {
+    if (isNotAllowed(label, repoMapping, allowlist)) {
       throw Starlark.errorf("file '%s' cannot use private API", label.getCanonicalForm());
     }
   }
+
+  /**
+   * Returns true if the given {@link Label} is not within both 1) the builtins repository, or 2) a
+   * package or subpackage of an entry in the given allowlist.
+   */
+  public static boolean isNotAllowed(
+      Label label, RepositoryMapping repoMapping, Collection<AllowlistEntry> allowlist) {
+    if (label.getRepository().getName().equals("_builtins")) {
+      return false;
+    }
+    return allowlist.stream().noneMatch(e -> e.allows(label, repoMapping));
+  }
 }

src/main/java/com/google/devtools/build/lib/rules/cpp/CcModule.java

@@ -138,18 +138,6 @@ public abstract class CcModule
   private static final ImmutableList<String> SUPPORTED_OUTPUT_TYPES =
       ImmutableList.of("executable", "dynamic_library", "archive");
 
-  private static final ImmutableList<BuiltinRestriction.AllowlistEntry>
-      PRIVATE_STARLARKIFICATION_ALLOWLIST =
-          ImmutableList.of(
-              BuiltinRestriction.allowlistEntry("", "bazel_internal/test_rules/cc"),
-              BuiltinRestriction.allowlistEntry("", "tools/build_defs/android"),
-              BuiltinRestriction.allowlistEntry("", "third_party/bazel_rules/rules_android"),
-              BuiltinRestriction.allowlistEntry(
-                  "", "rust/private"),
-              BuiltinRestriction.allowlistEntry("build_bazel_rules_android", ""),
-              BuiltinRestriction.allowlistEntry("rules_android", ""),
-              BuiltinRestriction.allowlistEntry("rules_rust", "rust/private"));
-
   // TODO(bazel-team): This only makes sense for the parameter in cc_common.compile()
   //  additional_include_scanning_roots which is technical debt and should go away.
   private static final BuiltinRestriction.AllowlistEntry MATCH_CLIF_ALLOWLISTED_LOCATION =
@@ -2056,7 +2044,7 @@ public CcDebugInfoContext mergeCcDebugInfoFromStarlark(
 
   public static void checkPrivateStarlarkificationAllowlist(StarlarkThread thread)
       throws EvalException {
-    BuiltinRestriction.failIfCalledOutsideAllowlist(thread, PRIVATE_STARLARKIFICATION_ALLOWLIST);
+    BuiltinRestriction.failIfCalledOutsideDefaultAllowlist(thread);
   }
 
   public static boolean isStarlarkCcCommonCalledFromBuiltins(StarlarkThread thread) {
@@ -2092,7 +2080,7 @@ protected static void isCalledFromStarlarkCcCommon(StarlarkThread thread) throws
       })
   public void checkPrivateApi(Object allowlistObject, StarlarkThread thread) throws EvalException {
     // Make sure that check_private_api is called either from builtins or allowlisted packages.
-    isCalledFromStarlarkCcCommon(thread);
+    checkPrivateStarlarkificationAllowlist(thread);
     BazelModuleContext bazelModuleContext =
         (BazelModuleContext) Module.ofInnermostEnclosingStarlarkFunction(thread, 1).getClientData();
     ImmutableList<BuiltinRestriction.AllowlistEntry> allowlist =

src/main/java/com/google/devtools/build/lib/rules/cpp/CppConfiguration.java

@@ -863,7 +863,7 @@ public boolean macosSetInstallName() {
   private static void checkInExpandedApiAllowlist(StarlarkThread thread, String feature)
       throws EvalException {
     try {
-      BuiltinRestriction.failIfCalledOutsideBuiltins(thread);
+      BuiltinRestriction.failIfCalledOutsideDefaultAllowlist(thread);
     } catch (EvalException e) {
       throw Starlark.errorf("%s (feature '%s' in CppConfiguration)", e.getMessage(), feature);
     }

src/main/java/com/google/devtools/build/lib/rules/java/JavaCommon.java

@@ -830,7 +830,7 @@ public RuleContext getRuleContext() {
 
   private JavaCompilationInfoProvider createCompilationInfoProvider() throws RuleErrorException {
     return new JavaCompilationInfoProvider.Builder()
-        .setJavacOpts(javacOpts)
+        .setJavacOpts(JavaHelper.detokenizeJavaOptions(javacOpts))
         .setBootClasspath(getBootClasspath())
         .setCompilationClasspath(getCompileTimeClasspath())
         .setRuntimeClasspath(getRuntimeClasspath())