ci: fix runtime patch profiles and Go smoke fixtures

third_party/rgo/v0_60_0/base/go/tools/builders/compilepkg_test.go

@@ -748,6 +748,16 @@ func TestPrepareModuleExportRootUsesWrappedSyntheticCache(t *testing.T) {
 // direct package metadata must still load even when a transitive dependency is
 // intentionally unresolved.
 func TestLoadModulePackageMetadataBatchSkipsBrokenTransitiveDeps(t *testing.T) {
+	// The missing dependency is intentional. Keep its lookup offline and
+	// independent from host module settings or toolchain downloads.
+	t.Setenv("GOPROXY", "off")
+	t.Setenv("GOSUMDB", "off")
+	t.Setenv("GOPRIVATE", "")
+	t.Setenv("GONOPROXY", "")
+	t.Setenv("GONOSUMDB", "")
+	t.Setenv("GOFLAGS", "")
+	t.Setenv("GOTOOLCHAIN", "local")
+
 	goExe, err := exec.LookPath("go")
 	if err != nil {
 		t.Skipf("go binary not on PATH: %v", err)

third_party/rgo/v0_61_1/base/go/tools/builders/compilepkg_test.go

@@ -748,6 +748,16 @@ func TestPrepareModuleExportRootUsesWrappedSyntheticCache(t *testing.T) {
 // direct package metadata must still load even when a transitive dependency is
 // intentionally unresolved.
 func TestLoadModulePackageMetadataBatchSkipsBrokenTransitiveDeps(t *testing.T) {
+	// The missing dependency is intentional. Keep its lookup offline and
+	// independent from host module settings or toolchain downloads.
+	t.Setenv("GOPROXY", "off")
+	t.Setenv("GOSUMDB", "off")
+	t.Setenv("GOPRIVATE", "")
+	t.Setenv("GONOPROXY", "")
+	t.Setenv("GONOSUMDB", "")
+	t.Setenv("GOFLAGS", "")
+	t.Setenv("GOTOOLCHAIN", "local")
+
 	goExe, err := exec.LookPath("go")
 	if err != nil {
 		t.Skipf("go binary not on PATH: %v", err)

third_party/rgo/v0_62_0/base/go/tools/builders/compilepkg_test.go

@@ -748,6 +748,16 @@ func TestPrepareModuleExportRootUsesWrappedSyntheticCache(t *testing.T) {
 // direct package metadata must still load even when a transitive dependency is
 // intentionally unresolved.
 func TestLoadModulePackageMetadataBatchSkipsBrokenTransitiveDeps(t *testing.T) {
+	// The missing dependency is intentional. Keep its lookup offline and
+	// independent from host module settings or toolchain downloads.
+	t.Setenv("GOPROXY", "off")
+	t.Setenv("GOSUMDB", "off")
+	t.Setenv("GOPRIVATE", "")
+	t.Setenv("GONOPROXY", "")
+	t.Setenv("GONOSUMDB", "")
+	t.Setenv("GOFLAGS", "")
+	t.Setenv("GOTOOLCHAIN", "local")
+
 	goExe, err := exec.LookPath("go")
 	if err != nil {
 		t.Skipf("go binary not on PATH: %v", err)

third_party/rgo/v0_63_0/base/go/tools/builders/compilepkg_test.go

@@ -748,6 +748,16 @@ func TestPrepareModuleExportRootUsesWrappedSyntheticCache(t *testing.T) {
 // direct package metadata must still load even when a transitive dependency is
 // intentionally unresolved.
 func TestLoadModulePackageMetadataBatchSkipsBrokenTransitiveDeps(t *testing.T) {
+	// The missing dependency is intentional. Keep its lookup offline and
+	// independent from host module settings or toolchain downloads.
+	t.Setenv("GOPROXY", "off")
+	t.Setenv("GOSUMDB", "off")
+	t.Setenv("GOPRIVATE", "")
+	t.Setenv("GONOPROXY", "")
+	t.Setenv("GONOSUMDB", "")
+	t.Setenv("GOFLAGS", "")
+	t.Setenv("GOTOOLCHAIN", "local")
+
 	goExe, err := exec.LookPath("go")
 	if err != nil {
 		t.Skipf("go binary not on PATH: %v", err)

third_party/rules_go_orchestrion/patches/v0_60_0/base/0001-full-delta.patch

@@ -7705,10 +7705,10 @@ index e2b0be5..a034d09 100644
 +}
 diff --git a/go/tools/builders/compilepkg_test.go b/go/tools/builders/compilepkg_test.go
 new file mode 100644
-index 0000000..f967fca
+index 0000000..942fbeb
 --- /dev/null
 +++ b/go/tools/builders/compilepkg_test.go
-@@ -0,0 +1,983 @@
+@@ -0,0 +1,993 @@
 +package main
 +
 +import (
@@ -8459,6 +8459,16 @@ index 0000000..f967fca
 +// direct package metadata must still load even when a transitive dependency is
 +// intentionally unresolved.
 +func TestLoadModulePackageMetadataBatchSkipsBrokenTransitiveDeps(t *testing.T) {
++	// The missing dependency is intentional. Keep its lookup offline and
++	// independent from host module settings or toolchain downloads.
++	t.Setenv("GOPROXY", "off")
++	t.Setenv("GOSUMDB", "off")
++	t.Setenv("GOPRIVATE", "")
++	t.Setenv("GONOPROXY", "")
++	t.Setenv("GONOSUMDB", "")
++	t.Setenv("GOFLAGS", "")
++	t.Setenv("GOTOOLCHAIN", "local")
++
 +	goExe, err := exec.LookPath("go")
 +	if err != nil {
 +		t.Skipf("go binary not on PATH: %v", err)

third_party/rules_go_orchestrion/patches/v0_61_1/base/0001-full-delta.patch

@@ -7703,10 +7703,10 @@ index e2b0be5..a034d09 100644
 +}
 diff --git a/go/tools/builders/compilepkg_test.go b/go/tools/builders/compilepkg_test.go
 new file mode 100644
-index 0000000..f967fca
+index 0000000..942fbeb
 --- /dev/null
 +++ b/go/tools/builders/compilepkg_test.go
-@@ -0,0 +1,983 @@
+@@ -0,0 +1,993 @@
 +package main
 +
 +import (
@@ -8457,6 +8457,16 @@ index 0000000..f967fca
 +// direct package metadata must still load even when a transitive dependency is
 +// intentionally unresolved.
 +func TestLoadModulePackageMetadataBatchSkipsBrokenTransitiveDeps(t *testing.T) {
++	// The missing dependency is intentional. Keep its lookup offline and
++	// independent from host module settings or toolchain downloads.
++	t.Setenv("GOPROXY", "off")
++	t.Setenv("GOSUMDB", "off")
++	t.Setenv("GOPRIVATE", "")
++	t.Setenv("GONOPROXY", "")
++	t.Setenv("GONOSUMDB", "")
++	t.Setenv("GOFLAGS", "")
++	t.Setenv("GOTOOLCHAIN", "local")
++
 +	goExe, err := exec.LookPath("go")
 +	if err != nil {
 +		t.Skipf("go binary not on PATH: %v", err)

third_party/rules_go_orchestrion/patches/v0_62_0/base/0001-full-delta.patch

@@ -7707,10 +7707,10 @@ index a1782d4..2f160ae 100644
 +}
 diff --git a/go/tools/builders/compilepkg_test.go b/go/tools/builders/compilepkg_test.go
 new file mode 100644
-index 0000000..f967fca
+index 0000000..942fbeb
 --- /dev/null
 +++ b/go/tools/builders/compilepkg_test.go
-@@ -0,0 +1,983 @@
+@@ -0,0 +1,993 @@
 +package main
 +
 +import (
@@ -8461,6 +8461,16 @@ index 0000000..f967fca
 +// direct package metadata must still load even when a transitive dependency is
 +// intentionally unresolved.
 +func TestLoadModulePackageMetadataBatchSkipsBrokenTransitiveDeps(t *testing.T) {
++	// The missing dependency is intentional. Keep its lookup offline and
++	// independent from host module settings or toolchain downloads.
++	t.Setenv("GOPROXY", "off")
++	t.Setenv("GOSUMDB", "off")
++	t.Setenv("GOPRIVATE", "")
++	t.Setenv("GONOPROXY", "")
++	t.Setenv("GONOSUMDB", "")
++	t.Setenv("GOFLAGS", "")
++	t.Setenv("GOTOOLCHAIN", "local")
++
 +	goExe, err := exec.LookPath("go")
 +	if err != nil {
 +		t.Skipf("go binary not on PATH: %v", err)

third_party/rules_go_orchestrion/patches/v0_63_0/base/0001-full-delta.patch

@@ -6686,10 +6686,10 @@ index 98963c6..658b744 100644
 +}
 diff --git a/go/tools/builders/compilepkg_test.go b/go/tools/builders/compilepkg_test.go
 new file mode 100644
-index 0000000..f967fca
+index 0000000..942fbeb
 --- /dev/null
 +++ b/go/tools/builders/compilepkg_test.go
-@@ -0,0 +1,983 @@
+@@ -0,0 +1,993 @@
 +package main
 +
 +import (
@@ -7440,6 +7440,16 @@ index 0000000..f967fca
 +// direct package metadata must still load even when a transitive dependency is
 +// intentionally unresolved.
 +func TestLoadModulePackageMetadataBatchSkipsBrokenTransitiveDeps(t *testing.T) {
++	// The missing dependency is intentional. Keep its lookup offline and
++	// independent from host module settings or toolchain downloads.
++	t.Setenv("GOPROXY", "off")
++	t.Setenv("GOSUMDB", "off")
++	t.Setenv("GOPRIVATE", "")
++	t.Setenv("GONOPROXY", "")
++	t.Setenv("GONOSUMDB", "")
++	t.Setenv("GOFLAGS", "")
++	t.Setenv("GOTOOLCHAIN", "local")
++
 +	goExe, err := exec.LookPath("go")
 +	if err != nil {
 +		t.Skipf("go binary not on PATH: %v", err)

third_party/rules_go_orchestrion/profiles/bzlmod_runtime.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "name": "bzlmod_runtime",
-  "description": "Runtime Orchestrion/Test Optimization patch for Bzlmod consumers, including rules_go's Orchestrion extension registration. Excludes lockfiles and repository tests.",
+  "description": "Runtime Orchestrion/Test Optimization patch for Bzlmod consumers, including rules_go's Orchestrion extension registration. Excludes lockfiles, development Bazel configuration, and repository tests.",
   "variant": "base",
   "include": [
     "/BUILD.bazel",
@@ -45,8 +45,13 @@
     "go/tools/builders/tool_version.go"
   ],
   "exclude": [
+    "/.bazelrc",
+    "/.bazelversion",
     "/MODULE.bazel.lock",
     "docs/**",
+    "examples/.bazelrc",
+    "examples/basic_gazelle/.bazelversion",
+    "examples/hello/.bazelversion",
     "tests/**",
     "**/*_test.go"
   ],

third_party/rules_go_orchestrion/profiles/workspace_runtime.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "name": "workspace_runtime",
-  "description": "Generic WORKSPACE-mode runtime Orchestrion/Test Optimization patch profile. This excludes Bzlmod extension wiring and public repository tests.",
+  "description": "Generic WORKSPACE-mode runtime Orchestrion/Test Optimization patch profile. This excludes Bzlmod extension wiring, development Bazel configuration, and public repository tests.",
   "variant": "base",
   "include": [
     "/BUILD.bazel",
@@ -43,9 +43,14 @@
     "go/tools/builders/tool_version.go"
   ],
   "exclude": [
+    "/.bazelrc",
+    "/.bazelversion",
     "/MODULE.bazel",
     "/MODULE.bazel.lock",
     "docs/**",
+    "examples/.bazelrc",
+    "examples/basic_gazelle/.bazelversion",
+    "examples/hello/.bazelversion",
     "go/extensions.bzl",
     "tests/**",
     "**/*_test.go"

tools/tests/BUILD.bazel

@@ -19,6 +19,7 @@ exports_files(
     [
         "example_stub_repo.bzl",
         "integration/mock_dd_server.py",
+        "integration/run_workspace_go_integration.sh",
     ],
     visibility = ["//visibility:public"],
 )

tools/tests/integration/run_workspace_go_integration.sh

@@ -1099,6 +1099,14 @@ dd_topt_go_orchestrion_tool_repo(
 )
 
 go_rules_dependencies()
+
+# Bazel's collect_coverage helper needs a shell toolchain even for a plain
+# go_test. Bzlmod registers it automatically; WORKSPACE consumers must do so.
+load("@rules_shell//shell:repositories.bzl", "rules_shell_dependencies", "rules_shell_toolchains")
+
+rules_shell_dependencies()
+rules_shell_toolchains()
+
 go_register_toolchains(version = "${GO_VERSION}")
 gazelle_dependencies()
 

tools/tests/python/BUILD.bazel

@@ -79,6 +79,7 @@ sh_test(
         "//tools/test_optimization:create_support_bundle.py",
         "//tools/test_optimization:render_report_summary.py",
         "//tools/tests:integration/mock_dd_server.py",
+        "//tools/tests:integration/run_workspace_go_integration.sh",
         "//tools/tests/python/fixtures/generated_uploader",
     ],
 )

tools/tests/python/test_python_tools.py

@@ -9068,6 +9068,72 @@ def test_powershell_runtime_supports_multi_context_selection(self) -> None:
         self.assertIn("Log-Stderr \"warning: skipping context enrichment", powershell_text)
 
 
+class GoWorkspaceIntegrationTests(unittest.TestCase):
+    def test_generated_consumers_register_shell_toolchains(self) -> None:
+        """Both fetch paths initialize the shell rules used by collect_coverage."""
+        bash = _require_functional_bash(self)
+        source = _runfile("tools/tests/integration/run_workspace_go_integration.sh").read_text(
+            encoding="utf-8"
+        )
+        quote = source[source.index("bzl_quote() {"):source.index("\nsha256_file() {")]
+        writer = source[
+            source.index("write_positive_workspace() {"):
+            source.index("\nwrite_invalid_workspace() {")
+        ]
+        env = {
+            **os.environ,
+            "PYTHON": sys.executable,
+            "REPO_ROOT": "/fixture/rules with spaces",
+            "rules_go_fork_abs": "/fixture/rules with spaces/third_party/rgo/v0_60_0/base",
+            "ARCHIVE_URL": "file:///fixture/rules.tar.gz",
+            "ARCHIVE_SHA256": "a" * 64,
+            "ARCHIVE_NAME": "rules-fixture",
+            "RULES_GO_UPSTREAM": "v0_60_0",
+            "RULES_GO_VARIANT": "base",
+            "ORCHESTRION_VERSION": "v1.12.0",
+            "GO_VERSION": "1.25.0",
+            "SERVICE_NAME": "fixture-service",
+            "MODULE_IMPORTPATH": "example.com/fixture",
+            "OUT_DIR": "custom_topt",
+        }
+        for fetch_mode in ("local", "archive"):
+            with self.subTest(fetch_mode=fetch_mode), tempfile.TemporaryDirectory() as tmp:
+                subprocess.run(
+                    [
+                        bash, "-eu", "-c",
+                        quote + writer + '\nwrite_positive_workspace "$1" "$2"',
+                        "fixture", tmp, fetch_mode,
+                    ],
+                    env=env,
+                    check=True,
+                    capture_output=True,
+                    text=True,
+                )
+                workspace = ast.parse(Path(tmp, "WORKSPACE").read_text(encoding="utf-8"))
+                calls = [
+                    node.value for node in workspace.body
+                    if isinstance(node, ast.Expr) and isinstance(node.value, ast.Call)
+                ]
+                shell_load = next(
+                    (
+                        index for index, call in enumerate(calls)
+                        if call.func.id == "load"
+                        and call.args[0].value == "@rules_shell//shell:repositories.bzl"
+                    ),
+                    None,
+                )
+                self.assertIsNotNone(shell_load, "WORKSPACE must load rules_shell initialization")
+                self.assertEqual(
+                    ["rules_shell_dependencies", "rules_shell_toolchains"],
+                    [arg.value for arg in calls[shell_load].args[1:]],
+                )
+                names = [call.func.id for call in calls]
+                self.assertLess(names.index("go_rules_dependencies"), shell_load)
+                self.assertLess(shell_load, names.index("rules_shell_dependencies"))
+                self.assertLess(names.index("rules_shell_dependencies"), names.index("rules_shell_toolchains"))
+                self.assertEqual(1, names.count("rules_shell_toolchains"))
+
+
 class MockDdServerTests(unittest.TestCase):
     """Test case group covering MockDdServerTests behaviors."""
     @classmethod