ci: add daily buildifier formatting cron that opens a PR on changes

.gitattributes

@@ -0,0 +1,6 @@
+# Test fixture workspaces are deliberately constructed inputs to the E2E tests
+# (e.g. module_bazel_comment exercises comment preservation, cquery_failing_target
+# encodes a specific failure scenario). Exclude them from aspect_rules_lint
+# formatters (buildifier/ktfmt) so the cron jobs never rewrite the very content
+# under test. `rules-lint-ignored` is honored by //cli/format and //cli/format:buildifier.
+cli/src/test/resources/** rules-lint-ignored

.github/workflows/buildifier.yaml

@@ -0,0 +1,64 @@
+name: Buildifier
+
+# Runs buildifier over all Starlark/BUILD files on a daily schedule and opens a
+# PR only if the formatter produced changes. Mirrors the ktfmt format cron: it
+# force-pushes a dedicated, bot-owned branch so re-runs reuse one PR instead of
+# accumulating stale branches, and it never touches master directly.
+#
+# Pinned to the repo's .bazelversion (no USE_BAZEL_VERSION) and run with
+# --lockfile_mode=off so MODULE.bazel.lock is never rewritten — that keeps the
+# generated PR limited to formatting-only changes.
+on:
+  schedule:
+    # 12:30 UTC daily (between the ktfmt format and coverage-badge crons).
+    - cron: '30 12 * * *'
+  workflow_dispatch:
+
+jobs:
+  buildifier:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Setup Java JDK
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - name: Setup Go environment
+        uses: actions/setup-go@v5
+        with:
+          go-version: ^1.17
+        id: go
+      - name: Setup Bazelisk
+        run: go install github.com/bazelbuild/bazelisk@latest && export PATH=$PATH:$(go env GOPATH)/bin
+      - uses: actions/checkout@v4
+      - name: Run buildifier
+        run: ~/go/bin/bazelisk run //cli/format:buildifier --enable_bzlmod=true --enable_workspace=false --lockfile_mode=off
+      - name: Open PR if formatting changed
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if [ -z "$(git status --porcelain)" ]; then
+            echo "No buildifier changes; nothing to do."
+            exit 0
+          fi
+          BRANCH="ci/buildifier-format"
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git checkout -B "$BRANCH"
+          git add -A
+          git commit -m "ci: apply buildifier formatting"
+          # Force-push the dedicated, bot-owned branch so re-runs reuse one PR
+          # instead of accumulating stale branches. This never touches master.
+          git push --force origin "$BRANCH"
+          if gh pr view "$BRANCH" --json state --jq '.state' 2>/dev/null | grep -q OPEN; then
+            echo "PR already open for $BRANCH; it now points at the latest formatting."
+          else
+            gh pr create \
+              --base master \
+              --head "$BRANCH" \
+              --title "ci: apply buildifier formatting" \
+              --body "Automated buildifier run via \`bazel run //cli/format:buildifier\`. This PR contains formatting-only changes to BUILD/Starlark files."
+          fi

.github/workflows/format.yaml

@@ -31,9 +31,10 @@ jobs:
         run: go install github.com/bazelbuild/bazelisk@latest && export PATH=$PATH:$(go env GOPATH)/bin
       - uses: actions/checkout@v4
       - name: Run ktfmt
-        env:
-          USE_BAZEL_VERSION: '9.x'
-        run: ~/go/bin/bazelisk run //cli/format --enable_bzlmod=true --enable_workspace=false
+        # Pinned to the repo's .bazelversion (no USE_BAZEL_VERSION) and run with
+        # --lockfile_mode=off so MODULE.bazel.lock is never rewritten, keeping the
+        # generated PR limited to formatting-only changes.
+        run: ~/go/bin/bazelisk run //cli/format --enable_bzlmod=true --enable_workspace=false --lockfile_mode=off
       - name: Open PR if formatting changed
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

MODULE.bazel

@@ -6,6 +6,7 @@ module(
 
 bazel_dep(name = "rules_license", version = "1.0.0", dev_dependency = True)
 bazel_dep(name = "aspect_rules_lint", version = "2.1.0", dev_dependency = True)
+bazel_dep(name = "buildifier_prebuilt", version = "8.5.1.2", dev_dependency = True)
 bazel_dep(name = "aspect_bazel_lib", version = "2.22.5", dev_dependency = True)
 
 bazel_dep(name = "bazel_skylib", version = "1.9.0")