Bazel tooling that runs static analyzers as aspects and normalizes their output to SARIF. It does two things:
- Lints — Starlark aspects that run each language's analyzers as Bazel aspects (so they ride the action cache), per-language Go wrappers that normalize each tool's output to SARIF (native where the tool emits it, converted where it does not), and a shared architecture-test library.
- Scaffolds builds — macros (e.g.
web_project) that generate a project's whole Bazel build graph so consumers stop hand-wiring it.
Built for the Gavel quality platform, but
usable on its own: the interface is SARIF files on disk (output group
gavel_submissions) — no Go imports cross the boundary, so any SARIF-aware
consumer can read the results.
Note
Alpha. Aspect labels, the catalog format, and the macro API may still change.
gavel-tools is published to the Bazel Central Registry. Depend on it by version — no extra registry configuration needed:
# MODULE.bazel — pin the latest version listed in the registry
bazel_dep(name = "gavel_tools", version = "0.3.10")Run a lint aspect over your targets — findings land as *.sarif under
bazel-bin/:
bazel build //... \
--aspects=@gavel_tools//lint/aspects:defs.bzl%go_golangci_lint_submission_aspect \
--output_groups=gavel_submissionsOr scaffold a frontend's entire build graph (esbuild + tailwind + tsc + eslint) from one declaration:
load("@gavel_tools//macros:web.bzl", "web_project")| Language | Aspects |
|---|---|
| Go | golangci-lint, archtest |
| Java | PMD, CPD, SpotBugs, Error Prone, archtest |
| Python | Ruff, Bandit, pycompile, archtest |
| TypeScript | ESLint, archtest |
| Rust | Clippy, archtest |
Warning
Two aspects run hermetic through gavel-owned glue coupled to build-rule
internals, and fail at lint time, not build time if that glue drifts: the
Go golangci-lint driver (which needs --@rules_go//go/config:export_stdlib=True)
and the TypeScript ESLint pnpm-store repair. Re-validate the relevant one
whenever you bump rules_go / golangci-lint or rules_js / ESLint — the
maintenance contracts are in
the hermetic analyzer driver.
The docs/ bundle explains the design — the hermetic driver,
the SARIF boundary, the language catalog, and the web_project macro. It is an
Open Knowledge Format
bundle: each concept is one markdown file with a type / title / description
header, indexed by index.md.