Release 0.3.0: hermetic rules on all six platforms, uv_audit_test, and a six-platform CI matrix

[amsokol]

Release 0.3.0: every public rule works without host tools on linux, darwin, and windows (amd64 and arm64), and CI checks this on all six platforms.

Changes

Dependency updates (every release is at least 2 days old; each sha256 is from the upstream checksum file and checked against the download):

• protoc-gen-protovalidate-buffa v0.10.2 (catalog and pin).
• ruff 0.16.10, rules_go 0.64.1.
• uv 0.12.23, fetched directly from its GitHub release like ruff.
• markdown: aspect_rules_js 3.5.1, rules_nodejs 6.7.6, Node 24.21.0, pnpm 12.10.1. Node and pnpm checksums are pinned here because those versions are newer than the rules' catalogs.

No host bash or Python on Windows:

• bazel_utils_core downloads busybox-w32 (amd64, arm64).
• Test and run rules return a .bat launcher that runs the wrapper with busybox sh. buf_module and buf_generate run their scripts with busybox instead of run_shell. Wrappers are ash-compatible.
• Prebuilt binaries get a .exe output on Windows. buf_plugin keeps the wrapped binary's extension.
• protoc-gen-buffa, protoc-gen-buffa-packaging, and protoc-gen-connect-rust have no aarch64 Windows build upstream, so windows-arm64 uses the x64 build under emulation.
• protoc.plugin zips are extracted at build time with bsdtar from tar.bzl. Bazel 9.2's own zip reader crashes on protobuf-go's zip comment.
• Bazel's Windows test env has no %LocalAppData% or %USERPROFILE%, so the Go wrappers point them at the test tmpdir.
• markdownlint_test needs build:windows --enable_runfiles, because rules_js's js_binary needs a runfiles tree.
• Wrappers find the workspace through the runfiles manifest: on Windows the runfiles tree holds copies, not links to the checkout.
• aspect_rules_py is dropped: 1.12.1 failed on Windows hosts ("Unsupported platform windows") and broke analysis of the whole build.

Breaking: pip_audit_test is replaced by uv_audit_test, which runs uv audit --frozen with the pinned uv. flags are now uv audit flags, and the binary override attr is uv. The python module no longer ships pip-audit, its lock, or a Python toolchain. uv audit is a uv preview feature; the wrapper opts in with --preview-features audit-command.

Fixed:

• protoc-gen-grpc-gateway v2.31.0 windows-arm64 pinned protoc-gen-openapiv2's sha256. Bazel's repository cache is keyed by sha256, so Windows arm64 builds could silently get the openapiv2 binary. The new catalog_test fails when one sha256 is pinned for two URLs or a version is missing one of the six platforms.
• golangci_test and govulncheck_test run in the go.mod directory, so a go.mod below the repo root works. The README documents that layout, but it failed with "directory prefix … does not contain main module".

Tests and CI:

• tests/ has a fixture for every public rule, including buf_generate with all nine prebuilt plugins.
• CI is one matrix: ubuntu-24.04, ubuntu-24.04-arm, macos-15-intel, macos-15, windows-2025, windows-11-arm. It runs on pull requests, v* tags, and manual dispatch.
• Each job builds and tests //... and runs the three format targets, which must leave the checkout unchanged.
• Windows jobs set a missing --shell_executable, so any use of a host bash fails.

Repo: Cursor rules are removed. CLAUDE.md holds the maintainer notes: the 2-day quarantine, pin locations, Windows and ash rules, testing, and versioning.

Test plan

• CI green on all six platforms: build, 14 tests, and three format targets with no changes.
• golangci-lint, buf lint, uv audit, and catalog_test fail when an error is added on purpose.
• Every wrapper runs under busybox ash locally, both with manifest-only runfiles and with a copied runfiles tree.

🤖 Generated with Claude Code