Fix per-analyzer overrides of default-disabled groups

Currently behavior of config groups with `default: false` is buggy. The
intention is that adding an empty suppression section for that group to a
specific analyzer config should enable reporting for that analyzer. i.e.,

```
groups:
  - name: foo
    regex: "^foo/"
    default: false
global:
  ...
analyzers:
  asmdecl:
    foo: # Enabled.
```

This should enable the foo group only for asmdecl. Unfortunately, today the
actual behavior depends on the contents of the `global:` section. If `global:`
contains an entry for foo, then it will work as described. If `global:` does
_not_ contain an entry for foo, then the group default (disabled) always
applies and the individual analyzer options have no effect.

The cause of this is confusion in `AnalyzerConfig.shouldReport`, which doesn't
distinguish between explicit suppression via a global suppression/exclude and
simply having no configuration at all. Make this more explicit, so that the no
configuration case can continue to per-analyzer configuration before falling
back to the group default.

The last test case in the added test fails without this change.

This re-enables several opted-in analyzers for external dependencies, which
have gained a few more false positives to suppress.

PiperOrigin-RevId: 386904725

1 files changed, 7 insertions, 1 deletions

diff --git a/tools/nogo/BUILD b/tools/nogo/BUILD
index a7e280b32..27fe48680 100644
--- a/tools/nogo/BUILD
+++ b/tools/nogo/BUILD
@@ -1,4 +1,4 @@
-load("//tools:defs.bzl", "bzl_library", "go_library", "select_goarch", "select_goos")
+load("//tools:defs.bzl", "bzl_library", "go_library", "go_test", "select_goarch", "select_goos")
 load("//tools/nogo:defs.bzl", "nogo_objdump_tool", "nogo_stdlib", "nogo_target")
 
 package(licenses = ["notice"])
@@ -73,6 +73,12 @@ go_library(
     ],
 )
 
+go_test(
+    name = "nogo_test",
+    srcs = ["config_test.go"],
+    library = ":nogo",
+)
+
 bzl_library(
     name = "defs_bzl",
     srcs = ["defs.bzl"],