From e6bcd7fb6ee7d894661b52ba737e295e7c8ca174 Mon Sep 17 00:00:00 2001 From: Keith Smiley Date: Tue, 25 Nov 2025 00:59:03 +0000 Subject: [PATCH 1/5] Remove allowlist_include_directories from data When very recent versions of bazel, improvements in the merkle tree recommend that instead of passing a huge list of files to the toolchain, you instead pass the root directory of those files once, and then bazel symlinks the entire directory as opposed to every file one by one. In order to do this you must pass a filegroup pointing at only the directory. In this case, if you then also pass all the files, you get conflicts in bazel trying to link the files, and the directory. If you didn't get those conflicts you would still lose the perf benefits. This change makes allowlist_include_directories only affect the cxx_builtin_include_directories field. If you need the directory also in data, you must now also add it to `data`. If you want to continue using the entire list of files, that still works fine. --- cc/toolchains/args.bzl | 2 +- cc/toolchains/impl/nested_args.bzl | 2 +- cc/toolchains/tool.bzl | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/cc/toolchains/args.bzl b/cc/toolchains/args.bzl index a852292f5..5a25e47d4 100644 --- a/cc/toolchains/args.bzl +++ b/cc/toolchains/args.bzl @@ -67,7 +67,7 @@ def _cc_args_impl(ctx): ) files = nested.files else: - files = collect_files(ctx.attr.data + ctx.attr.allowlist_include_directories) + files = collect_files(ctx.attr.data) requires = collect_provider(ctx.attr.requires_any_of, FeatureConstraintInfo) diff --git a/cc/toolchains/impl/nested_args.bzl b/cc/toolchains/impl/nested_args.bzl index fa17d790e..e59711d5a 100644 --- a/cc/toolchains/impl/nested_args.bzl +++ b/cc/toolchains/impl/nested_args.bzl @@ -99,7 +99,7 @@ def nested_args_provider_from_ctx(ctx, maybe_used_vars = []): args = ctx.attr.args, format = ctx.attr.format, nested = collect_provider(ctx.attr.nested, NestedArgsInfo), - files = collect_files(ctx.attr.data + getattr(ctx.attr, "allowlist_include_directories", [])), + files = collect_files(ctx.attr.data), iterate_over = ctx.attr.iterate_over, requires_not_none = _var(ctx.attr.requires_not_none), requires_none = _var(ctx.attr.requires_none), diff --git a/cc/toolchains/tool.bzl b/cc/toolchains/tool.bzl index ee0a49bc5..dc87b9f24 100644 --- a/cc/toolchains/tool.bzl +++ b/cc/toolchains/tool.bzl @@ -30,7 +30,7 @@ def _cc_tool_impl(ctx): else: fail("Expected cc_tool's src attribute to be either an executable or a single file") - runfiles = collect_data(ctx, ctx.attr.data + [ctx.attr.src] + ctx.attr.allowlist_include_directories) + runfiles = collect_data(ctx, ctx.attr.data + [ctx.attr.src]) tool = ToolInfo( label = ctx.label, exe = exe, From 1f41e9fa51e506f6243a15d5d8a909b8d0fe2b7e Mon Sep 17 00:00:00 2001 From: Keith Smiley Date: Tue, 25 Nov 2025 01:55:33 +0000 Subject: [PATCH 2/5] update tests --- tests/rule_based_toolchain/args/BUILD | 9 +++++++++ tests/rule_based_toolchain/args/args_test.bzl | 14 +++++++++++++- tests/rule_based_toolchain/args_list/BUILD | 2 ++ tests/rule_based_toolchain/features/BUILD | 1 + tests/rule_based_toolchain/tool/BUILD | 1 + tests/rule_based_toolchain/toolchain_config/BUILD | 11 +++++++++-- 6 files changed, 35 insertions(+), 3 deletions(-) diff --git a/tests/rule_based_toolchain/args/BUILD b/tests/rule_based_toolchain/args/BUILD index dd72250df..da6b8188d 100644 --- a/tests/rule_based_toolchain/args/BUILD +++ b/tests/rule_based_toolchain/args/BUILD @@ -63,6 +63,15 @@ util.helper_target( args = ["--secret-builtin-include-dir"], ) +util.helper_target( + cc_args, + name = "with_dir_and_data", + actions = ["//tests/rule_based_toolchain/actions:all_compile"], + allowlist_include_directories = ["//tests/rule_based_toolchain/testdata:directory"], + data = ["//tests/rule_based_toolchain/testdata:directory"], + args = ["--secret-builtin-include-dir"], +) + util.helper_target( cc_args, name = "good_env_format", diff --git a/tests/rule_based_toolchain/args/args_test.bzl b/tests/rule_based_toolchain/args/args_test.bzl index 619c7ba89..2adc82b0b 100644 --- a/tests/rule_based_toolchain/args/args_test.bzl +++ b/tests/rule_based_toolchain/args/args_test.bzl @@ -152,11 +152,21 @@ def _env_only_requires_test(env, targets): def _with_dir_test(env, targets): with_dir = env.expect.that_target(targets.with_dir).provider(ArgsInfo) with_dir.allowlist_include_directories().contains_exactly([_TOOL_DIRECTORY]) - with_dir.files().contains_at_least(_SIMPLE_FILES) + with_dir.files().contains_exactly([]) c_compile = env.expect.that_target(targets.with_dir).provider(ArgsListInfo).by_action().get( targets.c_compile[ActionTypeInfo], ) + c_compile.files().contains_exactly([]) + +def _with_dir_and_data_test(env, targets): + with_dir = env.expect.that_target(targets.with_dir_and_data).provider(ArgsInfo) + with_dir.allowlist_include_directories().contains_exactly([_TOOL_DIRECTORY]) + with_dir.files().contains_at_least(_SIMPLE_FILES) + + c_compile = env.expect.that_target(targets.with_dir_and_data).provider(ArgsListInfo).by_action().get( + targets.c_compile[ActionTypeInfo], + ) c_compile.files().contains_at_least(_SIMPLE_FILES) TARGETS = [ @@ -165,6 +175,7 @@ TARGETS = [ ":env_only", ":env_only_requires", ":with_dir", + ":with_dir_and_data", ":iterate_over_optional", ":good_env_format", ":good_env_format_optional", @@ -349,6 +360,7 @@ TESTS = { "env_only_test": _env_only_test, "env_only_requires_test": _env_only_requires_test, "with_dir_test": _with_dir_test, + "with_dir_and_data_test": _with_dir_and_data_test, "good_env_format_test": _good_env_format_test, "good_env_format_optional_test": _good_env_format_optional_test, } diff --git a/tests/rule_based_toolchain/args_list/BUILD b/tests/rule_based_toolchain/args_list/BUILD index 64f0fbbbf..f0bc4a6ee 100644 --- a/tests/rule_based_toolchain/args_list/BUILD +++ b/tests/rule_based_toolchain/args_list/BUILD @@ -48,6 +48,7 @@ util.helper_target( actions = ["//tests/rule_based_toolchain/actions:c_compile"], allowlist_include_directories = ["//tests/rule_based_toolchain/testdata:subdirectory_1"], args = ["dir1"], + data = ["//tests/rule_based_toolchain/testdata:subdirectory_1"], visibility = ["//tests/rule_based_toolchain:__subpackages__"], ) @@ -57,6 +58,7 @@ util.helper_target( actions = ["//tests/rule_based_toolchain/actions:cpp_compile"], allowlist_include_directories = ["//tests/rule_based_toolchain/testdata:subdirectory_2"], args = ["dir2"], + data = ["//tests/rule_based_toolchain/testdata:subdirectory_2"], visibility = ["//tests/rule_based_toolchain:__subpackages__"], ) diff --git a/tests/rule_based_toolchain/features/BUILD b/tests/rule_based_toolchain/features/BUILD index c98231871..e43da9d32 100644 --- a/tests/rule_based_toolchain/features/BUILD +++ b/tests/rule_based_toolchain/features/BUILD @@ -115,6 +115,7 @@ util.helper_target( actions = ["//tests/rule_based_toolchain/actions:c_compile"], allowlist_include_directories = ["//tests/rule_based_toolchain/testdata:subdirectory_1"], args = ["--include-builtin-dirs"], + data = ["//tests/rule_based_toolchain/testdata:subdirectory_1"], ) util.helper_target( diff --git a/tests/rule_based_toolchain/tool/BUILD b/tests/rule_based_toolchain/tool/BUILD index daa617aab..8b1c07303 100644 --- a/tests/rule_based_toolchain/tool/BUILD +++ b/tests/rule_based_toolchain/tool/BUILD @@ -21,6 +21,7 @@ cc_tool( name = "tool_with_allowlist_include_directories", src = "//tests/rule_based_toolchain/testdata:bin_wrapper.sh", allowlist_include_directories = ["//tests/rule_based_toolchain/testdata:directory"], + data = ["//tests/rule_based_toolchain/testdata:directory"], visibility = ["//tests/rule_based_toolchain:__subpackages__"], ) diff --git a/tests/rule_based_toolchain/toolchain_config/BUILD b/tests/rule_based_toolchain/toolchain_config/BUILD index 08b5f8380..7bf8d3b43 100644 --- a/tests/rule_based_toolchain/toolchain_config/BUILD +++ b/tests/rule_based_toolchain/toolchain_config/BUILD @@ -32,7 +32,10 @@ util.helper_target( actions = ["//tests/rule_based_toolchain/actions:c_compile"], allowlist_include_directories = ["//tests/rule_based_toolchain/testdata:subdirectory_1"], args = ["c_compile_args"], - data = ["//tests/rule_based_toolchain/testdata:file1"], + data = [ + "//tests/rule_based_toolchain/testdata:file1", + "//tests/rule_based_toolchain/testdata:subdirectory_1", + ], ) util.helper_target( @@ -48,6 +51,7 @@ cc_tool( src = "//tests/rule_based_toolchain/testdata:bin_wrapper", allowlist_include_directories = ["//tests/rule_based_toolchain/testdata:subdirectory_3"], capabilities = ["//cc/toolchains/capabilities:supports_pic"], + data = ["//tests/rule_based_toolchain/testdata:subdirectory_3"], ) cc_sysroot( @@ -94,7 +98,10 @@ util.helper_target( actions = ["//tests/rule_based_toolchain/actions:all_compile"], allowlist_include_directories = ["//tests/rule_based_toolchain/testdata:subdirectory_2"], args = ["compile_args"], - data = ["//tests/rule_based_toolchain/testdata:file2"], + data = [ + "//tests/rule_based_toolchain/testdata:file2", + "//tests/rule_based_toolchain/testdata:subdirectory_2", + ], ) util.helper_target( From bd3a7f4cd13de1e10240e51bd53ebd57a2623ad2 Mon Sep 17 00:00:00 2001 From: Keith Smiley Date: Tue, 25 Nov 2025 01:58:06 +0000 Subject: [PATCH 3/5] update docs --- cc/toolchains/args.bzl | 3 +++ cc/toolchains/tool.bzl | 3 +++ 2 files changed, 6 insertions(+) diff --git a/cc/toolchains/args.bzl b/cc/toolchains/args.bzl index 5a25e47d4..95cdf5217 100644 --- a/cc/toolchains/args.bzl +++ b/cc/toolchains/args.bzl @@ -262,6 +262,9 @@ def cc_args( your toolchain and you've ensured that the toolchain is compiling with the `-no-canonical-prefixes` and/or `-fno-canonical-system-headers` arguments. + These files are not automatically passed to each action. If they + need to be, add them to 'data' as well. + This can help work around errors like: `the source file 'main.c' includes the following non-builtin files with absolute paths (if these are builtin files, make sure these paths are in your toolchain)`. diff --git a/cc/toolchains/tool.bzl b/cc/toolchains/tool.bzl index dc87b9f24..51ba7c31b 100644 --- a/cc/toolchains/tool.bzl +++ b/cc/toolchains/tool.bzl @@ -93,6 +93,9 @@ As a rule of thumb, only use this if Bazel is complaining about absolute paths i toolchain and you've ensured that the toolchain is compiling with the `-no-canonical-prefixes` and/or `-fno-canonical-system-headers` arguments. +These files are not automatically passed to each action. If they need to be, +add them to 'data' as well. + This can help work around errors like: `the source file 'main.c' includes the following non-builtin files with absolute paths (if these are builtin files, make sure these paths are in your toolchain)`. From 79596df33487ec1fe9805b391d8c4d816c7d2207 Mon Sep 17 00:00:00 2001 From: Keith Smiley Date: Tue, 25 Nov 2025 01:58:40 +0000 Subject: [PATCH 4/5] lint --- tests/rule_based_toolchain/args/BUILD | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/rule_based_toolchain/args/BUILD b/tests/rule_based_toolchain/args/BUILD index da6b8188d..7f47073c4 100644 --- a/tests/rule_based_toolchain/args/BUILD +++ b/tests/rule_based_toolchain/args/BUILD @@ -68,8 +68,8 @@ util.helper_target( name = "with_dir_and_data", actions = ["//tests/rule_based_toolchain/actions:all_compile"], allowlist_include_directories = ["//tests/rule_based_toolchain/testdata:directory"], - data = ["//tests/rule_based_toolchain/testdata:directory"], args = ["--secret-builtin-include-dir"], + data = ["//tests/rule_based_toolchain/testdata:directory"], ) util.helper_target( From 9871dd82f18988f362291ce20a6cbee34686e611 Mon Sep 17 00:00:00 2001 From: Keith Smiley Date: Wed, 17 Dec 2025 17:50:29 -0800 Subject: [PATCH 5/5] docs --- docs/toolchain_api.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/toolchain_api.md b/docs/toolchain_api.md index 780bc7e3c..11cad2a72 100755 --- a/docs/toolchain_api.md +++ b/docs/toolchain_api.md @@ -518,7 +518,7 @@ cc_tool( | name | A unique name for this target. | Name | required | | | src | The underlying binary that this tool represents.

Usually just a single prebuilt (eg. @toolchain//:bin/clang), but may be any executable label. | Label | optional | `None` | | data | Additional files that are required for this tool to run.

Frequently, clang and gcc require additional files to execute as they often shell out to other binaries (e.g. `cc1`). | List of labels | optional | `[]` | -| allowlist_include_directories | Include paths implied by using this tool.

Compilers may include a set of built-in headers that are implicitly available unless flags like `-nostdinc` are provided. Bazel checks that all included headers are properly provided by a dependency or allowlisted through this mechanism.

As a rule of thumb, only use this if Bazel is complaining about absolute paths in your toolchain and you've ensured that the toolchain is compiling with the `-no-canonical-prefixes` and/or `-fno-canonical-system-headers` arguments.

This can help work around errors like: `the source file 'main.c' includes the following non-builtin files with absolute paths (if these are builtin files, make sure these paths are in your toolchain)`. | List of labels | optional | `[]` | +| allowlist_include_directories | Include paths implied by using this tool.

Compilers may include a set of built-in headers that are implicitly available unless flags like `-nostdinc` are provided. Bazel checks that all included headers are properly provided by a dependency or allowlisted through this mechanism.

As a rule of thumb, only use this if Bazel is complaining about absolute paths in your toolchain and you've ensured that the toolchain is compiling with the `-no-canonical-prefixes` and/or `-fno-canonical-system-headers` arguments.

These files are not automatically passed to each action. If they need to be, add them to 'data' as well.

This can help work around errors like: `the source file 'main.c' includes the following non-builtin files with absolute paths (if these are builtin files, make sure these paths are in your toolchain)`. | List of labels | optional | `[]` | | capabilities | Declares that a tool is capable of doing something.

For example, `@rules_cc//cc/toolchains/capabilities:supports_pic`. | List of labels | optional | `[]` | @@ -659,7 +659,7 @@ For more extensive examples, see the usages here: | :------------- | :------------- | :------------- | | name | (str) The name of the target. | none | | actions | (List[Label]) A list of labels of [`cc_action_type`](#cc_action_type) or [`cc_action_type_set`](#cc_action_type_set) rules that dictate which actions these arguments should be applied to. | `None` | -| allowlist_include_directories | (List[Label]) A list of include paths that are implied by using this rule. These must point to a skylib [directory](https://github.com/bazelbuild/bazel-skylib/tree/main/docs/directory_doc.md#directory) or [subdirectory](https://github.com/bazelbuild/bazel-skylib/tree/main/docs/directory_subdirectory_doc.md#subdirectory) rule. Some flags (e.g. --sysroot) imply certain include paths are available despite not explicitly specifying a normal include path flag (`-I`, `-isystem`, etc.). Bazel checks that all included headers are properly provided by a dependency or allowlisted through this mechanism.

As a rule of thumb, only use this if Bazel is complaining about absolute paths in your toolchain and you've ensured that the toolchain is compiling with the `-no-canonical-prefixes` and/or `-fno-canonical-system-headers` arguments.

This can help work around errors like: `the source file 'main.c' includes the following non-builtin files with absolute paths (if these are builtin files, make sure these paths are in your toolchain)`. | `None` | +| allowlist_include_directories | (List[Label]) A list of include paths that are implied by using this rule. These must point to a skylib [directory](https://github.com/bazelbuild/bazel-skylib/tree/main/docs/directory_doc.md#directory) or [subdirectory](https://github.com/bazelbuild/bazel-skylib/tree/main/docs/directory_subdirectory_doc.md#subdirectory) rule. Some flags (e.g. --sysroot) imply certain include paths are available despite not explicitly specifying a normal include path flag (`-I`, `-isystem`, etc.). Bazel checks that all included headers are properly provided by a dependency or allowlisted through this mechanism.

As a rule of thumb, only use this if Bazel is complaining about absolute paths in your toolchain and you've ensured that the toolchain is compiling with the `-no-canonical-prefixes` and/or `-fno-canonical-system-headers` arguments.

These files are not automatically passed to each action. If they need to be, add them to 'data' as well.

This can help work around errors like: `the source file 'main.c' includes the following non-builtin files with absolute paths (if these are builtin files, make sure these paths are in your toolchain)`. | `None` | | allowlist_absolute_include_directories | (List[str]) Allowlists absolute include directories, preventing Bazel from emitting errors when an #include of local system files in the directory occurs. Be careful when adding directories to this list, as it inherently causes leaks in hermeticity. Prefer to reserve use of this for cases like Xcode, where the conventional expectation is to allowlist well-known system-absolute include paths rather than redistributing the SDK. | `None` | | args | (List[str]) The command-line arguments that are applied by using this rule. This is mutually exclusive with [nested](#cc_args-nested). | `None` | | data | (List[Label]) A list of runtime data dependencies that are required for these arguments to work as intended. | `None` |