[SR-10064] Change swift's cmake to use sandboxed compile commands to catch missing cmake dependencies

[gottesmm]

Previous ID	SR-10064
Radar	rdar://48723199
Original Reporter	@gottesmm
Type	Bug

Attachment: Download

Additional Detail from JIRA

Votes	0
Component/s	Project Infrastructure
Labels	Bug, CMake
Assignee	@shahmishal
Priority	Medium

md5: 80a12190344bbf41e231ea59753cd199

Issue Description:

ChrisB has implemented in LLVM the ability to sand box compile commands. What this does is disable access to the file system except for dependencies explicitly specified by cmake. This ensures that if we have a dependency that was missed, the compile job fails.

My understanding is that it is good enough now for LLVM's build but it does not work for Swift/Clang yet. Helping ChrisB (if needed)/enabling once it works for swift with this would provide large benefit to the project's CI and the project's developer productivity by defining away this problem.

Here is the permalink to the code that does this.

https://github.com/llvm/llvm-project/blob/d15a4154a8b7391941e0592427588b0a1b229e65/llvm/cmake/modules/AddLLVM.cmake#L1706

[swift-ci]

Comment by Chris Bieneman (JIRA)

I've attached some WIP patches to llvm.org/trunk that extend the mechanism to all tablegen generated files. There are still some issues with the dependency debugging mode not properly handling transitive dependencies.

For example, if target A depends on a file, and target B depends on target A, because of how CMake handles dependencies on custom command targets B's compile commands will always run after the header generation, so B shouldn't be sandboxed. Transitive recognition of dependencies doesn't presently work, but it is a solvable problem.