Compile Apple tools as fat binaries if possible

The Apple toolchain has 2 native binaries that are inputs to every
single action. Because of this if you want to share caches between Apple
Silicon machines and Intel machines, you either need to force them to be
x86_64 binaries and suffer the performance loss on Apple Silicon
machiens, or use fat binaries so the sha's match on both architectures,
which is what this change does. These binaries are so small that the
size impact of this doesn't matter. Since Apple Silicon support requires
Xcode 12 this falls back to compiling the single architecture binary if
it fails, under the assumption that means you're on Xcode 11 or lower.
We don't have a better indication at this point of what Xcode version
you're using, so this seems like a fine workaround until Xcode 12 is the
minimum supported version.

Closes #13452.

PiperOrigin-RevId: 405842940

tools/cpp/osx_cc_configure.bzl

@@ -53,7 +53,8 @@ def _get_escaped_xcode_cxx_inc_directories(repository_ctx, cc, xcode_toolchains)
 
     return include_dirs
 
-def _compile_cc_file(repository_ctx, src_name, out_name):
+# TODO: Remove once Xcode 12 is the minimum supported version
+def _compile_cc_file_single_arch(repository_ctx, src_name, out_name):
     env = repository_ctx.os.environ
     xcrun_result = repository_ctx.execute([
         "env",
@@ -83,6 +84,56 @@ def _compile_cc_file(repository_ctx, src_name, out_name):
              "https://github.com/bazelbuild/bazel/issues with the following:\n" +
              error_msg)
 
+def _compile_cc_file(repository_ctx, src_name, out_name):
+    env = repository_ctx.os.environ
+    xcrun_result = repository_ctx.execute([
+        "env",
+        "-i",
+        "DEVELOPER_DIR={}".format(env.get("DEVELOPER_DIR", default = "")),
+        "xcrun",
+        "--sdk",
+        "macosx",
+        "clang",
+        "-mmacosx-version-min=10.9",
+        "-std=c++11",
+        "-lc++",
+        "-arch",
+        "arm64",
+        "-arch",
+        "x86_64",
+        "-Wl,-no_adhoc_codesign",
+        "-O3",
+        "-o",
+        out_name,
+        src_name,
+    ], 30)
+
+    if xcrun_result.return_code == 0:
+        xcrun_result = repository_ctx.execute([
+            "env",
+            "-i",
+            "codesign",
+            "--identifier",  # Required to be reproducible across archs
+            out_name,
+            "--force",
+            "--sign",
+            "-",
+            out_name,
+        ], 30)
+        if xcrun_result.return_code != 0:
+            error_msg = (
+                "codesign return code {code}, stderr: {err}, stdout: {out}"
+            ).format(
+                code = xcrun_result.return_code,
+                err = xcrun_result.stderr,
+                out = xcrun_result.stdout,
+            )
+            fail(out_name + " failed to generate. Please file an issue at " +
+                 "https://github.com/bazelbuild/bazel/issues with the following:\n" +
+                 error_msg)
+    else:
+        _compile_cc_file_single_arch(repository_ctx, src_name, out_name)
+
 def configure_osx_toolchain(repository_ctx, cpu_value, overriden_tools):
     """Configure C++ toolchain on macOS.