bazel: ignore tool_deps for dependency validation

[keith]

When validating the different deps types and their use_categories, host
/ tool deps don't need to be included since those aren't part of the
built product. We hit this with rules_foreign_cc changes.

Signed-off-by: Keith Smiley keithbsmiley@gmail.com

[lizan]

LGTM but defer to @envoyproxy/dependency-shepherds

[htuch]

LGTM. I know @moderation has some stronger opinions here though.

[moderation]

@keith Not keen on carving some categories of dependencies out of the checks. Feels like a slippery slope. Could a sophisticated adversary somehow introduce problems in the excluded dependencies that then end up impacting the built product?

Here is the Bazel documentation - https://docs.bazel.build/versions/4.0.0/user-manual.html#query

Is this the error you are trying to work around? #17445 (comment)

Is there a way to fix upstream in rules_foreign_cc? Or configure rules_foreign_cc differently? Or change our metadata?

[moderation]

This also works:

diff --git a/bazel/repository_locations.bzl b/bazel/repository_locations.bzl
index 59ad429af..72cf854d4 100644
--- a/bazel/repository_locations.bzl
+++ b/bazel/repository_locations.bzl
@@ -656,7 +656,7 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         strip_prefix = "rules_foreign_cc-{version}",
         urls = ["https://github.com/bazelbuild/rules_foreign_cc/archive/{version}.tar.gz"],
         release_date = "2021-07-22",
-        use_category = ["build"],
+        use_category = ["build", "dataplane_core", "controlplane"],
     ),
     rules_python = dict(
         project_name = "Python rules for Bazel",

[ggreenway]

/wait

[moderation]

With this PR about to be merged can this PR be closed?

https://github.com/envoyproxy/envoy/pull/17445/files#diff-a2ca502474bb8ec5f092176f7ee6d2f11fc395ebb00e1717d6fbad9b16ee8fd8R659

[keith]

Yea I was keeping this open as a placeholder, it might be worth investigating why that connection exists in the non-host parts of the build, but unless it causes more issue I'm not going to look at it for now