diff --git a/BUILD b/BUILD
index 779af8e3..cbc47891 100644
--- a/BUILD
+++ b/BUILD
@@ -29,6 +29,7 @@ config_setting(
 )
 
 load("@com_github_bazelbuild_buildtools//buildifier:def.bzl", "buildifier")
+
 buildifier(
     name = "buildifier",
 )
diff --git a/WORKSPACE b/WORKSPACE
index bc039ce4..df0b2690 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -154,7 +154,6 @@ http_archive(
 )
 
 load("@io_bazel_rules_docker//toolchains/docker:toolchain.bzl", docker_toolchain_configure = "toolchain_configure")
-
 load(
     "@io_bazel_rules_docker//repositories:repositories.bzl",
     container_repositories = "repositories",
@@ -178,10 +177,9 @@ container_pull(
     digest = "sha256:cfa3b79333c4e56fc675b6800445b6dcbb3e6cd4d52f2a9ade944ab73dadc6a1",
     registry = "index.docker.io",
     repository = "python",
-    tag = "3.10-bullseye",   # use the same version as in python_register_toolchains
+    tag = "3.10-bullseye",  # use the same version as in python_register_toolchains
 )
 
-
 container_pull(
     name = "prodimage-bionic",
     digest = "sha256:1cd1f84169b8e1414a5d511b42909f2d540831c67b6799ae9af8cd6a80d75b5f",
@@ -223,10 +221,11 @@ git_repository(
 
 # Force newer version of Gerrit plugin API.
 load("@com_googlesource_gerrit_bazlets//:gerrit_api.bzl", "gerrit_api")
+
 gerrit_api(
-    version = "3.7.5",
-    plugin_api_sha1 = "1ea41f95da74045c2cdb30d359041a79b61e72ff",
     acceptance_framework_sha1 = "aa51456eda49f928217de4bd46e4af8fbea8c4f1",
+    plugin_api_sha1 = "1ea41f95da74045c2cdb30d359041a79b61e72ff",
+    version = "3.7.5",
 )
 
 load("//devtools/gerrit/gerrit-oauth-provider:external_plugin_deps.bzl", gerrit_oauth_deps = "external_plugin_deps")
@@ -238,12 +237,12 @@ gerrit_oauth_deps(omit_commons_codec = False)
 git_repository(
     name = "com_googlesource_gerrit_plugin_owners",
     commit = "6db2d3f048f56fa49469d315b716787d21f8393f",
-    remote = "https://gerrit.googlesource.com/plugins/owners/",
-    shallow_since = "1593642470 +0200",
     patch_args = ["-p1"],
     patches = [
         "//third_party:gerrit_plugins_owner.patch",
     ],
+    remote = "https://gerrit.googlesource.com/plugins/owners/",
+    shallow_since = "1593642470 +0200",
 )
 
 load("@com_googlesource_gerrit_plugin_owners//:external_plugin_deps_standalone.bzl", gerrit_owners_deps = "external_plugin_deps_standalone")
@@ -296,6 +295,7 @@ http_file(
 
 # viz.js 2.x used by //dc/topo
 load("//third_party:vizjs.bzl", "vizjs_repositories")
+
 vizjs_repositories()
 
 # buildifier and friends
diff --git a/app/mailman-web/BUILD b/app/mailman-web/BUILD
index f79e0e3c..451ff39c 100644
--- a/app/mailman-web/BUILD
+++ b/app/mailman-web/BUILD
@@ -2,8 +2,8 @@ load("@pydeps//:requirements.bzl", "requirement")
 load("@rules_python//python:defs.bzl", "py_binary")
 load("@io_bazel_rules_docker//python:image.bzl", "py_layer")
 load("@io_bazel_rules_docker//python3:image.bzl", "py3_image")
-load("@io_bazel_rules_docker//container:container.bzl", "container_layer", "container_image")
-load("@io_bazel_rules_docker//docker/util:run.bzl",  "container_run_and_extract", "container_run_and_commit_layer")
+load("@io_bazel_rules_docker//container:container.bzl", "container_image", "container_layer")
+load("@io_bazel_rules_docker//docker/util:run.bzl", "container_run_and_commit_layer", "container_run_and_extract")
 load("@io_bazel_rules_docker//docker/package_managers:download_pkgs.bzl", "download_pkgs")
 load("@io_bazel_rules_docker//docker/package_managers:install_pkgs.bzl", "install_pkgs")
 
@@ -20,10 +20,10 @@ download_pkgs(
 
 install_pkgs(
     name = "base_image",
-    output_image_name = "base_image",
     image_tar = "@python-debian//image",
     installables_tar = ":apt_py_is_py3.tar",
     installation_cleanup_commands = "rm -rf /var/lib/apt/lists/* /usr/share/doc && apt remove -y libbluetooth3 mariadb-common tk && apt autoremove -y",
+    output_image_name = "base_image",
 )
 
 BASE_IMAGE = ":base_image"
@@ -42,8 +42,8 @@ container_run_and_extract(
 
 container_image(
     name = "static_build_image",
-    layers = [":static_build_layer"],
     base = BASE_IMAGE,
+    layers = [":static_build_layer"],
 )
 
 # this will also contain .pyc files, but the python binary will be the same
@@ -56,16 +56,16 @@ container_run_and_commit_layer(
         # gettext is cursed, TODO make this work
         #"./app/mailman-web/manage compilemessages",
     ],
-    image = ":build_container.tar",
     docker_run_flags = ["--entrypoint="],
+    image = ":build_container.tar",
 )
 
 py3_image(
     name = "build_container",
     srcs = [":manage"],
-    main = "manage.py",
     base = ":build_tools_container",
     layers = [":deps_layer"],
+    main = "manage.py",
     # this doesn't work for some reason - this is always rebuilt, unless
     # you pass --nostamp globally
     stamp = 0,
@@ -75,23 +75,22 @@ download_pkgs(
     name = "build_tools",
     image_tar = "@python-debian//image",
     packages = [
-        "sassc",
         "gettext",
+        "sassc",
     ],
 )
 
 install_pkgs(
     name = "build_tools_container",
-    output_image_name = "build_tools_container",
-    image_tar = BASE_IMAGE + '.tar',
+    image_tar = BASE_IMAGE + ".tar",
     installables_tar = ":build_tools.tar",
     installation_cleanup_commands = "rm -rf /var/lib/apt/lists/* /usr/share/doc",
+    output_image_name = "build_tools_container",
 )
 
 #  - - - -
 # overkill rube goldberg setup to build static files ends
 
-
 # - - python stuff - -
 
 # this is purely a build optimization - put the pip deps into a separate layer
@@ -108,8 +107,12 @@ py_layer(
 
 py_library(
     name = "django_base",
-    srcs = ["settings.py", "urls.py"]
-        + glob(["upstream_settings/*.py"]),
+    srcs = [
+        "settings.py",
+        "urls.py",
+    ] + glob([
+        "upstream_settings/*.py",
+    ]),
     deps = [
         requirement("Django"),
         requirement("postorius"),
@@ -136,15 +139,15 @@ py_binary(
 py3_image(
     name = "mailman-web",
     srcs = ["container_main.py"],
+    #base = ":base_container"
+    base = ":static_build_image",
+    layers = [
+        ":deps_layer",
+    ],
+    main = "container_main.py",
     deps = [
         ":django_base",
         ":manage",
         ":serve",
     ],
-    layers = [
-        ":deps_layer",
-    ],
-    main = "container_main.py",
-    #base = ":base_container"
-    base = ":static_build_image",
 )
diff --git a/bzl/rules.bzl b/bzl/rules.bzl
index 6b264872..c89c9fde 100644
--- a/bzl/rules.bzl
+++ b/bzl/rules.bzl
@@ -6,16 +6,17 @@ def _copy_go_binary_impl(ctx):
         if f.path.endswith(".a"):
             continue
         ctx.actions.run_shell(
-            inputs=[f],
-            outputs=[output],
-            mnemonic="CopyGoBinary",
-            command="mkdir -p %s && cp %s %s" % (output.dirname, f.path, output.path))
-        return [DefaultInfo(executable=output)]
+            inputs = [f],
+            outputs = [output],
+            mnemonic = "CopyGoBinary",
+            command = "mkdir -p %s && cp %s %s" % (output.dirname, f.path, output.path),
+        )
+        return [DefaultInfo(executable = output)]
 
 copy_go_binary = rule(
-    implementation=_copy_go_binary_impl,
-    attrs={
-        "src": attr.label(mandatory=True, allow_files=True),
+    implementation = _copy_go_binary_impl,
+    attrs = {
+        "src": attr.label(mandatory = True, allow_files = True),
     },
-    executable=True,
+    executable = True,
 )
diff --git a/dc/topo/assets/BUILD.bazel b/dc/topo/assets/BUILD.bazel
index 419c0a4f..1b05f662 100644
--- a/dc/topo/assets/BUILD.bazel
+++ b/dc/topo/assets/BUILD.bazel
@@ -4,8 +4,8 @@ load("@io_bazel_rules_go//extras:embed_data.bzl", "go_embed_data")
 go_embed_data(
     name = "assets_embed",
     srcs = glob(["*.js"]) + [
-        "@vizjs-viz.js//file",
         "@vizjs-full.render.js//file",
+        "@vizjs-viz.js//file",
     ],
     flatten = True,
     package = "assets",
diff --git a/devtools/gerrit/gerrit-oauth-provider/BUILD b/devtools/gerrit/gerrit-oauth-provider/BUILD
index aa8f9236..d378e748 100644
--- a/devtools/gerrit/gerrit-oauth-provider/BUILD
+++ b/devtools/gerrit/gerrit-oauth-provider/BUILD
@@ -20,9 +20,9 @@ gerrit_plugin(
     resources = glob(["src/main/resources/**/*"]),
     deps = [
         "@commons-codec//jar:neverlink",
+        "@jackson-annotations//jar",
         "@jackson-core//jar",
         "@jackson-databind//jar",
-        "@jackson-annotations//jar",
         "@scribejava-core//jar",
     ],
 )
diff --git a/hswaw/site/deps.bzl b/hswaw/site/deps.bzl
index 8bf59d12..b7436647 100644
--- a/hswaw/site/deps.bzl
+++ b/hswaw/site/deps.bzl
@@ -1,4 +1,4 @@
-load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_file", "http_archive")
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive", "http_file")
 
 def hswaw_site_deps():
     http_archive(
@@ -42,4 +42,3 @@ filegroup(
         urls = ["https://fonts.gstatic.com/s/inconsolata/v21/QldgNThLqRwH-OJ1UHjlKENVzkWGVkL3GZQmAwLYxYWI2qfdm7Lpp2I7aRo.ttf"],
         downloaded_file_path = "font.ttf",
     )
-
diff --git a/third_party/factorio/factorio.bzl b/third_party/factorio/factorio.bzl
index c201346b..9da67a66 100644
--- a/third_party/factorio/factorio.bzl
+++ b/third_party/factorio/factorio.bzl
@@ -63,7 +63,7 @@ def factorio_images():
         revision = revision_overrides.get(v, 1)
         factorio_image(v, revision)
 
-    highest_version = sorted(_versions.keys(), key=_sort_by_version, reverse=True)[0]
+    highest_version = sorted(_versions.keys(), key = _sort_by_version, reverse = True)[0]
     revision = revision_overrides.get(highest_version, 1)
     container_push(
         name = "push_latest",
diff --git a/third_party/vizjs.bzl b/third_party/vizjs.bzl
index 1e40cf46..fce8af5c 100644
--- a/third_party/vizjs.bzl
+++ b/third_party/vizjs.bzl
@@ -1,4 +1,4 @@
-load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_file") 
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_file")
 
 def vizjs_repositories():
     http_file(
diff --git a/tools/gostatic/rules.bzl b/tools/gostatic/rules.bzl
index e0326f92..4819f149 100644
--- a/tools/gostatic/rules.bzl
+++ b/tools/gostatic/rules.bzl
@@ -9,7 +9,7 @@ def _gostatic_tarball_impl(ctx):
     # Build path to root of sources, based on source_dir
     # and location of the instantiating BUILDfile
     # (source_dir is defined as relative to the BUILD file).
-    source_dir = '/'.join(ctx.build_file_path.split('/')[:-1]) + '/' + ctx.attr.source_dir
+    source_dir = "/".join(ctx.build_file_path.split("/")[:-1]) + "/" + ctx.attr.source_dir
 
     # Relative path to go up from generated config to build
     # root. This is because gostatic is magical and really
@@ -37,12 +37,14 @@ def _gostatic_tarball_impl(ctx):
         inputs = [out],
         executable = ctx.file._tarify,
         arguments = [
-            "-site", out.path,
-            "-tarball", tarball.path,
+            "-site",
+            out.path,
+            "-tarball",
+            tarball.path,
         ],
     )
 
-    return [DefaultInfo(files=depset([tarball]))]
+    return [DefaultInfo(files = depset([tarball]))]
 
 gostatic_tarball = rule(
     implementation = _gostatic_tarball_impl,
@@ -60,7 +62,7 @@ gostatic_tarball = rule(
         ),
         "srcs": attr.label_list(
             allow_files = True,
-            doc = "Site sources, all must be contained within source_dir"
+            doc = "Site sources, all must be contained within source_dir",
         ),
         "templates": attr.label_list(
             allow_files = True,