Fix go_tool_binary non-hermeticity and Go 1.19 incompatibility

`go_tool_binary` used to non-hermetically pick up rules_go's `go.mod` file when run unsandboxed, which resulted in it downloading a different toolchain and messing up version checks.

Also make `nogo_main.go` compatible with Go 1.19.

WORKSPACE

@@ -1,7 +1,7 @@
 workspace(name = "io_bazel_rules_go")
 
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
-load("@io_bazel_rules_go//go:deps.bzl", "go_register_toolchains", "go_rules_dependencies")
+load("@io_bazel_rules_go//go:deps.bzl", "go_download_sdk", "go_register_nogo", "go_register_toolchains", "go_rules_dependencies")
 
 # Required by toolchains_protoc.
 http_archive(
@@ -29,6 +29,15 @@ go_rules_dependencies()
 
 go_register_toolchains(version = "1.23.1")
 
+go_download_sdk(
+    name = "rules_go_internal_compatibility_sdk",
+    version = "1.19.13",
+)
+
+go_register_nogo(
+    nogo = "@//:tools_nogo",
+)
+
 http_archive(
     name = "rules_proto",
     sha256 = "303e86e722a520f6f326a50b41cfc16b98fe6d1955ce46642a5b7a67c11c0f5d",

go/private/rules/binary.bzl

@@ -464,6 +464,11 @@ go_non_executable_binary = rule(executable = False, **_go_binary_kwargs(
 ))
 
 def _go_tool_binary_impl(ctx):
+    # Keep in mind that the actions registered by this rule may not be
+    # sandboxed, so care must be taken to make them hermetic, for example by
+    # preventing `go build` from searching for go.mod or downloading a
+    # different toolchain version.
+
     sdk = ctx.attr.sdk[GoSDK]
     name = ctx.label.name
     if sdk.goos == "windows":
@@ -478,6 +483,8 @@ def _go_tool_binary_impl(ctx):
 set GOMAXPROCS=1
 set GOCACHE=%cd%\\{gotmp}\\gocache
 set GOPATH=%cd%"\\{gotmp}\\gopath
+set GOTOOLCHAIN=local
+set GO111MODULE=off
 {go} build -o {out} -trimpath -ldflags \"{ldflags}\" {srcs}
 set GO_EXIT_CODE=%ERRORLEVEL%
 RMDIR /S /Q "{gotmp}"
@@ -506,7 +513,16 @@ exit /b %GO_EXIT_CODE%
         )
     else:
         # Note: GOPATH is needed for Go 1.16.
-        cmd = """GOTMP=$(mktemp -d);trap "rm -rf \"$GOTMP\"" EXIT;GOMAXPROCS=1 GOCACHE="$GOTMP"/gocache GOPATH="$GOTMP"/gopath {go} build -o {out} -trimpath -ldflags '{ldflags}' {srcs}""".format(
+        cmd = """
+GOTMP=$(mktemp -d)
+trap "rm -rf \"$GOTMP\"" EXIT
+GOMAXPROCS=1 \
+GOCACHE="$GOTMP"/gocache \
+GOPATH="$GOTMP"/gopath \
+GOTOOLCHAIN=local \
+GO111MODULE=off \
+{go} build -o {out} -trimpath -ldflags '{ldflags}' {srcs}
+""".format(
             go = sdk.go.path,
             out = out.path,
             srcs = " ".join([f.path for f in ctx.files.srcs]),

go/tools/builders/nogo_main.go

@@ -223,7 +223,7 @@ func checkPackage(analyzers []*analysis.Analyzer, packagePath string, packageFil
 		if _, ok := ignoreFilesSet[pkg.fset.Position(f.Pos()).Filename]; ok {
 			for _, act := range actions {
 				act.nolint = append(act.nolint, &Range{
-					from: pkg.fset.Position(f.FileStart),
+					from: pkg.fset.Position(f.Pos()),
 					to:   pkg.fset.Position(f.End()).Line,
 				})
 			}

tests/core/compatibility/BUILD.bazel

@@ -0,0 +1,12 @@
+load("//go:def.bzl", "go_binary", "go_cross_binary")
+
+go_binary(
+    name = "hello",
+    srcs = ["hello.go"],
+)
+
+go_cross_binary(
+    name = "hello_old",
+    sdk_version = "1.19",
+    target = ":hello",
+)

tests/core/compatibility/README.md

@@ -0,0 +1,5 @@
+# Compatibility
+
+## compatibility_test
+
+Verifies that a simple Go project builds with an older version of Go.

tests/core/compatibility/hello.go

@@ -0,0 +1,7 @@
+package main
+
+import "fmt"
+
+func main() {
+	fmt.Println("hello")
+}