Add @CompileTimeConstant annotations to CustomCommandLine.

This enforces certain memory-efficient patterns. For deliberate use of dynamic strings, explicitly named overloads are introduced, with javadoc that guides the programmer into making the right choice.

This CL is a memory no-op on benchmarks, but it tries to prevent backslide by making sure programmers make conscious choices when they construct their command lines.

RELNOTES: None
PiperOrigin-RevId: 165185997

26 files changed, 187 insertions, 127 deletions

diff --git a/src/main/java/com/google/devtools/build/lib/analysis/actions/CustomCommandLine.java b/src/main/java/com/google/devtools/build/lib/analysis/actions/CustomCommandLine.java
index 9ef6545700..67e3811d7c 100644
--- a/src/main/java/com/google/devtools/build/lib/analysis/actions/CustomCommandLine.java
+++ b/src/main/java/com/google/devtools/build/lib/analysis/actions/CustomCommandLine.java
@@ -30,6 +30,7 @@ import com.google.devtools.build.lib.collect.nestedset.NestedSet;
 import com.google.devtools.build.lib.concurrent.BlazeInterners;
 import com.google.devtools.build.lib.concurrent.ThreadSafety.Immutable;
 import com.google.devtools.build.lib.util.Preconditions;
+import com.google.errorprone.annotations.CompileTimeConstant;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
@@ -217,14 +218,14 @@ public final class CustomCommandLine extends CommandLine {
       }
 
       /** Each argument is formatted via {@link String#format}. */
-      public Builder<T> formatEach(String formatEach) {
+      public Builder<T> formatEach(@CompileTimeConstant String formatEach) {
         Preconditions.checkNotNull(formatEach);
         this.formatEach = formatEach;
         return this;
       }
 
       /** Each argument is prepended by the beforeEach param. */
-      public Builder<T> beforeEach(String beforeEach) {
+      public Builder<T> beforeEach(@CompileTimeConstant String beforeEach) {
         Preconditions.checkNotNull(beforeEach);
         this.beforeEach = beforeEach;
         return this;
@@ -238,7 +239,19 @@ public final class CustomCommandLine extends CommandLine {
       }
 
       /** Once all arguments have been evaluated, they are joined with this delimiter */
-      public Builder<T> joinWith(String delimiter) {
+      public Builder<T> joinWith(@CompileTimeConstant String delimiter) {
+        Preconditions.checkNotNull(delimiter);
+        this.joinWith = delimiter;
+        return this;
+      }
+
+      /**
+       * Once all arguments have been evaluated, they are joined with this delimiter
+       *
+       * <p>Prefer use of {@link Builder#joinWith} to this method, as it will be more memory
+       * efficient.
+       */
+      public Builder joinWithDynamicString(String delimiter) {
         Preconditions.checkNotNull(delimiter);
         this.joinWith = delimiter;
         return this;
@@ -445,8 +458,40 @@ public final class CustomCommandLine extends CommandLine {
       return this;
     }
 
+    /**
+     * Adds a constant-value string.
+     *
+     * <p>Prefer this over its dynamic cousin, as using static strings saves memory.
+     */
+    public Builder add(@CompileTimeConstant String value) {
+      if (value != null) {
+        arguments.add(value);
+      }
+      return this;
+    }
+
+    /**
+     * Adds a dynamically calculated string.
+     *
+     * <p>Consider whether using another method could be more efficient. For instance, rather than
+     * calling this method with an Artifact's exec path, just add the artifact itself. It will
+     * lazily get converted to its exec path. Same with labels, path fragments, and many other
+     * objects.
+     *
+     * <p>If you are joining some list into a single argument, consider using {@link VectorArg}.
+     *
+     * <p>If you are formatting a string, consider using {@link Builder#addFormatted(String,
+     * Object...)}.
+     *
+     * <p>There are many other ways you can try to avoid calling this. In general, try to use
+     * constants or objects that are already on the heap elsewhere.
+     */
+    public Builder addDynamicString(@Nullable String value) {
+      return add((Object) value);
+    }
+
     /** Adds the arg and the passed value if the value is non-null. */
-    public Builder add(String arg, @Nullable Object value) {
+    public Builder add(@CompileTimeConstant String arg, @Nullable Object value) {
       Preconditions.checkNotNull(arg);
       if (value != null) {
         arguments.add(arg);
@@ -476,7 +521,7 @@ public final class CustomCommandLine extends CommandLine {
      *
      * <p>If values is empty, the arg isn't added.
      */
-    public Builder add(String arg, @Nullable ImmutableCollection<?> values) {
+    public Builder add(@CompileTimeConstant String arg, @Nullable ImmutableCollection<?> values) {
       Preconditions.checkNotNull(arg);
       if (values != null && !values.isEmpty()) {
         arguments.add(arg);
@@ -490,7 +535,7 @@ public final class CustomCommandLine extends CommandLine {
      *
      * <p>If values is empty, the arg isn't added.
      */
-    public Builder add(String arg, @Nullable NestedSet<?> values) {
+    public Builder add(@CompileTimeConstant String arg, @Nullable NestedSet<?> values) {
       Preconditions.checkNotNull(arg);
       if (values != null && !values.isEmpty()) {
         arguments.add(arg);
@@ -518,7 +563,7 @@ public final class CustomCommandLine extends CommandLine {
      *
      * <p>If values is empty, the arg isn't added.
      */
-    public Builder add(String arg, VectorArg.Builder<?> vectorArg) {
+    public Builder add(@CompileTimeConstant String arg, VectorArg.Builder<?> vectorArg) {
       Preconditions.checkNotNull(arg);
       if (!vectorArg.isEmpty) {
         arguments.add(arg);
@@ -542,14 +587,38 @@ public final class CustomCommandLine extends CommandLine {
     }
 
     /** Calls {@link String#format} at command line expansion time. */
-    public Builder addFormatted(String formatStr, Object... args) {
+    public Builder addFormatted(@CompileTimeConstant String formatStr, Object... args) {
+      Preconditions.checkNotNull(formatStr);
+      FormatArg.push(arguments, formatStr, args);
+      return this;
+    }
+
+    /**
+     * Calls {@link String#format} at command line expansion time.
+     *
+     * <p>Prefer {@link Builder#addFormatted} instead, as it will be more memory efficient.
+     */
+    public Builder addFormattedWithDynamicFormatStr(String formatStr, Object... args) {
       Preconditions.checkNotNull(formatStr);
       FormatArg.push(arguments, formatStr, args);
       return this;
     }
 
     /** Cancatenates the passed prefix string and the object's string representation. */
-    public Builder addWithPrefix(String prefix, @Nullable Object arg) {
+    public Builder addWithPrefix(@CompileTimeConstant String prefix, @Nullable Object arg) {
+      Preconditions.checkNotNull(prefix);
+      if (arg != null) {
+        PrefixArg.push(arguments, prefix, arg);
+      }
+      return this;
+    }
+
+    /**
+     * Cancatenates the passed prefix string and the object's string representation.
+     *
+     * <p>Prefer {@link Builder#addWithPrefix}, as it will be more memory efficient.
+     */
+    public Builder addWithDynamicPrefix(String prefix, @Nullable Object arg) {
       Preconditions.checkNotNull(prefix);
       if (arg != null) {
         PrefixArg.push(arguments, prefix, arg);
diff --git a/src/main/java/com/google/devtools/build/lib/analysis/actions/ParamFileHelper.java b/src/main/java/com/google/devtools/build/lib/analysis/actions/ParamFileHelper.java
index 8224804091..a1bb0611e6 100644
--- a/src/main/java/com/google/devtools/build/lib/analysis/actions/ParamFileHelper.java
+++ b/src/main/java/com/google/devtools/build/lib/analysis/actions/ParamFileHelper.java
@@ -88,7 +88,7 @@ public final class ParamFileHelper {
       ImmutableList<String> executableArgs, ParamFileInfo paramFileInfo, Artifact parameterFile) {
     return CustomCommandLine.builder()
         .add(executableArgs)
-        .addWithPrefix(paramFileInfo.getFlag(), parameterFile)
+        .addWithDynamicPrefix(paramFileInfo.getFlag(), parameterFile)
         .build();
   }
 
diff --git a/src/main/java/com/google/devtools/build/lib/analysis/actions/SpawnAction.java b/src/main/java/com/google/devtools/build/lib/analysis/actions/SpawnAction.java
index 94066c76e2..a391dd653b 100644
--- a/src/main/java/com/google/devtools/build/lib/analysis/actions/SpawnAction.java
+++ b/src/main/java/com/google/devtools/build/lib/analysis/actions/SpawnAction.java
@@ -1049,7 +1049,7 @@ public class SpawnAction extends AbstractAction implements ExecutionInfoSpecifie
      */
     public Builder addArgument(String argument) {
       Preconditions.checkState(commandLine == null);
-      commandLineBuilder.add(argument);
+      commandLineBuilder.addDynamicString(argument);
       return this;
     }
 
diff --git a/src/main/java/com/google/devtools/build/lib/bazel/rules/python/BazelPythonSemantics.java b/src/main/java/com/google/devtools/build/lib/bazel/rules/python/BazelPythonSemantics.java
index 468a71c114..f0846a96f4 100644
--- a/src/main/java/com/google/devtools/build/lib/bazel/rules/python/BazelPythonSemantics.java
+++ b/src/main/java/com/google/devtools/build/lib/bazel/rules/python/BazelPythonSemantics.java
@@ -253,20 +253,20 @@ public class BazelPythonSemantics implements PythonSemantics {
     PathFragment workspaceName = runfilesSupport.getWorkspaceName();
     CustomCommandLine.Builder argv = new CustomCommandLine.Builder();
     inputsBuilder.add(templateMain);
-    argv.add("__main__.py=" + templateMain.getExecPathString());
+    argv.addWithPrefix("__main__.py=", templateMain);
 
     // Creating __init__.py files under each directory
     argv.add("__init__.py=");
-    argv.add(getZipRunfilesPath("__init__.py", workspaceName) + "=");
+    argv.addDynamicString(getZipRunfilesPath("__init__.py", workspaceName) + "=");
     for (String path : runfilesSupport.getRunfiles().getEmptyFilenames()) {
-      argv.add(getZipRunfilesPath(path, workspaceName) + "=");
+      argv.addDynamicString(getZipRunfilesPath(path, workspaceName) + "=");
     }
 
     // Read each runfile from execute path, add them into zip file at the right runfiles path.
     // Filter the executable file, cause we are building it.
     for (Artifact artifact : runfilesSupport.getRunfilesArtifactsWithoutMiddlemen()) {
       if (!artifact.equals(executable)) {
-        argv.add(
+        argv.addDynamicString(
             getZipRunfilesPath(artifact.getRunfilesPath(), workspaceName)
                 + "="
                 + artifact.getExecPathString());
diff --git a/src/main/java/com/google/devtools/build/lib/rules/android/AndroidResourceMergingActionBuilder.java b/src/main/java/com/google/devtools/build/lib/rules/android/AndroidResourceMergingActionBuilder.java
index ddf4e42bb0..780acde3b6 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/android/AndroidResourceMergingActionBuilder.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/android/AndroidResourceMergingActionBuilder.java
@@ -137,7 +137,7 @@ public class AndroidResourceMergingActionBuilder {
     inputs.add(sdk.getAndroidJar());
 
     Preconditions.checkNotNull(primary);
-    builder.add("--primaryData").add(RESOURCE_CONTAINER_TO_ARG.apply(primary));
+    builder.add("--primaryData", RESOURCE_CONTAINER_TO_ARG.apply(primary));
     inputs.addTransitive(RESOURCE_CONTAINER_TO_ARTIFACTS.apply(primary));
 
     Preconditions.checkNotNull(primary.getManifest());
@@ -168,7 +168,7 @@ public class AndroidResourceMergingActionBuilder {
     if (!Strings.isNullOrEmpty(customJavaPackage)) {
       // Sets an alternative java package for the generated R.java
       // this allows android rules to generate resources outside of the java{,tests} tree.
-      builder.add("--packageForR").add(customJavaPackage);
+      builder.add("--packageForR", customJavaPackage);
     }
 
     // TODO(corysmith): Move the data binding parsing out of the merging pass to enable faster
diff --git a/src/main/java/com/google/devtools/build/lib/rules/android/AndroidResourceParsingActionBuilder.java b/src/main/java/com/google/devtools/build/lib/rules/android/AndroidResourceParsingActionBuilder.java
index 99f4b90a70..a68c2610e3 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/android/AndroidResourceParsingActionBuilder.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/android/AndroidResourceParsingActionBuilder.java
@@ -136,7 +136,7 @@ public class AndroidResourceParsingActionBuilder {
 
     Preconditions.checkNotNull(primary);
     String resourceDirectories = RESOURCE_CONTAINER_TO_ARG.apply(primary);
-    builder.add("--primaryData").add(resourceDirectories);
+    builder.add("--primaryData", resourceDirectories);
     inputs.addTransitive(RESOURCE_CONTAINER_TO_ARTIFACTS.apply(primary));
 
     Preconditions.checkNotNull(output);
@@ -177,8 +177,7 @@ public class AndroidResourceParsingActionBuilder {
           .add("--tool")
           .add("COMPILE_LIBRARY_RESOURCES")
           .add("--")
-          .add("--resources")
-          .add(resourceDirectories)
+          .add("--resources", resourceDirectories)
           .add("--output", compiledSymbols);
       outs.add(compiledSymbols);
 
@@ -187,7 +186,7 @@ public class AndroidResourceParsingActionBuilder {
         flatFileBuilder.add("--manifest", resourceContainer.getManifest());
         inputs.add(resourceContainer.getManifest());
         if (!Strings.isNullOrEmpty(resourceContainer.getJavaPackage())) {
-          flatFileBuilder.add("--packagePath").add(resourceContainer.getJavaPackage());
+          flatFileBuilder.add("--packagePath", resourceContainer.getJavaPackage());
         }
         builder.add("--dataBindingInfoOut", dataBindingInfoZip);
         outs.add(dataBindingInfoZip);
diff --git a/src/main/java/com/google/devtools/build/lib/rules/android/AndroidResourceValidatorActionBuilder.java b/src/main/java/com/google/devtools/build/lib/rules/android/AndroidResourceValidatorActionBuilder.java
index 3680f10414..37a42e1584 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/android/AndroidResourceValidatorActionBuilder.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/android/AndroidResourceValidatorActionBuilder.java
@@ -13,7 +13,6 @@
 // limitations under the License.
 package com.google.devtools.build.lib.rules.android;
 
-import com.google.common.base.Joiner;
 import com.google.common.base.Preconditions;
 import com.google.common.base.Strings;
 import com.google.common.collect.FluentIterable;
@@ -24,6 +23,7 @@ import com.google.devtools.build.lib.analysis.RuleConfiguredTarget.Mode;
 import com.google.devtools.build.lib.analysis.RuleContext;
 import com.google.devtools.build.lib.analysis.actions.ActionConstructionContext;
 import com.google.devtools.build.lib.analysis.actions.CustomCommandLine;
+import com.google.devtools.build.lib.analysis.actions.CustomCommandLine.VectorArg;
 import com.google.devtools.build.lib.analysis.actions.SpawnAction;
 import java.util.ArrayList;
 import java.util.List;
@@ -159,7 +159,9 @@ public class AndroidResourceValidatorActionBuilder {
 
     builder
         .add("--libraries")
-        .add(libraries.join(Joiner.on(context.getConfiguration().getHostPathSeparator())));
+        .add(
+            VectorArg.of(ImmutableList.copyOf(libraries))
+                .joinWithDynamicString(context.getConfiguration().getHostPathSeparator()));
     inputs.addAll(libraries);
 
     builder.add("--compiled", compiledSymbols);
@@ -171,7 +173,7 @@ public class AndroidResourceValidatorActionBuilder {
     if (!Strings.isNullOrEmpty(customJavaPackage)) {
       // Sets an alternative java package for the generated R.java
       // this allows android rules to generate resources outside of the java{,tests} tree.
-      builder.add("--packageForR").add(customJavaPackage);
+      builder.add("--packageForR", customJavaPackage);
     }
 
     builder.add("--sourceJarOut", aapt2SourceJarOut);
@@ -214,7 +216,7 @@ public class AndroidResourceValidatorActionBuilder {
     builder.add("--tool").add("VALIDATE").add("--");
 
     if (!Strings.isNullOrEmpty(sdk.getBuildToolsVersion())) {
-      builder.add("--buildToolsVersion").add(sdk.getBuildToolsVersion());
+      builder.add("--buildToolsVersion", sdk.getBuildToolsVersion());
     }
 
     builder.add("--aapt", sdk.getAapt().getExecutable());
@@ -241,7 +243,7 @@ public class AndroidResourceValidatorActionBuilder {
     if (!Strings.isNullOrEmpty(customJavaPackage)) {
       // Sets an alternative java package for the generated R.java
       // this allows android rules to generate resources outside of the java{,tests} tree.
-      builder.add("--packageForR").add(customJavaPackage);
+      builder.add("--packageForR", customJavaPackage);
     }
     List<Artifact> outs = new ArrayList<>();
     Preconditions.checkNotNull(rTxtOut);
diff --git a/src/main/java/com/google/devtools/build/lib/rules/android/AndroidResourcesProcessorBuilder.java b/src/main/java/com/google/devtools/build/lib/rules/android/AndroidResourcesProcessorBuilder.java
index a76a6da073..87a6d54b84 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/android/AndroidResourcesProcessorBuilder.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/android/AndroidResourcesProcessorBuilder.java
@@ -397,11 +397,11 @@ public class AndroidResourcesProcessorBuilder {
       List<Artifact> outs, NestedSetBuilder<Artifact> inputs, Builder builder) {
 
     // Add data
-    builder.add("--primaryData").add(RESOURCE_CONTAINER_TO_ARG.apply(primary));
+    builder.add("--primaryData", RESOURCE_CONTAINER_TO_ARG.apply(primary));
     inputs.addTransitive(RESOURCE_CONTAINER_TO_ARTIFACTS.apply(primary));
 
     if (!Strings.isNullOrEmpty(sdk.getBuildToolsVersion())) {
-      builder.add("--buildToolsVersion").add(sdk.getBuildToolsVersion());
+      builder.add("--buildToolsVersion", sdk.getBuildToolsVersion());
     }
 
     builder.add("--annotationJar", sdk.getAnnotationsJar());
@@ -452,10 +452,10 @@ public class AndroidResourcesProcessorBuilder {
       outs.add(apkOut);
     }
     if (resourceFilter.hasConfigurationFilters() && !resourceFilter.isPrefiltering()) {
-      builder.add("--resourceConfigs").add(resourceFilter.getConfigurationFilterString());
+      builder.add("--resourceConfigs", resourceFilter.getConfigurationFilterString());
     }
     if (resourceFilter.hasDensities() && !resourceFilter.isPrefiltering()) {
-      builder.add("--densities").add(resourceFilter.getDensityString());
+      builder.add("--densities", resourceFilter.getDensityString());
     }
     ImmutableList<String> filteredResources = resourceFilter.getResourcesToIgnoreInExecution();
     if (!filteredResources.isEmpty()) {
@@ -478,15 +478,15 @@ public class AndroidResourcesProcessorBuilder {
     }
 
     if (versionCode != null) {
-      builder.add("--versionCode").add(versionCode);
+      builder.add("--versionCode", versionCode);
     }
 
     if (versionName != null) {
-      builder.add("--versionName").add(versionName);
+      builder.add("--versionName", versionName);
     }
 
     if (applicationId != null) {
-      builder.add("--applicationId").add(applicationId);
+      builder.add("--applicationId", applicationId);
     }
 
     if (dataBindingInfoZip != null) {
@@ -497,7 +497,7 @@ public class AndroidResourcesProcessorBuilder {
     if (!Strings.isNullOrEmpty(customJavaPackage)) {
       // Sets an alternative java package for the generated R.java
       // this allows android rules to generate resources outside of the java{,tests} tree.
-      builder.add("--packageForR").add(customJavaPackage);
+      builder.add("--packageForR", customJavaPackage);
     }
 
     if (featureOf != null) {
diff --git a/src/main/java/com/google/devtools/build/lib/rules/android/LibraryRGeneratorActionBuilder.java b/src/main/java/com/google/devtools/build/lib/rules/android/LibraryRGeneratorActionBuilder.java
index d5b332d9e2..f361f8a89a 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/android/LibraryRGeneratorActionBuilder.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/android/LibraryRGeneratorActionBuilder.java
@@ -67,7 +67,7 @@ public class LibraryRGeneratorActionBuilder {
     builder.add("--tool").add("GENERATE_LIBRARY_R").add("--");
 
     if (!Strings.isNullOrEmpty(javaPackage)) {
-      builder.add("--packageForR").add(javaPackage);
+      builder.add("--packageForR", javaPackage);
     }
 
     FluentIterable<ResourceContainer> symbolProviders =
diff --git a/src/main/java/com/google/devtools/build/lib/rules/android/ManifestMergerActionBuilder.java b/src/main/java/com/google/devtools/build/lib/rules/android/ManifestMergerActionBuilder.java
index e892ae25e3..b04e63f5d1 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/android/ManifestMergerActionBuilder.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/android/ManifestMergerActionBuilder.java
@@ -104,11 +104,10 @@ public class ManifestMergerActionBuilder {
     inputs.add(manifest);
 
     if (mergeeManifests != null && !mergeeManifests.isEmpty()) {
-      builder
-          .add("--mergeeManifests")
-          .add(
-              mapToDictionaryString(
-                  mergeeManifests, Artifact::getExecPathString, null /* valueConverter */));
+      builder.add(
+          "--mergeeManifests",
+          mapToDictionaryString(
+              mergeeManifests, Artifact::getExecPathString, null /* valueConverter */));
       inputs.addAll(mergeeManifests.keySet());
     }
 
@@ -117,11 +116,11 @@ public class ManifestMergerActionBuilder {
     }
 
     if (manifestValues != null && !manifestValues.isEmpty()) {
-      builder.add("--manifestValues").add(mapToDictionaryString(manifestValues));
+      builder.add("--manifestValues", mapToDictionaryString(manifestValues));
     }
 
     if (customPackage != null && !customPackage.isEmpty()) {
-      builder.add("--customPackage").add(customPackage);
+      builder.add("--customPackage", customPackage);
     }
 
     builder.add("--manifestOutput", manifestOutput);
diff --git a/src/main/java/com/google/devtools/build/lib/rules/android/RClassGeneratorActionBuilder.java b/src/main/java/com/google/devtools/build/lib/rules/android/RClassGeneratorActionBuilder.java
index 89386d6d0c..9eba56e56b 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/android/RClassGeneratorActionBuilder.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/android/RClassGeneratorActionBuilder.java
@@ -97,7 +97,7 @@ public class RClassGeneratorActionBuilder {
       inputs.add(primary.getManifest());
     }
     if (!Strings.isNullOrEmpty(primary.getJavaPackage())) {
-      builder.add("--packageForR").add(primary.getJavaPackage());
+      builder.add("--packageForR", primary.getJavaPackage());
     }
     if (dependencies != null) {
       // TODO(corysmith): Remove NestedSet as we are already flattening it.
diff --git a/src/main/java/com/google/devtools/build/lib/rules/android/ResourceContainerConverter.java b/src/main/java/com/google/devtools/build/lib/rules/android/ResourceContainerConverter.java
index d3d017a931..760e2f3880 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/android/ResourceContainerConverter.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/android/ResourceContainerConverter.java
@@ -244,14 +244,14 @@ public class ResourceContainerConverter {
         cmdBuilder.add(
             "--data",
             VectorArg.of(dependencies.getTransitiveResources())
-                .joinWith(toArg.listSeparator())
+                .joinWithDynamicString(toArg.listSeparator())
                 .mapEach(toArg));
       }
       if (!dependencies.getDirectResources().isEmpty()) {
         cmdBuilder.add(
             "--directData",
             VectorArg.of(dependencies.getDirectResources())
-                .joinWith(toArg.listSeparator())
+                .joinWithDynamicString(toArg.listSeparator())
                 .mapEach(toArg));
       }
       // This flattens the nested set. Since each ResourceContainer needs to be transformed into
diff --git a/src/main/java/com/google/devtools/build/lib/rules/android/ResourceShrinkerActionBuilder.java b/src/main/java/com/google/devtools/build/lib/rules/android/ResourceShrinkerActionBuilder.java
index dd9fea6ea3..e2af72db31 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/android/ResourceShrinkerActionBuilder.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/android/ResourceShrinkerActionBuilder.java
@@ -183,7 +183,7 @@ public class ResourceShrinkerActionBuilder {
       commandLine.add("--debug");
     }
     if (resourceFilter.hasConfigurationFilters()) {
-      commandLine.add("--resourceConfigs").add(resourceFilter.getConfigurationFilterString());
+      commandLine.add("--resourceConfigs", resourceFilter.getConfigurationFilterString());
     }
 
     checkNotNull(resourceFilesZip);
diff --git a/src/main/java/com/google/devtools/build/lib/rules/android/RobolectricResourceSymbolsActionBuilder.java b/src/main/java/com/google/devtools/build/lib/rules/android/RobolectricResourceSymbolsActionBuilder.java
index 17cd13bc9b..ce177f4830 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/android/RobolectricResourceSymbolsActionBuilder.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/android/RobolectricResourceSymbolsActionBuilder.java
@@ -89,7 +89,7 @@ public class RobolectricResourceSymbolsActionBuilder {
       builder.add(
           "--data",
           VectorArg.of(dependencies.getResources())
-              .joinWith(RESOURCE_CONTAINER_TO_ARG.listSeparator())
+              .joinWithDynamicString(RESOURCE_CONTAINER_TO_ARG.listSeparator())
               .mapEach(RESOURCE_CONTAINER_TO_ARG));
     }
 
diff --git a/src/main/java/com/google/devtools/build/lib/rules/java/DeployArchiveBuilder.java b/src/main/java/com/google/devtools/build/lib/rules/java/DeployArchiveBuilder.java
index 354cde97bd..025f8babdc 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/java/DeployArchiveBuilder.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/java/DeployArchiveBuilder.java
@@ -176,8 +176,7 @@ public class DeployArchiveBuilder {
     }
     args.add("--normalize");
     if (javaMainClass != null) {
-      args.add("--main_class");
-      args.add(javaMainClass);
+      args.add("--main_class", javaMainClass);
     }
 
     if (!deployManifestLines.isEmpty()) {
@@ -194,8 +193,7 @@ public class DeployArchiveBuilder {
       args.add("--exclude_build_data");
     }
     if (launcher != null) {
-      args.add("--java_launcher");
-      args.add(launcher.getExecPathString());
+      args.add("--java_launcher", launcher);
     }
 
     args.add("--classpath_resources", classpathResources);
diff --git a/src/main/java/com/google/devtools/build/lib/rules/java/JavaCompileAction.java b/src/main/java/com/google/devtools/build/lib/rules/java/JavaCompileAction.java
index 7ded72f2cd..d1ebd1bdd9 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/java/JavaCompileAction.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/java/JavaCompileAction.java
@@ -435,8 +435,8 @@ public final class JavaCompileAction extends SpawnAction {
                               .addAll(instrumentationJars)
                               .add(javaBuilderJar)
                               .build())
-                      .joinWith(pathDelimiter))
-              .add(javaBuilderMainClass);
+                      .joinWithDynamicString(pathDelimiter))
+              .addDynamicString(javaBuilderMainClass);
         } else {
           // If there are no instrumentation jars, use simpler '-jar' option to launch JavaBuilder.
           builder.add("-jar", javaBuilderJar);
@@ -712,8 +712,7 @@ public final class JavaCompileAction extends SpawnAction {
         result.add("--javacopts", ImmutableList.copyOf(javacOpts));
       }
       if (ruleKind != null) {
-        result.add("--rule_kind");
-        result.add(ruleKind);
+        result.add("--rule_kind", ruleKind);
       }
       if (targetLabel != null) {
         result.add("--target_label");
@@ -737,8 +736,7 @@ public final class JavaCompileAction extends SpawnAction {
       // strict_java_deps controls whether the mapping from jars to targets is
       // written out and whether we try to minimize the compile-time classpath.
       if (strictJavaDeps != BuildConfiguration.StrictDepsMode.OFF) {
-        result.add("--strict_java_deps");
-        result.add(strictJavaDeps.toString());
+        result.add("--strict_java_deps", strictJavaDeps.toString());
         result.add(new JarsToTargetsArgv(classpathEntries, directJars));
 
         if (configuration.getFragment(JavaConfiguration.class).getReduceJavaClasspath()
diff --git a/src/main/java/com/google/devtools/build/lib/rules/java/JavaHeaderCompileAction.java b/src/main/java/com/google/devtools/build/lib/rules/java/JavaHeaderCompileAction.java
index 016ad43967..562ce2f559 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/java/JavaHeaderCompileAction.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/java/JavaHeaderCompileAction.java
@@ -534,8 +534,7 @@ public class JavaHeaderCompileAction extends SpawnAction {
       result.add("--javacopts", javacOpts);
 
       if (ruleKind != null) {
-        result.add("--rule_kind");
-        result.add(ruleKind);
+        result.add("--rule_kind", ruleKind);
       }
       if (targetLabel != null) {
         result.add("--target_label");
diff --git a/src/main/java/com/google/devtools/build/lib/rules/objc/AppleStubBinary.java b/src/main/java/com/google/devtools/build/lib/rules/objc/AppleStubBinary.java
index 493f6f5f26..5880a7f280 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/objc/AppleStubBinary.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/objc/AppleStubBinary.java
@@ -155,7 +155,7 @@ public class AppleStubBinary implements RuleConfiguredTargetFactory {
     CustomCommandLine copyCommandLine =
         new Builder()
             .add("/bin/cp")
-            .add(resolveXcenvBasedPath(ruleContext, platform))
+            .addDynamicString(resolveXcenvBasedPath(ruleContext, platform))
             .add(ImmutableList.of(outputBinary))
             .build();
 
diff --git a/src/main/java/com/google/devtools/build/lib/rules/objc/BundleSupport.java b/src/main/java/com/google/devtools/build/lib/rules/objc/BundleSupport.java
index 179095a7bc..d04c630cc1 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/objc/BundleSupport.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/objc/BundleSupport.java
@@ -268,14 +268,13 @@ final class BundleSupport {
     CustomCommandLine.Builder commandLine =
         CustomCommandLine.builder()
             .add(zipOutput.getExecPath())
-            .add(archiveRoot)
+            .addDynamicString(archiveRoot)
             .add("--minimum-deployment-target")
-            .add(bundling.getMinimumOsVersion().toString())
-            .add("--module")
-            .add(ruleContext.getLabel().getName());
+            .add(bundling.getMinimumOsVersion())
+            .add("--module", ruleContext.getLabel().getName());
 
     for (TargetDeviceFamily targetDeviceFamily : targetDeviceFamiliesForResources()) {
-      commandLine.add("--target-device").add(targetDeviceFamily.name().toLowerCase(Locale.US));
+      commandLine.add("--target-device", targetDeviceFamily.name().toLowerCase(Locale.US));
     }
 
     return commandLine.add(storyboardInput.getExecPath()).build();
@@ -294,17 +293,18 @@ final class BundleSupport {
               .addInputs(datamodel.getInputs())
               .setCommandLine(
                   CustomCommandLine.builder()
-                      .add(outputZip.getExecPath())
-                      .add(datamodel.archiveRootForMomczip())
-                      .add("-XD_MOMC_SDKROOT=" + AppleToolchain.sdkDir())
-                      .add("-XD_MOMC_IOS_TARGET_VERSION=" + bundling.getMinimumOsVersion())
+                      .add(outputZip)
+                      .addDynamicString(datamodel.archiveRootForMomczip())
+                      .addDynamicString("-XD_MOMC_SDKROOT=" + AppleToolchain.sdkDir())
+                      .addDynamicString(
+                          "-XD_MOMC_IOS_TARGET_VERSION=" + bundling.getMinimumOsVersion())
                       .add("-MOMC_PLATFORMS")
-                      .add(
+                      .addDynamicString(
                           appleConfiguration
                               .getMultiArchPlatform(PlatformType.IOS)
                               .getLowerCaseNameInPlist())
                       .add("-XD_MOMC_TARGET_VERSION=10.6")
-                      .add(datamodel.getContainer().getSafePathString())
+                      .add(datamodel.getContainer())
                       .build())
               .build(ruleContext));
     }
@@ -437,14 +437,15 @@ final class BundleSupport {
     CustomCommandLine.Builder commandLine =
         CustomCommandLine.builder()
             .add(zipOutput.getExecPath())
-            .add("--platform")
-            .add(appleConfiguration.getMultiArchPlatform(platformType).getLowerCaseNameInPlist())
+            .add(
+                "--platform",
+                appleConfiguration.getMultiArchPlatform(platformType).getLowerCaseNameInPlist())
             .add("--output-partial-info-plist", partialInfoPlist)
             .add("--minimum-deployment-target")
-            .add(bundling.getMinimumOsVersion().toString());
+            .add(bundling.getMinimumOsVersion());
 
     for (TargetDeviceFamily targetDeviceFamily : targetDeviceFamiliesForResources()) {
-      commandLine.add("--target-device").add(targetDeviceFamily.name().toLowerCase(Locale.US));
+      commandLine.add("--target-device", targetDeviceFamily.name().toLowerCase(Locale.US));
     }
 
     return commandLine
diff --git a/src/main/java/com/google/devtools/build/lib/rules/objc/CompilationSupport.java b/src/main/java/com/google/devtools/build/lib/rules/objc/CompilationSupport.java
index e6043f1fc8..edfc4eb343 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/objc/CompilationSupport.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/objc/CompilationSupport.java
@@ -34,7 +34,6 @@ import static java.nio.charset.StandardCharsets.ISO_8859_1;
 import static java.util.stream.Collectors.toCollection;
 
 import com.google.common.annotations.VisibleForTesting;
-import com.google.common.base.Joiner;
 import com.google.common.base.Optional;
 import com.google.common.base.Preconditions;
 import com.google.common.base.Predicate;
@@ -1087,7 +1086,7 @@ public abstract class CompilationSupport {
                   "--archive_source_mapping_files",
                   VectorArg.of(j2ObjcArchiveSourceMappingFiles).joinWith(","))
               .add("--entry_classes")
-              .add(Joiner.on(",").join(entryClasses))
+              .add(VectorArg.of(entryClasses).joinWith(","))
               .build();
 
       ruleContext.registerAction(
@@ -1385,16 +1384,16 @@ public abstract class CompilationSupport {
                     .list());
     CustomCommandLine.Builder cmdLine =
         CustomCommandLine.builder()
-            .add("--arch")
-            .add(appleConfiguration.getSingleArchitecture().toLowerCase())
-            .add("--platform")
-            .add(appleConfiguration.getSingleArchPlatform().getLowerCaseNameInPlist())
-            .add("--sdk_version")
-            .add(XcodeConfig.getSdkVersionForPlatform(
-                ruleContext, appleConfiguration.getSingleArchPlatform())
+            .add("--arch", appleConfiguration.getSingleArchitecture().toLowerCase())
+            .add("--platform", appleConfiguration.getSingleArchPlatform().getLowerCaseNameInPlist())
+            .add(
+                "--sdk_version",
+                XcodeConfig.getSdkVersionForPlatform(
+                        ruleContext, appleConfiguration.getSingleArchPlatform())
                     .toStringWithMinimumComponents(2))
-            .add("--xcode_version")
-            .add(XcodeConfig.getXcodeVersion(ruleContext).toStringWithMinimumComponents(2))
+            .add(
+                "--xcode_version",
+                XcodeConfig.getXcodeVersion(ruleContext).toStringWithMinimumComponents(2))
             .add("--");
     for (ObjcHeaderThinningInfo info : infos) {
       cmdLine.add(
diff --git a/src/main/java/com/google/devtools/build/lib/rules/objc/J2ObjcAspect.java b/src/main/java/com/google/devtools/build/lib/rules/objc/J2ObjcAspect.java
index af346447c2..4bb491d284 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/objc/J2ObjcAspect.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/objc/J2ObjcAspect.java
@@ -479,7 +479,7 @@ public class J2ObjcAspect extends NativeAspectClass implements ConfiguredAspectF
       J2ObjcSource j2ObjcSource) {
     CustomCommandLine.Builder argBuilder = CustomCommandLine.builder();
     PathFragment javaExecutable = JavaCommon.getHostJavaExecutable(ruleContext);
-    argBuilder.add("--java").add(javaExecutable.getPathString());
+    argBuilder.add("--java", javaExecutable.getPathString());
 
     Artifact j2ObjcDeployJar = ruleContext.getPrerequisiteArtifact("$j2objc", Mode.HOST);
     argBuilder.add("--j2objc", j2ObjcDeployJar);
@@ -527,7 +527,7 @@ public class J2ObjcAspect extends NativeAspectClass implements ConfiguredAspectF
     argBuilder.add("--compiled_archive_file_path", compiledLibrary);
 
     Artifact bootclasspathJar = ruleContext.getPrerequisiteArtifact("$jre_emul_jar", Mode.HOST);
-    argBuilder.add("-Xbootclasspath:" + bootclasspathJar.getExecPathString());
+    argBuilder.addFormatted("-Xbootclasspath:%s", bootclasspathJar);
 
     Artifact deadCodeReport = ruleContext.getPrerequisiteArtifact(":dead_code_report", Mode.HOST);
     if (deadCodeReport != null) {
diff --git a/src/main/java/com/google/devtools/build/lib/rules/objc/LegacyCompilationSupport.java b/src/main/java/com/google/devtools/build/lib/rules/objc/LegacyCompilationSupport.java
index 56f171cc34..696cb4a726 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/objc/LegacyCompilationSupport.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/objc/LegacyCompilationSupport.java
@@ -348,8 +348,8 @@ public class LegacyCompilationSupport extends CompilationSupport {
       // TODO(bazel-team): Use -fmodule-map-file when Xcode 6 support is dropped.
       commandLine
           .add("-iquote")
-          .add(moduleMap.get().getArtifact().getExecPath().getParentDirectory().toString())
-          .add("-fmodule-name=" + moduleMap.get().getName());
+          .add(moduleMap.get().getArtifact().getExecPath().getParentDirectory())
+          .addFormatted("-fmodule-name=%s", moduleMap.get().getName());
     }
 
     return commandLine.build();
@@ -502,16 +502,18 @@ public class LegacyCompilationSupport extends CompilationSupport {
       Iterable<Artifact> objFiles,
       Artifact archive) {
     Artifact objList = intermediateArtifacts.archiveObjList();
-    ruleContext.registerAction(ObjcRuleClasses.spawnAppleEnvActionBuilder(
+    ruleContext.registerAction(
+        ObjcRuleClasses.spawnAppleEnvActionBuilder(
                 appleConfiguration, appleConfiguration.getSingleArchPlatform())
             .setMnemonic("ObjcLink")
             .setExecutable(libtool(ruleContext))
-            .setCommandLine(new CustomCommandLine.Builder()
+            .setCommandLine(
+                new CustomCommandLine.Builder()
                     .add("-static")
-                    .add("-filelist").add(objList.getExecPathString())
-                    .add("-arch_only").add(appleConfiguration.getSingleArchitecture())
-                    .add("-syslibroot").add(AppleToolchain.sdkDir())
-                    .add("-o").add(archive.getExecPathString())
+                    .add("-filelist", objList)
+                    .add("-arch_only", appleConfiguration.getSingleArchitecture())
+                    .add("-syslibroot", AppleToolchain.sdkDir())
+                    .add("-o", archive)
                     .build())
             .addInputs(objFiles)
             .addInput(objList)
@@ -531,12 +533,9 @@ public class LegacyCompilationSupport extends CompilationSupport {
             .setCommandLine(
                 new CustomCommandLine.Builder()
                     .add("-static")
-                    .add("-arch_only")
-                    .add(appleConfiguration.getSingleArchitecture())
-                    .add("-syslibroot")
-                    .add(AppleToolchain.sdkDir())
-                    .add("-o")
-                    .add(outputArchive.getExecPathString())
+                    .add("-arch_only", appleConfiguration.getSingleArchitecture())
+                    .add("-syslibroot", AppleToolchain.sdkDir())
+                    .add("-o", outputArchive)
                     .add(ImmutableList.copyOf(inputArtifacts))
                     .build())
             .addInputs(inputArtifacts)
@@ -700,7 +699,7 @@ public class LegacyCompilationSupport extends CompilationSupport {
 
     registerObjFilelistAction(objFiles, inputFileList);
 
-    commandLine.add("-filelist").add(inputFileList.getExecPathString());
+    commandLine.add("-filelist", inputFileList.getExecPathString());
 
     AppleBitcodeMode bitcodeMode = appleConfiguration.getBitcodeMode();
     commandLine.add(bitcodeMode.getCompileAndLinkFlags());
@@ -712,7 +711,7 @@ public class LegacyCompilationSupport extends CompilationSupport {
           .add("-Xlinker")
           .add("-bitcode_symbol_map")
           .add("-Xlinker")
-          .add(bitcodeSymbolMap.get().getExecPathString());
+          .add(bitcodeSymbolMap.get());
     }
 
     commandLine
@@ -750,13 +749,11 @@ public class LegacyCompilationSupport extends CompilationSupport {
     }
 
     for (String linkopt : attributes.linkopts()) {
-      commandLine.add("-Wl," + linkopt);
+      commandLine.addFormatted("-Wl,%s", linkopt);
     }
 
     if (linkmap.isPresent()) {
-      commandLine
-        .add("-Xlinker -map")
-        .add("-Xlinker " + linkmap.get().getExecPath());
+      commandLine.add("-Xlinker -map").add("-Xlinker ", linkmap.get().getExecPath());
     }
 
     // Call to dsymutil for debug symbol generation must happen in the link action.
@@ -769,10 +766,11 @@ public class LegacyCompilationSupport extends CompilationSupport {
           .add("&&")
           .add(xcrunwrapper(ruleContext).getExecutable().getExecPath())
           .add(DSYMUTIL)
-          .add(linkedBinary.getExecPathString())
-          .add("-o " + dsymPath)
-          .add("&& zipped_bundle=${PWD}/" + dsymBundleZip.get().getShellEscapedExecPathString())
-          .add("&& cd " + dsymPath)
+          .add(linkedBinary)
+          .add("-o", dsymPath)
+          .addDynamicString(
+              "&& zipped_bundle=${PWD}/" + dsymBundleZip.get().getShellEscapedExecPathString())
+          .addDynamicString("&& cd " + dsymPath)
           .add("&& /usr/bin/zip -q -r \"${zipped_bundle}\" .");
     }
 
diff --git a/src/main/java/com/google/devtools/build/lib/rules/objc/ProtobufSupport.java b/src/main/java/com/google/devtools/build/lib/rules/objc/ProtobufSupport.java
index 93f0c9a1b9..d7322d0f8e 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/objc/ProtobufSupport.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/objc/ProtobufSupport.java
@@ -470,12 +470,12 @@ final class ProtobufSupport {
   private CustomCommandLine getGenerationCommandLine(Artifact protoInputsFile) {
     return new Builder()
         .add("--input-file-list")
-        .add(protoInputsFile.getExecPathString())
+        .add(protoInputsFile)
         .add("--output-dir")
-        .add(getWorkspaceRelativeOutputDir().getSafePathString())
+        .addDynamicString(getWorkspaceRelativeOutputDir().getSafePathString())
         .add("--force")
         .add("--proto-root-dir")
-        .add(getGenfilesPathString())
+        .addDynamicString(getGenfilesPathString())
         .add("--proto-root-dir")
         .add(".")
         .add(VectorArg.of(portableProtoFilters).beforeEach("--config"))
diff --git a/src/main/java/com/google/devtools/build/lib/rules/objc/ProtocolBuffers2Support.java b/src/main/java/com/google/devtools/build/lib/rules/objc/ProtocolBuffers2Support.java
index 343aa82741..c7c6f8ddee 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/objc/ProtocolBuffers2Support.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/objc/ProtocolBuffers2Support.java
@@ -156,18 +156,16 @@ final class ProtocolBuffers2Support {
   private CustomCommandLine getGenerationCommandLine() {
     CustomCommandLine.Builder commandLineBuilder =
         new CustomCommandLine.Builder()
-            .add(attributes.getProtoCompiler().getExecPathString())
+            .add(attributes.getProtoCompiler())
             .add("--input-file-list")
-            .add(getProtoInputsFile().getExecPathString())
+            .add(getProtoInputsFile())
             .add("--output-dir")
-            .add(getWorkspaceRelativeOutputDir().getSafePathString())
+            .addDynamicString(getWorkspaceRelativeOutputDir().getSafePathString())
             .add("--working-dir")
             .add(".");
 
     if (attributes.getOptionsFile().isPresent()) {
-      commandLineBuilder
-          .add("--compiler-options-path")
-          .add(attributes.getOptionsFile().get().getExecPathString());
+      commandLineBuilder.add("--compiler-options-path").add(attributes.getOptionsFile().get());
     }
 
     if (attributes.usesObjcHeaderNames()) {
diff --git a/src/main/java/com/google/devtools/build/lib/rules/objc/ReleaseBundlingSupport.java b/src/main/java/com/google/devtools/build/lib/rules/objc/ReleaseBundlingSupport.java
index 0f12eba57a..1f2d9da01c 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/objc/ReleaseBundlingSupport.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/objc/ReleaseBundlingSupport.java
@@ -1024,7 +1024,7 @@ public final class ReleaseBundlingSupport {
 
     CustomCommandLine.Builder commandLine = CustomCommandLine.builder();
     if (appleConfiguration.getXcodeToolchain() != null) {
-      commandLine.add("--toolchain").add(appleConfiguration.getXcodeToolchain());
+      commandLine.add("--toolchain", appleConfiguration.getXcodeToolchain());
     }
 
     commandLine
@@ -1033,7 +1033,7 @@ public final class ReleaseBundlingSupport {
         .add("--bundle_path")
         .add("Frameworks")
         .add("--platform")
-        .add(platform.getLowerCaseNameInPlist())
+        .addDynamicString(platform.getLowerCaseNameInPlist())
         .add("--scan-executable", combinedArchBinary);
 
     ruleContext.registerAction(
@@ -1056,16 +1056,16 @@ public final class ReleaseBundlingSupport {
 
     CustomCommandLine.Builder commandLine = CustomCommandLine.builder();
     if (configuration.getXcodeToolchain() != null) {
-      commandLine.add("--toolchain").add(configuration.getXcodeToolchain());
+      commandLine.add("--toolchain", configuration.getXcodeToolchain());
     }
 
     commandLine
         .add("--output_zip_path")
         .add(intermediateArtifacts.swiftSupportZip().getExecPath())
         .add("--bundle_path")
-        .add("SwiftSupport/" + platform.getLowerCaseNameInPlist())
+        .addDynamicString("SwiftSupport/" + platform.getLowerCaseNameInPlist())
         .add("--platform")
-        .add(platform.getLowerCaseNameInPlist())
+        .addDynamicString(platform.getLowerCaseNameInPlist())
         .add("--scan-executable", combinedArchBinary);
 
     ruleContext.registerAction(
diff --git a/src/main/java/com/google/devtools/build/lib/rules/proto/ProtoCompileActionBuilder.java b/src/main/java/com/google/devtools/build/lib/rules/proto/ProtoCompileActionBuilder.java
index 1f93fbf85e..f7e934a1dd 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/proto/ProtoCompileActionBuilder.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/proto/ProtoCompileActionBuilder.java
@@ -283,7 +283,7 @@ public class ProtoCompileActionBuilder {
 
     if (langPluginName == null) {
       if (langParameter != null) {
-        result.add(langParameter);
+        result.addDynamicString(langParameter);
       }
     } else {
       FilesToRunProvider langPluginTarget = getLangPluginTarget();