[TECH-16629] bzlmod support

[dblasen-compass]

No description provided.

[greptile-apps]

Greptile Summary

This large PR adds bzlmod support to the LLVM toolchain repository while also introducing significant new capabilities: support for additional target architectures (WebAssembly, RISC-V, ARMv7), Clang module map generation for layering_check, configurable libunwind/compiler-rt via select(), a new sysroot repository rule, and LLVM distribution coverage from 14.0.1 through 20.1.3.

• Bzlmod integration: New MODULE.bazel, toolchain/extensions/llvm.bzl module extension, and WORKSPACE.bzlmod for dual WORKSPACE/bzlmod support
• Architecture refactoring: Consistent host_* → exec_* renaming throughout, attribute definitions consolidated from rules.bzl into toolchain/internal/repo.bzl
• New targets: WebAssembly (wasm32, wasm64, wasip1), bare-metal (none-riscv32, none-x86_64), Linux armv7 and riscv64
• CC wrapper rewrite: Both cc_wrapper.sh.tpl and osx_cc_wrapper.sh.tpl rewritten with dirname_shim, sanitize_option, and response file handling — but contain bugs in response file processing (wrong variable expansion ${i:1} instead of ${!i:1}, and missing echo in macOS wrapper)
• Module maps & layering_check: New system_module_map rule generates Clang module maps for the stricter layering_check feature
• LLVM distributions: Massively expanded distribution list with version requirement support (latest:>=17.0.0,<20) and comprehensive test infrastructure

Confidence Score: 2/5

• The cc_wrapper response file handling bugs will cause failures when clang is invoked with response files, particularly impacting macOS builds.
• Score of 2 reflects two confirmed logic bugs in the cc_wrapper shell scripts that will break response file handling at compile time. The macOS wrapper has two compounding bugs (wrong readability check variable and missing echo to tmpfile). These are in critical path code that runs on every compiler invocation that uses response files. The rest of the PR is architecturally sound.
• Pay close attention to toolchain/osx_cc_wrapper.sh.tpl (2 bugs: wrong variable in readability check + missing echo) and toolchain/cc_wrapper.sh.tpl (1 bug: wrong variable in readability check). Also review toolchain/cc_toolchain_config.bzl for leftover debug TODO comments.

Important Files Changed

Filename	Overview
toolchain/cc_wrapper.sh.tpl	Rewritten cc_wrapper with new dirname_shim and sanitize_option functions. Contains a bug in the response file readability check (${i:1} instead of ${!i:1}).
toolchain/osx_cc_wrapper.sh.tpl	Rewritten macOS cc_wrapper. Contains two bugs: wrong variable in response file readability check, and parse_option output incorrectly redirected to tmpfile instead of echoing the option.
toolchain/cc_toolchain_config.bzl	Extensive rework: renamed host_* to exec_*, added new targets (wasm, riscv, armv7), new stdlib options, archive_flags, configurable libunwind/compiler-rt via select. Contains debug TODO comments that should be cleaned up.
toolchain/internal/repo.bzl	Attribute definitions moved from rules.bzl, added extra_llvm_distributions, exec_os/arch, extra flags, repo_metadata support. Doc string has typos.
toolchain/internal/configure.bzl	Core configuration logic reworked: host_* renamed to exec_*, bzlmod label handling, system module map generation, cxx_builtin_include_directories computed per-target, extra constraint support.
toolchain/internal/common.bzl	Extended SUPPORTED_TARGETS with wasm/riscv/armv7/none targets, refactored host_info into structured struct, added toolchain_tools function, removed host_tools.
toolchain/extensions/llvm.bzl	New bzlmod extension implementing LLVM toolchain configuration via module tags (toolchain, toolchain_root, sysroot, extra_*_compatible_with). Root-only restriction enforced.
toolchain/rules.bzl	Simplified by moving attribute definitions to repo.bzl. Fixed version validation logic (was incorrectly using == instead of and for mutual exclusion check).
toolchain/internal/llvm_distributions.bzl	Major expansion: added distributions for LLVM 14.0.1-20.1.3, version requirement parsing, distribution basename resolution, comprehensive test writer rules.
MODULE.bazel	New bzlmod module definition with dependencies on bazel_features, bazel_skylib, aspect_bazel_lib, rules_cc, platforms, helly25_bzl, and tar.bzl.
toolchain/sysroot.bzl	New sysroot repository rule using bsdtar for extraction with source directory support for efficient sandbox symlinks.
toolchain/internal/system_module_map.bzl	New rule generating Clang module maps for layering_check support, handling both absolute and relative include paths.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[MODULE.bazel / WORKSPACE] -->|bzlmod| B[toolchain/extensions/llvm.bzl]
    A -->|WORKSPACE| C[toolchain/rules.bzl]
    B --> D[llvm_toolchain macro]
    C --> D
    D --> E[llvm repo rule<br/>toolchain/internal/repo.bzl]
    D --> F[toolchain config rule<br/>toolchain/internal/configure.bzl]
    E --> G[llvm_distributions.bzl<br/>Download LLVM]
    F --> H[cc_toolchain_config.bzl<br/>Generate toolchain config]
    F --> I[system_module_map.bzl<br/>Generate module maps]
    F --> J[cc_wrapper.sh.tpl / osx_cc_wrapper.sh.tpl<br/>Compiler wrapper scripts]
    F --> K[BUILD.toolchain.tpl<br/>Generated BUILD file]
    E --> L[BUILD.llvm_repo.tpl<br/>LLVM repo BUILD file]
    G --> M[LLVM Distribution Archive]
    H --> N[Supported Targets:<br/>linux, darwin, wasm, none]
    I --> O[Clang Module Map<br/>for layering_check]

Loading

Prompt To Fix All With AI

This is a comment left during a code review.
Path: toolchain/osx_cc_wrapper.sh.tpl
Line: 149-158

Comment:
**Response file readability check uses wrong variable**

Two bugs in this response-file handling block:

1. **Line 149:** `"${i:1}"` performs substring extraction on the loop variable `i` (a number), not the argument at position `i`. For example, when `i=5`, `${i:1}` yields `""` (empty) instead of the argument value. This should be `"${!i:1}"` to get the positional argument via indirect expansion and strip the leading `@`.

2. **Line 157:** `parse_option "${opt}" >>"${tmpfile}"` redirects the (empty) stdout of `parse_option` into the tmpfile, but `parse_option` only sets shell variables as side effects — it doesn't print anything. The sanitized option is never actually written to the tmpfile. Compare with `cc_wrapper.sh.tpl` line 130-131, which correctly does:
   ```
   parse_option "${opt}"
   echo "${opt}" >>"${tmpfile}"
   ```

Together these mean: on macOS, any clang invocation that uses a response file (`@file`) will (a) fail the `-r` readability check or check the wrong path, and (b) produce an empty sanitized response file, causing the compiler to receive no arguments from the original response file.

```suggestion
  if [[ ${!i} == @* && -r "${!i:1}" ]]; then
    tmpfile=$(mktemp)
    CLEANUP_FILES+=("${tmpfile}")
    while IFS= read -r opt; do
      opt="$(
        set -e
        sanitize_option "${opt}"
      )"
      parse_option "${opt}"
      echo "${opt}" >>"${tmpfile}"
    done <"${!i:1}"
    cmd+=("@${tmpfile}")
```

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: toolchain/cc_wrapper.sh.tpl
Line: 121

Comment:
**Response file readability check uses wrong variable**

`"${i:1}"` performs substring extraction on the loop counter `i` (a number like `0`, `1`, `2`...), not the actual argument value. For instance, when `i=0`, `${i:1}` is `""` (empty); when `i=12`, it's `"2"`. This should be `"${!i:1}"` to use indirect expansion to get the positional parameter at index `i`, then strip the leading `@` to get the filename.

The same bug exists on line 132 where the response file is read: `<"${!i:1}"` is correct there, but the guard check on this line is wrong.

```suggestion
  if [[ ${!i} == @* && -r "${!i:1}" ]]; then
```

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: toolchain/cc_toolchain_config.bzl
Line: 256-257

Comment:
**Debug TODO comments left in production code**

These `TODO TODO` and `TODO: as above, so below` comments appear to be personal debugging notes that were left in the code. They should be cleaned up or converted into proper documentation before merging.

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: toolchain/internal/repo.bzl
Line: 42-44

Comment:
**Multiple typos in doc string**

This doc string has three typos:
- `"additon"` should be `"addition"`
- `"distributiosn"` should be `"distributions"`
- `"'utils/lvm_checksums.sh'"` should be `"'utils/llvm_checksums.sh'"` (missing an `l`)

```suggestion
        doc = ("A dictionary that maps distributions to their SHA256 values. " +
               "It allows for simple addition of llvm distributions using the " +
               "'utils/llvm_checksums.sh' tool. This also allows to use the " +
```

How can I resolve this? If you propose a fix, please make it concise.

_{Last reviewed commit: "Merge branch 'master..."}

[greptile-apps]

Response file readability check uses wrong variable

Two bugs in this response-file handling block:

1. Line 149: "${i:1}" performs substring extraction on the loop variable i (a number), not the argument at position i. For example, when i=5, ${i:1} yields "" (empty) instead of the argument value. This should be "${!i:1}" to get the positional argument via indirect expansion and strip the leading @.

2. Line 157: parse_option "${opt}" >>"${tmpfile}" redirects the (empty) stdout of parse_option into the tmpfile, but parse_option only sets shell variables as side effects — it doesn't print anything. The sanitized option is never actually written to the tmpfile. Compare with cc_wrapper.sh.tpl line 130-131, which correctly does:

   parse_option "${opt}"
   echo "${opt}" >>"${tmpfile}"
   

Together these mean: on macOS, any clang invocation that uses a response file (@file) will (a) fail the -r readability check or check the wrong path, and (b) produce an empty sanitized response file, causing the compiler to receive no arguments from the original response file.

Suggested change

	if [[ ${!i} == @* && -r "${i:1}" ]]; then
	tmpfile=$(mktemp)
	CLEANUP_FILES+=("${tmpfile}")
	while IFS= read -r opt; do
	opt="$(
	set -e
	sanitize_option "${opt}"
	)"
	parse_option "${opt}" >>"${tmpfile}"
	done <"${!i:1}"
	if [[ ${!i} == @* && -r "${!i:1}" ]]; then
	tmpfile=$(mktemp)
	CLEANUP_FILES+=("${tmpfile}")
	while IFS= read -r opt; do
	opt="$(
	set -e
	sanitize_option "${opt}"
	)"
	parse_option "${opt}"
	echo "${opt}" >>"${tmpfile}"
	done <"${!i:1}"
	cmd+=("@${tmpfile}")

Prompt To Fix With AI

This is a comment left during a code review.
Path: toolchain/osx_cc_wrapper.sh.tpl
Line: 149-158

Comment:
**Response file readability check uses wrong variable**

Two bugs in this response-file handling block:

1. **Line 149:** `"${i:1}"` performs substring extraction on the loop variable `i` (a number), not the argument at position `i`. For example, when `i=5`, `${i:1}` yields `""` (empty) instead of the argument value. This should be `"${!i:1}"` to get the positional argument via indirect expansion and strip the leading `@`.

2. **Line 157:** `parse_option "${opt}" >>"${tmpfile}"` redirects the (empty) stdout of `parse_option` into the tmpfile, but `parse_option` only sets shell variables as side effects — it doesn't print anything. The sanitized option is never actually written to the tmpfile. Compare with `cc_wrapper.sh.tpl` line 130-131, which correctly does:
   ```
   parse_option "${opt}"
   echo "${opt}" >>"${tmpfile}"
   ```

Together these mean: on macOS, any clang invocation that uses a response file (`@file`) will (a) fail the `-r` readability check or check the wrong path, and (b) produce an empty sanitized response file, causing the compiler to receive no arguments from the original response file.

```suggestion
  if [[ ${!i} == @* && -r "${!i:1}" ]]; then
    tmpfile=$(mktemp)
    CLEANUP_FILES+=("${tmpfile}")
    while IFS= read -r opt; do
      opt="$(
        set -e
        sanitize_option "${opt}"
      )"
      parse_option "${opt}"
      echo "${opt}" >>"${tmpfile}"
    done <"${!i:1}"
    cmd+=("@${tmpfile}")
```

How can I resolve this? If you propose a fix, please make it concise.

[greptile-apps]

Response file readability check uses wrong variable

"${i:1}" performs substring extraction on the loop counter i (a number like 0, 1, 2...), not the actual argument value. For instance, when i=0, ${i:1} is "" (empty); when i=12, it's "2". This should be "${!i:1}" to use indirect expansion to get the positional parameter at index i, then strip the leading @ to get the filename.

The same bug exists on line 132 where the response file is read: <"${!i:1}" is correct there, but the guard check on this line is wrong.

Suggested change

	if [[ ${!i} == @* && -r "${i:1}" ]]; then
	if [[ ${!i} == @* && -r "${!i:1}" ]]; then

Prompt To Fix With AI

This is a comment left during a code review.
Path: toolchain/cc_wrapper.sh.tpl
Line: 121

Comment:
**Response file readability check uses wrong variable**

`"${i:1}"` performs substring extraction on the loop counter `i` (a number like `0`, `1`, `2`...), not the actual argument value. For instance, when `i=0`, `${i:1}` is `""` (empty); when `i=12`, it's `"2"`. This should be `"${!i:1}"` to use indirect expansion to get the positional parameter at index `i`, then strip the leading `@` to get the filename.

The same bug exists on line 132 where the response file is read: `<"${!i:1}"` is correct there, but the guard check on this line is wrong.

```suggestion
  if [[ ${!i} == @* && -r "${!i:1}" ]]; then
```

How can I resolve this? If you propose a fix, please make it concise.

[greptile-apps]

Debug TODO comments left in production code

These TODO TODO and TODO: as above, so below comments appear to be personal debugging notes that were left in the code. They should be cleaned up or converted into proper documentation before merging.

Prompt To Fix With AI

This is a comment left during a code review.
Path: toolchain/cc_toolchain_config.bzl
Line: 256-257

Comment:
**Debug TODO comments left in production code**

These `TODO TODO` and `TODO: as above, so below` comments appear to be personal debugging notes that were left in the code. They should be cleaned up or converted into proper documentation before merging.

How can I resolve this? If you propose a fix, please make it concise.

[greptile-apps]

Multiple typos in doc string

This doc string has three typos:

• "additon" should be "addition"
• "distributiosn" should be "distributions"
• "'utils/lvm_checksums.sh'" should be "'utils/llvm_checksums.sh'" (missing an l)

Suggested change

	doc = ("A dictionary that maps distributions to their SHA256 values. " +
	"It allows for simple additon of llvm distributiosn using the " +
	"'utils/lvm_checksums.sh' tool. This also allows to use the " +
	doc = ("A dictionary that maps distributions to their SHA256 values. " +
	"It allows for simple addition of llvm distributions using the " +
	"'utils/llvm_checksums.sh' tool. This also allows to use the " +

Prompt To Fix With AI

This is a comment left during a code review.
Path: toolchain/internal/repo.bzl
Line: 42-44

Comment:
**Multiple typos in doc string**

This doc string has three typos:
- `"additon"` should be `"addition"`
- `"distributiosn"` should be `"distributions"`
- `"'utils/lvm_checksums.sh'"` should be `"'utils/llvm_checksums.sh'"` (missing an `l`)

```suggestion
        doc = ("A dictionary that maps distributions to their SHA256 values. " +
               "It allows for simple addition of llvm distributions using the " +
               "'utils/llvm_checksums.sh' tool. This also allows to use the " +
```

How can I resolve this? If you propose a fix, please make it concise.