Make attempting to change --config in invocation policy an error.

It will not work as expected, since config is already expanded by this point in options processing.

RELNOTES: None.
PiperOrigin-RevId: 193196664

src/main/java/com/google/devtools/common/options/InvocationPolicyEnforcer.java

diff --git a/src/main/java/com/google/devtools/common/options/InvocationPolicyEnforcer.java b/src/main/java/com/google/devtools/common/options/InvocationPolicyEnforcer.java
index 88deb46..3b42a29 100644
--- a/src/main/java/com/google/devtools/common/options/InvocationPolicyEnforcer.java
+++ b/src/main/java/com/google/devtools/common/options/InvocationPolicyEnforcer.java
@@ -248,6 +248,15 @@
     OptionPriority nextPriority =
         OptionPriority.lowestOptionPriorityAtCategory(PriorityCategory.INVOCATION_POLICY);
     for (FlagPolicy policy : invocationPolicy.getFlagPoliciesList()) {
+      // Explicitly disallow --config in invocation policy.
+      if (policy.getFlagName().equals("config")) {
+        throw new OptionsParsingException(
+            "Invocation policy is applied after --config expansion, changing config values now "
+                + "would have no effect and is disallowed to prevent confusion. Please remove the "
+                + "following policy : "
+                + policy);
+      }
+
       // These policies are high-level, before expansion, and so are not the implicitDependents or
       // expansions of any other flag, other than in an obtuse sense from --invocation_policy.
       OptionPriority currentPriority = nextPriority;

src/test/java/com/google/devtools/common/options/InvocationPolicySetValueTest.java

diff --git a/src/test/java/com/google/devtools/common/options/InvocationPolicySetValueTest.java b/src/test/java/com/google/devtools/common/options/InvocationPolicySetValueTest.java
index c8d08cc..2232419 100644
--- a/src/test/java/com/google/devtools/common/options/InvocationPolicySetValueTest.java
+++ b/src/test/java/com/google/devtools/common/options/InvocationPolicySetValueTest.java
@@ -481,4 +481,31 @@
       // expected.
     }
   }
+
+  @Test
+  public void testConfigNotAllowed() throws Exception {
+    InvocationPolicy.Builder invocationPolicyBuilder = InvocationPolicy.newBuilder();
+    invocationPolicyBuilder
+        .addFlagPoliciesBuilder()
+        .setFlagName("config")
+        .getSetValueBuilder()
+        .addFlagValue("foo");
+
+    InvocationPolicyEnforcer enforcer = createOptionsPolicyEnforcer(invocationPolicyBuilder);
+    parser.parse();
+    try {
+      enforcer.enforce(parser, BUILD_COMMAND);
+      fail();
+    } catch (OptionsParsingException expected) {
+      assertThat(expected)
+          .hasMessageThat()
+          .isEqualTo(
+              "Invocation policy is applied after --config expansion, changing config values now "
+                  + "would have no effect and is disallowed to prevent confusion. Please remove "
+                  + "the following policy : flag_name: \"config\"\n"
+                  + "set_value {\n"
+                  + "  flag_value: \"foo\"\n"
+                  + "}\n");
+    }
+  }
 }