Fix hermeticity issue in system_module_map

tests/.bazelrc

@@ -1,5 +1,2 @@
 build --incompatible_enable_cc_toolchain_resolution
 build --features=layering_check
-
-# Temporary workaround for bugs in Bazel 7.0.0.
-build --noincompatible_sandbox_hermetic_tmp

toolchain/internal/BUILD.bazel

@@ -11,3 +11,5 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+
+exports_files(["generate_system_module_map.sh"])

toolchain/internal/generate_system_module_map.sh

@@ -0,0 +1,33 @@
+#!/bin/sh
+# Based on:
+# https://github.com/bazelbuild/bazel/blob/44c5a1bbb26d3c61b37529b38406f1f5b0832baf/tools/cpp/generate_system_module_map.sh
+#
+# Copyright 2020 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -eu
+
+echo 'module "crosstool" [system] {'
+
+for dir in "$@"; do
+  find -L "${dir}" -type f 2>/dev/null | LANG=C sort | uniq | while read -r header; do
+    case "$dir" in
+      /*) ;;
+      *) header=${EXECROOT_PREFIX}"$header" ;;
+    esac
+    echo "  textual header \"${header}\""
+  done
+done
+
+echo "}"

toolchain/internal/system_module_map.bzl

@@ -15,20 +15,13 @@
 def _system_module_map(ctx):
     module_map = ctx.actions.declare_file(ctx.attr.name + ".modulemap")
 
-    # The builtin include directories are relative to the execroot, but the
-    # paths in the module map must be relative to the directory that contains
-    # the module map.
-    to_execroot = (module_map.dirname.count("/") + 1) * "../"
-
     dirs = []
     non_hermetic = False
     for dir in ctx.attr.cxx_builtin_include_directories:
         if ctx.attr.sysroot_path and dir.startswith("%sysroot%"):
             dir = ctx.attr.sysroot_path + dir[len("%sysroot%"):]
         if dir.startswith("/"):
             non_hermetic = True
-        else:
-            dir = to_execroot + dir
         dir = dir.replace("//", "/")
         dirs.append(dir)
 
@@ -41,17 +34,23 @@ def _system_module_map(ctx):
             "no-remote": "",
         }
 
+    # The builtin include directories are relative to the execroot, but the
+    # paths in the module map must be relative to the directory that contains
+    # the module map.
+    execroot_prefix = (module_map.dirname.count("/") + 1) * "../"
+
     ctx.actions.run_shell(
         outputs = [module_map],
         inputs = ctx.attr.toolchain[DefaultInfo].files,
-        arguments = [
-            ctx.executable._generate_system_module_map.path,
-            module_map.path,
-        ] + dirs,
-        tools = [ctx.executable._generate_system_module_map],
         command = """
-"$1" "${@:3}" > "$2"
-""",
+{tool} "$@" > {module_map}
+""".format(
+            tool = ctx.executable._generate_system_module_map.path,
+            module_map = module_map.path,
+        ),
+        arguments = dirs,
+        tools = [ctx.executable._generate_system_module_map],
+        env = {"EXECROOT_PREFIX": execroot_prefix},
         execution_requirements = execution_requirements,
         mnemonic = "LlvmSystemModuleMap",
         progress_message = "Generating system module map",
@@ -66,7 +65,7 @@ system_module_map = rule(
         "cxx_builtin_include_directories": attr.string_list(mandatory = True),
         "sysroot_path": attr.string(),
         "_generate_system_module_map": attr.label(
-            default = "@bazel_tools//tools/cpp:generate_system_module_map.sh",
+            default = ":generate_system_module_map.sh",
             allow_single_file = True,
             cfg = "exec",
             executable = True,