ci: enable buildifier check on ci

.github/workflows/buildifier.yaml

@@ -0,0 +1,20 @@
+name: Buildifier
+
+# Controls when the action will run.
+on:
+  # Triggers the workflow on push or pull request events but only for the main branch
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: buildifier
+        run: bazel run --enable_bzlmod //:buildifier.check

BUILD.bazel

@@ -1,6 +1,7 @@
 load("@aspect_bazel_lib_host//:defs.bzl", "host")
 load("@bazel_skylib//:bzl_library.bzl", "bzl_library")
 load("@bazel_gazelle//:def.bzl", "DEFAULT_LANGUAGES", "gazelle", "gazelle_binary")
+load("@buildifier_prebuilt//:rules.bzl", "buildifier")
 load("//lib:write_source_files.bzl", "write_source_files")
 load("//lib:yq.bzl", "yq")
 load("//lib:diff_test.bzl", "diff_test")
@@ -33,6 +34,15 @@ gazelle(
     command = "update-repos",
 )
 
+buildifier(
+    name = "buildifier.check",
+    exclude_patterns = [
+        "./.git/*",
+    ],
+    lint_mode = "warn",
+    mode = "diff",
+)
+
 bzl_library(
     name = "internal_deps",
     srcs = ["internal_deps.bzl"],

MODULE.bazel

@@ -28,3 +28,4 @@ register_toolchains(
 # Development-only dependencies
 
 bazel_dep(name = "bazel_skylib_gazelle_plugin", version = "1.4.1", dev_dependency = True)
+bazel_dep(name = "buildifier_prebuilt", version = "6.0.0.1", dev_dependency = True)

WORKSPACE

@@ -46,3 +46,12 @@ go_rules_dependencies()
 go_register_toolchains(version = "1.18.3")
 
 gazelle_dependencies()
+
+# Buildifier
+load("@buildifier_prebuilt//:deps.bzl", "buildifier_prebuilt_deps")
+
+buildifier_prebuilt_deps()
+
+load("@buildifier_prebuilt//:defs.bzl", "buildifier_prebuilt_register_toolchains")
+
+buildifier_prebuilt_register_toolchains()

internal_deps.bzl

@@ -53,6 +53,15 @@ def bazel_lib_internal_deps():
         ],
     )
 
+    http_archive(
+        name = "buildifier_prebuilt",
+        sha256 = "e46c16180bc49487bfd0f1ffa7345364718c57334fa0b5b67cb5f27eba10f309",
+        strip_prefix = "buildifier-prebuilt-6.1.0",
+        urls = [
+            "https://github.com/keith/buildifier-prebuilt/archive/6.1.0.tar.gz",
+        ],
+    )
+
     # Register toolchains for tests
     register_jq_toolchains()
     register_yq_toolchains()