| commit | 6c3e9d57df173d6f428a768f0f389894548e6ee8 | [log] [tgz] |
|---|---|---|
| author | Googler <brandjon@google.com> | Wed Aug 09 12:12:32 2023 -0700 |
| committer | Copybara-Service <copybara-worker@google.com> | Wed Aug 09 12:13:37 2023 -0700 |
| tree | 3bd051064dd8c5611ae59d482d765f3963061da4 | |
| parent | 7a489b17fcdb17577244f7447b4985a28c5fe837 [diff] |
Refactor retrieval of BazelModuleContext from thread, and @_builtins allowlist checking Most of the call sites inspecting the Starlark stack (Module.ofInnermostEnclosingStarlarkFunction) are to check whether we're in the @_builtins repo or another allowlisted location. Direct use of stack inspection is discouraged, so this CL refactors these usages into helpers underneath the existing BuiltinRestriction utility class. The delta ended up being much bigger than I intended, but most of the change is straightforward-ish. - BazelModuleContext: of() is now explicitly documented as returning null if there's no applicable context object, and no longer crashes if the context object is of the wrong type. Added ofInnermostBzlOrThrow() to serve the common case of retrieving a context from a given thread and throwing an unchecked exception if there is none. - Factored a bunch of "check where we're called from, fail if it's not @_builtins" implementations into BuiltinRestriction.throwIfNotBuiltinUsage, which is renamed to failIfCalledOutsideBuiltins. (The "fail" terminology is more idiomatic when we're talking about a soft Starlark evaluation error rather than a fatal exception.) The error message is tweaked to mention the offending .bzl file. In one or two cases we now omit the name of the guarded api. - Factored similar checks that allow either @_builtins or an allowlist into BuiltinRestriction.failIfCalledOutsideAllowlist. - In some cases matching logic is changed to "is a subpackage of" rather than "package matches exactly". In others it changed from "is a string prefix of" to "is a package prefix of". One instance of the dummy name //bazel_internal/test was changed to //bazel_internal/test_rules for this reason. - CcModule had the most elaborate allowlist checking. It needs to work under bzlmod, so some allowlist items need to be processed through the repository mapping. I refactored it so that instead of creating non-canonically named PackageIdentifiers (which violates the invariant that instances of Label, RepositoryName, etc., should always be canonical), the allowlist is written as a list of strings and parsed into PackageIdentifiers when needed. - Created BuiltinRestriction.failIfLabelOutsideAllowlist for the few cases where we want to compare the allowlist against a stack frame that is not the top-most frame. - Fix typo in test case names - Drive-by fix: Added BazelModuleContext#ofInnermostBzlOrFail and use it in Label() constructor, so that calling Label() inside a BUILD file does not crash. PiperOrigin-RevId: 555236616 Change-Id: If1f830e316fef056a7d722c8891a0017663e95a2
{Fast, Correct} - Choose two
Build and test software of any size, quickly and reliably.
Speed up your builds and tests: Bazel rebuilds only what is necessary. With advanced local and distributed caching, optimized dependency analysis and parallel execution, you get fast and incremental builds.
One tool, multiple languages: Build and test Java, C++, Android, iOS, Go, and a wide variety of other language platforms. Bazel runs on Windows, macOS, and Linux.
Scalable: Bazel helps you scale your organization, codebase, and continuous integration solution. It handles codebases of any size, in multiple repositories or a huge monorepo.
Extensible to your needs: Easily add support for new languages and platforms with Bazel's familiar extension language. Share and re-use language rules written by the growing Bazel community.
Follow our tutorials:
To report a security issue, please email security@bazel.build with a description of the issue, the steps you took to create the issue, affected versions, and, if known, mitigations for the issue. Our vulnerability management team will respond within 3 working days of your email. If the issue is confirmed as a vulnerability, we will open a Security Advisory. This project follows a 90 day disclosure timeline.
See CONTRIBUTING.md
