Enable bazel on darwin

.bazelrc

@@ -81,5 +81,8 @@ build --extra_toolchains=@rust_toolchains//:all
 # Generated by the LRE flake module.
 try-import %workspace%/lre.bazelrc
 
+# Generated by the darwin flake module.
+try-import %workspace%/darwin.bazelrc
+
 # Allow user-side customization.
 try-import %workspace%/user.bazelrc

.gitignore

@@ -19,3 +19,4 @@ trivy-results.sarif
 Pulumi.dev.yaml
 lre.bazelrc
 rust-project.json
+darwin.bazelrc

flake.nix

@@ -41,6 +41,7 @@
       imports = [
         inputs.git-hooks.flakeModule
         ./local-remote-execution/flake-module.nix
+        ./tools/darwin/flake-module.nix
       ];
       perSystem = {
         config,
@@ -71,6 +72,7 @@
         maybeDarwinDeps = pkgs.lib.optionals pkgs.stdenv.isDarwin [
           pkgs.darwin.apple_sdk.frameworks.Security
           pkgs.libiconv
+          pkgs.darwin.apple_sdk.frameworks.CoreFoundation
         ];
 
         llvmPackages = pkgs.llvmPackages_18;
@@ -420,6 +422,7 @@
             else lre-cc.meta.Env;
           prefix = "lre";
         };
+
         devShells.default = pkgs.mkShell {
           nativeBuildInputs = let
             bazel = pkgs.writeShellScriptBin "bazel" ''
@@ -483,6 +486,10 @@
             # in the nix environment.
             ${config.local-remote-execution.installationScript}
 
+            # Generate darwin.bazelrc which configures darwin libs when
+            # running in the nix environment.
+            ${config.darwin.installationScript}
+
             # The Bazel and Cargo builds in nix require a Clang toolchain.
             # TODO(aaronmondal): The Bazel build currently uses the
             #                    irreproducible host C++ toolchain. Provide
@@ -499,6 +506,7 @@
       };
     }
     // {
-      flakeModule = ./local-remote-execution/flake-module.nix;
+      flakeModule.default = ./local-remote-execution/flake-module.nix;
+      flakeModule.darwin = ./tools/darwin/flake-module.nix;
     };
 }

local-remote-execution/examples/BUILD.bazel

@@ -4,4 +4,9 @@ cc_binary(
     name = "hello_lre",
     srcs = ["hello.cpp"],
     copts = ["--verbose"],
+    target_compatible_with = [
+        "@platforms//os:linux",
+        "@platforms//cpu:x86_64",
+        "@bazel_tools//tools/cpp:clang",
+    ],
 )

tools/darwin/flake-module.nix

@@ -0,0 +1,44 @@
+{
+  lib,
+  flake-parts-lib,
+  ...
+}: {
+  options = {
+    perSystem = flake-parts-lib.mkPerSystemOption (
+      {
+        config,
+        options,
+        pkgs,
+        ...
+      }: let
+        cfg = config.darwin;
+      in {
+        options = {
+          darwin = {
+            pkgs = lib.mkOption {
+              type = lib.types.uniq (lib.types.lazyAttrsOf (lib.types.raw or lib.types.unspecified));
+              description = "Nixpkgs to use.";
+              default = pkgs;
+              defaultText = lib.literalMD "`pkgs` (module argument)";
+            };
+            settings = lib.mkOption {
+              type = lib.types.submoduleWith {
+                modules = [./modules/darwin.nix];
+                specialArgs = {inherit (cfg) pkgs;};
+              };
+              default = {};
+              description = "Configuration for Bazel on Darwin.";
+            };
+            installationScript = lib.mkOption {
+              type = lib.types.str;
+              description = "Create darwin.bazelrc.";
+              default = cfg.settings.installationScript;
+              defaultText = lib.literalMD "bazelrc content";
+              readOnly = true;
+            };
+          };
+        };
+      }
+    );
+  };
+}

tools/darwin/modules/darwin.nix

@@ -0,0 +1,56 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  bazelrc = pkgs.writeText "darwin.bazelrc" ''
+    # These flags are dynamically generated by the Darwin flake module.
+    #
+    # Add `try-import %%workspace%%/darwin.bazelrc` to your .bazelrc to
+    # include these flags when running Bazel in a nix environment.
+    # These are the libs and frameworks used by darwin.
+
+    build --@rules_rust//:extra_rustc_flags=-L${pkgs.libiconv}/lib,-Lframework=${pkgs.darwin.apple_sdk.frameworks.Security}/Library/Frameworks,-Lframework=${pkgs.darwin.apple_sdk.frameworks.CoreFoundation}/Library/Frameworks
+    build --@rules_rust//:extra_exec_rustc_flags=-L${pkgs.libiconv}/lib,-Lframework=${pkgs.darwin.apple_sdk.frameworks.Security}/Library/Frameworks,-Lframework=${pkgs.darwin.apple_sdk.frameworks.CoreFoundation}/Library/Frameworks
+  '';
+in {
+  options = {
+    installationScript = lib.mkOption {
+      type = lib.types.str;
+      description = "A bash snippet which creates a darwin.bazelrc file in the
+        repository.";
+    };
+    path = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [];
+      description = "List of paths to include in the Bazel environment.";
+    };
+  };
+  config = {
+    installationScript = ''
+      if ! type -t git >/dev/null; then
+        # In pure shells
+        echo 1>&2 "WARNING: darwin: git command not found; skipping installation."
+      elif ! ${pkgs.git}/bin/git rev-parse --git-dir &> /dev/null; then
+        echo 1>&2 "WARNING: darwin: .git not found; skipping installation."
+      else
+        GIT_WC=`${pkgs.git}/bin/git rev-parse --show-toplevel`
+        # These update procedures compare before they write, to avoid
+        # filesystem churn. This improves performance with watch tools like
+        # lorri and prevents installation loops by lorri.
+        if ! readlink "''${GIT_WC}/darwin.bazelrc" >/dev/null \
+          || [[ $(readlink "''${GIT_WC}/darwin.bazelrc") != ${bazelrc} ]]; then
+          echo 1>&2 "darwin: updating $PWD repository"
+          [ -L darwin.bazelrc ] && unlink darwin.bazelrc
+          if [ -e "''${GIT_WC}/darwin.bazelrc" ]; then
+            echo 1>&2 "darwin: WARNING: Refusing to install because of pre-existing darwin.bazelrc"
+            echo 1>&2 "  Remove the darwin.bazelrc file and add darwin.bazelrc to .gitignore."
+          else
+            ln -fs ${bazelrc} "''${GIT_WC}/darwin.bazelrc"
+          fi
+        fi
+      fi
+    '';
+  };
+}