Generate facts for targets not in nogo scope (#4268)

**What type of PR is this?**

Bug fix

**What does this PR do? Why is it needed?**

Nogo analyzers may need facts from their (transitive) dependencies to
operate correctly. We thus need to run nogo on all targets, even those
not in scope, but should only register the validation action for the
targets that are in scope to have them fail the build on nogo findings.

**Which issues(s) does this PR fix?**

Fixes #4241

**Other notes for review**

Author: fmeum

go/private/actions/archive.bzl

@@ -14,7 +14,7 @@
 
 load(
     "//go/private:context.bzl",
-    "get_nogo",
+    "validate_nogo",
 )
 load(
     "//go/private:mode.bzl",
@@ -59,19 +59,22 @@ def emit_archive(go, source = None, _recompile_suffix = "", recompile_internal_d
     out_export = go.declare_file(go, name = source.name, ext = pre_ext + ".x")
     out_cgo_export_h = None  # set if cgo used in c-shared or c-archive mode
 
-    nogo = get_nogo(go)
+    nogo = go.nogo
 
     # nogo is a FilesToRunProvider and some targets don't have it, some have it but no executable.
     if nogo != None and nogo.executable != None:
         out_facts = go.declare_file(go, name = source.name, ext = pre_ext + ".facts")
         out_nogo_log = go.declare_file(go, name = source.name, ext = pre_ext + ".nogo.log")
-        out_nogo_validation = go.declare_file(go, name = source.name, ext = pre_ext + ".nogo")
         out_nogo_fix = go.declare_file(go, name = source.name, ext = pre_ext + ".nogo.patch")
+        if validate_nogo(go):
+            out_nogo_validation = go.declare_file(go, name = source.name, ext = pre_ext + ".nogo")
+        else:
+            out_nogo_validation = None
     else:
         out_facts = None
         out_nogo_log = None
-        out_nogo_validation = None
         out_nogo_fix = None
+        out_nogo_validation = None
 
     direct = source.deps
 
@@ -116,8 +119,8 @@ def emit_archive(go, source = None, _recompile_suffix = "", recompile_internal_d
             out_export = out_export,
             out_facts = out_facts,
             out_nogo_log = out_nogo_log,
-            out_nogo_validation = out_nogo_validation,
             out_nogo_fix = out_nogo_fix,
+            out_nogo_validation = out_nogo_validation,
             nogo = nogo,
             out_cgo_export_h = out_cgo_export_h,
             gc_goopts = source.gc_goopts,

go/private/actions/compilepkg.bzl

@@ -69,8 +69,8 @@ def emit_compilepkg(
         out_export = None,
         out_facts = None,
         out_nogo_log = None,
-        out_nogo_validation = None,
         out_nogo_fix = None,
+        out_nogo_validation = None,
         nogo = None,
         out_cgo_export_h = None,
         gc_goopts = [],
@@ -88,8 +88,6 @@ def emit_compilepkg(
         fail("nogo must be specified if and only if out_facts is specified", nogo)
     if have_nogo != (out_nogo_log != None):
         fail("nogo must be specified if and only if out_nogo_log is specified")
-    if have_nogo != (out_nogo_validation != None):
-        fail("nogo must be specified if and only if out_nogo_validation is specified")
     if have_nogo != (out_nogo_fix != None):
         fail("nogo must be specified if and only if out_nogo_fix is specified")
 
@@ -222,8 +220,8 @@ def emit_compilepkg(
             archives = archives,
             out_facts = out_facts,
             out_log = out_nogo_log,
-            out_validation = out_nogo_validation,
             out_fix = out_nogo_fix,
+            out_validation = out_nogo_validation,
             nogo = nogo,
         )
 
@@ -279,21 +277,22 @@ def _run_nogo(
         progress_message = "Running nogo on %{label}",
     )
 
-    # This is a separate action that produces the validation output registered with Bazel. It
-    # prints any nogo findings and, crucially, fails if there are any findings. This is necessary
-    # to actually fail the build on nogo findings, which RunNogo doesn't do.
-    validation_args = go.actions.args()
-    validation_args.add("nogovalidation")
-    validation_args.add(out_validation)
-    validation_args.add(out_log)
-    validation_args.add(out_fix)
+    if out_validation:
+        # This is a separate action that produces the validation output registered with Bazel. It
+        # prints any nogo findings and, crucially, fails if there are any findings. This is necessary
+        # to actually fail the build on nogo findings, which RunNogo doesn't do.
+        validation_args = go.actions.args()
+        validation_args.add("nogovalidation")
+        validation_args.add(out_validation)
+        validation_args.add(out_log)
+        validation_args.add(out_fix)
 
-    go.actions.run(
-        inputs = [out_log, out_fix],
-        outputs = [out_validation],
-        mnemonic = "ValidateNogo",
-        executable = go.toolchain._builder,
-        arguments = [validation_args],
-        execution_requirements = SUPPORTS_PATH_MAPPING_REQUIREMENT,
-        progress_message = "Validating nogo output for %{label}",
-    )
+        go.actions.run(
+            inputs = [out_log, out_fix],
+            outputs = [out_validation],
+            mnemonic = "ValidateNogo",
+            executable = go.toolchain._builder,
+            arguments = [validation_args],
+            execution_requirements = SUPPORTS_PATH_MAPPING_REQUIREMENT,
+            progress_message = "Validating nogo output for %{label}",
+        )

go/private/context.bzl

@@ -429,13 +429,11 @@ def _matches_scopes(label, scopes):
             return True
     return False
 
-def get_nogo(go):
-    """Returns the nogo file for this target, if enabled and in scope."""
+def validate_nogo(go):
+    """Whether nogo should be run as a validation action rather than just to generate fact files for the current
+    target."""
     label = go.label
-    if _matches_scopes(label, NOGO_INCLUDES) and not _matches_scopes(label, NOGO_EXCLUDES):
-        return go.nogo
-    else:
-        return None
+    return _matches_scopes(label, NOGO_INCLUDES) and not _matches_scopes(label, NOGO_EXCLUDES)
 
 default_go_config_info = GoConfigInfo(
     static = False,

go/private/rules/library.bzl

@@ -115,8 +115,7 @@ go_library = rule(
             with the same path (for example, from different vendor directories).
             """,
         ),
-        "importpath_aliases": attr.string_list(
-        ),  # experimental, undocumented
+        "importpath_aliases": attr.string_list(),  # experimental, undocumented
         "embed": attr.label_list(
             providers = [GoInfo],
             doc = """

tests/core/cgo/BUILD.bazel

@@ -99,23 +99,21 @@ go_library(
     tags = ["manual"],
 )
 
-
 genrule(
     name = "generate_imported_dylib_linux",
     srcs = ["imported.c"],
-    tools = ["generate_imported_dylib.sh"],
     outs = [
         "libimported.so",
         "libversioned.so.2",
     ],
     cmd = "$(location generate_imported_dylib.sh) $(location imported.c) $(@D)",
     target_compatible_with = ["@platforms//os:linux"],
+    tools = ["generate_imported_dylib.sh"],
 )
 
 genrule(
     name = "generate_imported_dylib_darwin",
     srcs = ["imported.c"],
-    tools = ["generate_imported_dylib.sh"],
     outs = [
         "libimported.dylib",
         "libversioned.2.dylib",
@@ -124,6 +122,7 @@ genrule(
     ],
     cmd = "$(location generate_imported_dylib.sh) $(location imported.c) $(@D)",
     target_compatible_with = ["@platforms//os:macos"],
+    tools = ["generate_imported_dylib.sh"],
 )
 
 cc_import(

tests/core/go_library/BUILD.bazel

@@ -186,9 +186,9 @@ genrule(
 go_source(
     name = "use_syso_srcs",
     srcs = [
-        ":sysolib",
         "wrap_imported_amd64.s",
         "wrap_imported_arm64.s",
+        ":sysolib",
     ],
     visibility = [
         "//tests/core/go_binary:__pkg__",

tests/core/go_proto_aspect/codegen.bzl

@@ -27,7 +27,6 @@ def _go_generated_library_impl(ctx):
         ),
     ]
 
-
 go_generated_library = rule(
     implementation = _go_generated_library_impl,
     attrs = {