incompatible_visibility_private_attributes_at_definition

[fmeum]

With this flag enabled, the visibility of a target referenced in a private attribute of a rule is first checked relative to the package that contains the rule definition. If it is visible from the definition, it no longer needs to be visible from the rule usage.

This allows rule authors to limit the visibility of tools and config_settings used internally by a rule. Previously, these targets usually had to have public visibility so that the rule could be used everywhere.

The change can be temporarily disabled via --noincompatible_visibility_private_attributes_at_definition.

Migration:

• Since visibility is still checked relative to the target as a fallback, this change should not result in any new visibility errors.
• If you want to limit the packages that can use a given rule, use load visibility instead.

[fmeum]

@comius You might be interested in this based on https://github.com/bazelbuild/rules_python/blob/main/python/private/proto/BUILD.bazel#L43-L45. I could also see this helping with clean Starlarkification once the built-in rules are ready to move to their respective separate repos.

[comius]

cc @mai93

I assumed that this can't break anything, but it does. :( Examples are one-off rules that already have tight visibility, like toolchains. Or rules that have a small amount of targets.

A prebuilt tool on the toolchain can currently set visibility just to the toolchain target. After the flag flip it needs to be visible to the toolchain rule.

Are there any options besides a cleanup?

[comius]

Can we add another condition, that if it's visible to the target that's enough? No need for rule visibility. That might make it a non-breaking change in one direction.

[fmeum]

Can we add another condition, that if it's visible to the target that's enough? No need for rule visibility. That might make it a non-breaking change in one direction.

That's a good idea. I updated the description of this issue to reflect it and will submit a PR to implement it after the merge of #19442.