Introduce ["all"] scope for nogo

Author: fmeum

go/private/extensions.bzl

@@ -74,16 +74,15 @@ _nogo_tag = tag_class(
         ),
         "includes": attr.label_list(
             default = NOGO_DEFAULT_INCLUDES,
-            # The special include "all" is undocumented on purpose: With it, adding a new transitive
-            # dependency to a Go module can cause a build failure if the new dependency has lint
-            # issues.
             doc = """
 A Go target is checked with nogo if its package matches at least one of the entries in 'includes'
 and none of the entries in 'excludes'. By default, nogo is applied to all targets in the main
 repository.
 
 Uses the same format as 'visibility', i.e., every entry must be a label that ends with ':__pkg__' or
-':__subpackages__'.
+':__subpackages__'. As an exception to this rule, the special value ["all"] is allowed for 'includes'
+and means that nogo should be applied to all Go targets, including those in all external
+repositories.
 """,
         ),
         "excludes": attr.label_list(
@@ -126,21 +125,23 @@ def _go_sdk_impl(ctx):
                 *[t for p in zip(module.tags.nogo, len(module.tags.nogo) * ["\n"]) for t in p]
             )
         nogo_tag = module.tags.nogo[0]
-        for scope in nogo_tag.includes + nogo_tag.excludes:
-            # Validate that the scope references a valid, visible repository.
-            # buildifier: disable=no-effect
-            scope.workspace_name
-            if scope.name != "__pkg__" and scope.name != "__subpackages__":
-                fail(
-                    "go_sdk.nogo: all entries in includes and excludes must end with ':__pkg__' or ':__subpackages__', got '{}' in".format(scope.name),
-                    nogo_tag,
-                )
+
+        # "all" is still processed into a Label instance.
+        if len(nogo_tag.includes) == 1 and nogo_tag.includes[0].name == "all":
+            includes = ["all"]
+        else:
+            for scope in nogo_tag.includes:
+                _check_nogo_scope(scope, nogo_tag)
+            includes = nogo_tag.includes
+        for scope in nogo_tag.excludes:
+            _check_nogo_scope(scope, nogo_tag)
+
     go_register_nogo(
         name = "io_bazel_rules_nogo",
         nogo = str(nogo_tag.nogo),
         # Go through canonical label literals to avoid a dependency edge on the packages in the
         # scope.
-        includes = [str(l) for l in nogo_tag.includes],
+        includes = [str(l) for l in includes],
         excludes = [str(l) for l in nogo_tag.excludes],
     )
 
@@ -300,6 +301,16 @@ def _go_sdk_impl(ctx):
     else:
         return None
 
+def _check_nogo_scope(scope, nogo_tag):
+    # Validate that the scope references a valid, visible repository.
+    # buildifier: disable=no-effect
+    scope.workspace_name
+    if scope.name != "__pkg__" and scope.name != "__subpackages__":
+        fail(
+            "go_sdk.nogo: all entries in includes and excludes must end with ':__pkg__' or ':__subpackages__', got '{}' in".format(scope.name),
+            nogo_tag,
+        )
+
 def _default_go_sdk_name(*, module, multi_version, tag_type, index, suffix = ""):
     # Keep the version out of the repository name if possible to prevent unnecessary rebuilds when
     # it changes.