Refactor with tidy workflow and jobs

Author: chouetz

.github/chainguard/self.bazel-native-tidy.push-branch.sts.yaml

@@ -87,6 +87,31 @@ jobs:
           token: ${{ steps.setup.outputs.token }}
           commit-message: "[renovate skip] Auto-repin Bazel Rust lockfile and regenerate Rust licenses"
 
+  bazel_native_tidy:
+    if: ${{ github.repository == 'DataDog/datadog-agent' && github.event.pull_request.user.login == 'renovate[bot]' && contains(github.event.pull_request.labels.*.name, 'dependencies-bazel-native') }}
+    permissions:
+      id-token: write # Required for dd-octo-sts OIDC token
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.head_ref }}
+          fetch-depth: 0
+      - uses: ./.github/actions/deps-tidy-setup
+        id: setup
+      - name: Install dda
+        uses: ./.github/actions/install-dda
+        with:
+          features: legacy-tasks
+      - name: Refresh http_archive sha256 for changed deps
+        env:
+          BRANCH: ${{ github.event.pull_request.base.ref }}
+        run: dda inv -- renovate.refresh-archive-hashes --base-ref=origin/${BRANCH}
+      - uses: ./.github/actions/deps-tidy-push
+        with:
+          token: ${{ steps.setup.outputs.token }}
+          commit-message: "[renovate skip] Auto-refresh http_archive sha256"
+
   bazel_tidy:
     if: ${{ github.repository == 'DataDog/datadog-agent' && github.event.pull_request.user.login == 'renovate[bot]' && contains(github.event.pull_request.labels.*.name, 'dependencies-bazel') }}
     permissions:

.github/workflows/bazel-native-tidy.yml

@@ -12,7 +12,6 @@
     agent_ci_api,
     ami,
     auth,
-    bazel,
     bench,
     buildimages,
     claude,
@@ -70,6 +69,7 @@
     python_version,
     quality_gates,
     release,
+    renovate,
     rtloader,
     sbomgen,
     schema,
@@ -199,7 +199,6 @@
 ns.add_collection(agent)
 ns.add_collection(ami)
 ns.add_collection(agent_ci_api)
-ns.add_collection(bazel)
 ns.add_collection(buildimages)
 ns.add_collection(claude)
 ns.add_collection(cluster_agent)
@@ -242,6 +241,7 @@
 ns.add_collection(setup)
 ns.add_collection(systray)
 ns.add_collection(release)
+ns.add_collection(renovate)
 ns.add_collection(rtloader)
 ns.add_collection(system_probe)
 ns.add_collection(process_agent)

.github/workflows/deps-tidy.yml

@@ -1,5 +1,5 @@
 """
-Bazel maintenance tasks.
+Renovate maintenance tasks.
 
 The first task here, ``refresh_archive_hashes``, is the companion to the
 Renovate auto-bump flow for native deps pinned via ``http_archive(...)`` in
@@ -21,9 +21,9 @@
 import urllib.request
 from pathlib import Path
 
-from invoke import task
 from invoke.context import Context
 from invoke.exceptions import Exit
+from invoke.tasks import task
 
 REPO_ROOT = Path(__file__).resolve().parent.parent
 MODULE_FILE = REPO_ROOT / "deps" / "repos.MODULE.bazel"
@@ -46,6 +46,68 @@
 URL_LITERAL_RE = re.compile(r'"(https?://[^"\s]+)"')
 
 
+@task(
+    help={
+        "base_ref": "Git ref to compare against to detect changed http_archive blocks. "
+        "Defaults to origin/main, which suits the bazel-native-tidy workflow. "
+        "For local testing pass HEAD~1 or any other ref."
+    }
+)
+def refresh_archive_hashes(ctx: Context, base_ref: str = "origin/main") -> None:
+    """
+    Recompute sha256 for any http_archive in deps/repos.MODULE.bazel whose
+    version literal differs from ``base_ref``.
+
+    Used by ``.github/workflows/bazel-native-tidy.yml`` after Renovate bumps a
+    version. Renovate cannot refresh ``sha256`` itself; this task downloads the
+    new tarball from the first reachable URL, hashes it, and rewrites the
+    source so the next Bazel build verifies cleanly.
+    """
+    current_text = MODULE_FILE.read_text()
+    current_blocks = _parse_archive_blocks(current_text)
+
+    result = ctx.run(f"git show {base_ref}:deps/repos.MODULE.bazel", hide=True, warn=True)
+    if not result.ok:
+        raise Exit(f"Could not read deps/repos.MODULE.bazel at {base_ref!r}: {result.stderr.strip()}")
+    previous_blocks = _parse_archive_blocks(result.stdout)
+
+    needs_refresh: list[str] = []
+    for name, body in current_blocks.items():
+        prev = previous_blocks.get(name)
+        if prev is None:
+            # New http_archive added in this PR — initial sha256 is the human's job.
+            continue
+        if _block_signature(body) != _block_signature(prev):
+            needs_refresh.append(name)
+
+    if not needs_refresh:
+        print("No http_archive blocks need sha256 refresh.")
+        return
+
+    print(f"Refreshing sha256 for {len(needs_refresh)} block(s): {', '.join(needs_refresh)}")
+    new_text = current_text
+    for name in needs_refresh:
+        body = _parse_archive_blocks(new_text)[name]
+        urls = _extract_urls(body)
+        if not urls:
+            print(f"  ! {name}: skipping — no literal URL found in block")
+            continue
+        old_sha = _extract_sha256(body)
+        print(f"  → {name}: downloading from {urls[0]}")
+        new_sha = _download_and_hash(urls)
+        if new_sha == old_sha:
+            print(f"    sha256 unchanged ({old_sha[:12]}...)")
+            continue
+        new_text = _replace_sha256_in_block(new_text, name, new_sha)
+        print(f"    sha256 {old_sha[:12]}... -> {new_sha[:12]}...")
+
+    if new_text != current_text:
+        MODULE_FILE.write_text(new_text)
+        print(f"Updated {MODULE_FILE.relative_to(REPO_ROOT)}.")
+    else:
+        print("No sha256 values changed.")
+
+
 def _parse_archive_blocks(text: str) -> dict[str, str]:
     """Return a mapping of http_archive name -> raw block body."""
     blocks: dict[str, str] = {}
@@ -111,65 +173,3 @@ def repl(match: re.Match[str]) -> str:
     if count == 0:
         raise Exit(f"Could not locate http_archive block for {archive_name!r}")
     return new_text
-
-
-@task(
-    help={
-        "base_ref": "Git ref to compare against to detect changed http_archive blocks. "
-        "Defaults to origin/main, which suits the bazel-native-tidy workflow. "
-        "For local testing pass HEAD~1 or any other ref."
-    }
-)
-def refresh_archive_hashes(ctx: Context, base_ref: str = "origin/main") -> None:
-    """
-    Recompute sha256 for any http_archive in deps/repos.MODULE.bazel whose
-    version literal differs from ``base_ref``.
-
-    Used by ``.github/workflows/bazel-native-tidy.yml`` after Renovate bumps a
-    version. Renovate cannot refresh ``sha256`` itself; this task downloads the
-    new tarball from the first reachable URL, hashes it, and rewrites the
-    source so the next Bazel build verifies cleanly.
-    """
-    current_text = MODULE_FILE.read_text()
-    current_blocks = _parse_archive_blocks(current_text)
-
-    result = ctx.run(f"git show {base_ref}:deps/repos.MODULE.bazel", hide=True, warn=True)
-    if not result.ok:
-        raise Exit(f"Could not read deps/repos.MODULE.bazel at {base_ref!r}: {result.stderr.strip()}")
-    previous_blocks = _parse_archive_blocks(result.stdout)
-
-    needs_refresh: list[str] = []
-    for name, body in current_blocks.items():
-        prev = previous_blocks.get(name)
-        if prev is None:
-            # New http_archive added in this PR — initial sha256 is the human's job.
-            continue
-        if _block_signature(body) != _block_signature(prev):
-            needs_refresh.append(name)
-
-    if not needs_refresh:
-        print("No http_archive blocks need sha256 refresh.")
-        return
-
-    print(f"Refreshing sha256 for {len(needs_refresh)} block(s): {', '.join(needs_refresh)}")
-    new_text = current_text
-    for name in needs_refresh:
-        body = _parse_archive_blocks(new_text)[name]
-        urls = _extract_urls(body)
-        if not urls:
-            print(f"  ! {name}: skipping — no literal URL found in block")
-            continue
-        old_sha = _extract_sha256(body)
-        print(f"  → {name}: downloading from {urls[0]}")
-        new_sha = _download_and_hash(urls)
-        if new_sha == old_sha:
-            print(f"    sha256 unchanged ({old_sha[:12]}...)")
-            continue
-        new_text = _replace_sha256_in_block(new_text, name, new_sha)
-        print(f"    sha256 {old_sha[:12]}... -> {new_sha[:12]}...")
-
-    if new_text != current_text:
-        MODULE_FILE.write_text(new_text)
-        print(f"Updated {MODULE_FILE.relative_to(REPO_ROOT)}.")
-    else:
-        print("No sha256 values changed.")