feat: Saving the nogo fixes (#4102)

**What type of PR is this?**

> Feature

**What does this PR do? Why is it needed?**

nogo analyzers may produce fixes as
analysis.[Diagnostic](https://pkg.go.dev/golang.org/x/tools/go/analysis#Diagnostic).
This PR allows rules_go to save the fixes as patches, one per target.
The patch and the command to apply the patch is printed out to the
terminal for users to manually apply. The patch is also available in the
"nogo_fix" output group. This allows people to get patches for all
targets without failing the build by passing `--norun_validations
--output_groups nogo_fix`.

Example output:

```
Use --sandbox_debug to see verbose messages from the sandbox and retain the sandbox build root for debugging

nogo: errors found by nogo during build-time code analysis:
src/example.com/send_request.go:133:4: Add and Done should not both exist inside the same goroutine block (example_nogo_analyzer)

-------------------Suggested Fix-------------------
--- src/example.com/send_request.go
+++ src/example.com/send_request.go
@@ -123,6 +123,7 @@
 
 	for !isComplete {
 		<-ticker.C
+		concurrentJobs.Add(1)
 		go func() {
 			text, hasMore := <-line
 			if !hasMore {
@@ -130,7 +131,6 @@
 				return
 			}
 
-			concurrentJobs.Add(1)
 			defer concurrentJobs.Done()
 
 			atomic.AddInt32(&totalSend, 1)

-----------------------------------------------------

To apply the suggested fix, run the following command:
$ patch -p1 < bazel-out/k8-fastbuild/bin/src/example.com/send_request.nogo.patch

Target //src/example.com:send_request failed to build
Use --verbose_failures to see the command lines of failed build steps.
```

**Other notes for review**
An analyzer may suggest multiple alternative fixes to one issue. Only
the first one is selected by default, unless it conflicts with other
fixes, in which case it moves on to try the next alternative. If all
alternatives are tried but still have conflicts, they will be skipped.
In such case, the user will have to apply the patch first, and run nogo
again to get the fix to the issue.

---------

Co-authored-by: Zhongpeng Lin <[email protected]>

Author: peng3141

MODULE.bazel

@@ -38,6 +38,7 @@ use_repo(
     "com_github_gogo_protobuf",
     "com_github_golang_mock",
     "com_github_golang_protobuf",
+    "com_github_pmezard_go_difflib",
     "org_golang_google_genproto",
     "org_golang_google_grpc",
     "org_golang_google_grpc_cmd_protoc_gen_go_grpc",

go.mod

@@ -6,6 +6,7 @@ require (
 	github.com/gogo/protobuf v1.3.2
 	github.com/golang/mock v1.7.0-rc.1
 	github.com/golang/protobuf v1.5.3
+	github.com/pmezard/go-difflib v1.0.0
 	golang.org/x/net v0.26.0
 	golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d
 	google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013

go.sum

@@ -49,6 +49,7 @@ github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=

go/private/actions/archive.bzl

@@ -64,10 +64,12 @@ def emit_archive(go, source = None, _recompile_suffix = "", recompile_internal_d
         out_facts = go.declare_file(go, name = source.name, ext = pre_ext + ".facts")
         out_nogo_log = go.declare_file(go, name = source.name, ext = pre_ext + ".nogo.log")
         out_nogo_validation = go.declare_file(go, name = source.name, ext = pre_ext + ".nogo")
+        out_nogo_fix = go.declare_file(go, name = source.name, ext = pre_ext + ".nogo.patch")
     else:
         out_facts = None
         out_nogo_log = None
         out_nogo_validation = None
+        out_nogo_fix = None
 
     direct = source.deps
 
@@ -113,6 +115,7 @@ def emit_archive(go, source = None, _recompile_suffix = "", recompile_internal_d
             out_facts = out_facts,
             out_nogo_log = out_nogo_log,
             out_nogo_validation = out_nogo_validation,
+            out_nogo_fix = out_nogo_fix,
             nogo = nogo,
             out_cgo_export_h = out_cgo_export_h,
             gc_goopts = source.gc_goopts,
@@ -142,6 +145,7 @@ def emit_archive(go, source = None, _recompile_suffix = "", recompile_internal_d
             out_facts = out_facts,
             out_nogo_log = out_nogo_log,
             out_nogo_validation = out_nogo_validation,
+            out_nogo_fix = out_nogo_fix,
             nogo = nogo,
             gc_goopts = source.gc_goopts,
             cgo = False,
@@ -185,6 +189,7 @@ def emit_archive(go, source = None, _recompile_suffix = "", recompile_internal_d
         facts_file = out_facts,
         runfiles = source.runfiles,
         _validation_output = out_nogo_validation,
+        _nogo_fix_output = out_nogo_fix,
         _cgo_deps = cgo_deps,
     )
     x_defs = dict(source.x_defs)

go/private/actions/compilepkg.bzl

@@ -70,6 +70,7 @@ def emit_compilepkg(
         out_facts = None,
         out_nogo_log = None,
         out_nogo_validation = None,
+        out_nogo_fix = None,
         nogo = None,
         out_cgo_export_h = None,
         gc_goopts = [],
@@ -89,6 +90,8 @@ def emit_compilepkg(
         fail("nogo must be specified if and only if out_nogo_log is specified")
     if have_nogo != (out_nogo_validation != None):
         fail("nogo must be specified if and only if out_nogo_validation is specified")
+    if have_nogo != (out_nogo_fix != None):
+        fail("nogo must be specified if and only if out_nogo_fix is specified")
 
     if cover and go.coverdata:
         archives = archives + [go.coverdata]
@@ -220,6 +223,7 @@ def emit_compilepkg(
             out_facts = out_facts,
             out_log = out_nogo_log,
             out_validation = out_nogo_validation,
+            out_fix = out_nogo_fix,
             nogo = nogo,
         )
 
@@ -233,6 +237,7 @@ def _run_nogo(
         out_facts,
         out_log,
         out_validation,
+        out_fix,
         nogo):
     """Runs nogo on Go source files, including those generated by cgo."""
     sdk = go.sdk
@@ -241,7 +246,7 @@ def _run_nogo(
                      [archive.data.facts_file for archive in archives if archive.data.facts_file] +
                      [archive.data.export_file for archive in archives])
     inputs_transitive = [sdk.tools, sdk.headers, go.stdlib.libs]
-    outputs = [out_facts, out_log]
+    outputs = [out_facts, out_log, out_fix]
 
     nogo_args = go.tool_args(go)
     if cgo_go_srcs:
@@ -251,6 +256,7 @@ def _run_nogo(
     nogo_args.add_all(archives, before_each = "-facts", map_each = _facts)
     nogo_args.add("-out_facts", out_facts)
     nogo_args.add("-out_log", out_log)
+    nogo_args.add("-out_fix", out_fix)
     nogo_args.add("-nogo", nogo)
 
     # This action runs nogo and produces the facts files for downstream nogo actions.
@@ -279,8 +285,10 @@ def _run_nogo(
     validation_args.add("nogovalidation")
     validation_args.add(out_validation)
     validation_args.add(out_log)
+    validation_args.add(out_fix)
+
     go.actions.run(
-        inputs = [out_log],
+        inputs = [out_log, out_fix],
         outputs = [out_validation],
         mnemonic = "ValidateNogo",
         executable = go.toolchain._builder,

go/private/repositories.bzl

@@ -102,6 +102,25 @@ def go_rules_dependencies(force = False):
         patch_args = ["-p1"],
     )
 
+    # Needed for nogo to generate unified diff
+    # releaser:upgrade-dep pmezard go-difflib
+    wrapper(
+        http_archive,
+        name = "com_github_pmezard_go_difflib",
+        # v1.0.0, latest as of 2024-12-19
+        urls = [
+            "https://mirror.bazel.build/github.com/pmezard/go-difflib/archive/refs/tags/v1.0.0.tar.gz",
+            "https://github.com/pmezard/go-difflib/archive/refs/tags/v1.0.0.tar.gz",
+        ],
+        sha256 = "28f3dc1b5c0efd61203ab07233f774740d3bf08da4d8153fb5310db6cea0ebda",
+        strip_prefix = "go-difflib-1.0.0",
+        patches = [
+            # releaser:patch-cmd gazelle -repo_root . -go_prefix github.com/pmezard/go-difflib -go_naming_convention import_alias
+            Label("//third_party:com_github_pmezard_go_difflib-gazelle.patch"),
+        ],
+        patch_args = ["-p1"],
+    )
+
     # releaser:upgrade-dep golang sys
     wrapper(
         http_archive,

go/private/rules/binary.bzl

@@ -152,12 +152,14 @@ def _go_binary_impl(ctx):
         executable = executable,
     )
     validation_output = archive.data._validation_output
+    nogo_fix_output = archive.data._nogo_fix_output
 
     providers = [
         archive,
         OutputGroupInfo(
             cgo_exports = archive.cgo_exports,
             compilation_outputs = [archive.data.file],
+            nogo_fix = [nogo_fix_output] if nogo_fix_output else [],
             _validation = [validation_output] if validation_output else [],
         ),
     ]

go/private/rules/library.bzl

@@ -49,6 +49,7 @@ def _go_library_impl(ctx):
     go_info = new_go_info(go, ctx.attr)
     archive = go.archive(go, go_info)
     validation_output = archive.data._validation_output
+    nogo_fix_output = archive.data._nogo_fix_output
 
     return [
         go_info,
@@ -65,6 +66,7 @@ def _go_library_impl(ctx):
         OutputGroupInfo(
             cgo_exports = archive.cgo_exports,
             compilation_outputs = [archive.data.file],
+            nogo_fix = [nogo_fix_output] if nogo_fix_output else [],
             _validation = [validation_output] if validation_output else [],
         ),
     ]

go/private/rules/nogo.bzl

@@ -65,7 +65,7 @@ def _nogo_impl(ctx):
         go,
         struct(
             embed = [ctx.attr._nogo_srcs],
-            deps = analyzer_archives,
+            deps = analyzer_archives + [ctx.attr._go_difflib[GoArchive]],
         ),
         generated_srcs = [nogo_main],
         name = go.label.name + "~nogo",
@@ -102,6 +102,7 @@ _nogo = rule(
         ),
         "_cgo_context_data": attr.label(default = "//:cgo_context_data_proxy"),
         "_go_config": attr.label(default = "//:go_config"),
+        "_go_difflib": attr.label(default = "@com_github_pmezard_go_difflib//difflib:go_default_library"),
         "_stdlib": attr.label(default = "//:stdlib"),
         "_allowlist_function_transition": attr.label(
             default = "@bazel_tools//tools/allowlists/function_transition_allowlist",

go/private/rules/test.bzl

@@ -69,6 +69,7 @@ def _go_test_impl(ctx):
     )
 
     validation_outputs = []
+    nogo_fix_outputs = []
 
     # Compile the library to test with internal white box tests
     internal_go_info = new_go_info(
@@ -79,6 +80,8 @@ def _go_test_impl(ctx):
     internal_archive = go.archive(go, internal_go_info)
     if internal_archive.data._validation_output:
         validation_outputs.append(internal_archive.data._validation_output)
+    if internal_archive.data._nogo_fix_output:
+        nogo_fix_outputs.append(internal_archive.data._nogo_fix_output)
     go_srcs = [src for src in internal_go_info.srcs if src.extension == "go"]
 
     # Compile the library with the external black box tests
@@ -99,6 +102,8 @@ def _go_test_impl(ctx):
     external_archive = go.archive(go, external_go_info, is_external_pkg = True)
     if external_archive.data._validation_output:
         validation_outputs.append(external_archive.data._validation_output)
+    if external_archive.data._nogo_fix_output:
+        nogo_fix_outputs.append(external_archive.data._nogo_fix_output)
 
     # now generate the main function
     repo_relative_rundir = ctx.attr.rundir or ctx.label.package or "."
@@ -207,6 +212,7 @@ def _go_test_impl(ctx):
         ),
         OutputGroupInfo(
             compilation_outputs = [internal_archive.data.file],
+            nogo_fix = nogo_fix_outputs,
             _validation = validation_outputs,
         ),
         coverage_common.instrumented_files_info(