Reduce duplicate Android configurations

Macro-internal targets carry `tags = ["manual"]`, so a wildcard pattern
stops requesting them beside the transitioned edges that already reach
them: Bazel's build unit is `(label, configuration)`, and the private
`<name>_apk` was analysed and executed once in the command line's
`fastbuild` and again at `opt` under the `_flutter_apk` wrapper. One
`_internal_tags`/`_internal_kwargs` pair owns the tagging, including the
debug-only manifest library, which takes no kwargs of its own.

The bundle guard now runs in the configuration the APK ships: the same
release-compilation-mode transition as the wrapper, Java/native
contributions through rules_android's `android_split_transition`, and
the asset contribution left unsplit as `android_binary.assets` is. It
checks every split rather than the first, emitting one
`<name>.<platform>.checked` marker per configured platform, so a build
naming two `--android_platforms` has both of its shipped configurations
verified.

`tests/consumer`'s lockfile records the extension digest the example
lockfiles already carried; that module's CI step does not pass
`--lockfile_mode=error`, which is why it stayed stale.

Author: Sameri11

tests/consumer/MODULE.bazel.lock

@@ -25,6 +25,17 @@ load(
     "ArtProfileInfo",
     "DataBindingV2Info",
 )
+
+# Not re-exported by rules_android's `rules/rules.bzl`, but its own file is
+# `visibility(PROJECT_VISIBILITY)` with `PROJECT_VISIBILITY = "public"`, so the
+# load is legal on the pinned 0.7.3. Its sibling `android_transition` -- the 1:1
+# one, documented for exactly this purpose -- is unusable here: it returns
+# `None` when `--android_platforms` is unset, which is this repository's default,
+# so it would leave the check in the plain configuration the APK does not use.
+# The split keys are `platform.name` (`rules/android_split_transition.bzl`,
+# `_handle_android_platforms`); an upgrade that renames the file breaks this
+# `load` loudly, which is the intended failure mode.
+load("@rules_android//rules:android_split_transition.bzl", "android_split_transition")
 load(
     "@rules_android//rules:rules.bzl",
     "ApkInfo",
@@ -428,15 +439,14 @@ def _contributions_for(mode):
 def _libraries_required(mode):
     return ["engine"] if mode == "debug" else ["aot_library", "engine"]
 
-def _flutter_bundle_check_impl(ctx):
-    marker = ctx.actions.declare_file(ctx.label.name + ".checked")
-
-    check_abis(ctx.attr.abis, str(ctx.label))
-    mode = ctx.attr._mode[BuildSettingInfo].value
-    expected = _contributions_for(mode)
+def _check_split(ctx, mode, expected, deps, marker):
+    """Checks one configured slice of the bundle, and writes its marker.
 
+    `deps` is one split of the Java/native contributions plus the assets
+    contribution, which `android_binary` keeps in its own target configuration.
+    """
     by_kind = {}
-    for dep in ctx.attr.contributions:
+    for dep in deps:
         info = dep[FlutterBundleContributionInfo]
         if info.kind in by_kind:
             fail("Two contributions declare kind '{}'.".format(info.kind))
@@ -533,10 +543,57 @@ def _flutter_bundle_check_impl(ctx):
         progress_message = "Checking bundle contributions %{label}",
     )
 
-    return [DefaultInfo(files = depset([marker]))]
+def _flutter_bundle_check_impl(ctx):
+    check_abis(ctx.attr.abis, str(ctx.label))
+    mode = ctx.attr._mode[BuildSettingInfo].value
+    expected = _contributions_for(mode)
+
+    # One marker per split, because `android_binary` packages one per split:
+    # `--android_platforms` naming two platforms ships both, so both are
+    # checked. Unset -- this repository's default -- is a single split keyed by
+    # the first `--platforms` value.
+    splits = ctx.split_attr.contributions
+    if not splits:
+        # rules_android 0.7.3 always yields at least one branch. If a later
+        # version yields none, an empty DefaultInfo would satisfy the
+        # `build_test` that names this target while checking nothing, so this
+        # guard fails closed instead.
+        fail("flutter_bundle_check: the Android dependency split produced no configuration.")
+
+    markers = []
+    for platform in sorted(splits.keys()):
+        marker = ctx.actions.declare_file("{}.{}.checked".format(ctx.label.name, platform))
+        _check_split(
+            ctx,
+            mode,
+            expected,
+            splits[platform] + [ctx.attr.assets_contribution],
+            marker,
+        )
+        markers.append(marker)
+
+    return [DefaultInfo(files = depset(markers))]
+
+# Pin release builds to `opt`; preserve explicitly non-fastbuild modes.
+def _pin_release_compilation_mode_impl(settings, _attr):
+    mode = settings["//tools/flutter:mode"]
+    compilation_mode = str(settings["//command_line_option:compilation_mode"])
+    if mode == "release" and compilation_mode == "fastbuild":
+        compilation_mode = "opt"
+    return {"//command_line_option:compilation_mode": compilation_mode}
+
+_pin_release_compilation_mode = transition(
+    implementation = _pin_release_compilation_mode_impl,
+    inputs = [
+        "//tools/flutter:mode",
+        "//command_line_option:compilation_mode",
+    ],
+    outputs = ["//command_line_option:compilation_mode"],
+)
 
 flutter_bundle_check = rule(
     implementation = _flutter_bundle_check_impl,
+    cfg = _pin_release_compilation_mode,
     doc = """Fails the build if the bundle is missing a piece for any ABI it declares.
 
 Instantiated by flutter_android_libs, not written by hand. Three checks, in
@@ -547,15 +604,35 @@ code assets the manifest names for that ABI.
 
 The last two are one guard split across phases, because analysis sees only that
 a label was supplied. Handing the arm64 jar to the x86_64 slot resolves, builds,
-and ships an empty ABI.""",
+and ships an empty ABI.
+
+All three run once per `android_binary` dependency split, emitting one
+`<name>.<platform>.checked` marker each: with `--android_platforms` naming two
+platforms the APK packages two configurations, so both are checked.""",
     attrs = {
         "abis": attr.string_list(
             mandatory = True,
             doc = "The ABIs the bundle claims to support. Every native contribution must cover each.",
         ),
         "contributions": attr.label_list(
+            cfg = android_split_transition,
+            providers = [FlutterBundleContributionInfo],
+            mandatory = True,
+            doc = """The Java/native contributions, checked once per split.
+
+`android_binary` reaches its own `deps` through rules_android's
+`android_split_transition`, so this edge takes it too: the check then inspects
+the configured inputs the APK ships instead of a third target-configuration
+copy of them.""",
+        ),
+        "assets_contribution": attr.label(
             providers = [FlutterBundleContributionInfo],
             mandatory = True,
+            doc = """The asset contribution, in this target's own configuration.
+
+Deliberately unsplit: `android_binary.assets` is `cfg = "target"`
+(rules_android `rules/attrs.bzl`), so splitting here would check a bundle the
+APK does not package.""",
         ),
         "_checker": attr.label(
             default = "//tools/flutter:check_native_assets.py",
@@ -649,6 +726,27 @@ def _per_abi(supplied, abis, kind):
         return _plugin_libs(kind, abis)
     return {abi: supplied[abi] for abi in abis if abi in supplied}
 
+# Macro-internal targets are not API. They carry `manual`, so a wildcard
+# pattern stops requesting them beside the transitioned edges that already
+# reach them -- Bazel's build unit is `(label, configuration)`, so an untagged
+# internal target is analysed and executed once per configuration. See
+# `.pi-flow/docs/adr/0010-tag-macro-internal-targets-manual.md`. The caller's
+# own tags are forwarded rather than replaced: a caller asking for
+# `no-remote-cache` on the APK means the graph that produces it too.
+#
+# Every internal declaration in this file goes through one of these two. A new
+# one that does not is a wildcard root, which is the omission this centralises.
+def _internal_tags(kwargs):
+    tags = list(kwargs.get("tags", []))
+    if "manual" not in tags:
+        tags.append("manual")
+    return tags
+
+def _internal_kwargs(kwargs):
+    internal = dict(kwargs)
+    internal["tags"] = _internal_tags(kwargs)
+    return internal
+
 def flutter_android_libs(
         name,
         abis,
@@ -715,7 +813,8 @@ def flutter_android_libs(
       Under `mode=debug` the `aot_library` contribution and its `_libapp`
         export are dropped: debug ships no AOT snapshot, so nothing supplies
         one and android_binary must not expect it.
-      **kwargs: visibility, tags.
+      **kwargs: visibility and tags for the caller-facing join and check.
+        Macro-internal helper and contribution targets append `manual`.
     """
     no_plugin_graph = plugins == None
     if native_libs == None:
@@ -728,6 +827,7 @@ def flutter_android_libs(
         embedding_deps = flutter_embedding_deps(maven_repo)
 
     check_abis(abis, "flutter_android_libs " + name)
+    internal_kwargs = _internal_kwargs(kwargs)
 
     # A non-empty dict has to cover the declared ABI set exactly. `{}` is the
     # deliberate declaration that this app has no recipe or plugin-native
@@ -800,7 +900,7 @@ def flutter_android_libs(
             name = libapp_jars[abi],
             src = "{}_{}".format(aot, abi),
             abi = abi,
-            **kwargs
+            **internal_kwargs
         )
 
         engine_stripped[abi] = "{}_engine_{}_stripped".format(name, abi)
@@ -811,7 +911,7 @@ def flutter_android_libs(
                 _MODE_RELEASE: engine_jar_label(abi, "release"),
             })),
             abi = abi,
-            **kwargs
+            **internal_kwargs
         )
 
     # One java_import per contribution, not per ABI: android_binary collects
@@ -820,12 +920,12 @@ def flutter_android_libs(
     java_import(
         name = name + "_libapp",
         jars = [libapp_jars[abi] for abi in abis],
-        **kwargs
+        **internal_kwargs
     )
     java_import(
         name = name + "_engine",
         jars = [engine_stripped[abi] for abi in abis],
-        **kwargs
+        **internal_kwargs
     )
 
     # Which contributions vary by ABI is the location's property, not a second
@@ -857,6 +957,7 @@ def flutter_android_libs(
         "registrant",
     ]
     contributions = []
+    asset_contribution = None
     aot_contribution = None
     for kind, location in _ANDROID_CONTRIBUTIONS:
         contribution = "{}_{}_contribution".format(name, kind)
@@ -872,17 +973,21 @@ def flutter_android_libs(
             # emptiness is still explicit at this boundary; the two structural
             # runtime contributions and the asset/AOT/engine never are.
             empty = kind in empty_kinds and not srcs and not libraries,
-            **kwargs
+            **internal_kwargs
         )
         if kind == "aot_library":
             # Declare AOT for all modes; debug excludes it before inputs are needed.
             aot_contribution = contribution
+        elif kind == "assets":
+            # android_binary's assets edge does not take its deps split.
+            asset_contribution = contribution
         else:
             contributions.append(contribution)
 
     flutter_bundle_check(
         name = name + "_check",
         abis = abis,
+        assets_contribution = asset_contribution,
         contributions = contributions + select({
             _MODE_DEBUG: [],
             _MODE_RELEASE: [aot_contribution],
@@ -958,23 +1063,6 @@ _MANIFEST_VALUES = {
     "targetSdkVersion": "36",
 }
 
-# Pin release builds to `opt`; preserve explicitly non-fastbuild modes.
-def _pin_release_compilation_mode_impl(settings, _attr):
-    mode = settings["//tools/flutter:mode"]
-    compilation_mode = str(settings["//command_line_option:compilation_mode"])
-    if mode == "release" and compilation_mode == "fastbuild":
-        compilation_mode = "opt"
-    return {"//command_line_option:compilation_mode": compilation_mode}
-
-_pin_release_compilation_mode = transition(
-    implementation = _pin_release_compilation_mode_impl,
-    inputs = [
-        "//tools/flutter:mode",
-        "//command_line_option:compilation_mode",
-    ],
-    outputs = ["//command_line_option:compilation_mode"],
-)
-
 def _flutter_apk_impl(ctx):
     apk = ctx.attr.apk
     info = apk[ApkInfo]
@@ -1194,13 +1282,17 @@ def flutter_android_binary(
       maven_repo: the repository the embedding's Maven deps resolve in; must
         match what `flutter_embedding_library` was given.
       engine_jars: ABI -> an engine jar overriding the ABI table's.
-      **kwargs: passed to every android_binary this declares -- visibility,
-        tags, and anything else android_binary accepts, except
-        `proguard_specs`, which the release-compilation-mode wrapper refuses
-        (see docs_internal/compilation-mode-pinning.md). The emitted
-        `<name>_check_test` takes only visibility and tags.
+      **kwargs: android_binary attributes for the private packaging target --
+        anything android_binary accepts, except `proguard_specs`, which the
+        release-compilation-mode wrapper refuses (see
+        docs_internal/compilation-mode-pinning.md). `visibility` lands on the
+        public APK wrapper rather than the private target, and `tags` are
+        forwarded to both, with `manual` appended for the macro-internal half
+        (`.pi-flow/docs/adr/0010-tag-macro-internal-targets-manual.md`). The
+        emitted `<name>_check_test` takes only visibility and tags.
     """
     check_abis(abis, "flutter_android_binary " + name)
+    internal_tags = _internal_tags(kwargs)
 
     if kwargs.get("proguard_specs"):
         fail(
@@ -1270,6 +1362,7 @@ def flutter_android_binary(
         name = versioned_manifest,
         manifest = manifest,
         pubspec = pubspec,
+        tags = internal_tags,
     )
 
     if resource_files == None:
@@ -1288,6 +1381,13 @@ def flutter_android_binary(
                 # Android manifest merging requires a package.
                 custom_package = values["applicationId"],
                 resource_files = [],
+                # Reached only through the private APK's `deps`, and only under
+                # `mode=debug`. Without `manual`, wildcard expansion builds this
+                # debug-only library in the release configuration, where nothing
+                # packages it, and requests it a second time in debug beside the
+                # APK's split edge. Measured cost is in
+                # `.pi-flow/configuration-forks/issues/02-collapse-android-split-duplication.md`.
+                tags = internal_tags,
             )
             debug_manifest_deps = select({
                 _MODE_DEBUG: [":" + debug_manifest_lib],
@@ -1359,10 +1459,12 @@ def flutter_android_binary(
             plugins = plugins,
             registrant = registrant,
             maven_repo = maven_repo,
+            tags = internal_tags,
         )
 
         packaging_kwargs = dict(kwargs)
         wrapper_visibility = packaging_kwargs.pop("visibility", None)
+        packaging_kwargs.pop("tags", None)
 
         packaged = target + "_apk"
         android_binary(
@@ -1374,6 +1476,7 @@ def flutter_android_binary(
             resource_files = resource_files,
             deps = deps + [":" + join] + debug_manifest_deps,
             visibility = ["//visibility:private"],
+            tags = internal_tags,
             **packaging_kwargs
         )