Optionally let nogo itself fail on findings

go/nogo.rst

@@ -140,6 +140,10 @@ workspace.  If any of the analyzers reject the program, the build will fail. How
 from the first failing target. You can also specify ``--norun_validations`` to disable all
 validations, including ``nogo``.
 
+Note: Since the action that runs ``nogo`` doesn't fail if ``nogo`` produces findings, it
+is not possible to debug it with ``--sandbox_debug``. If necessary, set the ``debug``
+attribute of the ``nogo`` rule to ``True`` to have ``nogo`` fail in this case.
+
 ``nogo`` will run on all Go targets in your workspace, including tests and binary targets.
 When using WORKSPACE, it will also run on targets that are imported from other workspaces
 by default. You could exclude the external repositories from ``nogo`` by using the

go/private/actions/compilepkg.bzl

@@ -268,7 +268,8 @@ def _run_nogo(
     # to get the nogo findings for all targets with --keep_going rather than stopping at the first
     # target with findings.
     # If nogo fails for any other reason, the action still fails, which allows users to debug their
-    # analyzers with --sandbox_debug.
+    # analyzers with --sandbox_debug. Users can set debug = True on the nogo target to have it fail
+    # on findings to get the same debugging experience as with other failures.
     go.actions.run(
         inputs = inputs,
         outputs = outputs,

go/private/rules/nogo.bzl

@@ -44,6 +44,8 @@ def _nogo_impl(ctx):
     nogo_args = ctx.actions.args()
     nogo_args.add("gennogomain")
     nogo_args.add("-output", nogo_main)
+    if ctx.attr.debug:
+        nogo_args.add("-debug")
     nogo_inputs = []
     analyzer_archives = [get_archive(dep) for dep in ctx.attr.deps]
     analyzer_importpaths = [archive.data.importpath for archive in analyzer_archives]
@@ -96,6 +98,9 @@ _nogo = rule(
         "config": attr.label(
             allow_single_file = True,
         ),
+        "debug": attr.bool(
+            default = False,
+        ),
         "_nogo_srcs": attr.label(
             default = "//go/tools/builders:nogo_srcs",
         ),

go/tools/builders/generate_nogo_main.go

@@ -84,6 +84,8 @@ var configs = map[string]config{
 	},
 {{- end}}
 }
+
+const debugMode = {{ .Debug }}
 `
 
 func genNogoMain(args []string) error {
@@ -92,6 +94,7 @@ func genNogoMain(args []string) error {
 	out := flags.String("output", "", "output file to write (defaults to stdout)")
 	flags.Var(&analyzerImportPaths, "analyzer_importpath", "import path of an analyzer library")
 	configFile := flags.String("config", "", "nogo config file")
+	debug := flags.Bool("debug", false, "enable debug mode")
 	if err := flags.Parse(args); err != nil {
 		return err
 	}
@@ -135,9 +138,11 @@ func genNogoMain(args []string) error {
 		Imports    []Import
 		Configs    Configs
 		NeedRegexp bool
+		Debug      bool
 	}{
 		Imports: imports,
 		Configs: config,
+		Debug:   *debug,
 	}
 	for _, c := range config {
 		if len(c.OnlyFiles) > 0 || len(c.ExcludeFiles) > 0 {

go/tools/builders/nogo_main.go

@@ -96,7 +96,13 @@ func run(args []string) (error, int) {
 		}
 	}
 	if diagnostics != "" {
-		return fmt.Errorf("errors found by nogo during build-time code analysis:\n%s\n", diagnostics), nogoViolation
+		// debugMode is defined by the template in generate_nogo_main.go.
+		exitCode := nogoViolation
+		if debugMode {
+			// Force actions running nogo to fail to help debug issues.
+			exitCode = nogoError
+		}
+		return fmt.Errorf("errors found by nogo during build-time code analysis:\n%s\n", diagnostics), exitCode
 	}
 
 	return nil, nogoSuccess