From fdb447c55dfd0ae0e4319d9f22d0e0ed4921956f Mon Sep 17 00:00:00 2001
From: Tony Redondo <tony.redondo@datadoghq.com>
Date: Wed, 28 Oct 2026 17:51:34 +0100
Subject: [PATCH] ci: register shell toolchains in WORKSPACE Go fixtures

---
 tools/tests/BUILD.bazel                       |  1 +
 .../run_workspace_go_integration.sh           |  8 +++
 tools/tests/python/BUILD.bazel                |  1 +
 tools/tests/python/test_python_tools.py       | 66 +++++++++++++++++++
 4 files changed, 76 insertions(+)

diff --git a/tools/tests/BUILD.bazel b/tools/tests/BUILD.bazel
index 9244021f..a4c0260e 100644
--- a/tools/tests/BUILD.bazel
+++ b/tools/tests/BUILD.bazel
@@ -19,6 +19,7 @@ exports_files(
     [
         "example_stub_repo.bzl",
         "integration/mock_dd_server.py",
+        "integration/run_workspace_go_integration.sh",
     ],
     visibility = ["//visibility:public"],
 )
diff --git a/tools/tests/integration/run_workspace_go_integration.sh b/tools/tests/integration/run_workspace_go_integration.sh
index 484069a6..d3d972b2 100755
--- a/tools/tests/integration/run_workspace_go_integration.sh
+++ b/tools/tests/integration/run_workspace_go_integration.sh
@@ -1099,6 +1099,14 @@ dd_topt_go_orchestrion_tool_repo(
 )
 
 go_rules_dependencies()
+
+# Bazel's collect_coverage helper needs a shell toolchain even for a plain
+# go_test. Bzlmod registers it automatically; WORKSPACE consumers must do so.
+load("@rules_shell//shell:repositories.bzl", "rules_shell_dependencies", "rules_shell_toolchains")
+
+rules_shell_dependencies()
+rules_shell_toolchains()
+
 go_register_toolchains(version = "${GO_VERSION}")
 gazelle_dependencies()
 
diff --git a/tools/tests/python/BUILD.bazel b/tools/tests/python/BUILD.bazel
index 4550898e..8f85d2d1 100644
--- a/tools/tests/python/BUILD.bazel
+++ b/tools/tests/python/BUILD.bazel
@@ -79,6 +79,7 @@ sh_test(
         "//tools/test_optimization:create_support_bundle.py",
         "//tools/test_optimization:render_report_summary.py",
         "//tools/tests:integration/mock_dd_server.py",
+        "//tools/tests:integration/run_workspace_go_integration.sh",
         "//tools/tests/python/fixtures/generated_uploader",
     ],
 )
diff --git a/tools/tests/python/test_python_tools.py b/tools/tests/python/test_python_tools.py
index a561b8a9..69b49916 100644
--- a/tools/tests/python/test_python_tools.py
+++ b/tools/tests/python/test_python_tools.py
@@ -9068,6 +9068,72 @@ def test_powershell_runtime_supports_multi_context_selection(self) -> None:
         self.assertIn("Log-Stderr \"warning: skipping context enrichment", powershell_text)
 
 
+class GoWorkspaceIntegrationTests(unittest.TestCase):
+    def test_generated_consumers_register_shell_toolchains(self) -> None:
+        """Both fetch paths initialize the shell rules used by collect_coverage."""
+        bash = _require_functional_bash(self)
+        source = _runfile("tools/tests/integration/run_workspace_go_integration.sh").read_text(
+            encoding="utf-8"
+        )
+        quote = source[source.index("bzl_quote() {"):source.index("\nsha256_file() {")]
+        writer = source[
+            source.index("write_positive_workspace() {"):
+            source.index("\nwrite_invalid_workspace() {")
+        ]
+        env = {
+            **os.environ,
+            "PYTHON": sys.executable,
+            "REPO_ROOT": "/fixture/rules with spaces",
+            "rules_go_fork_abs": "/fixture/rules with spaces/third_party/rgo/v0_60_0/base",
+            "ARCHIVE_URL": "file:///fixture/rules.tar.gz",
+            "ARCHIVE_SHA256": "a" * 64,
+            "ARCHIVE_NAME": "rules-fixture",
+            "RULES_GO_UPSTREAM": "v0_60_0",
+            "RULES_GO_VARIANT": "base",
+            "ORCHESTRION_VERSION": "v1.12.0",
+            "GO_VERSION": "1.25.0",
+            "SERVICE_NAME": "fixture-service",
+            "MODULE_IMPORTPATH": "example.com/fixture",
+            "OUT_DIR": "custom_topt",
+        }
+        for fetch_mode in ("local", "archive"):
+            with self.subTest(fetch_mode=fetch_mode), tempfile.TemporaryDirectory() as tmp:
+                subprocess.run(
+                    [
+                        bash, "-eu", "-c",
+                        quote + writer + '\nwrite_positive_workspace "$1" "$2"',
+                        "fixture", tmp, fetch_mode,
+                    ],
+                    env=env,
+                    check=True,
+                    capture_output=True,
+                    text=True,
+                )
+                workspace = ast.parse(Path(tmp, "WORKSPACE").read_text(encoding="utf-8"))
+                calls = [
+                    node.value for node in workspace.body
+                    if isinstance(node, ast.Expr) and isinstance(node.value, ast.Call)
+                ]
+                shell_load = next(
+                    (
+                        index for index, call in enumerate(calls)
+                        if call.func.id == "load"
+                        and call.args[0].value == "@rules_shell//shell:repositories.bzl"
+                    ),
+                    None,
+                )
+                self.assertIsNotNone(shell_load, "WORKSPACE must load rules_shell initialization")
+                self.assertEqual(
+                    ["rules_shell_dependencies", "rules_shell_toolchains"],
+                    [arg.value for arg in calls[shell_load].args[1:]],
+                )
+                names = [call.func.id for call in calls]
+                self.assertLess(names.index("go_rules_dependencies"), shell_load)
+                self.assertLess(shell_load, names.index("rules_shell_dependencies"))
+                self.assertLess(names.index("rules_shell_dependencies"), names.index("rules_shell_toolchains"))
+                self.assertEqual(1, names.count("rules_shell_toolchains"))
+
+
 class MockDdServerTests(unittest.TestCase):
     """Test case group covering MockDdServerTests behaviors."""
     @classmethod