locking: enforce Bzlmod lockfile consistency (#169)

* locking: enforce Bzlmod lockfile consistency

- add reusable lockfile check workflow

- track MODULE.bazel.lock (remove from .gitignore)

- enforce --lockfile_mode=error in CI and scripts

Addresses eclipse-score/score#2628

* lock: update lockfile

updated lockfile

Signed-off-by: Dan Calavrezo <195309321+dcalavrezo-qorix@users.noreply.github.com>

* fix: formatting fix

Fixed formatting

Signed-off-by: Dan Calavrezo <195309321+dcalavrezo-qorix@users.noreply.github.com>

* revert: don't use the lockfile_mode in scripts

Ensure the decoupling from CI and local builds this way

Signed-off-by: Dan Calavrezo <195309321+dcalavrezo-qorix@users.noreply.github.com>

---------

Signed-off-by: Dan Calavrezo <195309321+dcalavrezo-qorix@users.noreply.github.com>

Author: dcalavrezo-qorix

.github/workflows/build_and_test_autosd.yml

@@ -47,7 +47,7 @@ jobs:
           sudo apt-get install -y podman curl qemu-system createrepo-c
       - name: Build Showcases
         run: |
-          bazel build --config autosd-x86_64 //images/autosd_x86_64:score-showcases
+          bazel build --lockfile_mode=error --config autosd-x86_64 //images/autosd_x86_64:score-showcases
       - name: Copy showcases folder
         run: |
           set -e

.github/workflows/build_and_test_ebclfsa.yml

@@ -43,7 +43,7 @@ jobs:
           cache-save: ${{ github.event_name == 'push' }}
       - name: Build for EB corbos Linux for Safety Applications and run tests
         run: |
-          bazel build --config=eb-aarch64 //images/ebclfsa_aarch64/scrample_integration:run
+          bazel build --lockfile_mode=error --config=eb-aarch64 //images/ebclfsa_aarch64/scrample_integration:run
       - name: Upload test logs
         uses: actions/upload-artifact@v5
         with:

.github/workflows/build_and_test_linux.yml

@@ -44,7 +44,7 @@ jobs:
           cache-save: ${{ github.event_name == 'push' }}
       - name: Build image
         run: |
-          bazel build --config=linux-x86_64 //images/linux_x86_64:image
+          bazel build --lockfile_mode=error --config=linux-x86_64 //images/linux_x86_64:image
       - name: Integration tests
         run: |
-          bazel test --config=linux-x86_64 //feature_integration_tests/itf:linux_x86_64
+          bazel test --lockfile_mode=error --config=linux-x86_64 //feature_integration_tests/itf:linux_x86_64

.github/workflows/build_and_test_qnx.yml

@@ -70,10 +70,10 @@ jobs:
           SCORE_QNX_USER: ${{ secrets.SCORE_QNX_USER }}
           SCORE_QNX_PASSWORD: ${{ secrets.SCORE_QNX_PASSWORD }}
         run: |
-          bazel build --config qnx-x86_64 //images/qnx_x86_64:image
+          bazel build --lockfile_mode=error --config qnx-x86_64 //images/qnx_x86_64:image
       - name: Run integration tests
         run: |
-          bazel test --config=itf-qnx-x86_64 //feature_integration_tests/itf:qnx_x86_64
+          bazel test --lockfile_mode=error --config=itf-qnx-x86_64 //feature_integration_tests/itf:qnx_x86_64
       - name: Cleanup QNX license
         if: always()
         run: sudo rm -rf /opt/score_qnx

.github/workflows/bzlmod-lock.yml

@@ -0,0 +1,26 @@
+# *******************************************************************************
+# Copyright (c) 2025 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+name: Bzlmod Lockfile Check
+on:
+  pull_request:
+    types: [opened, reopened, synchronize]
+  merge_group:
+    types: [checks_requested]
+  push:
+    branches:
+      - main
+jobs:
+  bzlmod-lock:
+    uses: eclipse-score/cicd-workflows/.github/workflows/bzlmod-lock-check.yml@main
+    with:
+      working-directory: .

.github/workflows/test_and_docs.yml

@@ -85,7 +85,7 @@ jobs:
         run: |
           mkdir -p artifacts
           find bazel-testlogs/external -name 'test.xml' -print0 | xargs -0 -I{} cp --parents {} artifacts/
-          cp -r "$(bazel info bazel-bin)/coverage/rust-tests" artifacts/rust
+          cp -r "$(bazel info --lockfile_mode=error bazel-bin)/coverage/rust-tests" artifacts/rust
           zip -r ${{ github.event.repository.name }}_test_reports.zip artifacts/
         shell: bash
       - name: Upload release asset (attach ZIP to GitHub Release)
@@ -103,6 +103,7 @@ jobs:
       - name: Build documentation
         run: |
           bazel --output_base="/home/runner/.cache/bazel/output_base" run \
+            --lockfile_mode=error \
             --repo_contents_cache="/home/runner/.cache/bazel/repo_contents" \
             --repository_cache="/home/runner/.cache/bazel/repo" \
             --disk_cache="/home/runner/.cache/bazel/disk" \

.gitignore

@@ -1,6 +1,5 @@
 # Bazel
 bazel-*
-MODULE.bazel.lock
 user.bazelrc
 
 _logs

MODULE.bazel.lock

@@ -20,7 +20,6 @@ python.toolchain(
     is_default = True,
     python_version = PYTHON_VERSION,
 )
-use_repo(python)
 
 pip = use_extension("@rules_python//python/extensions:pip.bzl", "pip", dev_dependency = True)
 pip.parse(