MacOS default cache dir: /tmp -> /var/tmp

.bazelrc

@@ -10,6 +10,6 @@ build --worker_sandboxing
 # TODO: turn this back on when Zig can build CGo (https://github.com/uber/hermetic_cc_toolchain/issues/10)
 #build --action_env BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
 build --experimental_output_directory_naming_scheme=diff_against_dynamic_baseline
-build --sandbox_add_mount_pair=/tmp
+build --sandbox_add_mount_pair=/var/tmp
 
 build:darwin_toolchains --extra_toolchains @zig_sdk//toolchain:darwin_amd64,@zig_sdk//toolchain:darwin_arm64

.github/workflows/ci.yaml

@@ -38,7 +38,7 @@ jobs:
         with:
           key: cache-${{ matrix.os }}-${{ hashFiles('.bazelversion', 'toolchain/private/zig_sdk.bzl', '.github/workflows/ci.yaml') }}
           path: |
-            /tmp/zig-cache
+            /var/tmp/zig-cache
             ~/Library/Caches/bazelisk
 
       - uses: actions/cache@v4
@@ -47,7 +47,7 @@ jobs:
         with:
           key: cache-${{ matrix.os }}-${{ hashFiles('.bazelversion', 'toolchain/private/zig_sdk.bzl', '.github/workflows/ci.yaml') }}
           path: |
-            /tmp/zig-cache
+            /var/tmp/zig-cache
             ~/.cache/bazelisk
 
       - run: brew install bash

README.md

@@ -61,7 +61,7 @@ zig_toolchains()
 And this to `.bazelrc` on a Unix-y systems:
 
 ```
-build --sandbox_add_mount_pair=/tmp
+build --sandbox_add_mount_pair=/var/tmp
 ```
 
 Windows:
@@ -70,7 +70,7 @@ Windows:
 build --sandbox_add_mount_pair=C:\Temp
 ```
 
-The directories can be narrowed down to `/tmp/zig-cache` and
+The directories can be narrowed down to `/var/tmp/zig-cache` and
 `C:\Temp\hermetic_cc_toolchain` respectively if it can be ensured they will be
 created before the invocation of `bazel build`. See [#83][pr-83] for more
 context. If a different place is prefferred for zig cache, set:
@@ -329,7 +329,7 @@ will be accepted.
 
 ### Zig cache location
 
-Currently zig cache is stored in `/tmp/hermetic_cc_toolchain`, so `bazel clean
+Currently zig cache is stored in `/var/tmp/zig-cache`, so `bazel clean
 --expunge` will not clear the zig cache. Zig's cache should be stored somewhere
 in the project's path. It is not clear how to do it.
 

ci/test

@@ -5,7 +5,7 @@
 
 set -xeuo pipefail
 
-cache_prefix="${HERMETIC_CC_TOOLCHAIN_CACHE_PREFIX:-/tmp/zig-cache}"
+cache_prefix="${HERMETIC_CC_TOOLCHAIN_CACHE_PREFIX:-/var/tmp/zig-cache}"
 
 # check a very hermetic setup with a single target. Re-building all of
 # them takes a long time, so using only one. If we ever decide to build all

examples/bzlmod/.bazelrc

@@ -7,5 +7,5 @@ build --verbose_failures
 build --worker_sandboxing
 
 build --action_env BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
-build --sandbox_add_mount_pair=/tmp
+build --sandbox_add_mount_pair=/var/tmp
 build --experimental_output_directory_naming_scheme=diff_against_dynamic_baseline

examples/rules_cc/.bazelrc

@@ -7,5 +7,5 @@ build --verbose_failures
 build --worker_sandboxing
 
 build --action_env BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
-build --sandbox_add_mount_pair=/tmp
+build --sandbox_add_mount_pair=/var/tmp
 build --experimental_output_directory_naming_scheme=diff_against_dynamic_baseline

toolchain/defs.bzl

@@ -150,7 +150,7 @@ def _zig_repository_impl(repository_ctx):
         if os == "windows":
             cache_prefix = "C:\\\\Temp\\\\hermetic_cc_toolchain"
         else:
-            cache_prefix = "/tmp/zig-cache"
+            cache_prefix = "/var/tmp/zig-cache"
 
     repository_ctx.template(
         "tools/zig-wrapper.zig",