use sh_toolchain to get a truer path to bash (#4465)

<!-- Thanks for sending a PR! Before submitting:

1. If this is your first PR, please read CONTRIBUTING.md and sign the
CLA
   first. We cannot review code without a signed CLA.
2. Please file an issue *first*. All features and most bug fixes should
have
an associated issue with a design discussed and decided upon. Small bug
   fixes and documentation improvements don't need issues.
3. New features and bug fixes must have tests. Documentation may need to
be updated. If you're unsure what to update, send the PR, and we'll
discuss
   in review.
4. Note that PRs updating dependencies and new Go versions are not
accepted.
   Please file an issue instead.
-->

**What type of PR is this?**

> Uncomment one line below and remove others.
>
> Bug fix

**What does this PR do? Why is it needed?**

Use the `sh_toolchain` to find the path to `bash` instead of bazel.

**Which issues(s) does this PR fix?**

Fixes #4352 

**Other notes for review**

Author: TroyKomodo

go/config/BUILD.bazel

@@ -39,6 +39,12 @@ bool_flag(
     visibility = ["//visibility:public"],
 )
 
+bool_flag(
+    name = "experimental_use_sh_toolchain",
+    build_setting_default = False,
+    visibility = ["//visibility:public"],
+)
+
 string_flag(
     name = "linkmode",
     build_setting_default = LINKMODE_NORMAL,

go/private/rules/BUILD.bazel

@@ -5,7 +5,10 @@ load(
     "TRANSITIONED_GO_SETTING_KEYS",
 )
 
-exports_files(["library.bzl"])
+exports_files([
+    "library.bzl",
+    "binary_wrapper.sh",
+])
 
 [
     string_setting(

go/private/rules/binary.bzl

@@ -12,6 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+load("@bazel_skylib//rules:common_settings.bzl", "BuildSettingInfo")
 load(
     "//go/private:common.bzl",
     "GO_TOOLCHAIN",
@@ -574,26 +575,22 @@ exit /b %GO_EXIT_CODE%
         args.add(out)
         args.add_all(ctx.files.srcs)
 
-        # We do not use -a here as the cache drastically reduces the time spent
-        # on the second go build invocation (roughly 50% faster).
-        ctx.actions.run_shell(
-            # The value of GOCACHE/GOPATH are determined from HOME.
-            # We place them in the execroot to avoid dependency on `mktemp` and because we don't know
-            # a safe scratch space on all systems. Note that HOME must be an absolute path, otherwise the
-            # Go toolchain will write some outputs to the wrong place and the result will be uncacheable.
-            # We include an output path of this action to prevent collisions with anything else,
-            # including differently configured versions of the same target, under an unsandboxed strategy.
-            command = """
-set -eu
-export HOME="$PWD/_go_tool_binary-fake-home-${{1//\\//_}}"
-trap "{go} clean -cache" EXIT;
-{go} build -trimpath -ldflags='-buildid="" {ldflags}' -o "$1" cmd/pack
-shift
-{go} build -trimpath -ldflags='-buildid="" {ldflags}' -o "$@"
-""".format(
-                go = sdk.go.path,
-                ldflags = ctx.attr.ldflags,
-            ),
+        setting = ctx.attr._use_sh_toolchain_for_bootstrap_process_wrapper[BuildSettingInfo].value
+        sh_toolchain = ctx.toolchains["@bazel_tools//tools/sh:toolchain_type"]
+        binary_wrapper = ctx.file._binary_wrapper
+        if setting and sh_toolchain:
+            binary_wrapper = ctx.actions.declare_file(name + "_binary_wrapper.sh")
+            ctx.actions.expand_template(
+                template = ctx.file._binary_wrapper,
+                output = binary_wrapper,
+                is_executable = True,
+                substitutions = {
+                    "#!/usr/bin/env bash": "#!{}".format(sh_toolchain.path),
+                },
+            )
+
+        ctx.actions.run(
+            executable = binary_wrapper,
             arguments = [args],
             tools = [sdk.go],
             env = {
@@ -602,6 +599,8 @@ shift
                 "GO111MODULE": "off",
                 "GOTELEMETRY": "off",
                 "GOENV": "off",
+                "GO_BINARY": sdk.go.path,
+                "LD_FLAGS": ctx.attr.ldflags,
             },
             inputs = depset(
                 ctx.files.srcs,
@@ -634,6 +633,13 @@ go_tool_binary = rule(
             doc = "Raw value to pass to go build via -ldflags without tokenization",
         ),
         "out_pack": attr.output(),
+        "_binary_wrapper": attr.label(
+            allow_single_file = True,
+            default = "//go/private/rules:binary_wrapper.sh",
+        ),
+        "_use_sh_toolchain_for_bootstrap_process_wrapper": attr.label(
+            default = Label("//go/config:experimental_use_sh_toolchain"),
+        ),
     },
     executable = True,
     doc = """Used instead of go_binary for executables used in the toolchain.
@@ -648,6 +654,7 @@ rules_go as well as the `pack` tool provided by the Go SDK in source form
 only as of Go 1.25. Combining both builds into a single action drastically
 reduces the overall build time due to Go's own caching mechanism.
 """,
+    toolchains = [config_common.toolchain_type("@bazel_tools//tools/sh:toolchain_type", mandatory = False)],
 )
 
 def gc_linkopts(ctx):

go/private/rules/binary_wrapper.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+
+set -eu
+
+# The value of GOCACHE/GOPATH are determined from HOME.
+# We place them in the execroot to avoid dependency on `mktemp` and because we don't know
+# a safe scratch space on all systems. Note that HOME must be an absolute path, otherwise the
+# Go toolchain will write some outputs to the wrong place and the result will be uncacheable.
+# We include an output path of this action to prevent collisions with anything else,
+# including differently configured versions of the same target, under an unsandboxed strategy.
+
+export HOME="${PWD}/_go_tool_binary-fake-home-${1//\\//_}"
+trap "${GO_BINARY} clean -cache" EXIT
+
+# We do not use -a here as the cache drastically reduces the time spent
+# on the second go build invocation (roughly 50% faster).
+
+"${GO_BINARY}" build -trimpath -ldflags="-buildid=\"\" ${LD_FLAGS}" -o "$1" cmd/pack
+shift
+
+"${GO_BINARY}" build -trimpath -ldflags="-buildid=\"\" ${LD_FLAGS}" -o "$@"