Fix per-analyzer overrides of default-disabled groups

Currently behavior of config groups with `default: false` is buggy. The
intention is that adding an empty suppression section for that group to a
specific analyzer config should enable reporting for that analyzer. i.e.,

```
groups:
  - name: foo
    regex: "^foo/"
    default: false
global:
  ...
analyzers:
  asmdecl:
    foo: # Enabled.
```

This should enable the foo group only for asmdecl. Unfortunately, today the
actual behavior depends on the contents of the `global:` section. If `global:`
contains an entry for foo, then it will work as described. If `global:` does
_not_ contain an entry for foo, then the group default (disabled) always
applies and the individual analyzer options have no effect.

The cause of this is confusion in `AnalyzerConfig.shouldReport`, which doesn't
distinguish between explicit suppression via a global suppression/exclude and
simply having no configuration at all. Make this more explicit, so that the no
configuration case can continue to per-analyzer configuration before falling
back to the group default.

The last test case in the added test fails without this change.

This re-enables several opted-in analyzers for external dependencies, which
have gained a few more false positives to suppress.

PiperOrigin-RevId: 386904725

1 files changed, 2 insertions, 0 deletions

diff --git a/nogo.yaml b/nogo.yaml
index 9b7fc5c8f..d7a3ad956 100644
--- a/nogo.yaml
+++ b/nogo.yaml
@@ -130,6 +130,8 @@ analyzers:
     external: # Enabled.
   unreachable:
     external: # Enabled.
+      exclude:
+        - ".*protobuf/.*.go"
   unsafeptr:
     internal:
       exclude: