config_setting visibility not enforced

Description of the problem / bug:

It should not be allowed to access a private config_setting from select in other package. But bazel fails to enforce the visibility.

Bugs: what’s the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

pkgA/BUILD:

load(
    "@bazel_skylib//rules:common_settings.bzl",
    "bool_flag",
)

bool_flag(
    name = "myFlag",
    build_setting_default = False,
    # This visibility is working, however the config_setting is in same package.
    visibility = ["//visibility:private"]
)

config_setting(
    name = "mySetting",
    flag_values = {"myFlag": "True"},
    # This can be accessed from pkgB, despite private visibility
    visibility = ["//visibility:private"]
)

pkgB/BUILD:

genrule(
    name = "foo",
    srcs = [],
    outs = ["foo.out"],
    # Can access mySetting from another package, despite private visibility. 
    cmd = select({
        "//pkgA:mySetting": "echo running with mySetting > $@",
        "//conditions:default": "echo running default > $@"}),
)

I expect both of the following commands to fail, due to pkgB accessing private config_setting in pkgA, but no error is detected:

bbi_bazel build //pkgB:foo --//pkgA:myFlag=True
bbi_bazel build //pkgB:foo --//pkgA:myFlag=False

What operating system are you running Bazel on?

Linux

What’s the output of bazel info release?

3.7.0

Have you found anything relevant by searching the web?

I searched, but have not found anything.

[gregestren]

Filed bugs for --incompatible_* flags: https://github.com/bazelbuild/bazel/issues/12932. PR using them incoming.

[gregestren]

FYI: I rolled back my PR because it breaks some projects that already set visibility on config_setting with bad values.

I’m rolling it forward again behind a flag. Stay tuned…