rules_go: add registry-backed multi-version fork support

.bazelignore

@@ -9,8 +9,8 @@
 bazel-bin
 bazel-out
 bazel-testlogs
-third_party/rules_go_orchestrion_base
-third_party/rules_go_orchestrion_complete
+third_party/rgo/v0_60_0/base
+third_party/rgo/v0_61_1/base
 tools/tests/rules_go_variant_regressions
 modules/go/bazel-bin
 modules/go/bazel-out

.github/workflows/ci.yml

@@ -107,7 +107,7 @@ jobs:
       - name: Run Bazel tests
         timeout-minutes: 25
         shell: bash
-        run: ./bazelw test //tools/...
+        run: ./bazelw test //tools/... --test_output=errors
 
       - name: Run Bazel tests (go companion module)
         if: matrix.os == 'ubuntu-latest'
@@ -254,7 +254,9 @@ jobs:
   rules-go-variant-smoke:
     needs: changes
     if: ${{ needs.changes.outputs.run_full_ci == 'true' }}
-    timeout-minutes: 45
+    # This job runs the smoke harness serially for every supported upstream.
+    # Keep enough headroom as the registry grows.
+    timeout-minutes: 75
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -281,18 +283,19 @@ jobs:
           GO111MODULE=on go install github.com/bazelbuild/bazelisk@v1.28.1
           echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
 
-      - name: Run vendored rules_go base smoke coverage
-        shell: bash
-        run: RULES_GO_VARIANT=base ./tools/dev/run_rules_go_variant_smoke.sh
-
-      - name: Run vendored rules_go complete smoke coverage
+      - name: Run vendored rules_go smoke coverage
         shell: bash
-        run: RULES_GO_VARIANT=complete ./tools/dev/run_rules_go_variant_smoke.sh
+        run: |
+          while IFS= read -r upstream; do
+            RULES_GO_UPSTREAM="${upstream}" \
+            RULES_GO_VARIANT="base" \
+              ./tools/dev/run_rules_go_variant_smoke.sh
+          done < <(python3 tools/dev/materialize_rules_go_fork.py list-upstreams)
 
   workspace-compat:
     needs: changes
     if: ${{ needs.changes.outputs.run_full_ci == 'true' }}
-    timeout-minutes: 45
+    timeout-minutes: 90
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -314,53 +317,24 @@ jobs:
           GO111MODULE=on go install github.com/bazelbuild/bazelisk@v1.28.1
           echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
 
-      - name: Validate WORKSPACE Go companion path (base, general)
-        shell: bash
-        run: |
-          USE_BAZEL_VERSION=8.4.1 RULES_GO_VARIANT=base \
-            ./tools/tests/integration/run_workspace_go_integration.sh
-
-      - name: Validate WORKSPACE Go companion path (complete, general)
-        shell: bash
-        run: |
-          USE_BAZEL_VERSION=8.4.1 RULES_GO_VARIANT=complete \
-            ./tools/tests/integration/run_workspace_go_integration.sh
-
-      - name: Validate Bzlmod Go companion path (base, general)
-        shell: bash
-        run: |
-          USE_BAZEL_VERSION=8.4.1 RULES_GO_VARIANT=base \
-            ./tools/tests/integration/run_bzlmod_go_integration.sh
-
-      - name: Validate Bzlmod Go companion path (complete, general)
-        shell: bash
-        run: |
-          USE_BAZEL_VERSION=8.4.1 RULES_GO_VARIANT=complete \
-            ./tools/tests/integration/run_bzlmod_go_integration.sh
-
-      - name: Validate WORKSPACE Go companion path (base, test_optimization)
-        shell: bash
-        run: |
-          USE_BAZEL_VERSION=8.4.1 RULES_GO_VARIANT=base ORCHESTRION_MODE=test_optimization \
-            ./tools/tests/integration/run_workspace_go_integration.sh
-
-      - name: Validate WORKSPACE Go companion path (complete, test_optimization)
-        shell: bash
-        run: |
-          USE_BAZEL_VERSION=8.4.1 RULES_GO_VARIANT=complete ORCHESTRION_MODE=test_optimization \
-            ./tools/tests/integration/run_workspace_go_integration.sh
-
-      - name: Validate Bzlmod Go companion path (base, test_optimization)
-        shell: bash
-        run: |
-          USE_BAZEL_VERSION=8.4.1 RULES_GO_VARIANT=base ORCHESTRION_MODE=test_optimization \
-            ./tools/tests/integration/run_bzlmod_go_integration.sh
-
-      - name: Validate Bzlmod Go companion path (complete, test_optimization)
+      - name: Validate Go companion consumer paths
         shell: bash
         run: |
-          USE_BAZEL_VERSION=8.4.1 RULES_GO_VARIANT=complete ORCHESTRION_MODE=test_optimization \
-            ./tools/tests/integration/run_bzlmod_go_integration.sh
+          while IFS= read -r upstream; do
+            for mode in general test_optimization; do
+              USE_BAZEL_VERSION=8.4.1 \
+              RULES_GO_UPSTREAM="${upstream}" \
+              RULES_GO_VARIANT="base" \
+              ORCHESTRION_MODE="${mode}" \
+                ./tools/tests/integration/run_workspace_go_integration.sh
+
+              USE_BAZEL_VERSION=8.4.1 \
+              RULES_GO_UPSTREAM="${upstream}" \
+              RULES_GO_VARIANT="base" \
+              ORCHESTRION_MODE="${mode}" \
+                ./tools/tests/integration/run_bzlmod_go_integration.sh
+            done
+          done < <(python3 tools/dev/materialize_rules_go_fork.py list-upstreams)
 
   coverage-tools:
     needs: changes
@@ -485,6 +459,7 @@ jobs:
       run_schema_validation: true
       run_fixture_json_validation: true
       run_schema_parser_parity: true
+      run_rules_go_fork_drift: true
 
   # Policy: keep the hermetic lane Linux-only for now.
   # Rationale: sandbox/network-blocking semantics are most reliable on Linux;

.github/workflows/release.yml

@@ -264,6 +264,7 @@ jobs:
       run_schema_validation: true
       run_fixture_json_validation: false
       run_schema_parser_parity: true
+      run_rules_go_fork_drift: true
 
   release-docs-links:
     timeout-minutes: 10

.github/workflows/rules-go-variant-extended.yml

@@ -42,10 +42,11 @@ jobs:
           GO111MODULE=on go install github.com/bazelbuild/bazelisk@v1.28.1
           echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
 
-      - name: Run extended vendored rules_go base coverage
+      - name: Run extended vendored rules_go coverage
         shell: bash
-        run: RULES_GO_VARIANT=base ./tools/dev/run_rules_go_variant_extended.sh
-
-      - name: Run extended vendored rules_go complete coverage
-        shell: bash
-        run: RULES_GO_VARIANT=complete ./tools/dev/run_rules_go_variant_extended.sh
+        run: |
+          while IFS= read -r upstream; do
+            RULES_GO_UPSTREAM="${upstream}" \
+            RULES_GO_VARIANT="base" \
+              ./tools/dev/run_rules_go_variant_extended.sh
+          done < <(python3 tools/dev/materialize_rules_go_fork.py list-upstreams)

.github/workflows/shared-validation.yml

@@ -48,6 +48,10 @@ on:
         required: false
         type: boolean
         default: false
+      run_rules_go_fork_drift:
+        required: false
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -103,7 +107,8 @@ jobs:
         run: |
           mapfile -t starlark_files < <(
             git ls-files -- \
-              '*.bzl' 'BUILD' 'BUILD.bazel' 'WORKSPACE' 'MODULE.bazel'
+              '*.bzl' 'BUILD' 'BUILD.bazel' 'WORKSPACE' 'MODULE.bazel' \
+              ':(exclude)third_party/rgo/**'
           )
           if (( ${#starlark_files[@]} == 0 )); then
             echo "No Starlark files found."
@@ -194,6 +199,43 @@ jobs:
         shell: bash
         run: python3 tools/core/schemas/check_schema_parser_parity.py
 
+  rules-go-fork-drift:
+    if: ${{ !inputs.docs_only && inputs.run_rules_go_fork_drift }}
+    timeout-minutes: 15
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: ${{ inputs.python_version }}
+
+      - name: Set up Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: "1.25.0"
+
+      - name: Verify Go toolchain for generated rules_go maps
+        shell: bash
+        run: |
+          go version
+          command -v gofmt
+
+      - name: Verify rules_go fork registry and materialized trees
+        shell: bash
+        run: |
+          python3 tools/dev/generate_rules_go_fork_maps.py --check
+          RULES_GO_ORCHESTRION_CACHE="${RUNNER_TEMP}/rules_go_orchestrion_cache" \
+            python3 tools/dev/materialize_rules_go_fork.py check --all
+          python3 tools/dev/verify_rules_go_profiles.py \
+            --public-denylist tools/dev/private_leak_public_denylist.txt
+
+      - name: Verify rules_go fork release archive contents
+        shell: bash
+        run: python3 tools/dev/check_release_archive_contents.py
+
   powershell-lint:
     if: ${{ !inputs.docs_only && inputs.run_powershell_lint }}
     timeout-minutes: 20