Add cargo_build_script.use_cc_toolchain (#4161)

This change introduces `use_cc_toolchain` to `cargo_build_script` which
can be used to control whether or not a `cc_toolchain` is explicitly
withheld from `CargoBuildScript` actions. Additionally a global flag
`--@rules_rust//cargo/settings:use_cc_toolchain` can be used to control
the default of any build script that has not either explicitly set
`use_cc_toolchain = 1` (always include cc toolchains) or
`use_cc_toolchain = 0` (always exclude cc toolchains).

closes #3680
closes #3679

Co-authored-by: Krasimir Georgiev <krasimir@google.com>

Author: UebelAndre

cargo/private/cargo_build_script.bzl

@@ -286,6 +286,24 @@ def _feature_enabled(ctx, feature_name, default = False):
 
     return default
 
+def _resolve_tristate(attr_value, default_flag_target):
+    """Resolve a tri-state `int` attribute (`-1`/`0`/`1`) to a `bool`.
+
+    `-1` defers to the `BuildSettingInfo` on `default_flag_target`; any other
+    value is treated as truthy/falsy directly.
+
+    Args:
+        attr_value (int): The tri-state attribute value (`-1`, `0`, or `1`).
+        default_flag_target (Target): The `bool_flag` target providing the
+            default when `attr_value` is `-1`.
+
+    Returns:
+        bool: The resolved value.
+    """
+    if attr_value == -1:
+        return default_flag_target[BuildSettingInfo].value
+    return bool(attr_value)
+
 def _rlocationpath(file, workspace_name):
     if file.short_path.startswith("../"):
         return file.short_path[len("../"):]
@@ -390,12 +408,10 @@ def _cargo_build_script_impl(ctx):
 
     env = {}
 
-    if ctx.attr.use_default_shell_env == -1:
-        use_default_shell_env = ctx.attr._default_use_default_shell_env[BuildSettingInfo].value
-    elif ctx.attr.use_default_shell_env == 0:
-        use_default_shell_env = False
-    else:
-        use_default_shell_env = True
+    use_default_shell_env = _resolve_tristate(
+        ctx.attr.use_default_shell_env,
+        ctx.attr._default_use_default_shell_env,
+    )
 
     # If enabled, start with the default shell env, which contains any --action_env
     # settings passed in on the command line and defaults like $PATH.
@@ -433,9 +449,17 @@ def _cargo_build_script_impl(ctx):
         env["CARGO_PKG_VERSION_PRE"] = patch[1] if len(patch) > 1 else ""
         env["CARGO_PKG_VERSION"] = ctx.attr.version
 
+    use_cc_toolchain = _resolve_tristate(
+        ctx.attr.use_cc_toolchain,
+        ctx.attr._default_use_cc_toolchain,
+    )
+
     # Pull in env vars which may be required for the cc_toolchain to work (e.g. on OSX, the SDK version).
     # We hope that the linker env is sufficient for the whole cc_toolchain.
-    cc_toolchain, feature_configuration = find_cc_toolchain(ctx)
+    if use_cc_toolchain:
+        cc_toolchain, feature_configuration = find_cc_toolchain(ctx)
+    else:
+        cc_toolchain, feature_configuration = None, None
     linker, _, link_args, linker_env = get_linker_and_args(ctx, "bin", toolchain, cc_toolchain, feature_configuration, None)
     env.update(**linker_env)
     env["LD"] = linker
@@ -784,6 +808,31 @@ cargo_build_script = rule(
             allow_files = True,
             cfg = "exec",
         ),
+        "use_cc_toolchain": attr.int(
+            doc = dedent("""\
+                Whether or not to pull in the resolved `cc_toolchain` when
+                running the build script.
+
+                When enabled, the resolved `cc_toolchain`'s `all_files` are
+                added to the action inputs and the `CC`, `CXX`, `AR`,
+                `CFLAGS`, `CXXFLAGS`, `LDFLAGS`, and `INCLUDE` environment
+                variables are populated from that toolchain (matching Cargo's
+                normal behavior).
+
+                When disabled, the `cc_toolchain` is not requested for the
+                build script action. This can significantly shrink the input
+                trees of `cargo_build_script` actions (particularly with
+                hermetic sysroots) but breaks any build script that needs to
+                compile C/C++ code.
+
+                Unset (`-1`, the default) defers to the
+                `@rules_rust//cargo/settings:use_cc_toolchain` build setting
+                which itself defaults to enabled. Set to `1` to force enable
+                or `0` to force disable for a specific target.
+            """),
+            default = -1,
+            values = [-1, 0, 1],
+        ),
         "use_default_shell_env": attr.int(
             doc = dedent("""\
                 Whether or not to include the default shell environment for the build
@@ -808,6 +857,9 @@ cargo_build_script = rule(
         "_debug_std_streams_output_group": attr.label(
             default = Label("//cargo/settings:debug_std_streams_output_group"),
         ),
+        "_default_use_cc_toolchain": attr.label(
+            default = Label("//cargo/settings:use_cc_toolchain"),
+        ),
         "_default_use_default_shell_env": attr.label(
             default = Label("//cargo/settings:use_default_shell_env"),
         ),

cargo/private/cargo_build_script_wrapper.bzl

@@ -9,6 +9,23 @@ load(
 )
 load("//rust:defs.bzl", "rust_binary")
 
+def _sanitize_tristate(value):
+    """Coerce a user-provided value to the rule's `-1`/`0`/`1` tri-state `int` shape.
+
+    Args:
+        value (bool | int | None): The user-provided value. `None` is treated as
+            "unset" (`-1`), booleans are mapped to `0`/`1`, and integers are
+            passed through.
+
+    Returns:
+        int: The sanitized tri-state value (`-1`, `0`, or `1`).
+    """
+    if value == None:
+        return -1
+    if type(value) == "bool":
+        return 1 if value else 0
+    return value
+
 def cargo_build_script(
         *,
         name,
@@ -24,6 +41,7 @@ def cargo_build_script(
         build_script_env = {},
         build_script_env_files = [],
         emit_warnings = True,
+        use_cc_toolchain = None,
         use_default_shell_env = None,
         data = [],
         compile_data = [],
@@ -117,6 +135,14 @@ def cargo_build_script(
             to stderr. Honored only when
             `@rules_rust//cargo/settings:emit_build_script_warnings` is `auto` (the
             default); set the flag to `on` or `off` to override every target.
+        use_cc_toolchain (bool, optional): Whether or not to pull in the resolved `cc_toolchain` when running the build script.
+
+            When enabled, the resolved `cc_toolchain`'s `all_files` are added to the action inputs and the `CC`,
+            `CXX`, `AR`, `CFLAGS`, `CXXFLAGS`, `LDFLAGS`, and `INCLUDE` environment variables are populated from
+            that toolchain (matching Cargo's normal behavior). Disabling this can significantly shrink build
+            script action input trees (particularly with hermetic sysroots) but breaks any build script that
+            needs to compile C/C++ code. If unset the global setting
+            `@rules_rust//cargo/settings:use_cc_toolchain` will be used to determine this value.
         use_default_shell_env (bool, optional): Whether or not to include the default shell environment for the build script action. If unset the global
             setting `@rules_rust//cargo/settings:use_default_shell_env` will be used to determine this value.
         data (list, optional): Files needed by the build script.
@@ -206,12 +232,8 @@ def cargo_build_script(
         **wrapper_kwargs
     )
 
-    if use_default_shell_env == None:
-        sanitized_use_default_shell_env = -1
-    elif type(use_default_shell_env) == "bool":
-        sanitized_use_default_shell_env = 1 if use_default_shell_env else 0
-    else:
-        sanitized_use_default_shell_env = use_default_shell_env
+    sanitized_use_default_shell_env = _sanitize_tristate(use_default_shell_env)
+    sanitized_use_cc_toolchain = _sanitize_tristate(use_cc_toolchain)
 
     # This target executes the build script.
     _build_script_run(
@@ -225,6 +247,7 @@ def cargo_build_script(
         build_script_env = build_script_env,
         build_script_env_files = build_script_env_files,
         emit_warnings = emit_warnings,
+        use_cc_toolchain = sanitized_use_cc_toolchain,
         use_default_shell_env = sanitized_use_default_shell_env,
         links = links,
         deps = deps,

cargo/settings/BUILD.bazel

@@ -6,6 +6,7 @@ load(
     "emit_build_script_warnings",
     "experimental_symlink_execroot",
     "out_dir_volatile_file_basenames",
+    "use_cc_toolchain",
     "use_default_shell_env",
 )
 
@@ -33,3 +34,5 @@ use_default_shell_env()
 out_dir_volatile_file_basenames()
 
 emit_build_script_warnings()
+
+use_cc_toolchain()

cargo/settings/settings.bzl

@@ -43,6 +43,29 @@ def use_default_shell_env():
         build_setting_default = True,
     )
 
+def use_cc_toolchain():
+    """A flag which controls the global default of whether `cargo_build_script` \
+    targets should pull in the resolved `cc_toolchain`.
+
+    When enabled (the default), each `cargo_build_script` action gets the
+    resolved `cc_toolchain`'s `all_files` added to its inputs and picks up the
+    `CC`, `CXX`, `AR`, `CFLAGS`, `CXXFLAGS`, `LDFLAGS`, and `INCLUDE`
+    environment variables derived from that toolchain. This matches Cargo's
+    behavior and is required for build scripts that shell out to a C/C++
+    compiler (e.g. those using `cc-rs` or `cmake-rs`).
+
+    When disabled, the `cc_toolchain` is omitted from `cargo_build_script`
+    actions. This can significantly reduce action input sizes when using a
+    hermetic sysroot but breaks any build script that needs to compile C/C++
+    code. Individual targets may override this default via the
+    `cargo_build_script.use_cc_toolchain` attribute.
+    """
+    bool_flag(
+        name = "use_cc_toolchain",
+        scope = "universal",
+        build_setting_default = True,
+    )
+
 def emit_build_script_warnings():
     """A flag which controls whether `cargo_build_script` warnings \
     (`cargo::warning=`) are printed to stderr.

cargo/tests/cargo_build_script/use_cc_toolchain/BUILD.bazel

@@ -0,0 +1,3 @@
+load(":use_cc_toolchain_test.bzl", "use_cc_toolchain_test_suite")
+
+use_cc_toolchain_test_suite(name = "use_cc_toolchain_test_suite")

cargo/tests/cargo_build_script/use_cc_toolchain/build.rs

@@ -0,0 +1 @@
+fn main() {}

cargo/tests/cargo_build_script/use_cc_toolchain/use_cc_toolchain_test.bzl

@@ -0,0 +1,97 @@
+"""Analysis tests for the `use_cc_toolchain` attribute of `cargo_build_script`.
+
+Only the disabled paths are exercised; the enabled paths are already covered by
+the pre-existing `cc_args_and_env` suite.
+"""
+
+load("@bazel_skylib//lib:unittest.bzl", "analysistest", "asserts")
+load("//cargo:defs.bzl", "cargo_build_script")
+
+_USE_CC_TOOLCHAIN_FLAG = str(Label("//cargo/settings:use_cc_toolchain"))
+
+def _find_cargo_action(actions):
+    """Return the `CargoBuildScriptRun` action from a target's action list.
+
+    Args:
+        actions (list[Action]): The actions registered by the target under test.
+
+    Returns:
+        Action: The `CargoBuildScriptRun` action. Fails if none is present.
+    """
+    for action in actions:
+        if action.mnemonic == "CargoBuildScriptRun":
+            return action
+    fail("Could not find CargoBuildScriptRun action")
+
+def _assert_cc_toolchain_absent_impl(ctx):
+    env = analysistest.begin(ctx)
+    cargo_action = _find_cargo_action(analysistest.target_under_test(env).actions)
+    for var in ("CC", "CXX", "AR"):
+        value = cargo_action.env.get(var)
+        asserts.true(
+            env,
+            value != None,
+            "expected env var {} to be set, but it was missing".format(var),
+        )
+        asserts.true(
+            env,
+            "no_" + var.lower() in value,
+            "expected env var {} to point at the fallback tool, got: {}".format(var, value),
+        )
+    return analysistest.end(env)
+
+_cc_toolchain_absent_with_flag_disabled_test = analysistest.make(
+    impl = _assert_cc_toolchain_absent_impl,
+    config_settings = {_USE_CC_TOOLCHAIN_FLAG: False},
+)
+
+_cc_toolchain_absent_with_flag_enabled_test = analysistest.make(
+    impl = _assert_cc_toolchain_absent_impl,
+    config_settings = {_USE_CC_TOOLCHAIN_FLAG: True},
+)
+
+def use_cc_toolchain_test_suite(name):
+    """Instantiates analysis tests covering `cargo_build_script.use_cc_toolchain`.
+
+    Args:
+        name (str): The name of the test suite.
+    """
+    cargo_build_script(
+        name = "build_script_default",
+        edition = "2018",
+        srcs = ["build.rs"],
+        tags = ["manual"],
+    )
+
+    cargo_build_script(
+        name = "build_script_disabled",
+        edition = "2018",
+        srcs = ["build.rs"],
+        use_cc_toolchain = False,
+        tags = ["manual"],
+    )
+
+    # Attribute unset (`-1`) + flag flipped off => no toolchain.
+    _cc_toolchain_absent_with_flag_disabled_test(
+        name = "default_attr_follows_disabled_flag_test",
+        target_under_test = ":build_script_default",
+    )
+
+    # Attribute explicitly disabled (`0`) wins over either flag value.
+    _cc_toolchain_absent_with_flag_disabled_test(
+        name = "disabled_attr_matches_disabled_flag_test",
+        target_under_test = ":build_script_disabled",
+    )
+    _cc_toolchain_absent_with_flag_enabled_test(
+        name = "disabled_attr_overrides_enabled_flag_test",
+        target_under_test = ":build_script_disabled",
+    )
+
+    native.test_suite(
+        name = name,
+        tests = [
+            ":default_attr_follows_disabled_flag_test",
+            ":disabled_attr_matches_disabled_flag_test",
+            ":disabled_attr_overrides_enabled_flag_test",
+        ],
+    )

crate_universe/extensions.bzl

@@ -1041,6 +1041,19 @@ def _crate_impl(module_ctx):
                 annotation_dict["gen_binaries"] = True
             annotation_dict["gen_build_script"] = _OPT_BOOL_VALUES[annotation_dict["gen_build_script"]]
 
+            # Convert the tri-state string values ("auto"/"on"/"off") into the
+            # `int` representation understood by `crate.annotation` (`None`, `1`,
+            # or `0` respectively).
+            for opt_bool_key in (
+                "build_script_use_cc_toolchain",
+                "build_script_use_default_shell_env",
+            ):
+                bool_value = _OPT_BOOL_VALUES[annotation_dict[opt_bool_key]]
+                if bool_value == None:
+                    annotation_dict.pop(opt_bool_key)
+                else:
+                    annotation_dict[opt_bool_key] = int(bool_value)
+
             # Process the override targets for the annotation.
             # In the non-bzlmod approach, this is given as a dict
             # with the possible keys "`proc_macro`, `build_script`, `lib`, `bin`".
@@ -1306,6 +1319,24 @@ _ANNOTATION_NORMAL_ATTRS = {
     "build_script_toolchains": attr.label_list(
         doc = "A list of labels to set on a crates's `cargo_build_script::toolchains` attribute.",
     ),
+    "build_script_use_cc_toolchain": attr.string(
+        doc = (
+            "Whether or not to pull in the resolved `cc_toolchain` when running the build script. " +
+            "Supported values are `on`, `off`, and `auto`. Setting `auto` (the default) defers to the " +
+            "`@rules_rust//cargo/settings:use_cc_toolchain` build setting (defaults to enabled)."
+        ),
+        values = _OPT_BOOL_VALUES.keys(),
+        default = "auto",
+    ),
+    "build_script_use_default_shell_env": attr.string(
+        doc = (
+            "Whether or not to include the default shell environment for the build script action. " +
+            "Supported values are `on`, `off`, and `auto`. Setting `auto` (the default) defers to the " +
+            "`@rules_rust//cargo/settings:use_default_shell_env` build setting."
+        ),
+        values = _OPT_BOOL_VALUES.keys(),
+        default = "auto",
+    ),
     "compile_data_glob": attr.string_list(
         doc = "A list of glob patterns to add to a crate's `rust_library::compile_data` attribute.",
     ),

crate_universe/private/crate.bzl

@@ -103,6 +103,7 @@ def _annotation(
         build_script_rustc_env = None,
         build_script_toolchains = None,
         build_script_use_default_shell_env = None,
+        build_script_use_cc_toolchain = None,
         compile_data = None,
         compile_data_glob = None,
         compile_data_glob_excludes = None,
@@ -151,6 +152,9 @@ def _annotation(
         build_script_toolchains (list, optional): A list of labels to set on a crates's `cargo_build_script::toolchains` attribute.
         build_script_use_default_shell_env (int, optional): Whether or not to include the default shell environment for the build
             script action.
+        build_script_use_cc_toolchain (int, optional): Whether or not to pull in the resolved `cc_toolchain` when
+            running the build script. Set to `1` to force enable, `0` to force disable, or leave unset to
+            defer to the `@rules_rust//cargo/settings:use_cc_toolchain` build setting (defaults to enabled).
         compile_data (list, optional): A list of labels to add to a crate's `rust_library::compile_data` attribute.
         compile_data_glob (list, optional): A list of glob patterns to add to a crate's `rust_library::compile_data`
             attribute.
@@ -217,6 +221,7 @@ def _annotation(
             build_script_rustc_env = build_script_rustc_env,
             build_script_toolchains = _stringify_list(build_script_toolchains),
             build_script_use_default_shell_env = build_script_use_default_shell_env,
+            build_script_use_cc_toolchain = build_script_use_cc_toolchain,
             compile_data = _stringify_list(compile_data),
             compile_data_glob = compile_data_glob,
             compile_data_glob_excludes = compile_data_glob_excludes,