ci: adopt tidy workflow for bazel

Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>

.github/workflows/test-bazel.yml

@@ -7,13 +7,11 @@ on:
       - main
       - "release/**"
     paths:
-      - "*.go"
       - "**.bzl"
       - "**.bazel"
       - ".github/workflows/test-bazel.yml"
   pull_request:
     paths:
-      - "*.go"
       - "**.bzl"
       - "**.bazel"
       - ".github/workflows/test-bazel.yml"
@@ -28,11 +26,10 @@ jobs:
         with:
           ref: ${{ !github.event.pull_request.head.repo.fork && github.head_ref || '' }}
 
-      - name: Run buildifier and gazelle test
+      - name: Run buildifier
         shell: bash
         run: |
           bazelisk test //:buildifier-check
-          bazelisk run //:gazelle-check
 
       # TODO(malt3): Find workflows to run bazel unit tests
       # - name: Run unit tests

.github/workflows/test-tidy.yml

@@ -30,16 +30,28 @@ jobs:
           # No token available for forks, so we can't push changes
           token: ${{ !github.event.pull_request.head.repo.fork && secrets.CI_COMMIT_PUSH_PR || '' }}
 
-      - name: Setup Go environment
-        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
-        with:
-          go-version: "1.20.2"
+      - name: Run Bazel tidy
+        shell: bash
+        run: |
+          bazelisk run //bazel/ci:tidy
+          bazelisk run //:gazelle-check
 
-      - name: Go tidy check
+      - name: Check if tidy made modifications
         id: tidycheck
-        uses: katexochen/go-tidy-check@2f5d75dbd503b372466fa9d8bc85710558b953c7 # v2.0.0
-        with:
-          submodules: "true"
+        shell: bash
+        run: |
+          diff=$(git diff)
+          if [[ -z "$diff" ]]; then
+            echo "Everything is tidy"
+            exit 0
+          fi
+          cat << EOF >> "${GITHUB_STEP_SUMMARY}"
+          \`\`\`diff
+          ${diff}
+          \`\`\`
+          EOF
+          echo "::error::The repo is not tidy. Please run 'bazel run bazel/ci:tidy' and commit the changes."
+          exit 1
 
       # The following steps are only executed if the previous tidy check failed
       # and the action runs on an renovat branche. In this case, we tidy all

BUILD.bazel

@@ -12,18 +12,6 @@ gazelle(
     mode = "diff",
 )
 
-gazelle(
-    name = "gazelle-update-repos",
-    args = [
-        "-from_file=go.work",
-        "-to_macro=toolchains/go_module_deps.bzl%go_dependencies",
-        "-build_file_proto_mode=disable_global",
-        "-build_file_generation=on",
-        "-prune",
-    ],
-    command = "update-repos",
-)
-
 bazeldnf(name = "bazeldnf")
 
 buildifier_test(

CMakeLists.txt

@@ -94,7 +94,7 @@ add_test(NAME integration-license COMMAND bash -c "go test -tags integration" WO
 add_custom_target(format
   COMMAND bash -c "${BAZEL} run //:buildifier-fix"
   COMMAND bash -c "${BAZEL} run //:gazelle"
-  COMMAND bash -c "${BAZEL} run //:gazelle-update-repos"
+  COMMAND bash -c "${BAZEL} run //bazel/ci:tidy"
   COMMAND bash -c "shfmt -i 2 -s -w -sr $(shfmt -f ${CMAKE_SOURCE_DIR} | grep -v helm/charts/cilium)"
   COMMAND bash -c "gofumpt -l -w ${CMAKE_SOURCE_DIR}"
   VERBATIM

bazel/ci/BUILD.bazel

@@ -0,0 +1,12 @@
+sh_binary(
+    name = "tidy",
+    srcs = ["tidy.sh"],
+    data = [
+        "@bazel_gazelle//cmd/gazelle",
+        "@go_sdk//:bin/go",
+    ],
+    env = {
+        "GAZELLE": "$(location @bazel_gazelle//cmd/gazelle)",
+        "GO": "$(location @go_sdk//:bin/go)",
+    },
+)

bazel/ci/tidy.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+shopt -s inherit_errexit
+
+# shellcheck disable=SC2153
+gazelle=$(realpath "${GAZELLE}")
+go=$(realpath "${GO}")
+
+cd "${BUILD_WORKSPACE_DIRECTORY}"
+
+submodules=$(${go} list -f '{{.Dir}}' -m)
+
+for mod in ${submodules}; do
+  ${go} mod tidy -C "${mod}"
+done
+
+${gazelle} update-repos \
+  -from_file=go.work \
+  -to_macro=toolchains/go_module_deps.bzl%go_dependencies \
+  -build_file_proto_mode=disable_global \
+  -build_file_generation=on \
+  -prune