Merge changes from topics "nested-nsjail", "ro-api-surfaces-dir"

* changes:
  Special-case Soong finder to look in out/api_surfaces
  nsjail support verification should respect BUILD_BROKEN* flag for SrcDir

cmd/soong_build/main.go

@@ -243,6 +243,11 @@ func runApiBp2build(configuration android.Config, ctx *android.Context, extraNin
 	// Exclude all src BUILD files
 	excludes = append(excludes, apiBuildFileExcludes()...)
 
+	// Android.bp files for api surfaces are mounted to out/, but out/ should not be a
+	// dep for api_bp2build.
+	// Otherwise api_bp2build will be run every single time
+	excludes = append(excludes, configuration.OutDir())
+
 	// Create the symlink forest
 	symlinkDeps := bp2build.PlantSymlinkForest(
 		configuration.IsEnvTrue("BP2BUILD_VERBOSE"),

ui/build/config.go

@@ -82,6 +82,7 @@ type configImpl struct {
 	skipSoong       bool
 	skipNinja       bool
 	skipSoongTests  bool
+	searchApiDir    bool // Scan the Android.bp files generated in out/api_surfaces
 
 	// From the product config
 	katiArgs        []string
@@ -738,6 +739,8 @@ func (c *configImpl) parseArgs(ctx Context, args []string) {
 			c.bazelDevMode = true
 		} else if arg == "--bazel-mode-staging" {
 			c.bazelStagingMode = true
+		} else if arg == "--search-api-dir" {
+			c.searchApiDir = true
 		} else if len(arg) > 0 && arg[0] == '-' {
 			parseArgNum := func(def int) int {
 				if len(arg) > 2 {
@@ -904,6 +907,10 @@ func (c *configImpl) SoongOutDir() string {
 	return filepath.Join(c.OutDir(), "soong")
 }
 
+func (c *configImpl) ApiSurfacesOutDir() string {
+	return filepath.Join(c.OutDir(), "api_surfaces")
+}
+
 func (c *configImpl) PrebuiltOS() string {
 	switch runtime.GOOS {
 	case "linux":

ui/build/finder.go

@@ -63,7 +63,7 @@ func NewSourceFinder(ctx Context, config Config) (f *finder.Finder) {
 	// Set up configuration parameters for the Finder cache.
 	cacheParams := finder.CacheParams{
 		WorkingDirectory: dir,
-		RootDirs:         []string{"."},
+		RootDirs:         androidBpSearchDirs(config),
 		FollowSymlinks:   config.environ.IsEnvTrue("ALLOW_BP_UNDER_SYMLINKS"),
 		ExcludeDirs:      []string{".git", ".repo"},
 		PruneFiles:       pruneFiles,
@@ -100,6 +100,15 @@ func NewSourceFinder(ctx Context, config Config) (f *finder.Finder) {
 	return f
 }
 
+func androidBpSearchDirs(config Config) []string {
+	dirs := []string{"."} // always search from root of source tree.
+	if config.searchApiDir {
+		// Search in out/api_surfaces
+		dirs = append(dirs, config.ApiSurfacesOutDir())
+	}
+	return dirs
+}
+
 // Finds the list of Bazel-related files (BUILD, WORKSPACE and Starlark) in the tree.
 func findBazelFiles(entries finder.DirEntries) (dirNames []string, fileNames []string) {
 	matches := []string{}

ui/build/sandbox_config.go

@@ -27,6 +27,15 @@ func (sc *SandboxConfig) SrcDirIsRO() bool {
 	return sc.srcDirIsRO
 }
 
+// Return the mount flag of the source directory in the nsjail command
+func (sc *SandboxConfig) SrcDirMountFlag() string {
+	ret := "-B" // Read-write
+	if sc.SrcDirIsRO() {
+		ret = "-R" // Read-only
+	}
+	return ret
+}
+
 func (sc *SandboxConfig) SetSrcDirRWAllowlist(allowlist []string) {
 	sc.srcDirRWAllowlist = allowlist
 }

ui/build/sandbox_linux.go

@@ -101,7 +101,7 @@ func (c *Cmd) sandboxSupported() bool {
 			// srcDir is /tmp/.* in integration tests, which is a child dir of /tmp
 			// nsjail throws an error if a child dir is mounted before its parent
 			"-B", "/tmp",
-			"-B", sandboxConfig.srcDir,
+			c.config.sandboxConfig.SrcDirMountFlag(), sandboxConfig.srcDir,
 			"-B", sandboxConfig.outDir,
 		}
 
@@ -148,13 +148,6 @@ func (c *Cmd) sandboxSupported() bool {
 func (c *Cmd) wrapSandbox() {
 	wd, _ := os.Getwd()
 
-	var srcDirMountFlag string
-	if c.config.sandboxConfig.SrcDirIsRO() {
-		srcDirMountFlag = "-R"
-	} else {
-		srcDirMountFlag = "-B" //Read-Write
-	}
-
 	sandboxArgs := []string{
 		// The executable to run
 		"-x", c.Path,
@@ -195,7 +188,7 @@ func (c *Cmd) wrapSandbox() {
 		"-B", "/tmp",
 
 		// Mount source
-		srcDirMountFlag, sandboxConfig.srcDir,
+		c.config.sandboxConfig.SrcDirMountFlag(), sandboxConfig.srcDir,
 
 		//Mount out dir as read-write
 		"-B", sandboxConfig.outDir,