Fix rules to work with --incompatible_auto_exec_groups

Author: dzbarsky

.github/workflows/bazel7.bazelrc

@@ -8,6 +8,9 @@ common --noexperimental_check_external_repository_files
 # but got aspect_bazel_lib@1.31.2 in the resolved dependency graph.
 common --check_direct_dependencies=off
 
+# Make sure we don't regress this.
+common --incompatible_auto_exec_groups
+
 # Directories used by sandboxed non-worker execution may be reused to avoid unnecessary setup costs.
 # Save time on Sandbox creation and deletion when many of the same kind of action run during the
 # build.

MODULE.bazel

@@ -9,7 +9,7 @@ module(
 
 # Lower-bounds (minimum) versions for direct runtime dependencies.
 # Do not bump these unless rules_js requires a newer version to function.
-bazel_dep(name = "aspect_bazel_lib", version = "2.8.1")
+bazel_dep(name = "aspect_bazel_lib", version = "2.9.2")
 bazel_dep(name = "bazel_features", version = "1.9.0")
 bazel_dep(name = "bazel_skylib", version = "1.5.0")
 bazel_dep(name = "platforms", version = "0.0.5")

npm/private/npm_package_store.bzl

@@ -238,6 +238,7 @@ def _npm_package_store_impl(ctx):
                         "--directory",
                         package_store_directory.path,
                     ],
+                    toolchain = "@aspect_bazel_lib//lib:tar_toolchain_type",
                     mnemonic = "NpmPackageExtract",
                     progress_message = "Extracting npm package {}@{}".format(package, version),
                 )