bazel: add bazelisk run //:cmake — dependency prefix for plain CMake builds

.bazelrc

@@ -96,9 +96,13 @@ common --enable_platform_specific_config
 # macOS: boost.stacktrace needs this since backtrace() doesn't require GNU source
 build:macos --copt=-DBOOST_STACKTRACE_GNU_SOURCE_NOT_REQUIRED
 build:macos --host_copt=-DBOOST_STACKTRACE_GNU_SOURCE_NOT_REQUIRED
-# Aligned allocation/deallocation for abseil is only available since 10.13
-build:macos --macos_minimum_os=10.13
-build:macos --host_macos_minimum_os=10.13
+# Floating-point std::to_chars (behind std::format, used by OpenSTA)
+# needs macOS 13.3; std::filesystem (src/tcl_readline_setup.cc) needs
+# 10.15; abseil's aligned allocation needs 10.13. The historical 10.13
+# floor was never enforced: toolchains_llvm ignored it and compiled
+# against the host SDK's default. hermetic-llvm honors it.
+build:macos --macos_minimum_os=13.3
+build:macos --host_macos_minimum_os=13.3
 
 # Settings for --config=asan address sanitizer build
 build:asan --strip=never
@@ -123,6 +127,9 @@ build:profile --copt -fno-omit-frame-pointer --host_copt -fno-omit-frame-pointer
 # Improve hermeticity by disallowing user envars and network access
 build --incompatible_strict_action_env
 build --nosandbox_default_allow_network
+# Refuse to autodetect a local C++ toolchain (/usr/bin/gcc); the hermetic
+# toolchain must win resolution, with or without the etc/bazel wrapper.
+common --repo_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
 
 test --build_tests_only
 
@@ -142,6 +149,11 @@ build:ci --disk_cache=
 # Tell the 'ci' config to include 'opt'
 build:ci --config=opt
 
+# Launch py_binary via a shell stub instead of rules_python's legacy python
+# stub, whose '#!/usr/bin/env python3' shebang needs a host python3 before
+# the hermetic interpreter takes over (found by etc/bazel).
+common --@rules_python//python/config_settings:bootstrap_impl=script
+
 # Setup remote cache
 # Anon: HTTPS read-only cache
 build --remote_cache=https://bazel.precisioninno.com

.gitignore

@@ -60,6 +60,9 @@ user.bazelrc
 # Limit ignore to these files, so we see and clean out other cruft that pollutes grep
 /bazel-*
 
+# CMake dependency prefix written by `bazelisk run //:cmake`
+/deps/
+
 tmp/
 
 projectview.bazelproject

BUILD.bazel

@@ -514,6 +514,15 @@ alias(
     visibility = ["//visibility:public"],
 )
 
+# `bazelisk run //:cmake` materializes <workspace>/deps, a dependency
+# prefix (headers, static libs, tools, hermetic clang toolchain) for
+# building OpenROAD with plain CMake. See docs/user/Build.md.
+alias(
+    name = "cmake",
+    actual = "//cmake-deps:cmake",
+    visibility = ["//visibility:public"],
+)
+
 # Lightweight test suites that run without building OpenROAD.
 # Usage:
 #   bazelisk test --test_tag_filters=doc_check //src/... # all documentation checks

MODULE.bazel

@@ -36,6 +36,19 @@ bazel_dep(name = "swig", version = "4.3.0.bcr.2")
 
 BOOST_VERSION = "1.89.0.bcr.2"
 
+# boost::icl's exclusive_less_than comparator violates strict weak ordering
+# (boostorg/icl#51); libc++'s std::map exposes it, leaving phantom intervals
+# after interval_set subtraction (boostorg/icl#55) — pad IO fillers were
+# placed on top of pads. Upstream fix boostorg/icl@7de3f55655 (#54), merged
+# after boost 1.90. Drop when a boost.icl release containing it lands in BCR.
+single_version_override(
+    module_name = "boost.icl",
+    patch_strip = 1,
+    patches = [
+        "//bazel/boost-icl-patches:0001-refactor-interval-lookup-operations-icl-54.patch",
+    ],
+)
+
 bazel_dep(name = "boost.algorithm", version = BOOST_VERSION)
 bazel_dep(name = "boost.asio", version = BOOST_VERSION)
 bazel_dep(name = "boost.beast", version = BOOST_VERSION)
@@ -83,6 +96,19 @@ bazel_dep(name = "or-tools", version = "9.15")
 bazel_dep(name = "spdlog", version = "1.15.1")
 bazel_dep(name = "sv-lang", version = "10.0.1-20260316-f04e8156")
 bazel_dep(name = "tcl_lang", version = "9.0.2.bcr.1")
+
+# tclZipfs.c's '#include "crypt.h"' picks up glibc's crypt.h instead of the
+# vendored minizip one when glibc headers are explicit -isystem directories
+# (hermetic-llvm zero-sysroot toolchain). Drop when fixed in a tcl_lang
+# BCR release.
+single_version_override(
+    module_name = "tcl_lang",
+    patch_strip = 1,
+    patches = [
+        "//bazel/tcl-patches:0001-tclZipfs-include-vendored-minizip-crypt.h-by-path.patch",
+    ],
+)
+
 bazel_dep(name = "tcmalloc", version = "0.0.0-20250927-12f2552")
 bazel_dep(name = "yaml-cpp", version = "0.9.0")
 bazel_dep(name = "zlib", version = "1.3.1.bcr.8")
@@ -101,7 +127,25 @@ git_override(
 
 ## Lock the compiler version and avoid any local compiler.
 ## Downstream consumers must configure their own C++ toolchain.
-bazel_dep(name = "toolchains_llvm", version = "1.5.0", dev_dependency = True)
+##
+## hermetic-llvm (BCR module "llvm") provides statically linked LLVM
+## binaries and a zero-sysroot cc_toolchain: no host compiler, linker,
+## libxml2 or /usr/include involved, and it runs unmodified on distros
+## without FHS paths (e.g. NixOS).
+bazel_dep(name = "llvm", version = "0.8.11", dev_dependency = True)
+
+# hermetic-llvm injects kernel/glibc headers as the first -isystem entries,
+# outranking libraries that deliberately shadow libc headers (gnulib's
+# stdio.h in BCR sed; tcl's vendored minizip crypt.h). Host sysroots are
+# searched last; -idirafter restores that precedence. Drop when fixed
+# upstream.
+single_version_override(
+    module_name = "llvm",
+    patch_strip = 1,
+    patches = [
+        "//bazel/hermetic-llvm-patches:0001-libc-headers-idirafter-precedence.patch",
+    ],
+)
 
 # --- Dev dependencies (not propagated to downstream consumers) ---
 
@@ -162,23 +206,63 @@ bazel_dep(name = "yosys-slang", version = "0.0.0", dev_dependency = True)
 
 # --- Extensions ---
 
-llvm = use_extension(
-    "@toolchains_llvm//toolchain/extensions:llvm.bzl",
-    "llvm",
-    dev_dependency = True,
-)
-llvm.toolchain(
-    llvm_version = "20.1.8",
-)
-use_repo(llvm, "llvm_toolchain", "llvm_toolchain_llvm")
-
-# FYI: Comment out @llvm_toolchain//:all on NixOS and use the local clang toolchain instead.
 register_toolchains(
-    "@llvm_toolchain//:all",
+    "@llvm//toolchain:all",
     "@rules_verilator//verilator:verilator_toolchain",
     dev_dependency = True,
 )
 
+# hermetic-llvm ships a minimal macOS SDK subset (frameworks are opt-in).
+# Qt (qt-bazel) needs the desktop frameworks; the first six entries are
+# hermetic-llvm's defaults, which listing any framework replaces.
+osx = use_extension("@llvm//extensions:osx.bzl", "osx", dev_dependency = True)
+osx.frameworks(names = [
+    "CoreFoundation",
+    "Foundation",
+    "Kernel",
+    "OSLog",
+    "Security",
+    "SystemConfiguration",
+    "AppKit",
+    "ApplicationServices",
+    "CFNetwork",
+    "Carbon",
+    "Cocoa",
+    "ColorSync",
+    "CoreData",
+    "CoreGraphics",
+    "CoreImage",
+    "CoreServices",
+    "CoreText",
+    "CoreVideo",
+    "DiskArbitration",
+    # ATS (inside the ApplicationServices umbrella) has .tbd symlinks into
+    # the FontServices private framework; without it they dangle and bazel
+    # rejects the sysroot ("file type is not supported").
+    "FontServices",
+    "GSS",
+    "IOKit",
+    "IOSurface",
+    "ImageIO",
+    "Metal",
+    # MetalKit's MTKModel.h includes ModelIO/ModelIO.h.
+    "MetalKit",
+    "ModelIO",
+    "OpenGL",
+    # PrintCore is inside the ApplicationServices umbrella, but must be
+    # named for the SDK subset to keep usr/include/cups (its ObjC headers
+    # import <cups/ppd.h>).
+    "PrintCore",
+    "QuartzCore",
+    # AppKit reaches these on macOS: NSImageView.h includes Symbols
+    # unconditionally; NSText*.h take the non-UIKit branch into the
+    # UIFoundation private framework; NSSharingService pulls CloudKit.
+    "CloudKit",
+    "Symbols",
+    "UIFoundation",
+    "UniformTypeIdentifiers",
+])
+
 python = use_extension("@rules_python//python/extensions:python.bzl", "python")
 python.toolchain(
     ignore_root_user_error = True,