bazelbuild/bazel: 2 workflows skip the step the other 7 use

Of Bazel's 9 GitHub workflows, 7 open with step-security/harden-runner; ssl-monitor.yml and trigger-docs-update.yml don't. One rule checks the team's convention in every workflow, next to the headers and settings reviewers keep by hand.This config was written to test alint; Bazel doesn't use alint.

What alint found

.alint.yml

- id: bazel-gha-uses-step-security-harden-runner
  kind: file_content_matches
  paths:
    - ".github/workflows/*.yml"
    - ".github/workflows/*.yaml"
  pattern: 'step-security/harden-runner@'
  level: warning

⚠︎ warning bazel-gha-uses-step-security-harden-runner

ssl-monitor.yml and trigger-docs-update.yml skip the harden-runner step.

.alint.yml

- id: bazel-bzl-apache-license-header
  kind: file_header
  paths:
    include:
      - "**/*.bzl"
    exclude:
      - "**/testdata/**"
      - "**/test_data/**"
  pattern: '# Copyright [0-9]{4} The Bazel Authors\. All rights reserved\.'
  lines: 5
  level: warning

⚠︎ warning bazel-bzl-apache-license-header

The example rule file examples/windows/dll/windows_dll_library.bzl has no license header.

The bundled GitHub Actions rules (alint 0.16.1, on the workflows as of 7 May 2026) flag trigger-docs-update.yml for declaring no permissions, and 5 action references in 3 workflows that aren't pinned to a commit.

The config

Other conventions are kept by review: the Apache header on Java, C++, shell and Starlark files, and the settings in .gitattributes. The config checks those, the Bazel layout at the root and the workflows, and runs buildifier and ShellCheck from command rules. Two import_gate rules carry Bazel's layering checks for the JNI headers and sun.misc.Unsafe.

.alint.yml

- id: bazel-version-file-exists
  kind: file_exists
  paths: ".bazelversion"
  root_only: true
  respect_gitignore: false
  level: error
  policy_url: "https://bazel.build/install/bazelisk"

.bazelversion is tracked, and also listed in .gitignore so contributors can try other Bazel versions locally. alint skips ignored files unless a rule says otherwise, which is what respect_gitignore: false does.

What stays outside alint

Starlark semantics and the build itself stay with Bazel's tools:

cc_library dependencies, glob() results, target visibility and load order, which buildifier and bazel query own;
most of the Buildkite task matrix, which needs a list-membership rule alint doesn't have;
whether MODULE.bazel.lock is current. A generated_file_fresh rule could run Bazel to check it; the config leaves that to CI.