Make allows running arbitrary shell commands during evaluation via the
$(shell) function. Currently, we still allow this in the converted Starlark,
but plan to remove it before finishing the conversion.
Running arbitrary shell commands makes the build non-hermetic.
Along the same line, don't read or write any files during the product
configuration, either through
$(shell cat file.txt) or
File I/O in Bazel is only supported under certain situations, such as repository