Use ctx.watch properly for crate_universe (#3569)

I don't think rctx.read did what the comment was trying to do. 

https://bazel.build/rules/lib/builtins/repository_ctx#read says the
watch parameter "**default is 'auto'**...Can be the string 'yes', 'no',
or 'auto'. Passing 'yes' is equivalent to immediately invoking the
[watch()](https://bazel.build/rules/lib/builtins/repository_ctx#watch)
method; passing 'no' does not attempt to watch the file; **passing
'auto' will only attempt to watch the file when it is legal to do so**
(see watch() docs for more information."

https://bazel.build/rules/lib/builtins/repository_ctx#watch says "Note
that attempting to watch paths inside the repo currently being fetched,
or inside the working directory of the current module extension, will
result in an error. **A module extension attempting to watch a path
outside the current Bazel workspace will also result in an error.** "

This means that paths outside the workspace were already not getting
watched, so we can filter them out and then use `.watch` instead of
`.read`

Co-authored-by: UebelAndre <[email protected]>

Author: dzbarsky

crate_universe/extensions.bzl

@@ -684,9 +684,7 @@ def _generate_hub_and_spokes(
 
     paths_to_track = json.decode(module_ctx.read(paths_to_track_file))
     for path in paths_to_track:
-        # This read triggers watching the file at this path and invalidates the repository_rule which will get re-run.
-        # Ideally we'd use module_ctx.watch, but it doesn't support files outside of the workspace, and we need to support that.
-        module_ctx.read(path)
+        module_ctx.watch(path)
 
     warnings_output_file = json.decode(module_ctx.read(warnings_output_file))
     for warning in warnings_output_file:

crate_universe/private/crates_repository.bzl

@@ -119,9 +119,7 @@ def _crates_repository_impl(repository_ctx):
 
     paths_to_track = json.decode(repository_ctx.read(paths_to_track_file))
     for path in paths_to_track:
-        # This read triggers watching the file at this path and invalidates the repository_rule which will get re-run.
-        # Ideally we'd use repository_ctx.watch, but it doesn't support files outside of the workspace, and we need to support that.
-        repository_ctx.read(path)
+        repository_ctx.watch(path)
 
     warnings_output_file = json.decode(repository_ctx.read(warnings_output_file))
     for warning in warnings_output_file:

crate_universe/src/cli/generate.rs

@@ -137,6 +137,7 @@ pub fn generate(opt: GenerateOptions) -> Result<()> {
                     .values()
                     .filter_map(|crate_context| crate_context.repository.as_ref()),
                 context.unused_patches.iter(),
+                &opt.nonhermetic_root_bazel_workspace_dir,
             )?;
 
             return Ok(());
@@ -193,6 +194,7 @@ pub fn generate(opt: GenerateOptions) -> Result<()> {
         splicing_manifest.manifests.keys().cloned(),
         annotations.lockfile.crates.values(),
         cargo_lockfile.patch.unused.iter(),
+        &opt.nonhermetic_root_bazel_workspace_dir,
     )?;
 
     // Generate renderable contexts for each package
@@ -252,6 +254,7 @@ fn write_paths_to_track<
     manifests: Paths,
     source_annotations: SourceAnnotations,
     unused_patches: UnusedPatches,
+    nonhermetic_root_bazel_workspace_dir: &Utf8PathBuf,
 ) -> Result<()> {
     let source_annotation_manifests: BTreeSet<_> = source_annotations
         .filter_map(|v| {
@@ -266,6 +269,8 @@ fn write_paths_to_track<
         .iter()
         .cloned()
         .chain(manifests)
+        // Paths outside the bazel workspace cannot be `.watch`-ed.
+        .filter(|p| p.starts_with(nonhermetic_root_bazel_workspace_dir))
         .collect();
     std::fs::write(
         output_file,