This appears to be unconditional [here](https://github.com/please-build/go-rules/blob/ccca57637c3760fa547d85e834bc80a42384758c/build_defs/cgo.build_defs#L100). There's no way to get around it because it's added _after_ `cflags` so even if I pass `-Werror` it undoes it again. Ideally we'd remove this and just have the minimal amount of stuff needed to make it go.