bazel: deps mirror (#1522)

bazel-deps-mirror is an internal tools used to upload external dependencies
that are referenced in the Bazel WORKSPACE to the Edgeless Systems' mirror.

It also normalizes deps rules.

* hack: add tool to mirror Bazel dependencies
* hack: bazel-deps-mirror tests
* bazel: add deps mirror commands
* ci: upload Bazel dependencies on renovate PRs
* update go mod
* run deps_mirror_upload


Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
Co-authored-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>

bazel/ci/BUILD.bazel

@@ -331,6 +331,40 @@ sh_template(
     template = "go_generate.sh.in",
 )
 
+repo_command(
+    name = "deps_mirror_fix",
+    args = [
+        "fix",
+        "--unauthenticated",
+    ],
+    command = "//hack/bazel-deps-mirror",
+)
+
+repo_command(
+    name = "deps_mirror_upload",
+    args = [
+        "fix",
+    ],
+    command = "//hack/bazel-deps-mirror",
+)
+
+repo_command(
+    name = "deps_mirror_check",
+    args = [
+        "check",
+    ],
+    command = "//hack/bazel-deps-mirror",
+)
+
+repo_command(
+    name = "deps_mirror_check_mirror",
+    args = [
+        "check",
+        "--mirror",
+    ],
+    command = "//hack/bazel-deps-mirror",
+)
+
 multirun(
     name = "tidy",
     commands = [
@@ -342,6 +376,7 @@ multirun(
         ":buildifier_fix",
         ":terraform_fmt",
         ":buf_fmt",
+        ":deps_mirror_fix",
     ],
     jobs = 1,  # execute sequentially
     visibility = ["//visibility:public"],
@@ -358,6 +393,7 @@ multirun(
         ":golicenses_check",
         ":license_header_check",
         ":govulncheck",
+        ":deps_mirror_check",
     ] + select({
         "@io_bazel_rules_go//go/platform:darwin_arm64": [
             ":shellcheck_noop_warning",

bazel/ci/licenseheader.sh.in

@@ -24,6 +24,7 @@ noHeader=$(
     -rL \
     --include='*.go' \
     --exclude-dir 3rdparty \
+    --exclude-dir build \
     -e'SPDX-License-Identifier: AGPL-3.0-only' \
     -e'DO NOT EDIT'
 )