Hermetic Build Audit — check a Bazel workspace's build configuration, then fix it

Hermetic Build Audit: paste or drop one Bazel workspace's .bazelversion, .bazelrc, MODULE.bazel or WORKSPACE and the BUILD and .bzl files that matter. A free in-browser check with 21 rules reads every rc line, repository rule and target and flags what stops two machines from building the same bytes or sharing the cache: downloads with no checksum or a placeholder one, git dependencies on a branch, absolute local paths, curl or the clock inside genrules, the sandbox switched off, a leaking action environment, every laptop writing the shared cache, plaintext endpoints, stamping on every build, uncached tests, glob() in deps, undefined --config values, credentials in .bazelrc and WORKSPACE-only dependencies. The paid audit gives exact before/after edits per finding; the paid fix lane writes the whole fixed files; the page re-checks both and confirms every target, repository and config survives. Derived from the agent skill bazel-build-optimization by Seth Hobson (@wshobson/bazel-build-optimization, github.com/wshobson/agents, MIT). Bazel is a trademark of Google LLC; Hermetic Build Audit is not affiliated with or endorsed by Google or the Bazel project.