Make allows running arbitrary shell commands during evaluation via the
$(shell)
function. Currently, we still allow this in the converted Starlark,
but plan to remove it before finishing the conversion.
Running arbitrary shell commands makes the build non-hermetic.
Along the same line, don't read or write any files during the product
configuration, either through $(shell cat file.txt)
or $(file <file.txt)
.
File I/O in Bazel is only supported under certain situations, such as repository
rules.