[ABLD-474] Apply COMMON_TAGS and per platform tags in dd_agent_go_binary (#53947)

### What does this PR do?

- Updates dd_agent_go_binary
  - takes gotags and adds COMMON_TAGS + fips_tags - platform excluded tags + platform tags
  - provides an escape for some binaries that need to exactly specify tags (e.g. systray)
- Applies this to the existing dd_agent_go_binary targets.
- Clean up targets which were doing their own (redundant) setting for some link flags.
- Tidy up the code to group related lines together.
- Adds per/os fips config settings

It's not clear yet if we should also compute cgo based on platform and fips. Let's solve that as part of ABLD-525

### Testing
- CI
- A complete test is blocked on https://datadoghq.atlassian.net/browse/ABLD-525, which will switch the Go compiler used for fips mode. Right now, we get the same output for `bazel build //cmd/dogstatsd:dogstatsd  --//packages/agent:flavor=fips` with or without the flavor flag.

Co-authored-by: tony.aiuto <tony.aiuto@datadoghq.com>

Author: aiuto

bazel/rules/go/go_binary.bzl

@@ -30,6 +30,7 @@ load("@agent_volatile//:env_vars.bzl", "env_vars")
 load("@dd_release_json//:release_json.bzl", "release_json")
 load("@rules_go//go:def.bzl", "go_binary")
 load("//tasks:agent_payload_version.bzl", "AGENT_PAYLOAD_VERSION")
+load("//tasks:build_tags.bzl", "COMMON_TAGS", "DARWIN_EXCLUDED_TAGS", "FIPS_TAGS", "LINUX_ONLY_TAGS", "WINDOWS_EXCLUDED_TAGS")
 
 _REPO = "github.com/DataDog/datadog-agent"
 _VERSION_PKG = _REPO + "/pkg/version"
@@ -66,7 +67,7 @@ def _make_agent_version_url_safe():
         return env_vars.PACKAGE_VERSION
     return release_json.get("current_milestone") + "-localbuild"
 
-def dd_agent_go_binary(name, **kwargs):
+def dd_agent_go_binary(name, gc_linkopts = None, gotags = None, exact_gotags = None, **kwargs):
     """Wrapper around go_binary that injects Datadog Agent version x_defs.
 
     Accepts all go_binary attributes.  x_defs and gc_linkopts are merged with
@@ -75,34 +76,27 @@ def dd_agent_go_binary(name, **kwargs):
 
     Defaults applied automatically (override by passing the attribute explicitly):
       cgo: True on Windows (required to link .syso resource files), False elsewhere.
-      gc_linkopts: -s -w (strip symbol table and DWARF) on release builds.
 
     Args:
       name: target name
+      gc_linkopts: Base set of link opts. rpath and stripping options are
+                   automatically added to these.
+                   On linux: add RPATH
+                   On release builds: add -s -w (strip symbol table and DWARF)
+      gotags: Base set of gotags for this binary. COMMON tags are added, and
+              per-platform adjustments are made.
+      exact_gotags: Like gotags, but if this is specified, no other tag sets are added.
       **kwargs: arguments to be forwarded to go_binary
     """
-    agent_version_url_safe = _make_agent_version_url_safe()
-
     # TODO: When --stamp support is in place, also inject:
     #   _VERSION_PKG + ".Commit": "{STABLE_GIT_COMMIT}",
     # The value must come from a stamp file produced by a git_info repository
     # rule (planned: bazel/repo/git_info.bzl).
 
-    existing_x_defs = kwargs.pop("x_defs", {})
-    existing_linkopts = kwargs.pop("gc_linkopts", [])
-
-    # cgo must be enabled on Windows to link the .syso resource file produced
-    # by win_resource().  Callers that need additional conditions (e.g. FIPS)
-    # should pass an explicit cgo = select({...}) which replaces this default.
-    if "cgo" not in kwargs:
-        kwargs["cgo"] = select({
-            "@platforms//os:windows": True,
-            "//conditions:default": False,
-        })
-
     # Build two complete x_defs dicts — one per //:is_release branch.
     # string_dict attributes do not support per-value select(); the select()
     # must wrap the whole dict.
+    agent_version_url_safe = _make_agent_version_url_safe()
     release_x_defs = {
         _VERSION_PKG + ".AgentPayloadVersion": AGENT_PAYLOAD_VERSION,
         _VERSION_PKG + ".AgentVersion": _url_safe_to_standard(agent_version_url_safe),
@@ -115,9 +109,19 @@ def dd_agent_go_binary(name, **kwargs):
         _VERSION_PKG + ".AgentVersionURLSafe": agent_version_url_safe,
         _SETUP_PKG + ".defaultRunPath": _RUN_PATH_DEV,
     }
+    existing_x_defs = kwargs.pop("x_defs", {})
     release_x_defs.update(existing_x_defs)
     dev_x_defs.update(existing_x_defs)
 
+    # cgo must be enabled on Windows to link the .syso resource file produced
+    # by win_resource().  Callers that need additional conditions (e.g. FIPS)
+    # should pass an explicit cgo = select({...}) which replaces this default.
+    if "cgo" not in kwargs:
+        kwargs["cgo"] = select({
+            "@platforms//os:windows": True,
+            "//conditions:default": False,
+        })
+
     # "-r <path>" embeds the ELF RPATH so shared libraries under the run path
     # are found at runtime.  This flag is Linux-specific; non-Linux targets get
     # an empty list.
@@ -137,9 +141,21 @@ def dd_agent_go_binary(name, **kwargs):
         "//conditions:default": [],
     })
 
+    if exact_gotags:
+        kwargs["gotags"] = sorted(exact_gotags)
+    else:
+        gotags = gotags or set()
+        kwargs["gotags"] = select({
+            "@platforms//os:macos": sorted((COMMON_TAGS | gotags) - LINUX_ONLY_TAGS - DARWIN_EXCLUDED_TAGS),
+            "//packages/agent:linux_fips": sorted(COMMON_TAGS | gotags | FIPS_TAGS),
+            "//packages/agent:windows_x86_64_fips": sorted((COMMON_TAGS | gotags | FIPS_TAGS) - LINUX_ONLY_TAGS - WINDOWS_EXCLUDED_TAGS),
+            "//:windows_x86_64": sorted((COMMON_TAGS | gotags) - LINUX_ONLY_TAGS - WINDOWS_EXCLUDED_TAGS),
+            "//conditions:default": sorted(COMMON_TAGS | gotags),
+        })
+
     go_binary(
         name = name,
-        gc_linkopts = existing_linkopts + run_path_linkopts + strip_linkopts,
+        gc_linkopts = (gc_linkopts or []) + run_path_linkopts + strip_linkopts,
         x_defs = select({
             "//:is_release": release_x_defs,
             "//conditions:default": dev_x_defs,

cmd/agent/BUILD.bazel

@@ -1,6 +1,6 @@
 load("@rules_go//go:def.bzl", "go_library")
 load("//bazel/rules/go:go_binary.bzl", "dd_agent_go_binary")
-load("//tasks:build_tags.bzl", "AGENT_TAGS", "COMMON_TAGS", "DARWIN_EXCLUDED_TAGS", "LINUX_ONLY_TAGS", "WINDOWS_EXCLUDED_TAGS")
+load("//tasks:build_tags.bzl", "AGENT_TAGS")
 
 go_library(
     name = "agent_lib",
@@ -158,10 +158,6 @@ dd_agent_go_binary(
         "//conditions:default": [],
     }),
     embed = [":agent_lib"],
-    gotags = select({
-        "@platforms//os:macos": sorted((COMMON_TAGS | AGENT_TAGS) - LINUX_ONLY_TAGS - DARWIN_EXCLUDED_TAGS),
-        "@platforms//os:windows": sorted((COMMON_TAGS | AGENT_TAGS) - LINUX_ONLY_TAGS - WINDOWS_EXCLUDED_TAGS),
-        "//conditions:default": sorted(COMMON_TAGS | AGENT_TAGS),
-    }),
+    gotags = AGENT_TAGS,
     visibility = ["//visibility:public"],
 )

cmd/dogstatsd/BUILD.bazel

@@ -1,6 +1,6 @@
 load("@rules_go//go:def.bzl", "go_library")
 load("//bazel/rules/go:go_binary.bzl", "dd_agent_go_binary")
-load("//tasks:build_tags.bzl", "COMMON_TAGS", "DARWIN_EXCLUDED_TAGS", "DOGSTATSD_TAGS", "FIPS_TAGS", "LINUX_ONLY_TAGS", "WINDOWS_EXCLUDED_TAGS")
+load("//tasks:build_tags.bzl", "DOGSTATSD_TAGS")
 
 # gazelle:dd_agent_go_test on
 
@@ -134,19 +134,6 @@ dd_agent_go_binary(
         "//conditions:default": False,
     }),
     embed = [":dogstatsd_lib"],
-    # TODO: Platform filtering seems like something we should move into dd_agent_go_binary.
-    # Maybe we should 'or' in COMMON_TAGS there too.
-    # Or perhaps we need the equivalent of build_tags.py functions as starlark in build_tags.bzl.
-    # Then we can select on platform and have the value be something like get_build_flags("dogstatsd", "linux")
-    # We would like to put fips tags in the sort with the others, but the select() semantics aren't that
-    # sophisticated. What we really need is to fix rules_go/go_binary so that tags are deduped and sourced.
-    gotags = select({
-        "@platforms//os:macos": sorted((COMMON_TAGS | DOGSTATSD_TAGS) - LINUX_ONLY_TAGS - DARWIN_EXCLUDED_TAGS),
-        "@platforms//os:windows": sorted((COMMON_TAGS | DOGSTATSD_TAGS) - LINUX_ONLY_TAGS - WINDOWS_EXCLUDED_TAGS),
-        "//conditions:default": sorted(COMMON_TAGS | DOGSTATSD_TAGS),
-    }) + select({
-        "//packages/agent:fips_flavor": sorted(FIPS_TAGS),
-        "//conditions:default": [],
-    }),
+    gotags = DOGSTATSD_TAGS,
     visibility = ["//visibility:public"],
 )

cmd/host-profiler/BUILD.bazel

@@ -1,7 +1,7 @@
 load("@rules_go//go:def.bzl", "go_library")
 load("//bazel/rules/go:dd_agent_go_test.bzl", "dd_agent_go_test")
 load("//bazel/rules/go:go_binary.bzl", "dd_agent_go_binary")
-load("//tasks:build_tags.bzl", "COMMON_TAGS", "HOST_PROFILER_TAGS")
+load("//tasks:build_tags.bzl", "HOST_PROFILER_TAGS")
 
 # gazelle:dd_agent_go_test on
 
@@ -33,7 +33,7 @@ go_library(
 dd_agent_go_binary(
     name = "host-profiler",
     embed = [":host-profiler_lib"],
-    gotags = sorted(COMMON_TAGS | HOST_PROFILER_TAGS),
+    gotags = HOST_PROFILER_TAGS,
     target_compatible_with = ["@platforms//os:linux"],
     visibility = ["//visibility:public"],
 )

cmd/installer/BUILD.bazel

@@ -1,6 +1,8 @@
 load("@rules_go//go:def.bzl", "go_library", "go_test")
 load("//bazel/rules/go:go_binary.bzl", "dd_agent_go_binary")
-load("//tasks:build_tags.bzl", "COMMON_TAGS", "INSTALLER_TAGS")
+load("//tasks:build_tags.bzl", "INSTALLER_TAGS")
+
+# gazelle:dd_agent_go_test off
 
 go_library(
     name = "installer_lib",
@@ -31,15 +33,15 @@ dd_agent_go_binary(
         "//conditions:default": False,
     }),
     embed = [":installer_lib"],
-    gotags = sorted(COMMON_TAGS | INSTALLER_TAGS),
+    gotags = INSTALLER_TAGS,
     visibility = ["//visibility:public"],
 )
 
 go_test(
     name = "installer_test",
     srcs = ["main_test.go"],
     embed = [":installer_lib"],
-    gotags = ["test"],
+    gotags = sorted(["test"] + list(INSTALLER_TAGS)),
     deps = [
         "//pkg/fleet/installer/commands",
         "@com_github_spf13_cobra//:cobra",

cmd/process-agent/BUILD.bazel

@@ -1,6 +1,6 @@
 load("@rules_go//go:def.bzl", "go_library")
 load("//bazel/rules/go:go_binary.bzl", "dd_agent_go_binary")
-load("//tasks:build_tags.bzl", "COMMON_TAGS", "DARWIN_EXCLUDED_TAGS", "LINUX_ONLY_TAGS", "PROCESS_AGENT_TAGS", "WINDOWS_EXCLUDED_TAGS")
+load("//tasks:build_tags.bzl", "PROCESS_AGENT_TAGS")
 
 go_library(
     name = "process-agent_lib",
@@ -23,10 +23,6 @@ dd_agent_go_binary(
         "//conditions:default": [],
     }),
     embed = [":process-agent_lib"],
-    gotags = select({
-        "@platforms//os:macos": sorted((COMMON_TAGS | PROCESS_AGENT_TAGS) - LINUX_ONLY_TAGS - DARWIN_EXCLUDED_TAGS),
-        "@platforms//os:windows": sorted((COMMON_TAGS | PROCESS_AGENT_TAGS) - LINUX_ONLY_TAGS - WINDOWS_EXCLUDED_TAGS),
-        "//conditions:default": sorted(COMMON_TAGS | PROCESS_AGENT_TAGS),
-    }),
+    gotags = PROCESS_AGENT_TAGS,
     visibility = ["//visibility:public"],
 )

cmd/systray/BUILD.bazel

@@ -44,22 +44,14 @@ dd_agent_go_binary(
     out = "ddtray.exe",
     cgo = True,
     embed = [":systray_lib"],
+    exact_gotags = ["grpcnotrace"],
     # Subtle: This should be passed to the C linker, so the -Wl is redundant,
     # but it is handled by the mingw driver instead of ld, so we still need
     # -Wl to pass it on a second layer deep.
-    # TODO: Move selection of strip flags (-s -w) into dd_agent_go_binary. But that
-    # requires refactoring to merge fixed and variable parts.
     gc_linkopts = [
         "-linkmode=external",
         "-extldflags=-Wl,--subsystem,%s" % SUBSYSTEM,
-    ] + select({
-        "//:is_release": [
-            "-s",
-            "-w",
-        ],
-        "//conditions:default": [],
-    }),
-    gotags = ["grpcnotrace"],
+    ],
     target_compatible_with = ["@platforms//os:windows"],
     visibility = ["//visibility:public"],
     x_defs = {

cmd/trace-agent/BUILD.bazel

@@ -1,6 +1,6 @@
 load("@rules_go//go:def.bzl", "go_library")
 load("//bazel/rules/go:go_binary.bzl", "dd_agent_go_binary")
-load("//tasks:build_tags.bzl", "COMMON_TAGS", "TRACE_AGENT_TAGS")
+load("//tasks:build_tags.bzl", "TRACE_AGENT_TAGS")
 
 go_library(
     name = "trace-agent_lib",
@@ -30,6 +30,6 @@ dd_agent_go_binary(
         "//conditions:default": [],
     }),
     embed = [":trace-agent_lib"],
-    gotags = sorted(COMMON_TAGS | TRACE_AGENT_TAGS),
+    gotags = TRACE_AGENT_TAGS,
     visibility = ["//visibility:public"],
 )