fix: resolve critical CI failures across multiple component types

Fixes three major CI issues that were causing early build failures:

1. **Go Component World Name Validation**: Updated validation in go/defs.bzl
   to accept valid WIT world names with colons and forward slashes like
   'wasi:cli/command'. Previous validation was too restrictive, rejecting
   standard WIT namespace syntax.

2. **WIT Dependency Check Syntax Error**: Fixed wit_deps_check.bzl by
   removing unsupported 'stdout' parameter from ctx.actions.run() and
   passing output file path as argument instead. This resolves the
   "unexpected keyword argument 'stdout'" error.

3. **JavaScript Component JCO Installation**: Fixed jco_toolchain.bzl by
   actually installing npm packages with repository_ctx.execute() instead
   of creating empty placeholder files. This resolves the "Cannot find module"
   errors for @bytecodealliance/jco.

All fixes maintain hermetic build principles and cross-platform compatibility.
Successfully tested JavaScript components and Go world name validation.

Author: avrabe

MODULE.bazel.lock

@@ -57,8 +57,11 @@ def _assert_valid_go_component_attrs(ctx):
 
     # Validate world name format if provided
     if ctx.attr.world:
-        if not ctx.attr.world.replace("-", "").replace("_", "").isalnum():
-            fail("go_wasm_component rule '{}' has invalid world name '{}'. World names must be alphanumeric with hyphens/underscores".format(
+        # WIT world names support namespaces with colons, hyphens, underscores, and forward slashes
+        # Valid examples: "wasi:cli/command", "example:calculator/operations", "simple-world"
+        allowed_chars = ctx.attr.world.replace("-", "").replace("_", "").replace(":", "").replace("/", "")
+        if not allowed_chars.isalnum():
+            fail("go_wasm_component rule '{}' has invalid world name '{}'. World names must be alphanumeric with hyphens, underscores, colons, and forward slashes".format(
                 ctx.label, ctx.attr.world))
 
 def _assert_valid_toolchain_setup(ctx, tinygo, wasm_tools):

go/defs.bzl

@@ -194,17 +194,23 @@ def _setup_downloaded_jco_tools(repository_ctx, platform, jco_version, node_vers
 
     print("JCO dependencies configured")
 
-    print("JCO build configured")
-
-    # Create jco_workspace directory structure for compatibility
-    repository_ctx.file("jco_workspace/node_modules/.keep", "")
+    # Actually install the packages using npm
+    npm_install_result = repository_ctx.execute([
+        str(npm_binary),
+        "install", "--global-style", "--no-package-lock",
+    ] + install_packages, environment = npm_env, working_directory = "jco_workspace")
 
+    if npm_install_result.return_code != 0:
+        print("ERROR: npm install failed:")
+        print("STDOUT:", npm_install_result.stdout)
+        print("STDERR:", npm_install_result.stderr)
+        fail("Failed to install jco dependencies: {}".format(npm_install_result.stderr))
+
+    print("JCO installation completed successfully")
+
     # Create robust wrapper script for jco that always uses hermetic Node.js
     workspace_path = repository_ctx.path("jco_workspace").realpath
 
-    # Create placeholder package.json for compatibility
-    repository_ctx.file("jco_workspace/node_modules/@bytecodealliance/jco/package.json", "{}")
-
     print("jco installation verified, creating hermetic wrapper...")
 
     if platform.startswith("windows"):

toolchains/jco_toolchain.bzl

@@ -22,13 +22,12 @@ def _wit_deps_check_impl(ctx):
     # Run dependency analysis
     output_file = ctx.actions.declare_file(ctx.label.name + "_analysis.json")
 
-    # Run dependency analysis using ctx.actions.run with stdout parameter
+    # Run dependency analysis using ctx.actions.run (without stdout parameter for compatibility)
     ctx.actions.run(
         executable = ctx.executable._wit_dependency_analyzer,
-        arguments = [config_file.path],
+        arguments = [config_file.path, output_file.path],
         inputs = [config_file, ctx.file.wit_file],
         outputs = [output_file],
-        stdout = output_file,
         mnemonic = "CheckWitDependencies",
         progress_message = "Checking WIT dependencies in %s" % ctx.file.wit_file.short_path,
     )