Bazel: Add unified hermetic:tidy target for workspace formatting

BUILD.bazel

@@ -484,12 +484,52 @@ sh_binary(
     ],
 )
 
+# --- Bazel linting (buildifier -lint=warn) --------------------------------
+
+# buildifier: disable=native-sh-test
+sh_test(
+    name = "lint_bzl_test",
+    srcs = ["//bazel:bzl_lint_test.sh"],
+    args = ["$(rootpath @buildifier_prebuilt//:buildifier)"],
+    data = [
+        "@buildifier_prebuilt//:buildifier",
+    ],
+    tags = ["local"],
+)
+
+# --- Bazel formatting check (buildifier -mode=check -lint=off) ------------
+
+# buildifier: disable=native-sh-test
+sh_test(
+    name = "fmt_bzl_test",
+    srcs = ["//bazel:bzl_fmt_test.sh"],
+    args = ["$(rootpath @buildifier_prebuilt//:buildifier)"],
+    data = [
+        "@buildifier_prebuilt//:buildifier",
+    ],
+    tags = ["local"],
+)
+
+# --- Bazel auto-format only (buildifier -mode=fix) ------------------------
+
+# buildifier: disable=native-sh-binary
+sh_binary(
+    name = "tidy_bzl",
+    srcs = ["//bazel:bzl_tidy.sh"],
+    args = ["$(rootpath @buildifier_prebuilt//:buildifier)"],
+    data = [
+        "@buildifier_prebuilt//:buildifier",
+    ],
+)
+
 # --- Umbrella targets ------------------------------------------------------
 
 test_suite(
     name = "lint_test",
     tests = [
+        ":fmt_bzl_test",
         ":fmt_tcl_test",
+        ":lint_bzl_test",
         ":lint_tcl_test",
     ],
 )
@@ -505,12 +545,19 @@ sh_binary(
         "$(rootpath //bazel:tclfmt)",
         "$(rootpath //bazel:tcl_lint_test.sh)",
         "$(rootpath //bazel:tclint)",
+        "$(rootpath //bazel:bzl_tidy.sh)",
+        "$(rootpath @buildifier_prebuilt//:buildifier)",
+        "$(rootpath //bazel:bzl_lint_test.sh)",
+        "$(rootpath @buildifier_prebuilt//:buildifier)",
     ],
     data = [
         "tclint.toml",
+        "//bazel:bzl_lint_test.sh",
+        "//bazel:bzl_tidy.sh",
         "//bazel:tcl_lint_test.sh",
         "//bazel:tcl_tidy.sh",
         "//bazel:tclfmt",
         "//bazel:tclint",
+        "@buildifier_prebuilt//:buildifier",
     ],
 )

MODULE.bazel

@@ -96,6 +96,7 @@ bazel_dep(name = "toolchains_llvm", version = "1.5.0")
 # --- Dev dependencies (not propagated to downstream consumers) ---
 
 bazel_dep(name = "bant", version = "0.2.4", dev_dependency = True)
+bazel_dep(name = "buildifier_prebuilt", version = "8.5.1.2", dev_dependency = True)
 bazel_dep(name = "googletest", version = "1.17.0.bcr.2", dev_dependency = True)
 bazel_dep(name = "rules_pkg", version = "1.2.0", dev_dependency = True)
 bazel_dep(name = "rules_verilator", version = "0.1.0", dev_dependency = True)

bazel/BUILD

@@ -7,10 +7,13 @@ package(features = ["layering_check"])
 
 exports_files(
     [
+        "bzl_fmt_test.sh",
+        "bzl_lint_test.sh",
+        "bzl_tidy.sh",
         "fix_lint.sh",
         "install.sh",
-        "tcl_lint_test.sh",
         "tcl_fmt_test.sh",
+        "tcl_lint_test.sh",
         "tcl_tidy.sh",
     ],
     visibility = ["//visibility:public"],

bazel/bzl_fmt_test.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright (c) 2025-2026, The OpenROAD Authors
+#
+# Check that all Bazel files are properly formatted (no lint warnings).
+set -euo pipefail
+TOOL="$(readlink -f "$1")"
+WORKSPACE="$(dirname "$(readlink -f MODULE.bazel)")"
+cd "$WORKSPACE"
+# `git ls-files` skips submodule contents (src/sta, third-party/abc).
+# Explicit -mode=check -lint=off separates format errors from lint warnings,
+# and overrides the repo-root .buildifier.json default (mode: fix).
+git ls-files '*.bazel' '*.bzl' '**/BUILD' 'BUILD' '**/WORKSPACE' 'WORKSPACE' -z \
+    | xargs -0 "$TOOL" -mode=check -lint=off

bazel/bzl_lint_test.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright (c) 2025-2026, The OpenROAD Authors
+#
+# Lint all Bazel files using buildifier (check-only, with lint warnings).
+set -euo pipefail
+TOOL="$(readlink -f "$1")"
+WORKSPACE="$(dirname "$(readlink -f MODULE.bazel)")"
+cd "$WORKSPACE"
+# `git ls-files` skips submodule contents (src/sta, third-party/abc), so
+# we never try to reformat files owned by another repo.
+# Explicit -mode=check overrides the repo-root .buildifier.json default.
+git ls-files '*.bazel' '*.bzl' '**/BUILD' 'BUILD' '**/WORKSPACE' 'WORKSPACE' -z \
+    | xargs -0 "$TOOL" -mode=check -lint=warn

bazel/bzl_tidy.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright (c) 2025-2026, The OpenROAD Authors
+#
+# Auto-format all Bazel files in-place using buildifier.
+set -euo pipefail
+TOOL="$(cd "$(dirname "$1")" && pwd)/$(basename "$1")"
+cd "${BUILD_WORKSPACE_DIRECTORY:-$PWD}"
+# `git ls-files` skips submodule contents (src/sta, third-party/abc),
+# so we never rewrite files owned by another repo.
+git ls-files '*.bazel' '*.bzl' '**/BUILD' 'BUILD' '**/WORKSPACE' 'WORKSPACE' -z \
+    | xargs -0 "$TOOL" -mode=fix -lint=fix

bazel/fix_lint.sh

@@ -1,9 +1,9 @@
 #!/usr/bin/env bash
 # SPDX-License-Identifier: BSD-3-Clause
-# Copyright (c) 2025-2025, The OpenROAD Authors
+# Copyright (c) 2025-2026, The OpenROAD Authors
 #
-# Auto-fix then lint. Delegates to tcl_tidy.sh and tcl_lint_test.sh
-# so that file-discovery logic is not duplicated (DRY).
+# Auto-fix then lint. Delegates to per-language tidy/lint scripts so
+# that file-discovery logic is not duplicated (DRY).
 set -euo pipefail
 
 export BUILD_WORKSPACE_DIRECTORY="${BUILD_WORKSPACE_DIRECTORY:-$PWD}"
@@ -12,6 +12,10 @@ export BUILD_WORKSPACE_DIRECTORY="${BUILD_WORKSPACE_DIRECTORY:-$PWD}"
 "$1" "$2"
 "$3" "$4" || rc=$?
 
+# Bazel: auto-format then lint
+"$5" "$6"
+"$7" "$8" || rc=$?
+
 git -C "$BUILD_WORKSPACE_DIRECTORY" status
 
 if [ "${rc:-0}" -ne 0 ]; then

docs/contrib/LintTargets.md

@@ -61,13 +61,21 @@ the two umbrella targets.
 | `//:lint_tcl_test` | `sh_test` | Runs `tclint .` (lint rules) |
 | `//:fmt_tcl_test` | `sh_test` | Runs `tclfmt --check .` (formatting) |
 | `//:tidy_tcl` | `sh_binary` | Runs `tclfmt --in-place .` (auto-format) |
+| `//:lint_bzl_test` | `sh_test` | Runs `buildifier -mode=check -lint=warn` (lint rules) |
+| `//:fmt_bzl_test` | `sh_test` | Runs `buildifier -mode=check -lint=off` (formatting) |
+| `//:tidy_bzl` | `sh_binary` | Runs `buildifier -mode=fix -lint=fix` (auto-format) |
 
 ## Configuration
 
 TCL linting and formatting are controlled by `tclint.toml` at the repository
 root. See the [tclint documentation](https://tclint.readthedocs.io/) for
 available options.
 
+Bazel formatting and linting are controlled by `.buildifier.json` at the
+repository root. The test scripts (`bzl_lint_test.sh`, `bzl_fmt_test.sh`)
+explicitly pass `-mode=check` to override the default `mode: fix` in that
+config, ensuring they remain read-only checks.
+
 ## POLA
 
 `//:fix_lint` follows the
@@ -98,7 +106,6 @@ The following linters and formatters are planned for `//:lint_test` and
 - **C++ clang-tidy** — static analysis for C++ sources
 - **C++ clang-format** — formatting check/fix for C++ and header files
 - **Python ruff** — lint + format for Python scripts in `etc/`, `docs/`, tests
-- **Buildifier** — lint + format for BUILD, .bzl, and MODULE.bazel files
 - **ShellCheck** — lint for bash scripts in `test/`, `bazel/`, `etc/`
 - **Duplicate message ID check** — replace Jenkins "Find Duplicated Message IDs" stage
 - **Doc consistency checks** — replace Jenkins "Documentation Checks" stage