Upgrade rules_go and adapt Go build rules

.bazelrc

@@ -43,12 +43,12 @@ build --build_tag_filters=-nogo
 # Set flags for x86_64.
 build:x86_64 --crosstool_top=@crosstool//:toolchains
 build:x86_64 --cpu=k8
-build:x86_64 --platforms=@io_bazel_rules_go//go/toolchain:linux_amd64
+build:x86_64 --platforms=@io_bazel_rules_go//go/toolchain:linux_amd64_cgo
 
 # Set flags for aarch64.
 build:aarch64 --crosstool_top=@crosstool//:toolchains
 build:aarch64 --cpu=aarch64
-build:aarch64 --platforms=@io_bazel_rules_go//go/toolchain:linux_arm64
+build:aarch64 --platforms=@io_bazel_rules_go//go/toolchain:linux_arm64_cgo
 
 # Use prebuilt protoc to speed up builds.
 common --@com_google_protobuf//bazel/toolchains:prefer_prebuilt_protoc

MODULE.bazel

@@ -3,16 +3,16 @@ module(
     version = "0.0.1",
 )
 
-bazel_dep(name = "rules_go", version = "0.59.0", repo_name = "io_bazel_rules_go")
-bazel_dep(name = "gazelle", version = "0.47.0", repo_name = "bazel_gazelle")
+bazel_dep(name = "rules_go", version = "0.63.0", repo_name = "io_bazel_rules_go")
+bazel_dep(name = "gazelle", version = "0.51.3", repo_name = "bazel_gazelle")
 bazel_dep(name = "rules_license", version = "1.0.0")
 bazel_dep(name = "bazel_skylib", version = "1.9.2")
 bazel_dep(name = "rules_pkg", version = "1.0.1")
 bazel_dep(name = "rules_cc", version = "0.2.17")
 bazel_dep(name = "rules_shell", version = "0.8.0")
 bazel_dep(name = "grpc", version = "1.76.0", repo_name = "com_github_grpc_grpc")
 bazel_dep(name = "protobuf", version = "33.4", repo_name = "com_google_protobuf")
-bazel_dep(name = "platforms", version = "1.0.0")
+bazel_dep(name = "platforms", version = "1.1.0")
 bazel_dep(name = "abseil-cpp", version = "20250814.1", repo_name = "com_google_absl")
 bazel_dep(name = "googletest", version = "1.17.0", repo_name = "com_google_googletest")
 bazel_dep(name = "google_benchmark", version = "1.8.4", repo_name = "com_google_benchmark")
@@ -23,17 +23,15 @@ bazel_dep(name = "protoc-gen-validate", version = "1.3.0")
 bazel_dep(name = "xds", version = "0.0.0-20251210-ee656c7")
 bazel_dep(name = "cel-spec", version = "0.25.1")
 
-archive_override(
+single_version_override(
     module_name = "rules_go",
-    integrity = "sha256-pynI7SRHyQ/hQAd2iQecoKz7dYDsQWN/MS1lDOnZPZY=",
-    patch_args = ["-p1"],
+    patch_strip = 1,
     patches = [
         "//tools:rules_go_symbols.patch",
-        "//tools:rules_go_sdk.patch",
         "//tools:rules_cgo.patch",
         "//tools:rules_go_export.patch",
     ],
-    url = "https://github.com/bazel-contrib/rules_go/releases/download/v0.57.0/rules_go-v0.57.0.zip",
+    version = "0.63.0",
 )
 
 archive_override(

tools/bazeldefs/go.bzl

@@ -3,7 +3,7 @@
 load("@bazel_gazelle//:def.bzl", _gazelle = "gazelle")
 load("@bazel_skylib//lib:paths.bzl", "paths")
 load("@bazel_skylib//lib:shell.bzl", "shell")
-load("@io_bazel_rules_go//go:def.bzl", "GoArchive", "GoLibrary", _go_binary = "go_binary", _go_context = "go_context", _go_library = "go_library", _go_path = "go_path", _go_test = "go_test")
+load("@io_bazel_rules_go//go:def.bzl", "GoArchive", "GoLibrary", _go_binary = "go_binary", _go_context = "go_context", _go_library = "go_library", _go_path = "go_path", _go_rule = "go_rule", _go_test = "go_test")
 load("@io_bazel_rules_go//proto:def.bzl", _go_grpc_library = "go_grpc_library", _go_proto_library = "go_proto_library")
 load("//tools/bazeldefs:defs.bzl", "select_arch", "select_system")
 
@@ -164,7 +164,7 @@ def go_rule(rule, implementation, **kwargs):
     """Wraps a rule definition with Go attributes.
 
     Args:
-      rule: rule function (typically rule or aspect).
+      rule: rule or aspect function.
       implementation: implementation function.
       **kwargs: other arguments to pass to rule.
 
@@ -175,8 +175,11 @@ def go_rule(rule, implementation, **kwargs):
         "_go_context_data": attr.label(default = "@io_bazel_rules_go//:go_context_data"),
         "_stdlib": attr.label(default = "@io_bazel_rules_go//:stdlib"),
     })
-    kwargs.setdefault("toolchains", []).append("@io_bazel_rules_go//go:toolchain")
-    return rule(implementation, **kwargs)
+    if rule == aspect:
+        # Nogo analyzes Go sources without invoking the C/C++ toolchain.
+        kwargs.setdefault("toolchains", []).append("@io_bazel_rules_go//go:toolchain")
+        return aspect(implementation, **kwargs)
+    return _go_rule(implementation, **kwargs)
 
 def go_embed_libraries(target):
     if hasattr(target.attr, "embed"):
@@ -199,7 +202,7 @@ def go_context(ctx, goos = None, goarch = None, attr = None):
     # We don't change anything for the standard library analysis. All Go files
     # are available in all instances. Note that this includes the standard
     # library sources, which are analyzed by nogo.
-    go_ctx = _go_context(ctx, attr = attr)
+    go_ctx = _go_context(ctx, attr = attr, maybe_needs_cc_toolchain = False)
 
     nogo_args = []
     if go_ctx.mode.race:
@@ -214,13 +217,13 @@ def go_context(ctx, goos = None, goarch = None, attr = None):
 
     return struct(
         env = dict(go_ctx.env, CGO_ENABLED = "0"),
-        go = go_ctx.go,
+        go = go_ctx.sdk.go,
         goarch = goarch or go_ctx.sdk.goarch,
         goos = goos or go_ctx.sdk.goos,
-        gotags = go_ctx.tags,
+        gotags = go_ctx.mode.tags,
         lang_version = "go" + go_ctx.sdk.version,  # go_ctx.sdk.version excludes the go prefix.
         nogo_args = nogo_args,
-        runfiles = depset([go_ctx.go] + go_ctx.sdk.srcs.to_list() + go_ctx.sdk.tools.to_list() + go_ctx.stdlib.libs.to_list()),
+        runfiles = depset([go_ctx.sdk.go] + go_ctx.sdk.srcs.to_list() + go_ctx.sdk.tools.to_list() + go_ctx.stdlib.libs.to_list()),
         stdlib_srcs = go_ctx.sdk.srcs,
         stdlib_mod = stdlib_mod,
     )

tools/licensecheck/dependencies.yaml

@@ -89,10 +89,10 @@
   sha256: 2c8a2520ef58c3d2a6e9e0392ec2cea37adb17db4e00c903d48415fd809397f8
   license: Apache-2.0
 - dependency: gazelle
-  version: https://github.com/bazel-contrib/bazel-gazelle/releases/download/v0.47.0/bazel-gazelle-v0.47.0.tar.gz
-  retrieved: "2026-08-27"
-  commit: b13c1573c378bb3dd9b9de1397db89d0392f8e72
-  sha256: 675114d8b433d0a9f54d81171833be96ebc4113115664b791e6f204d58e93446
+  version: https://github.com/bazel-contrib/bazel-gazelle/releases/download/v0.51.3/bazel-gazelle-v0.51.3.tar.gz
+  retrieved: "2026-09-25"
+  commit: b66b19ce4b0ecebd3ae416e6b55a0d22a49fef34
+  sha256: 49d9eba309b0b695824ff417d734242824ad9ab5edb56063b9d3400df1a61a56
   license: Apache-2.0
 - dependency: github.com/BurntSushi/toml
   version: v1.4.1-0.20240526193622-a339e1f7089c
@@ -1020,10 +1020,10 @@
   sha256: a22461d13119ac5c78f205d3df1db13403e58ce1bb1794edc9313677313f4a9d
   license: MIT
 - dependency: platforms
-  version: https://github.com/bazelbuild/platforms/releases/download/1.0.0/platforms-1.0.0.tar.gz
-  retrieved: "2026-08-27"
-  commit: ab99943ab6bed53cff461a3afa99fc79d31e4351
-  sha256: 3384eb1c30762704fbe38e440204e114154086c8fc8a8c2e3e28441028c019a8
+  version: https://github.com/bazelbuild/platforms/releases/download/1.1.0/platforms-1.1.0.tar.gz
+  retrieved: "2026-09-25"
+  commit: 2d4b4996f0bf52376704c49264164e166213159e
+  sha256: dbad4a23abcca6171e47b79edc53bd6a41067a3b75f9e8b104656b459ff25046
   license: Apache-2.0
 - dependency: protobuf
   version: https://github.com/protocolbuffers/protobuf/releases/download/v33.4/protobuf-33.4.bazel.tar.gz
@@ -1044,10 +1044,10 @@
   sha256: 283fa1cdaaf172337898749cf4b9b1ef5ea269da59540954e51fba0e7b8f277a
   license: Apache-2.0
 - dependency: rules_go
-  version: https://github.com/bazel-contrib/rules_go/releases/download/v0.57.0/rules_go-v0.57.0.zip
-  retrieved: "2026-08-27"
-  commit: 64d9225db70d2e9014217fd8e0340ba4407066fb
-  sha256: a729c8ed2447c90fe140077689079ca0acfb7580ec41637f312d650ce9d93d96
+  version: https://github.com/bazel-contrib/rules_go/releases/download/v0.63.0/rules_go-v0.63.0.zip
+  retrieved: "2026-09-29"
+  commit: 9792f1c079a7602347e0fd966542b6d6b35a6c64
+  sha256: c3e253237109ab2e2a8d3cb075688b98a6e6fce43d849849648e8e3a84f20d6f
   license: Apache-2.0
 - dependency: rules_license
   version: https://github.com/bazelbuild/rules_license/releases/download/1.0.0/rules_license-1.0.0.tar.gz

tools/nogo/check/build.go

@@ -85,6 +85,12 @@ func FilterStdPackages(srcPkgs map[string][]string) (map[string][]string, error)
 			return err
 		}
 		if d.IsDir() {
+			// rules_go includes cmd/internal/{cov,bio} archives for coverage:
+			// https://github.com/bazel-contrib/rules_go/commit/56929daa4
+			// SplitStdPackages excludes cmd sources, so skip those archives.
+			if path == "cmd" {
+				return fs.SkipDir
+			}
 			return nil
 		}
 

tools/rules_cgo.patch

@@ -1,8 +1,8 @@
 diff --git a/go/private/rules/cgo.bzl b/go/private/rules/cgo.bzl
-index b8fc93a6..3fec27e4 100644
+index 541b2fec..dc12ed51 100644
 --- a/go/private/rules/cgo.bzl
 +++ b/go/private/rules/cgo.bzl
-@@ -144,7 +144,12 @@ def cgo_configure(go, srcs, cdeps, cppopts, copts, cxxopts, clinkopts):
+@@ -157,7 +157,12 @@ def cgo_configure(go, srcs, cdeps, cppopts, copts, cxxopts, clinkopts):
                          # libclntsh.dylib.12.1, users have to create a unversioned symbolic link,
                          # so it can be treated as a simple shared library too.
                          continue
@@ -12,6 +12,6 @@ index b8fc93a6..3fec27e4 100644
                  lib_opts.append(lib.path)
 +                # Disable whole-archive for other libraries.
 +                lib_opts.append("-Wl,--no-whole-archive")
-             clinkopts.extend(cc_link_flags)
-
-         elif hasattr(d, "objc"):
+                 if lib.basename.endswith(".a"):
+                     # Match cgo2's heuristic: static cdeps may need the C++ runtime.
+                     needs_cxx_runtime = True

tools/rules_go_export.patch

@@ -58,15 +58,17 @@ index 68a1d3b9..53c38cb2 100644
 +        ),
      ]
 
- go_tool_library = rule(
+ go_tool_library = go_rule(
 diff --git a/go/private/rules/test.bzl b/go/private/rules/test.bzl
 index dcb4eb63..660505b4 100644
 --- a/go/private/rules/test.bzl
 +++ b/go/private/rules/test.bzl
-@@ -215,6 +215,8 @@ def _go_test_impl(ctx):
-         ),
+@@ -220,8 +220,10 @@ def _go_test_impl(ctx):
          OutputGroupInfo(
-             compilation_outputs = [internal_archive.data.file],
+             compilation_outputs = [
+                 internal_archive.data.file,
+                 external_archive.data.file,
+             ],
 +            export_files = internal_archive.export_files,
 +            libs = internal_archive.libs,
              nogo_fix = nogo_diagnosticss,