Visibility on config_setting isn't historically enforced. This is purely for legacy reasons. There's no philosophical reason to distinguish them.

This flag starts the process of removing the distinction.

Values:

• --incompatible_enforce_config_setting_visibility=off: every config_setting is visible to every target, regardless of visibility settings
• --incompatible_enforce_config_setting_visibility=on: config_setting follows the policy set by --incompatible_config_setting_private_default_visibility (incompatible_config_setting_private_default_visibility #12933).

Incompatibility error:

ERROR: myapp/BUILD:4:1: in config_setting rule //myapp:my_config: target 'myapp:my_config' is not visible from target '//some:other_target. Check the visibility declaration of the former target if you think the dependency is legitimate

Migration:

Treat all config_settings as if they follow standard visibility logic at https://docs.bazel.build/versions/master/visibility.html: have them set visibility explicitly if they'll be used anywhere outside their own package. The ultimate goal of this migration is to fully enforce that expectation.