Zig cache goes to /tmp/zig-cache on Linux

.bazelrc

@@ -9,7 +9,9 @@ build --worker_sandboxing
 
 # TODO: turn this back on when Zig can build CGo (https://github.com/uber/hermetic_cc_toolchain/issues/10)
 #build --action_env BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
-build --experimental_output_directory_naming_scheme=diff_against_dynamic_baseline
+build --sandbox_add_mount_pair=/tmp
 build --sandbox_add_mount_pair=/var/tmp
+build --sandbox_add_mount_pair=C:\Temp
 
+build --experimental_output_directory_naming_scheme=diff_against_dynamic_baseline
 build:darwin_toolchains --extra_toolchains @zig_sdk//toolchain:darwin_amd64,@zig_sdk//toolchain:darwin_arm64

.github/workflows/ci.yaml

@@ -47,15 +47,13 @@ jobs:
         with:
           key: cache-${{ matrix.os }}-${{ hashFiles('.bazelversion', 'toolchain/private/zig_sdk.bzl', '.github/workflows/ci.yaml') }}
           path: |
-            /var/tmp/zig-cache
+            /tmp/zig-cache
             ~/.cache/bazelisk
 
       - run: brew install bash
         if: runner.os == 'macOS'
 
       - run: echo "common --announce_rc" >> .bazelrc.ci
-      - run: echo "build --sandbox_add_mount_pair=C:\\Temp" >> .bazelrc.ci
-        if: runner.os == 'Windows'
 
       # Linux, macOS and Windows
       - run: ci/list_toolchains_platforms

README.md

@@ -61,6 +61,7 @@ zig_toolchains()
 And this to `.bazelrc` on a Unix-y systems:
 
 ```
+build --sandbox_add_mount_pair=/tmp
 build --sandbox_add_mount_pair=/var/tmp
 ```
 
@@ -70,10 +71,11 @@ Windows:
 build --sandbox_add_mount_pair=C:\Temp
 ```
 
-The directories can be narrowed down to `/var/tmp/zig-cache` and
-`C:\Temp\hermetic_cc_toolchain` respectively if it can be ensured they will be
-created before the invocation of `bazel build`. See [#83][pr-83] for more
-context. If a different place is prefferred for zig cache, set:
+The directories can be narrowed down to `/tmp/zig-cache` (Linux),
+`/var/tmp/zig-cache` (MacOS) and `C:\Temp\hermetic_cc_toolchain` respectively
+if it can be ensured they will be created before the invocation of `bazel
+build`. See [#83][pr-83] for more context. If a different place is prefferred
+for zig cache, set:
 
 ```
 build --repo_env=HERMETIC_CC_TOOLCHAIN_CACHE_PREFIX=/path/to/cache

ci/test

@@ -5,7 +5,13 @@
 
 set -xeuo pipefail
 
-cache_prefix="${HERMETIC_CC_TOOLCHAIN_CACHE_PREFIX:-/var/tmp/zig-cache}"
+case "$(uname)" in
+    Linux) default_cache_prefix='/tmp/zig-cache' ;;
+    Darwin) default_cache_prefix='/var/tmp/zig-cache' ;;
+    *) default_cache_prefix='C:\Temp\hermetic_cc_toolchain' ;;
+esac
+
+cache_prefix="${HERMETIC_CC_TOOLCHAIN_CACHE_PREFIX:-$default_cache_prefix}"
 
 # check a very hermetic setup with a single target. Re-building all of
 # them takes a long time, so using only one. If we ever decide to build all

examples/bzlmod/.bazelrc

@@ -3,9 +3,14 @@
 test --sandbox_default_allow_network=false
 test --test_output=errors
 
+build --incompatible_disallow_empty_glob
 build --verbose_failures
 build --worker_sandboxing
 
 build --action_env BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
+
+build --sandbox_add_mount_pair=/tmp
 build --sandbox_add_mount_pair=/var/tmp
+build --sandbox_add_mount_pair=C:\Temp
+
 build --experimental_output_directory_naming_scheme=diff_against_dynamic_baseline

examples/rules_cc/.bazelrc

@@ -3,9 +3,13 @@
 test --sandbox_default_allow_network=false
 test --test_output=errors
 
+build --incompatible_disallow_empty_glob
 build --verbose_failures
 build --worker_sandboxing
 
 build --action_env BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
+
+build --sandbox_add_mount_pair=/tmp
 build --sandbox_add_mount_pair=/var/tmp
+build --sandbox_add_mount_pair=C:\Temp
 build --experimental_output_directory_naming_scheme=diff_against_dynamic_baseline

toolchain/defs.bzl

@@ -149,8 +149,12 @@ def _zig_repository_impl(repository_ctx):
     if cache_prefix == "":
         if os == "windows":
             cache_prefix = "C:\\\\Temp\\\\hermetic_cc_toolchain"
-        else:
+        elif os == "macos":
             cache_prefix = "/var/tmp/zig-cache"
+        elif os == "linux":
+            cache_prefix = "/tmp/zig-cache"
+        else:
+            fail("unknown os: {}".format(os))
 
     repository_ctx.template(
         "tools/zig-wrapper.zig",