tree 7811f02b29ec8b3e668f59e8b441c40ea24f917c
parent a2b7e40965416d869eff22b7c695f86a37d71044
author Greg Estren <gregestren@gmail.com> 1611848684 -0800
committer Copybara-Service <copybara-worker@google.com> 1611848755 -0800

Enforce visibility on select() keys

Example:

```
my_rule(
  name = "buildme",
  deps = select({
    "//other/package:some_config": [":mydeps"]
  }))
```

Today, `//other/package:some_config` is exempt from visibility checking, even though it's technically a target dep of
 `buildme`.

While this dep is "special" vs. other deps in various ways, there's no obvious reason why it needs to be special in this way. It adds an unclear corner case exception to visibility's API.

### Implementation:
select() keys are not "normal" dependencies and don't generally follow the same code path. Hence them not being automatically visibility checked like others.

In particular, normal dependencies are found in `ConfiguredTargetFunction` and validity-checked in `RuleContext.Builder`. select() keys' only purpose is to figure out which other normal dependencies should exist. There's generally no need to pass them to `RuleContext.Builder`. Instead, Blaze passes their `ConfigMatchingProvider`s, which remain useful for analysis phase attribute lookups.

`RuleContext.Builder` needs a `ConfiguredTargetAndData` to do validity-checking.  This patch propagates that information for select() keys too.

We could alternatively refactor the validity checking logic. But that's an even more invasive change. Or do ad hoc validity checking directly in `ConfiguredTargetFunction`. But that's duplicating logic we really want to keep consolidated.

### Backward compatibility:
This would break existing builds if `config_setting` defaulted to private visibility. So this change specially defaults `config_setting` to public visibility, with clarifying documentation. When ready we'll want to create an incompatible change to make `config_setting` the same as everything else.

Fixes #12669.

Closes #12877.

RELNOTES: config_setting now honors `visibility` attribute (and defaults to `//visibility:public`)
PiperOrigin-RevId: 354310777