Add a test for sandboxed cc_library builds.

This is a regression test for the issue in #12046 -
ensure that in sandboxed mode, we don't get error messages about
missing tools from our toolchain.

src/test/shell/bazel/cpp_darwin_integration_test.sh

@@ -96,5 +96,22 @@ EOF
       fail "Stripping failed, debug symbols still found in the stripped binary"
 }
 
+# Regression test for https://github.com/bazelbuild/bazel/pull/12046
+function test_osx_sandboxed_cc_library_build() {
+  mkdir -p cpp/osx_sandboxed_cc_library_build
+  cat > cpp/osx_sandboxed_cc_library_build/BUILD <<EOF
+cc_library(
+    name = "a",
+    srcs = ["a.cc"],
+)
+EOF
+  cat > cpp/osx_sandboxed_cc_library_build/a.cc <<EOF
+void a() { }
+EOF
+  assert_build --spawn_strategy=sandboxed //cpp/osx_sandboxed_cc_library_build:a
+  grep -E "libtool_check_unique|No such file" bazel-out/_tmp/actions/stderr-* \
+    && fail "Missing tools in sandboxed build"
+}
+
 run_suite "Tests for Bazel's C++ rules on Darwin"