Improve Bazel test coverage to get it closer to the legacy (#54628)

<!--Please give us some feedback on your experience writing this PR ! https://app.datadoghq.com/forms/43db4c02-6837-400c-8083-692e141b1b88 !-->

### What does this PR do?

This PR introduces some changes here and there to bridge the gap in the reported code coverage between Bazel and the legacy approach. Changes worth mentioning:

- There was a bug in the fallback mechanism in our custom Gazelle extension that sometimes returned no go tags to set at all. Now the fallback will come back with a minimal set of tags that is needed to build and run a test binary.
- `cel` tag wasn't set in some cases at all, so we add 2 new custom tag sets.
- `gazelle:dd_agent_go_test off` directives were removed in files that were regenerated by Gazelle.



Co-authored-by: joseph.gette <joseph.gette@datadoghq.com>

Author: JSGette

BUILD.bazel

@@ -1,8 +1,9 @@
 # Global build settings
 # gazelle:dd_agent_go_test on
-# gazelle:go_canonical_test_tag_set docker kubelet
 # gazelle:go_canonical_test_tag_set cel clusterchecks kubeapiserver kubelet orchestrator
 # gazelle:go_canonical_test_tag_set linux_bpf
+# gazelle:go_canonical_test_tag_set containerd cel
+# gazelle:go_canonical_test_tag_set docker kubelet cel
 
 load("@bazel_lib//lib:write_source_files.bzl", "write_source_file", "write_source_files")
 load("@bazel_skylib//rules:common_settings.bzl", "bool_flag", "string_flag")

bazel/AGENTS.md

@@ -302,6 +302,26 @@ package-local tag combinations from `//go:build` constraints. Dependency-only op
 tags it names. Gazelle uses those combinations instead of unsafe partial modes and only considers
 embedded library constraints when a configured combination satisfies them.
 
+Some `//go:build` constraints name a tag that a canonical set covers *and* a tag that no canonical
+set mentions. `//go:build trivy && containerd` is one: `containerd` belongs to the canonical set
+`containerd cel`, but no canonical set mentions `trivy`, so that set on its own cannot compile the
+file. Gazelle does not give up there — it derives the minimal combination the constraint needs
+(`containerd trivy`) and adds every canonical set that shares a tag with it, producing
+`cel containerd trivy`. The canonical grouping is still honoured, and the sources still get a test
+target.
+
+This only applies when the canonical set and the constraint can coexist. A constraint that
+contradicts a canonical set produces no combination at all, and its sources stay out of the wildcard
+test runs. For example `//go:build kubeapiserver && !kubelet` grows to include `kubelet`, because
+`kubeapiserver` and `kubelet` share the canonical set
+`cel clusterchecks kubeapiserver kubelet orchestrator` — and the result then fails the constraint's
+own `!kubelet`.
+
+Combinations built this way can be long, and target names are budgeted against the Windows runfiles
+path length (see the Windows section). When `dd_agent_go_test` fails with a path-length error, add a
+short suffix for the combination to `_TAG_SET_SUFFIX_ALIASES` in
+`//bazel/rules/go:dd_agent_go_test.bzl`.
+
 ## Starlark language
 
 Starlark is Python-like but with deliberate restrictions for hermeticity and parallelism. Key divergences:

bazel/rules/go/_gazelle_extension.go

@@ -486,12 +486,42 @@ func tagSetsForExpression(expr constraint.Expr, baseTags map[string]bool, config
 	if len(matches) > 0 {
 		return mergeTagSets(matches)
 	}
-	if referencesAnyTag(expr, configuredTags) || !deriveTagSets {
-		return mergeTagSets(matches)
+	if !deriveTagSets {
+		return nil
+	}
+	if referencesAnyTag(expr, configuredTags) {
+		return canonicalizedTagSets(expr, baseTags, configuredTagSets)
 	}
 	return minimalTagSets(expr, baseTags)
 }
 
+// canonicalizedTagSets handles constraints that pair a canonical tag with tags
+// no canonical set declares, such as `trivy && containerd` where the only set
+// naming containerd is {cel, containerd}. The set alone cannot satisfy the
+// constraint, but the grouping it expresses still holds, so each minimal set is
+// grown by the canonical sets it touches. Growth is measured against the
+// minimal set rather than the accumulating result: canonical sets frequently
+// share a tag, and re-scanning would chain them all together.
+//
+// A constraint that contradicts the grouping — `kubeapiserver && !kubelet`
+// against {cel, clusterchecks, kubeapiserver, kubelet, orchestrator} — survives
+// no such growth and still yields nothing.
+func canonicalizedTagSets(expr constraint.Expr, baseTags map[string]bool, configuredTagSets [][]string) [][]string {
+	var out [][]string
+	for _, minimal := range minimalTagSets(expr, baseTags) {
+		candidate := minimal
+		for _, tagSet := range configuredTagSets {
+			if stringSetsIntersect(minimal, tagSet) {
+				candidate = normalizeTagSet(append(append([]string(nil), candidate...), tagSet...))
+			}
+		}
+		if canSatisfy(expr, activeTagSet(baseTags, candidate)) {
+			out = append(out, candidate)
+		}
+	}
+	return mergeTagSets(out)
+}
+
 func referencesAnyTag(expr constraint.Expr, tags map[string]bool) bool {
 	switch e := expr.(type) {
 	case *constraint.TagExpr:

bazel/rules/go/_gazelle_extension_test.go

@@ -707,6 +707,7 @@ func TestApplicableTagSets(t *testing.T) {
 	tagCombined := write("combo_test.go", "//go:build kubeapiserver && linux")
 	twoTags := write("two_tags_test.go", "//go:build trivy && containerd")
 	relatedTags := write("related_tags_test.go", "//go:build trivy && docker")
+	crioTags := write("crio_tags_test.go", "//go:build trivy && crio")
 	oneTag := write("one_tag_test.go", "//go:build trivy")
 	negativeTag := write("negative_tag_test.go", "//go:build zlib && !zstd")
 	compression := write("compression_test.go", "//go:build zlib && zstd")
@@ -717,6 +718,8 @@ func TestApplicableTagSets(t *testing.T) {
 	orchestrator := write("orchestrator_test.go", "//go:build orchestrator")
 	kubeAPIServerWithoutKubelet := write("kube_no_kubelet_test.go", "//go:build kubeapiserver && !kubelet")
 	kubernetesTagSet := tagsList("cel", "clusterchecks", "kubeapiserver", "kubelet", "orchestrator")
+	containerdTagSet := tagsList("cel", "containerd")
+	dockerTagSet := tagsList("cel", "docker", "kubelet")
 	var manyTagNames []string
 	for tag := range AutoTestTags {
 		manyTagNames = append(manyTagNames, tag)
@@ -861,6 +864,24 @@ func TestApplicableTagSets(t *testing.T) {
 			configuredTagSets: [][]string{kubernetesTagSet},
 			wantTagSets:       [][]string{tagsList("linux_bpf")},
 		},
+		{
+			name:              "configured set grows to cover tags it does not name",
+			srcs:              []string{twoTags},
+			configuredTagSets: [][]string{containerdTagSet},
+			wantTagSets:       [][]string{tagsList("cel", "containerd", "trivy")},
+		},
+		{
+			name:              "only the configured sets a constraint touches are added",
+			srcs:              []string{relatedTags},
+			configuredTagSets: [][]string{containerdTagSet, dockerTagSet},
+			wantTagSets:       [][]string{tagsList("cel", "docker", "kubelet", "trivy")},
+		},
+		{
+			name:              "unconfigured alternative coalesces with the grown set",
+			srcs:              []string{twoTags, crioTags},
+			configuredTagSets: [][]string{containerdTagSet},
+			wantTagSets:       [][]string{tagsList("cel", "containerd", "crio", "trivy")},
+		},
 		{
 			name:              "embedded library selects configured set",
 			srcs:              []string{noConstraint},

bazel/rules/go/dd_agent_go_test.bzl

@@ -15,6 +15,8 @@ load(
 _TAG_SET_SUFFIX_ALIASES = {
     "cel+clusterchecks+kubeapiserver+kubelet+orchestrator": "dca",
     "cel+clusterchecks+docker+kubeapiserver+kubelet+orchestrator": "dca_docker",
+    "cel+clusterchecks+containerd+docker+kubeapiserver+kubelet+orchestrator": "dca_containerd_docker",
+    "cel+clusterchecks+docker+kubeapiserver+kubelet+orchestrator+python": "dca_docker_python",
 }
 
 # Windows caps a process's current directory at MAX_PATH even where longer paths

cmd/agent/common/BUILD.bazel

@@ -66,6 +66,7 @@ dd_agent_go_test(
     data = glob(["testdata/**"]),
     embed = [":common"],
     gotags_sets = [[
+        "cel",
         "docker",
         "kubelet",
     ]],

cmd/cluster-agent/subcommands/coverage/BUILD.bazel

@@ -1,6 +1,5 @@
-load("@rules_go//go:def.bzl", "go_library", "go_test")
-
-# gazelle:dd_agent_go_test off
+load("@rules_go//go:def.bzl", "go_library")
+load("//bazel/rules/go:dd_agent_go_test.bzl", "dd_agent_go_test")
 
 go_library(
     name = "coverage",
@@ -195,15 +194,18 @@ go_library(
     }),
 )
 
-go_test(
+dd_agent_go_test(
     name = "coverage_test",
     srcs = ["command_test.go"],
     embed = [":coverage"],
-    gotags = [
-        "test",
+    gotags_sets = [[
+        "cel",
+        "clusterchecks",
         "kubeapiserver",
-        "e2ecoverage",
-    ],  # keep
+        "kubelet",
+        "orchestrator",
+    ]],
+    include_default = False,
     deps = select({
         "@rules_go//go/platform:aix": [
             "//cmd/cluster-agent/command",

cmd/installer/BUILD.bazel

@@ -1,9 +1,8 @@
-load("@rules_go//go:def.bzl", "go_library", "go_test")
+load("@rules_go//go:def.bzl", "go_library")
+load("//bazel/rules/go:dd_agent_go_test.bzl", "dd_agent_go_test")
 load("//bazel/rules/go:go_binary.bzl", "dd_agent_go_binary")
 load("//tasks:build_tags.bzl", "INSTALLER_TAGS")
 
-# gazelle:dd_agent_go_test off
-
 go_library(
     name = "installer_lib",
     srcs = ["main.go"],
@@ -37,11 +36,10 @@ dd_agent_go_binary(
     visibility = ["//visibility:public"],
 )
 
-go_test(
+dd_agent_go_test(
     name = "installer_test",
     srcs = ["main_test.go"],
     embed = [":installer_lib"],
-    gotags = sorted(["test"] + list(INSTALLER_TAGS)),
     deps = [
         "//pkg/fleet/installer/commands",
         "@com_github_spf13_cobra//:cobra",

cmd/system-probe/modules/BUILD.bazel

@@ -261,7 +261,13 @@ dd_agent_go_test(
         "traceroute_test.go",
     ],
     embed = [":modules"],
-    gotags_sets = [["linux_bpf"]],
+    gotags_sets = [
+        ["linux_bpf"],
+        [
+            "linux_bpf",
+            "nvml",
+        ],
+    ],
     deps = select({
         "@rules_go//go/platform:android": [
             "//pkg/compliance/dbconfig",

comp/core/autodiscovery/common/utils/BUILD.bazel

@@ -1,8 +1,6 @@
 load("@rules_go//go:def.bzl", "go_library")
 load("//bazel/rules/go:dd_agent_go_test.bzl", "dd_agent_go_test")
 
-# gazelle:dd_agent_go_test on
-
 go_library(
     name = "utils",
     srcs = [
@@ -62,6 +60,7 @@ dd_agent_go_test(
             "orchestrator",
         ],
         [
+            "cel",
             "docker",
             "kubelet",
         ],