Support using a Swift file as a build tool plugin executable (#8807)

A Swift file can be executed directly in the shell. Typically the file
begins with a `#/usr/bin/swift` or an equivalent `xcrun` incantation,
and then simply running `swift MyFile.swift` will automatically compile
and execute it.

Build tool plugins often leverage Swift, but to do so they add two
targets, a `.plugin` and an `.executableTarget`. The executable target
builds a binary that the plugin tool then calls during a build.

Often this is more heavyweight than needed. By passing the path to a
Swift file to the `executable` argument of the `.buildCommand` returned
from your build tool plugin, you could bypass the need to create a
separate executable target and just execute the file directly.

However, because SwiftPM executes build tool plugins within a sandbox
the sandbox script needs to be ammended with the clang module cache
temporary directory so that the swift compiler can write the modules it
needs to execute the file.

Ammend the sandbox script to add write permissions to the root tmp
directory that LLVM uses to write clang modules. With this addition you
can now use a .swift file as a build tool plugin executable.

rdar://152874736

Author: plemarquand

Fixtures/Miscellaneous/Plugins/SwiftFilePlugin/Package.swift

@@ -0,0 +1,25 @@
+// swift-tools-version: 6.0
+
+import PackageDescription
+
+let package = Package(
+    name: "SwiftFilePluginFixture",
+    products: [
+        .library(
+            name: "SwiftFilePluginFixture",
+            targets: ["SwiftFilePluginFixture"]
+        ),
+    ],
+    targets: [
+        .target(
+            name: "SwiftFilePluginFixture",
+            plugins: [
+                .plugin(name: "MyCustomBuildTool")
+            ]
+        ),
+        .plugin(
+            name: "MyCustomBuildTool",
+            capability: .buildTool()
+        )
+    ]
+)

Fixtures/Miscellaneous/Plugins/SwiftFilePlugin/Plugins/MyCustomBuildTool/SwiftToolsBuildPlugin.swift

@@ -0,0 +1,16 @@
+import Foundation
+import PackagePlugin
+
+@main
+struct SwiftToolsBuildPlugin: BuildToolPlugin {
+    func createBuildCommands(context: PluginContext, target: Target) async throws -> [Command] {
+        let formatExecutable = context.package.directoryURL.appending(components: "SimpleSwiftScript.swift")
+        return [.buildCommand(
+            displayName: "Run a swift script",
+            executable: formatExecutable,
+            arguments: [],
+            inputFiles: [formatExecutable],
+            outputFiles: []
+        )]
+    }
+}

Fixtures/Miscellaneous/Plugins/SwiftFilePlugin/SimpleSwiftScript.swift

@@ -0,0 +1,3 @@
+#!/usr/bin/env swift
+
+print("Hello, Build Tool Plugin!")

Fixtures/Miscellaneous/Plugins/SwiftFilePlugin/Sources/SwiftFilePluginFixture/SwiftFilePluginFixture.swift

@@ -188,11 +188,16 @@ fileprivate func macOSSandboxProfile(
     }
     // Optionally allow writing to temporary directories (a lot of use of Foundation requires this).
     else if strictness == .writableTemporaryDirectory {
-        // Add `subpath` expressions for the regular and the Foundation temporary directories.
-        for tmpDir in ["/tmp", NSTemporaryDirectory()] {
-            writableDirectoriesExpression += try [
-                "(subpath \(resolveSymlinks(AbsolutePath(validating: tmpDir)).quotedAsSubpathForSandboxProfile))",
-            ]
+        var stableCacheDirectories: [AbsolutePath] = []
+        // Add `subpath` expressions for the regular, Foundation and clang module cache temporary directories.
+        for tmpDir in (["/tmp"] + threadSafeDarwinCacheDirectories.map(\.pathString)) {
+            let resolved = try resolveSymlinks(AbsolutePath(validating: tmpDir))
+            if !stableCacheDirectories.contains(where: { $0.isAncestorOfOrEqual(to: resolved) }) {
+                stableCacheDirectories.append(resolved)
+                writableDirectoriesExpression += [
+                    "(subpath \(resolved.quotedAsSubpathForSandboxProfile))",
+                ]
+            }
         }
     }
 
@@ -217,16 +222,17 @@ fileprivate func macOSSandboxProfile(
     // Emit rules for paths under which writing is allowed, even if they are descendants directories that are otherwise read-only.
     if writableDirectories.count > 0 {
         contents += "(allow file-write*\n"
+        var stableItemReplacementDirectories: [AbsolutePath] = []
         for path in writableDirectories {
             contents += "    (subpath \(try resolveSymlinks(path).quotedAsSubpathForSandboxProfile))\n"
 
             // `itemReplacementDirectories` may return a combination of stable directory paths, and subdirectories which are unique on every call. Avoid including unnecessary subdirectories in the Sandbox profile which may lead to nondeterminism in its construction.
             if let itemReplacementDirectories = try? fileSystem.itemReplacementDirectories(for: path).sorted(by: { $0.pathString.count < $1.pathString.count }) {
-                var stableItemReplacementDirectories: [AbsolutePath] = []
                 for directory in itemReplacementDirectories {
-                    if !stableItemReplacementDirectories.contains(where: { $0.isAncestorOfOrEqual(to: directory) }) {
-                        stableItemReplacementDirectories.append(directory)
-                        contents += "    (subpath \(try resolveSymlinks(directory).quotedAsSubpathForSandboxProfile))\n"
+                    let resolved = try resolveSymlinks(directory)
+                    if !stableItemReplacementDirectories.contains(where: { $0.isAncestorOfOrEqual(to: resolved) }) {
+                        stableItemReplacementDirectories.append(resolved)
+                        contents += "    (subpath \(resolved.quotedAsSubpathForSandboxProfile))\n"
                     }
                 }
             }

Sources/Basics/Sandbox.swift

@@ -381,7 +381,7 @@ public final class PIFBuilder {
                                         self.parameters.disableSandbox ?
                                             nil :
                                             .init(
-                                                strictness: .default,
+                                                strictness: .writableTemporaryDirectory,
                                                 writableDirectories: writableDirectories,
                                                 readOnlyDirectories: buildCommand.inputFiles
                                             )

Sources/SwiftBuildSupport/PIFBuilder.swift

@@ -1206,6 +1206,21 @@ final class PluginTests: XCTestCase {
         }
     }
 
+#if os(macOS)
+    func testBuildToolPluginSwiftFileExecutable() async throws {
+        for buildSystem in ["native", "swiftbuild"] {
+            try await fixture(name: "Miscellaneous/Plugins") { fixturePath in
+                let (stdout, stderr) = try await executeSwiftBuild(fixturePath.appending("SwiftFilePlugin"), configuration: .Debug, extraArgs: ["--build-system", buildSystem, "--verbose"])
+                if buildSystem == "native" {
+                    XCTAssertTrue(stdout.contains("Hello, Build Tool Plugin!"), "stdout:\n\(stdout)")
+                } else {
+                    XCTAssertTrue(stderr.contains("Hello, Build Tool Plugin!"), "stderr:\n\(stderr)")
+                }
+            }
+        }
+    }
+#endif
+
     func testTransitivePluginOnlyDependency() async throws {
         // Only run the test if the environment in which we're running actually supports Swift concurrency (which the plugin APIs require).
         try XCTSkipIf(!UserToolchain.default.supportsSwiftConcurrency(), "skipping because test environment doesn't support concurrency")