[tamird]

Repository attributes already own their strings for the duration of local-input hashing. Borrow those strings through the existing ordered set, and filter the attribute iterators directly. This removes the temporary vector for each attribute and preserves label order and deduplication.

On the checked-in extension_repo_patch fixture, Bazel 8.8.2 emits 23 attributes for @@sdk_rules++sdk+default_sdk. One scan previously cloned 11 strings, seven nonempty, totaling 123 UTF-8 bytes. Eleven per-attribute vectors held at least one string. The new scan borrows all 11 and retains the same two labels, //patches:sdk.patch and //visibility:private. The complete target-hash and dependency-edge files were byte-identical before and after. These counts describe the scan's allocations. Elapsed time was not measured.

Reproduce the attribute counts

From the repository root, decode the fixture's single length-prefixed repository definition and count its populated string fields. The printed fields are the attribute count, nonempty vector count, string count, nonempty string count, and UTF-8 byte count.

(cd tests/resources/workspaces/extension_repo_patch &&
  USE_BAZEL_VERSION=8.8.2 bazel mod show_repo @@sdk_rules++sdk+default_sdk --output=streamed_proto) |
python3 -c 'import sys
s = sys.stdin.buffer
while s.read(1)[0] & 128: pass
sys.stdout.buffer.write(s.read())' |
bazel run @protobuf//:protoc -- --proto_path="$PWD/rust/proto" --decode=blaze_query.Repository build.proto |
python3 -c 'import json, re, sys
attrs = re.findall(r"^attribute \{\n(.*?)^}", sys.stdin.read(), re.M | re.S)
values = [[json.loads(v) for v in re.findall(r"^  (?:string_value|string_list_value): (.*)$", a, re.M)] for a in attrs]
strings = [s for vs in values for s in vs]
print(len(attrs), sum(map(bool, values)), len(strings), sum(map(bool, strings)), sum(len(s.encode()) for s in strings))'
# 23 11 11 7 123

Codex for Tamir.