Run lint actions in sbox

Run lint actions in sbox with RuleBuilder.SandboxInputs.  This
copies all input files into the sandbox, which prevents the lint
tool from finding nearby source files that were not presented to it.

Using SandboxInputs requires use of PathForInput or PathForOutput
anywhere a path is used outside of the RuleBuilderCommand methods
that take paths so that they can be translated to the paths that
will be used in the sandbox.

Bug: 181681346
Test: lint_test.go
Test: m lint-check dist
Test: m USE_RBE=true RBE_LINT=true lint-check dist
Test: m USE_RBE=true RBE_LINT=true RBE_LINT_EXEC_STRATEGY=remote lint-check dist
Change-Id: Iab4e09d961891ef182643583d4d456e413bc5e39

java/lint.go

@@ -218,7 +218,7 @@ func (l *linter) writeLintProjectXML(ctx android.ModuleContext, rule *android.Ru
 		// The list of resources may be too long to put on the command line, but
 		// we can't use the rsp file because it is already being used for srcs.
 		// Insert a second rule to write out the list of resources to a file.
-		resourcesList = android.PathForModuleOut(ctx, "lint", "resources.list")
+		resourcesList = android.PathForModuleOut(ctx, "resources.list")
 		resListRule := android.NewRuleBuilder(pctx, ctx)
 		resListRule.Command().Text("cp").
 			FlagWithRspFileInputList("", resourcesList.ReplaceExtension(ctx, "rsp"), l.resources).
@@ -233,7 +233,7 @@ func (l *linter) writeLintProjectXML(ctx android.ModuleContext, rule *android.Ru
 	cacheDir := android.PathForModuleOut(ctx, "lint", "cache")
 	homeDir := android.PathForModuleOut(ctx, "lint", "home")
 
-	srcJarDir := android.PathForModuleOut(ctx, "lint-srcjars")
+	srcJarDir := android.PathForModuleOut(ctx, "lint", "srcjars")
 	srcJarList := zipSyncCmd(ctx, rule, srcJarDir, l.srcJars)
 	// TODO(ccross): this is a little fishy.  The files extracted from the srcjars are referenced
 	// by the project.xml and used by the later lint rule, but the lint rule depends on the srcjars,
@@ -248,6 +248,7 @@ func (l *linter) writeLintProjectXML(ctx android.ModuleContext, rule *android.Ru
 		FlagWithRspFileInputList("", srcsListRsp, l.srcs).
 		Output(srcsList)
 	trackRSPDependency(l.srcs, srcsList)
+	rule.Temporary(srcsList)
 
 	cmd := rule.Command().
 		BuiltTool("lint-project-xml").
@@ -262,11 +263,11 @@ func (l *linter) writeLintProjectXML(ctx android.ModuleContext, rule *android.Ru
 		cmd.Flag("--test")
 	}
 	if l.manifest != nil {
-		cmd.FlagWithArg("--manifest ", l.manifest.String())
+		cmd.FlagWithArg("--manifest ", cmd.PathForInput(l.manifest))
 		trackInputDependency(l.manifest)
 	}
 	if l.mergedManifest != nil {
-		cmd.FlagWithArg("--merged_manifest ", l.mergedManifest.String())
+		cmd.FlagWithArg("--merged_manifest ", cmd.PathForInput(l.mergedManifest))
 		trackInputDependency(l.mergedManifest)
 	}
 
@@ -279,23 +280,17 @@ func (l *linter) writeLintProjectXML(ctx android.ModuleContext, rule *android.Ru
 	}
 
 	if l.classes != nil {
-		cmd.FlagWithArg("--classes ", l.classes.String())
+		cmd.FlagWithArg("--classes ", cmd.PathForInput(l.classes))
 		trackInputDependency(l.classes)
 	}
 
-	cmd.FlagForEachArg("--classpath ", l.classpath.Strings())
+	cmd.FlagForEachArg("--classpath ", cmd.PathsForInputs(l.classpath))
 	trackInputDependency(l.classpath...)
 
-	cmd.FlagForEachArg("--extra_checks_jar ", l.extraLintCheckJars.Strings())
+	cmd.FlagForEachArg("--extra_checks_jar ", cmd.PathsForInputs(l.extraLintCheckJars))
 	trackInputDependency(l.extraLintCheckJars...)
 
-	if ctx.Config().UseRBE() && ctx.Config().IsEnvTrue("RBE_LINT") &&
-		lintRBEExecStrategy(ctx) != remoteexec.LocalExecStrategy {
-		// TODO(b/181912787): remove these and use "." instead.
-		cmd.FlagWithArg("--root_dir ", "/b/f/w")
-	} else {
-		cmd.FlagWithArg("--root_dir ", "$PWD")
-	}
+	cmd.FlagWithArg("--root_dir ", "$PWD")
 
 	// The cache tag in project.xml is relative to the root dir, or the project.xml file if
 	// the root dir is not set.
@@ -325,7 +320,7 @@ func (l *linter) writeLintProjectXML(ctx android.ModuleContext, rule *android.Ru
 
 // generateManifest adds a command to the rule to write a simple manifest that contains the
 // minSdkVersion and targetSdkVersion for modules (like java_library) that don't have a manifest.
-func (l *linter) generateManifest(ctx android.ModuleContext, rule *android.RuleBuilder) android.Path {
+func (l *linter) generateManifest(ctx android.ModuleContext, rule *android.RuleBuilder) android.WritablePath {
 	manifestPath := android.PathForModuleOut(ctx, "lint", "AndroidManifest.xml")
 
 	rule.Command().Text("(").
@@ -356,18 +351,36 @@ func (l *linter) lint(ctx android.ModuleContext) {
 		}
 	}
 
-	rule := android.NewRuleBuilder(pctx, ctx)
+	rule := android.NewRuleBuilder(pctx, ctx).
+		Sbox(android.PathForModuleOut(ctx, "lint"),
+			android.PathForModuleOut(ctx, "lint.sbox.textproto")).
+		SandboxInputs()
+
+	if ctx.Config().UseRBE() && ctx.Config().IsEnvTrue("RBE_LINT") {
+		pool := ctx.Config().GetenvWithDefault("RBE_LINT_POOL", "java16")
+		rule.Remoteable(android.RemoteRuleSupports{RBE: true})
+		rule.Rewrapper(&remoteexec.REParams{
+			Labels:          map[string]string{"type": "tool", "name": "lint"},
+			ExecStrategy:    lintRBEExecStrategy(ctx),
+			ToolchainInputs: []string{config.JavaCmd(ctx).String()},
+			EnvironmentVariables: []string{
+				"LANG",
+			},
+			Platform: map[string]string{remoteexec.PoolKey: pool},
+		})
+	}
 
 	if l.manifest == nil {
 		manifest := l.generateManifest(ctx, rule)
 		l.manifest = manifest
+		rule.Temporary(manifest)
 	}
 
 	lintPaths := l.writeLintProjectXML(ctx, rule)
 
-	html := android.PathForModuleOut(ctx, "lint-report.html")
-	text := android.PathForModuleOut(ctx, "lint-report.txt")
-	xml := android.PathForModuleOut(ctx, "lint-report.xml")
+	html := android.PathForModuleOut(ctx, "lint", "lint-report.html")
+	text := android.PathForModuleOut(ctx, "lint", "lint-report.txt")
+	xml := android.PathForModuleOut(ctx, "lint", "lint-report.xml")
 
 	depSetsBuilder := NewLintDepSetBuilder().Direct(html, text, xml)
 
@@ -397,43 +410,7 @@ func (l *linter) lint(ctx android.ModuleContext) {
 		FlagWithInput("SDK_ANNOTATIONS=", annotationsZipPath).
 		FlagWithInput("LINT_OPTS=-DLINT_API_DATABASE=", apiVersionsXMLPath)
 
-	if ctx.Config().UseRBE() && ctx.Config().IsEnvTrue("RBE_LINT") {
-		pool := ctx.Config().GetenvWithDefault("RBE_LINT_POOL", "java16")
-		// TODO(b/181912787): this should be local fallback once the hack that passes /b/f/w in project.xml
-		// is removed.
-		execStrategy := lintRBEExecStrategy(ctx)
-		labels := map[string]string{"type": "tool", "name": "lint"}
-		rule.Remoteable(android.RemoteRuleSupports{RBE: true})
-		remoteInputs := lintPaths.remoteInputs
-		remoteInputs = append(remoteInputs,
-			lintPaths.projectXML,
-			lintPaths.configXML,
-			lintPaths.homeDir,
-			lintPaths.cacheDir,
-			ctx.Config().HostJavaToolPath(ctx, "lint.jar"),
-			annotationsZipPath,
-			apiVersionsXMLPath,
-		)
-
-		cmd.Text((&remoteexec.REParams{
-			Labels:          labels,
-			ExecStrategy:    execStrategy,
-			ToolchainInputs: []string{config.JavaCmd(ctx).String()},
-			Inputs:          remoteInputs.Strings(),
-			OutputFiles:     android.Paths{html, text, xml}.Strings(),
-			RSPFile:         strings.Join(lintPaths.remoteRSPInputs.Strings(), ","),
-			EnvironmentVariables: []string{
-				"JAVA_OPTS",
-				"ANDROID_SDK_HOME",
-				"SDK_ANNOTATIONS",
-				"LINT_OPTS",
-				"LANG",
-			},
-			Platform: map[string]string{remoteexec.PoolKey: pool},
-		}).NoVarTemplate(ctx.Config().RBEWrapper()))
-	}
-
-	cmd.BuiltTool("lint").
+	cmd.BuiltTool("lint").ImplicitTool(ctx.Config().HostJavaToolPath(ctx, "lint.jar")).
 		Flag("--quiet").
 		FlagWithInput("--project ", lintPaths.projectXML).
 		FlagWithInput("--config ", lintPaths.configXML).
@@ -450,6 +427,9 @@ func (l *linter) lint(ctx android.ModuleContext) {
 		Implicit(apiVersionsXMLPath).
 		Implicits(lintPaths.deps)
 
+	rule.Temporary(lintPaths.projectXML)
+	rule.Temporary(lintPaths.configXML)
+
 	if checkOnly := ctx.Config().Getenv("ANDROID_LINT_CHECK"); checkOnly != "" {
 		cmd.FlagWithArg("--check ", checkOnly)
 	}