[libclang parser] include headers hermetically

MODULE.bazel

@@ -42,9 +42,23 @@ bazel_dep(name = "download_utils", version = "1.2.2")
 bazel_dep(name = "trlc", version = "3.0.0")
 bazel_dep(name = "lobster", version = "1.0.4")
 bazel_dep(name = "rules_distroless", version = "0.8.0")
+
+# The released 0.8.0 only supports the old manifest/lock apt.install() API.
+# apt.sysroot() (needed for the hermetic libclang sysroot below, and for the
+# docs_runtime dependency_set API) is only available on this fork, which is
+# also what eclipse-score-communication2 overrides to (see its
+# third_party/score_tooling/bump_rules_distroless_api.patch, which exists
+# specifically to migrate *this* module's old-API usage to match this fork
+# when score_tooling is a non-root dependency).
+git_override(
+    module_name = "rules_distroless",
+    commit = "2cda8c523a2219593e91dbb044dd30c793d9d68f",
+    remote = "https://github.com/LittleHuba/rules_distroless.git",
+)
+
 bazel_dep(name = "googletest", version = "1.17.0.bcr.2")
 
-bazel_dep(name = "toolchains_llvm", version = "1.6.0", dev_dependency = True)  # Libclang Tooling
+bazel_dep(name = "toolchains_llvm", version = "1.8.0", dev_dependency = True)  # Libclang Tooling
 
 bazel_dep(name = "rules_jvm_external", version = "6.10")  # PlantUML
 
@@ -286,22 +300,75 @@ deb(
 )
 
 ###############################################################################
-# Hermetic doc-tool sysroot (docs_runtime)
+# Hermetic apt packages (docs_runtime sysroot + LLVM toolchain sysroot)
 #
-# Distroless rootfs providing graphviz + fakechroot for hermetic dot execution
-# via //third_party/docs_runtime:dot (exec_in_sysroot).
+# Pinned to the Ubuntu 24.04 (noble) snapshot so the package closure is
+# reproducible. Both dependency sets below share this one sources_list.
 ###############################################################################
 # bsdtar (used by //bazel/rules/exec_in_sysroot to extract sysroot archives).
 bazel_dep(name = "tar.bzl", version = "0.6.0")
 
 apt = use_extension("@rules_distroless//apt:extensions.bzl", "apt")
+apt.sources_list(
+    architectures = ["amd64"],
+    components = [
+        "main",
+        "universe",
+    ],
+    suites = [
+        "noble",
+        "noble-security",
+        "noble-updates",
+    ],
+    types = ["deb"],
+    uris = ["https://snapshot.ubuntu.com/ubuntu/20260401T104001Z"],
+)
+
+# Distroless rootfs providing graphviz + fakechroot for hermetic dot execution
+# via //third_party/docs_runtime:dot (exec_in_sysroot).
 apt.install(
-    name = "docs_runtime",
-    lock = "//third_party/docs_runtime:docs_runtime.lock.json",
-    manifest = "//third_party/docs_runtime:docs_runtime.yaml",
+    dependency_set = "docs_runtime",
     mergedusr = True,
+    packages = [
+        "fakechroot",  # /usr/bin/fakechroot + libfakechroot.so for exec_in_sysroot
+        "graphviz",  # /usr/bin/dot and plugins used by Sphinx + PlantUML
+    ],
+    suites = [
+        "noble",
+        "noble-security",
+        "noble-updates",
+    ],
+)
+
+# Hermetic sysroot for the LLVM toolchain (see cpp/libclang), so that
+# cpp_parser's cc_common-derived flags (and any normal C++ compile using this
+# toolchain) resolve libc/libstdc++ headers from a pinned rootfs instead of the
+# build host, matching eclipse-score-communication2's ubuntu24_04_sysroot setup.
+apt.install(
+    dependency_set = "tooling_sysroot",
+    mergedusr = True,
+    packages = [
+        "libatomic1",  # Non-lock-free atomics support
+        "libc6",  # Core C/POSIX
+        "libc6-dev",  # Core C/POSIX
+        "libgcc-s1",  # Exception unwinding
+        "libstdc++-13-dev",  # C++ standard library headers
+        "libstdc++6",  # C++ standard library runtime
+        "linux-libc-dev",  # Core C/POSIX
+    ],
+    suites = [
+        "noble",
+        "noble-security",
+        "noble-updates",
+    ],
 )
-use_repo(apt, "docs_runtime")
+apt.sysroot(
+    name = "tooling_sysroot_amd64",
+    architecture = "amd64",
+    dependency_set = "tooling_sysroot",
+)
+apt.lock(into = "//:rules_distroless.lock.json")
+use_repo(apt, "docs_runtime", "tooling_sysroot_amd64")
 
 register_toolchains(
     "//bazel/rules/rules_score:sphinx_default_toolchain",
@@ -401,4 +468,9 @@ llvm.toolchain(
     ]},
     llvm_version = "19.1.7",
 )
+llvm.sysroot(
+    name = "llvm_toolchain",
+    label = "@tooling_sysroot_amd64//sysroot",
+    targets = ["linux-x86_64"],
+)
 use_repo(llvm, "llvm_toolchain", "llvm_toolchain_llvm")

bazel/rules/rules_score/docs/integration_guide.rst

@@ -276,11 +276,12 @@ Graphviz / ``dot``
 **Source and packaging**
 
 Graphviz now comes directly from the docs runtime sysroot
-(``@docs_runtime//:flat``), built with ``rules_distroless`` from
-``//third_party/docs_runtime/docs_runtime.yaml``.  The Sphinx action does not
-call ``dot`` directly; it uses ``//third_party/docs_runtime:dot`` — an
-``exec_in_sysroot`` wrapper that unpacks the sysroot archive and runs
-``/usr/bin/dot`` inside it through ``fakechroot``.
+(``@docs_runtime//:flat``), built with ``rules_distroless`` from the
+``apt.install(dependency_set = "docs_runtime", ...)`` tag in ``//MODULE.bazel``.
+The Sphinx action does not call ``dot`` directly; it uses
+``//third_party/docs_runtime:dot`` — an ``exec_in_sysroot`` wrapper that
+unpacks the sysroot archive and runs ``/usr/bin/dot`` inside it through
+``fakechroot``.
 
 **Where the files land (execroot-relative paths)**
 

bazel/rules/rules_score/examples/integrator/MODULE.bazel

@@ -40,6 +40,21 @@ local_path_override(
     path = "../some_other_library",
 )
 
+# score_tooling's own git_override for rules_distroless (needed for
+# apt.sources_list()/apt.sysroot()/dependency_set, used by its hermetic
+# libclang sysroot) is only honored when score_tooling is the root module.
+# Since score_tooling is merely a transitive dependency here, this module
+# must repeat the override, or the registry rules_distroless 0.8.0 (which
+# lacks those tag classes) is used instead and score_tooling's own
+# MODULE.bazel fails to load with "does not have a tag class named
+# sources_list".
+bazel_dep(name = "rules_distroless", version = "0.8.0")
+git_override(
+    module_name = "rules_distroless",
+    commit = "2cda8c523a2219593e91dbb044dd30c793d9d68f",
+    remote = "https://github.com/LittleHuba/rules_distroless.git",
+)
+
 bazel_dep(name = "trlc", version = "3.0.0")
 bazel_dep(name = "googletest", version = "1.17.0.bcr.2")
 bazel_dep(name = "lobster", version = "1.0.4")

bazel/rules/rules_score/examples/integrator/bazel/toolchains/BUILD

@@ -21,8 +21,7 @@ load(
 # ============================================================================
 libclang_toolchain(
     name = "integrator_libclang",
-    cxx_builtin_include = "@llvm_toolchain_llvm//:cxx_builtin_include",
-    extra_config_site = "@llvm_toolchain_llvm//:extra_config_site",
+    cc_toolchain = "@llvm_toolchain//:cc-clang-x86_64-linux",
     libclang = "@llvm_toolchain_llvm//:lib/libclang.so",
 )
 

bazel/rules/rules_score/examples/minimal/MODULE.bazel

@@ -22,6 +22,21 @@ local_path_override(
     path = "../../../../..",
 )
 
+# score_tooling's own git_override for rules_distroless (needed for
+# apt.sources_list()/apt.sysroot()/dependency_set, used by its hermetic
+# libclang sysroot) is only honored when score_tooling is the root module.
+# Since score_tooling is merely a transitive dependency here, this module
+# must repeat the override, or the registry rules_distroless 0.8.0 (which
+# lacks those tag classes) is used instead and score_tooling's own
+# MODULE.bazel fails to load with "does not have a tag class named
+# sources_list".
+bazel_dep(name = "rules_distroless", version = "0.8.0")
+git_override(
+    module_name = "rules_distroless",
+    commit = "2cda8c523a2219593e91dbb044dd30c793d9d68f",
+    remote = "https://github.com/LittleHuba/rules_distroless.git",
+)
+
 bazel_dep(name = "toolchains_llvm", version = "1.6.0", dev_dependency = True)
 
 llvm = use_extension(

bazel/rules/rules_score/examples/minimal/bazel/toolchains/BUILD

@@ -18,8 +18,7 @@ load(
 
 libclang_toolchain(
     name = "minimal_libclang",
-    cxx_builtin_include = "@llvm_toolchain_llvm//:cxx_builtin_include",
-    extra_config_site = "@llvm_toolchain_llvm//:extra_config_site",
+    cc_toolchain = "@llvm_toolchain//:cc-clang-x86_64-linux",
     libclang = "@llvm_toolchain_llvm//:lib/libclang.so",
 )
 

bazel/rules/rules_score/examples/seooc/MODULE.bazel

@@ -29,6 +29,21 @@ local_path_override(
     path = "../some_other_library",
 )
 
+# score_tooling's own git_override for rules_distroless (needed for
+# apt.sources_list()/apt.sysroot()/dependency_set, used by its hermetic
+# libclang sysroot) is only honored when score_tooling is the root module.
+# Since score_tooling is merely a transitive dependency here, this module
+# must repeat the override, or the registry rules_distroless 0.8.0 (which
+# lacks those tag classes) is used instead and score_tooling's own
+# MODULE.bazel fails to load with "does not have a tag class named
+# sources_list".
+bazel_dep(name = "rules_distroless", version = "0.8.0")
+git_override(
+    module_name = "rules_distroless",
+    commit = "2cda8c523a2219593e91dbb044dd30c793d9d68f",
+    remote = "https://github.com/LittleHuba/rules_distroless.git",
+)
+
 # Some other llvm toolchain
 bazel_dep(name = "toolchains_llvm", version = "1.6.0", dev_dependency = True)
 

bazel/rules/rules_score/examples/seooc/bazel/toolchains/BUILD

@@ -21,8 +21,7 @@ load(
 # ============================================================================
 libclang_toolchain(
     name = "seooc_libclang",
-    cxx_builtin_include = "@llvm_toolchain_llvm//:cxx_builtin_include",
-    extra_config_site = "@llvm_toolchain_llvm//:extra_config_site",
+    cc_toolchain = "@llvm_toolchain//:cc-clang-x86_64-linux",
     libclang = "@llvm_toolchain_llvm//:lib/libclang.so",
 )
 

bazel/rules/rules_score/examples/some_other_library/MODULE.bazel

@@ -23,6 +23,21 @@ local_path_override(
     path = "../../../../../",
 )
 
+# score_tooling's own git_override for rules_distroless (needed for
+# apt.sources_list()/apt.sysroot()/dependency_set, used by its hermetic
+# libclang sysroot) is only honored when score_tooling is the root module.
+# Since score_tooling is merely a transitive dependency here, this module
+# must repeat the override, or the registry rules_distroless 0.8.0 (which
+# lacks those tag classes) is used instead and score_tooling's own
+# MODULE.bazel fails to load with "does not have a tag class named
+# sources_list".
+bazel_dep(name = "rules_distroless", version = "0.8.0")
+git_override(
+    module_name = "rules_distroless",
+    commit = "2cda8c523a2219593e91dbb044dd30c793d9d68f",
+    remote = "https://github.com/LittleHuba/rules_distroless.git",
+)
+
 # Some other llvm toolchain
 bazel_dep(name = "toolchains_llvm", version = "1.6.0", dev_dependency = True)
 

bazel/rules/rules_score/examples/some_other_library/bazel/toolchains/BUILD

@@ -21,8 +21,7 @@ load(
 # ============================================================================
 libclang_toolchain(
     name = "some_other_library_libclang",
-    cxx_builtin_include = "@llvm_toolchain_llvm//:cxx_builtin_include",
-    extra_config_site = "@llvm_toolchain_llvm//:extra_config_site",
+    cc_toolchain = "@llvm_toolchain//:cc-clang-x86_64-linux",
     libclang = "@llvm_toolchain_llvm//:lib/libclang.so",
 )
 

bazel/rules/rules_score/private/unit.bzl

@@ -21,7 +21,6 @@ software element with associated design, implementation, and tests.
 
 load("@bazel_skylib//rules:common_settings.bzl", "BuildSettingInfo")
 load("@lobster//:lobster.bzl", "subrule_gtest_report")
-load("@rules_cc//cc:find_cc_toolchain.bzl", "use_cc_toolchain")
 load("@rules_cc//cc/common:cc_info.bzl", "CcInfo")
 load("@rules_rust//rust:defs.bzl", "rust_common")
 load("//bazel/rules/rules_score:providers.bzl", "CcDependencyInfo", "CertifiedScope", "SphinxSourcesInfo", "UnitDesignInfo", "UnitInfo")
@@ -196,7 +195,7 @@ _unit = rule(
     doc = "Defines a software unit with design, implementation, and tests for S-CORE process compliance",
     subrules = [subrule_gtest_report],
     attrs = _unit_attrs,
-    toolchains = cpp_parser_action_toolchains() + use_cc_toolchain(),
+    toolchains = cpp_parser_action_toolchains(),
     fragments = ["cpp"],
 )
 

bazel/rules/rules_score/test/BUILD

@@ -131,8 +131,7 @@ score_sphinx_toolchain(
 # ============================================================================
 libclang_toolchain(
     name = "test_libclang",
-    cxx_builtin_include = "@llvm_toolchain_llvm//:cxx_builtin_include",
-    extra_config_site = "@llvm_toolchain_llvm//:extra_config_site",
+    cc_toolchain = "@llvm_toolchain//:cc-clang-x86_64-linux",
     libclang = "@llvm_toolchain_llvm//:lib/libclang.so",
 )
 

bazel/rules/rules_score/test/MODULE.bazel

@@ -73,6 +73,21 @@ local_path_override(
     path = "../../../..",
 )
 
+# score_tooling's own git_override for rules_distroless (needed for
+# apt.sources_list()/apt.sysroot()/dependency_set, used by its hermetic
+# libclang sysroot) is only honored when score_tooling is the root module.
+# Since score_tooling is merely a transitive dependency here, this module
+# must repeat the override, or the registry rules_distroless 0.8.0 (which
+# lacks those tag classes) is used instead and score_tooling's own
+# MODULE.bazel fails to load with "does not have a tag class named
+# sources_list".
+bazel_dep(name = "rules_distroless", version = "0.8.0")
+git_override(
+    module_name = "rules_distroless",
+    commit = "2cda8c523a2219593e91dbb044dd30c793d9d68f",
+    remote = "https://github.com/LittleHuba/rules_distroless.git",
+)
+
 register_toolchains(
     "//:score_toolchain",
 )

cpp/libclang/BUILD

@@ -42,8 +42,7 @@ toolchain_type(
 # inherited by repositories that depend on score_tooling.
 libclang_toolchain(
     name = "score_tooling_libclang",
-    cxx_builtin_include = "@llvm_toolchain_llvm//:cxx_builtin_include",
-    extra_config_site = "@llvm_toolchain_llvm//:extra_config_site",
+    cc_toolchain = "@llvm_toolchain//:cc-clang-x86_64-linux",
     libclang = "@llvm_toolchain_llvm//:lib/libclang.so",
     visibility = ["//visibility:public"],
 )