feat: convert checksum_updater tool to Bazel-native build

🎯 DOGFOODING SUCCESS: Now practicing what we preach!

**Key Changes:**
- Fixed module import in main.rs (checksum_updater_lib → checksum_updater)
- Added proper lib declaration to Cargo.toml
- Updated BUILD.bazel with correct rule names and dependencies
- Migrated CI from Cargo to Bazel builds
- Replaced 'cargo build/test' with 'bazel build/test'
- Updated all tool invocations to use 'bazel run'

**Why This Matters:**
- Eliminates hypocrisy: We build Bazel rules but used Cargo for our tools
- Consistent with our principle: 'Bazel-native solutions first'
- Resolves weekly checksum update failures (Issues #106, #103, #79)
- Demonstrates proper dogfooding of our own rules

**CI Improvements:**
- Uses setup-bazel action instead of Rust toolchain
- Runs comprehensive Bazel tests instead of cargo test
- Better caching with Bazel's hermetic builds
- Cross-platform compatibility by design

This completes the first tool conversion in our dogfooding initiative.

Author: avrabe

.github/workflows/weekly-checksum-update.yml

@@ -28,8 +28,9 @@ permissions:
   issues: write
 
 env:
-  CARGO_TERM_COLOR: always
-  RUST_BACKTRACE: 1
+  # Bazel cache optimization
+  USE_BAZEL_VERSION: 8.0.0
+  BAZEL_CXXOPTS: "-std=c++17"
 
 jobs:
   checksum-update:
@@ -43,16 +44,12 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
           fetch-depth: 0
 
-      - name: Set up Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+      - name: Set up Bazel
+        uses: bazel-contrib/setup-bazel@0.8.7
         with:
-          components: rustfmt, clippy
-
-      - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: "tools/checksum_updater"
-          cache-on-failure: true
+          bazelisk-cache: true
+          disk-cache: ${{ github.workflow }}
+          repository-cache: true
 
       - name: Install system dependencies
         run: |
@@ -61,9 +58,8 @@ jobs:
 
       - name: Build checksum updater tool
         run: |
-          cd tools/checksum_updater
-          cargo build --release
-          cargo test --release
+          bazel build //tools/checksum_updater:checksum_updater_bin
+          bazel test //tools/checksum_updater:checksum_updater_test //tools/checksum_updater:integration_test //tools/checksum_updater:json_validation_test
 
       - name: Configure Git
         run: |
@@ -83,8 +79,6 @@ jobs:
       - name: Run checksum updates
         id: update
         run: |
-          cd tools/checksum_updater
-
           # Determine which tools to update
           TOOLS="${{ github.event.inputs.tools || 'all' }}"
           FORCE_FLAG=""
@@ -101,9 +95,9 @@ jobs:
 
           # Run the updater and capture output
           if [ "$TOOLS" = "all" ]; then
-            ./target/release/checksum_updater update-all $FORCE_FLAG $DRY_RUN_FLAG --output-format json > update_results.json
+            bazel run //tools/checksum_updater:checksum_updater_bin -- update-all $FORCE_FLAG $DRY_RUN_FLAG --output-format json > update_results.json
           else
-            ./target/release/checksum_updater update --tools "$TOOLS" $FORCE_FLAG $DRY_RUN_FLAG --output-format json > update_results.json
+            bazel run //tools/checksum_updater:checksum_updater_bin -- update --tools "$TOOLS" $FORCE_FLAG $DRY_RUN_FLAG --output-format json > update_results.json
           fi
 
           # Check if any updates were made
@@ -116,10 +110,10 @@ jobs:
           echo "errors_count=$ERRORS_COUNT" >> $GITHUB_OUTPUT
 
           # Store results for later steps
-          cp update_results.json ../../update_results.json
+          cp update_results.json ./update_results.json
 
           # Generate summary for PR description
-          ./target/release/checksum_updater generate-summary update_results.json > ../../update_summary.md
+          bazel run //tools/checksum_updater:checksum_updater_bin -- generate-summary update_results.json > ./update_summary.md
 
       - name: Validate updated checksums
         if: steps.update.outputs.updates_count > 0
@@ -136,8 +130,7 @@ jobs:
           done
 
           # Test that registry.bzl loads correctly
-          cd tools/checksum_updater
-          ./target/release/checksum_updater validate --all
+          bazel run //tools/checksum_updater:checksum_updater_bin -- validate --all
 
           echo "✅ All checksums validated successfully"
 
@@ -177,7 +170,6 @@ jobs:
         run: |
           # Add all changed files
           git add checksums/
-          git add tools/checksum_updater/
 
           # Create detailed commit message
           cat > commit_message.txt << 'EOF'

tools/checksum_updater/BUILD.bazel

@@ -8,10 +8,10 @@ package(default_visibility = ["//visibility:public"])
 
 # Main checksum updater binary
 rust_binary(
-    name = "checksum_updater",
+    name = "checksum_updater_bin",
     srcs = ["src/main.rs"],
     deps = [
-        ":checksum_updater_lib",
+        ":checksum_updater",
         "@crates//:anyhow",
         "@crates//:clap",
         "@crates//:regex",
@@ -24,7 +24,7 @@ rust_binary(
 
 # Checksum updater library
 rust_library(
-    name = "checksum_updater_lib",
+    name = "checksum_updater",
     srcs = [
         "src/checksum_manager.rs",
         "src/github_client.rs",
@@ -56,7 +56,7 @@ rust_library(
 # Unit tests
 rust_test(
     name = "checksum_updater_test",
-    crate = ":checksum_updater_lib",
+    crate = ":checksum_updater",
     deps = [
         "@crates//:tempfile",
         "@crates//:tokio-test",
@@ -68,10 +68,10 @@ rust_test(
     name = "integration_test",
     srcs = ["tests/integration_test.rs"],
     data = [
-        ":checksum_updater",
+        ":checksum_updater_bin",
     ],
     deps = [
-        ":checksum_updater_lib",
+        ":checksum_updater",
         "@crates//:anyhow",
         "@crates//:serde_json",
         "@crates//:tempfile",
@@ -85,13 +85,19 @@ rust_test(
     name = "json_validation_test",
     srcs = ["tests/json_validation_test.rs"],
     data = [
-        ":checksum_updater",
+        ":checksum_updater_bin",
     ],
     deps = [
-        ":checksum_updater_lib",
+        ":checksum_updater",
         "@crates//:anyhow",
         "@crates//:semver",
         "@crates//:serde_json",
         "@crates//:tokio",
     ],
 )
+
+# Alias for easier usage (CLI tool)
+alias(
+    name = "updater",
+    actual = ":checksum_updater_bin",
+)