External repositories: disallow use of unexported repository rules

Treat repository rules the same way as build rules: they may only be used,
if exported by a Skylark file. It has never been intended to create external
repositories by anonymous rules, and, in fact, for properly recording resolved
information, it is necessary that all repository rules used can be referred
to by an accessible name.

Change-Id: Ib9259d58be66b033721a6f591656c45889f49931
PiperOrigin-RevId: 204872735

1 files changed, 22 insertions, 0 deletions

diff --git a/src/test/shell/bazel/skylark_repository_test.sh b/src/test/shell/bazel/skylark_repository_test.sh
index 61c1e223dc..67cb00a94f 100755
--- a/src/test/shell/bazel/skylark_repository_test.sh
+++ b/src/test/shell/bazel/skylark_repository_test.sh
@@ -1070,6 +1070,28 @@ EOF
   bazel build //external:reg &> $TEST_log || fail "Couldn't build repo"
 }
 
+function test_unexported_rule() {
+  cat > repo.bzl <<'EOF'
+def _trivial_rule_impl(ctx):
+  ctx.file("BUILD","genrule(name='hello', outs=['hello.txt'], cmd=' echo hello world > $@')")
+
+def use_hidden_rule(name=""):
+  repository_rule(
+    implementation = _trivial_rule_impl,
+    attrs = {},
+  )(name=name)
+EOF
+  touch BUILD
+  cat > WORKSPACE <<'EOF'
+load("//:repo.bzl", "use_hidden_rule")
+
+use_hidden_rule(name="foo")
+EOF
+  bazel build @foo//... > "${TEST_log}" 2>&1 && fail "Expected failure" || :
+
+  expect_log 'unexported'
+}
+
 function tear_down() {
   shutdown_server
   if [ -d "${TEST_TMPDIR}/server_dir" ]; then