Move the tools from Python to C++17 and Bazel

The scripts in use become programs run with `bazelisk run //tools:<tool>`,
and arguments follow `--`:

  amalgamate     the single-file distribution; --check only compares it
  check          licenses, convenience headers, header guards, file names,
                 versions and whether the distribution is up to date
  third-party    compares third_party/ with its archives, or writes it
  version        prints the version, or moves every place that states it
  release-notes  prints a section of the release notes
  repo-info      reports the checkout and the tools on PATH; --json writes
                 it through yyjson, with the fields of Tala's repo-info

amalgamate writes what the Python script wrote, byte for byte, except for
the time of generation. That line is gone so that the output is
deterministic and --check can compare it.

MODULE.bazel now pins the archives of third_party/ by version and sha256,
so Bazel fetches and checks them instead of a tool of ours, and Renovate
reads the versions there.

Scripts nobody used are gone: fixWhitespace, updateDocumentSnippets,
buildAndTest, and updateDocumentToC, which rewrote unrelated documents.
CheckConvenienceHeaders leaves CTest, since //tools:check runs it in CI.
The Python of tests/TestScripts stays: those are tests, not tools.

2 files changed, 22 insertions, 30 deletions

diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 4a634ea3..b1accb38 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -46,16 +46,16 @@
     "custom.regex",
   ],
 
-  // third_party/ holds copies of release archives, which
-  // tools/scripts/updateThirdParty.py pins by version and sha256. Renovate
-  // changes the version; the pull request then needs the new digest and
-  // --update, which the third_party check of CI asks for.
+  // third_party/ holds copies of release archives, which MODULE.bazel pins by
+  // version and sha256. Renovate changes the version; the pull request then
+  // needs the new digest and //tools:third-party -- --update, which the
+  // third_party check of CI asks for.
   customManagers: [
     {
       customType: "regex",
-      managerFilePatterns: ["/^tools/scripts/updateThirdParty\\.py$/"],
+      managerFilePatterns: ["/^MODULE\\.bazel$/"],
       matchStrings: [
-        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)( extractVersion=(?<extractVersion>\\S+))?\\s+\"version\": \"(?<currentValue>[^\"]+)\"",
+        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)( extractVersion=(?<extractVersion>\\S+))?\\s+\\w+_VERSION = \"(?<currentValue>[^\"]+)\"",
       ],
     },
   ],
diff --git a/.github/workflows/validate-header-guards.yml b/.github/workflows/validate-header-guards.yml
index a8ba91ba..41a4b0a4 100644
--- a/.github/workflows/validate-header-guards.yml
+++ b/.github/workflows/validate-header-guards.yml
@@ -19,31 +19,23 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Setup Dependencies
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      - uses: bazel-contrib/setup-bazel@c5acdfb288317d0b5c0bbd7a396a3dc868bb0f86 # 0.19.0
         with:
-            python-version: '3.12'
-
-      # Every header is guarded with #pragma once, as the Progmasoft C++ Style
-      # asks; the amalgamation script relies on it.
-      - name: Check that every header starts its guard with pragma once
-        run: |
-          wrong_files=$(grep -rL --include='*.hpp' '^#pragma once' src/Progmasoft || true)
-          if [[ $wrong_files ]]; then
-            echo "Headers without #pragma once:"
-            echo $wrong_files
-            exit 1
-          fi
-
-      - name: Check that there are no duplicated filenames
-        run: |
-          ./tools/scripts/checkDuplicateFilenames.py
-
-      - name: Check that all source files have the correct license header
-        run: |
-          ./tools/scripts/checkLicense.py
+          bazelisk-cache: true
+          repository-cache: true
+
+      - name: Test the tools
+        run: bazel test //tools:tools_tests
+        env:
+          CC: clang
+
+      - name: Check licenses, headers, file names, versions and the amalgamation
+        run: bazel run //tools:check
+        env:
+          CC: clang
 
       # third_party/ must be the pinned release archives, byte for byte.
       - name: Check that third_party matches its pinned archives
-        run: |
-          ./tools/scripts/updateThirdParty.py --check
+        run: bazel run //tools:third-party -- --check
+        env:
+          CC: clang