feat(renovate): add bazel run //tasks:check_renovate_bazel_coverage target

Adds a py_binary so the coverage check can be invoked via Bazel without
needing dda/invoke. BUILD_WORKSPACE_DIRECTORY (set by `bazel run`) is
used to locate the repo root; direct `python tasks/renovate.py`
invocation falls back to the file's parent path.

Updates the validate-renovate-deps.yml workflow to use the new Bazel
target via the existing bazel-cache action, removing the dda dependency
from that workflow.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: chouetz

.github/workflows/validate-renovate-deps.yml

@@ -6,6 +6,7 @@ on:
       - "deps/**"
       - "renovate.json"
       - "tasks/renovate.py"
+      - "tasks/BUILD.bazel"
       - ".github/workflows/validate-renovate-deps.yml"
 
 permissions: {}
@@ -15,9 +16,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Install dda
-        uses: ./.github/actions/install-dda
-        with:
-          features: legacy-tasks
-      - name: Verify every http_archive in deps/ has Renovate coverage
-        run: dda inv -- renovate.check-bazel-coverage
+      - uses: ./.github/actions/bazel-cache
+      - name: Verify every http_archive/http_file in deps/ has Renovate coverage
+        run: bazel run //tasks:check_renovate_bazel_coverage

tasks/BUILD.bazel

@@ -1,3 +1,4 @@
+load("@rules_python//python:py_binary.bzl", "py_binary")
 load("@rules_python//python:py_library.bzl", "py_library")
 
 package(default_visibility = ["//visibility:private"])
@@ -13,3 +14,13 @@ py_library(
 )
 
 exports_files(["core_checks.py"])
+
+# No `data = [...]` for renovate.json / deps/ / .renovate-untracked.json on
+# purpose: the script resolves them via $BUILD_WORKSPACE_DIRECTORY (set by
+# `bazel run`) so it reads the live workspace, not the bazel sandbox. Adding
+# them as data deps would silently shadow the real files.
+py_binary(
+    name = "check_renovate_bazel_coverage",
+    srcs = ["renovate.py"],
+    deps = ["@py_dev_requirements//invoke"],
+)

tasks/renovate.py

@@ -20,9 +20,69 @@
 from invoke.exceptions import Exit
 
 REPO_ROOT = Path(__file__).resolve().parent.parent
-DEPS_DIR = REPO_ROOT / "deps"
-RENOVATE_FILE = REPO_ROOT / "renovate.json"
-ALLOWLIST_FILE = REPO_ROOT / "deps" / ".renovate-untracked.json"
+
+
+def main():
+    import sys
+
+    # BUILD_WORKSPACE_DIRECTORY is set by `bazel run`; fall back to the location
+    # of this file when invoked directly (e.g. python tasks/renovate.py).
+    _workspace = os.environ.get("BUILD_WORKSPACE_DIRECTORY")
+    _root = _workspace if _workspace else str(REPO_ROOT)
+    # Translate invoke's Exit to sys.exit so `bazel run` / direct python
+    # invocation produce the same stderr report + exit code as `dda inv`,
+    # whose runner catches Exit internally.
+    try:
+        check_bazel_coverage(Context(), _root)
+    except Exit as e:
+        if e.message:
+            print(e.message, file=sys.stderr)
+        sys.exit(e.code)
+
+
+@task
+def check_bazel_coverage(_: Context, root: str | None = None) -> None:
+    """
+    Fail if any http_archive or http_file in deps/ lacks a Renovate customManager.
+
+    Scans every ``*.MODULE.bazel`` file under ``deps/`` for ``http_archive``
+    and ``http_file`` calls. A dep is considered covered when either:
+      * its name appears as ``depNameTemplate`` in one of ``renovate.json``'s customManagers, or
+      * it is listed in ``deps/.renovate-untracked.json`` with a non-empty rationale.
+
+    Writes a markdown report to ``$GITHUB_STEP_SUMMARY`` when running in GitHub Actions.
+    """
+    root_path = Path(root) if root is not None else Path(REPO_ROOT)
+    dep_names = _parse_deps_dir(root_path / "deps")
+    tracked_names = _parse_renovate_json(root_path / "renovate.json")
+    allowlist = _parse_allowlist(root_path / "deps" / ".renovate-untracked.json")
+
+    untracked = dep_names - tracked_names - set(allowlist)
+    if untracked:
+        report = _emit_failure_report(untracked, allowlist)
+        summary_path = os.environ.get("GITHUB_STEP_SUMMARY")
+        if summary_path:
+            # GITHUB_STEP_SUMMARY is a shared file for the whole step; append
+            # rather than overwrite to play nice with any other writes.
+            with open(summary_path, "a", encoding="utf-8") as fh:
+                fh.write(report + "\n")
+        raise Exit(report, code=1)
+
+    print(
+        f"OK: {len(dep_names)} native deps (http_archive + http_file), "
+        f"{len(dep_names) - len(allowlist)} tracked by Renovate, "
+        f"{len(allowlist)} intentionally untracked."
+    )
+
+
+def _parse_deps_dir(deps_dir: Path) -> set[str]:
+    names: set[str] = set()
+    for path in deps_dir.rglob("*.MODULE.bazel"):
+        text = path.read_text()
+        for call in ("http_archive", "http_file"):
+            names |= _extract_call_names(text, call)
+    return names
+
 
 def _extract_call_names(text: str, call_name: str) -> set[str]:
     """Extract name = "..." from all call_name(...) blocks, regardless of arg order or comments."""
@@ -50,25 +110,20 @@ def _extract_call_names(text: str, call_name: str) -> set[str]:
                     i += 1
             i += 1
         block = text[pos + len(marker) : i - 1]
-        m = name_re.search(block)
+        uncommented = "\n".join(line for line in block.splitlines() if not line.lstrip().startswith("#"))
+        m = name_re.search(uncommented)
         if m:
             names.add(m.group(1))
         start = i
     return names
 
 
-def _parse_deps_dir(deps_dir: Path) -> set[str]:
-    names: set[str] = set()
-    for path in deps_dir.rglob("*.MODULE.bazel"):
-        text = path.read_text()
-        for call in ("http_archive", "http_file"):
-            names |= _extract_call_names(text, call)
-    return names
-
-
 def _parse_renovate_json(path: Path) -> set[str]:
+    # Assumption: renovate.json is plain JSON plus trailing commas only — no
+    # // or /* */ comments, no single-quoted strings. Renovate accepts the full
+    # JSON5 grammar but ours stays in this subset; if that changes, swap in a
+    # real JSON5 parser (e.g. the `json5` package) instead of extending this regex.
     raw = path.read_text()
-    # renovate.json is JSON5 (trailing commas allowed); strip them so json.loads accepts.
     stripped = re.sub(r",(\s*[}\]])", r"\1", raw)
     data = json.loads(stripped)
     return {cm["depNameTemplate"] for cm in data.get("customManagers", []) if "depNameTemplate" in cm}
@@ -114,32 +169,5 @@ def _emit_failure_report(untracked: set[str], allowlist: dict[str, str]) -> str:
     return "\n".join(lines)
 
 
-@task
-def check_bazel_coverage(_: Context) -> None:
-    """
-    Fail if any http_archive or http_file in deps/ lacks a Renovate customManager.
-
-    Scans every ``*.MODULE.bazel`` file under ``deps/`` for ``http_archive``
-    and ``http_file`` calls. A dep is considered covered when either:
-      * its name appears as ``depNameTemplate`` in one of ``renovate.json``'s customManagers, or
-      * it is listed in ``deps/.renovate-untracked.json`` with a non-empty rationale.
-
-    Writes a markdown report to ``$GITHUB_STEP_SUMMARY`` when running in GitHub Actions.
-    """
-    dep_names = _parse_deps_dir(DEPS_DIR)
-    tracked_names = _parse_renovate_json(RENOVATE_FILE)
-    allowlist = _parse_allowlist(ALLOWLIST_FILE)
-
-    untracked = dep_names - tracked_names - set(allowlist)
-    if untracked:
-        report = _emit_failure_report(untracked, allowlist)
-        summary_path = os.environ.get("GITHUB_STEP_SUMMARY")
-        if summary_path:
-            Path(summary_path).write_text(report + "\n", encoding="utf-8")
-        raise Exit(report, code=1)
-
-    print(
-        f"OK: {len(dep_names)} native deps (http_archive + http_file), "
-        f"{len(dep_names) - len(allowlist)} tracked by Renovate, "
-        f"{len(allowlist)} intentionally untracked."
-    )
+if __name__ == "__main__":
+    main()