third_party/nix: move bazel-inner wrapper to external file

Because of previous interpolation issues and hard to read escaping, we are moving the wrapper script to a dedicated file. This also corrects the .gitignore to not exclude files that are
prefixed with bazel-

Change-Id: I922636041302ba01b331665f74b64f4e91dae56c
Reviewed-on: https://review.monogon.dev/c/monogon/+/2837
Tested-by: Jenkins CI
Reviewed-by: Lorenz Brun <lorenz@monogon.tech>
diff --git a/third_party/nix/bazel-inner.sh b/third_party/nix/bazel-inner.sh
new file mode 100755
index 0000000..1fdfd38
--- /dev/null
+++ b/third_party/nix/bazel-inner.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/bash
+function get_workspace_root() {
+  workspace_dir="${PWD}"
+  while [[ "${workspace_dir}" != / ]]; do
+    if [[ -e "${workspace_dir}/WORKSPACE" || -e "${workspace_dir}/WORKSPACE.bazel" ]]; then
+      readonly workspace_dir
+      return
+    fi
+    workspace_dir="$(dirname "${workspace_dir}")"
+  done
+  readonly workspace_dir=""
+}
+
+get_workspace_root
+readonly wrapper="${workspace_dir}/tools/bazel"
+if [ -f "${wrapper}" ]; then
+  exec -a "$0" "${wrapper}" "$@"
+fi
+exec -a "$0" "${BAZEL_REAL}" "$@"
diff --git a/third_party/nix/env.nix b/third_party/nix/env.nix
index 4ba3a49..b329f7c 100644
--- a/third_party/nix/env.nix
+++ b/third_party/nix/env.nix
@@ -46,34 +46,17 @@
       unpackPhase = ''
         true
       '';
+      nativeBuildInputs = [ makeWrapper ];
       buildPhase = ''
         mkdir -p $out/bin
         cp $src $out/bin/.bazel-inner
         chmod +x $out/bin/.bazel-inner
 
-        cat > $out/bin/bazel <<EOF
-        #!/usr/bin/bash
-        export BAZEL_REAL=$out/bin/.bazel-inner
-        function get_workspace_root() {
-          workspace_dir="\''${PWD}"
-          while [[ "\''${workspace_dir}" != / ]]; do
-            if [[ -e "\''${workspace_dir}/WORKSPACE" || -e "\''${workspace_dir}/WORKSPACE.bazel" ]]; then
-              readonly workspace_dir
-              return
-            fi
-            workspace_dir="\''$(dirname "\''${workspace_dir}")"
-          done
-          readonly workspace_dir=""
-        }
-
-        get_workspace_root
-        readonly wrapper="\''${workspace_dir}/tools/bazel"
-        if [ -f "\''${wrapper}" ]; then
-          exec -a "\$0" "\''${wrapper}" "\$@"
-        fi
-        exec -a "\$0" "\''${BAZEL_REAL}" "\$@"
-        EOF
+        cp ${./bazel-inner.sh} $out/bin/bazel
         chmod +x $out/bin/bazel
+
+        # Use wrapProgram to set the actual bazel path
+        wrapProgram $out/bin/bazel --set BAZEL_REAL $out/bin/.bazel-inner
       '';
       dontStrip = true;
     })