locking: enforce Bzlmod lockfile consistency (eclipse-score#72)

* locking: enforce Bzlmod lockfile consistency

- add reusable lockfile check workflow

- track MODULE.bazel.lock (remove from .gitignore)

- enforce --lockfile_mode=error in CI and scripts

Addresses eclipse-score/score#2628

* updated lock file

* fix: mixed params

Mixed params for reusable workflow cpp-coverage

Signed-off-by: Dan Calavrezo <195309321+dcalavrezo-qorix@users.noreply.github.com>

* fix: add permission

add detail permission to shut copilot up

Signed-off-by: Dan Calavrezo <195309321+dcalavrezo-qorix@users.noreply.github.com>

* fix: review

Added lockfile for qnx builds

Signed-off-by: Dan Calavrezo <195309321+dcalavrezo-qorix@users.noreply.github.com>

---------

Signed-off-by: Dan Calavrezo <195309321+dcalavrezo-qorix@users.noreply.github.com>

Author: dcalavrezo-qorix

.github/workflows/build.yml

@@ -62,4 +62,4 @@ jobs:
 
       - name: Build with Bazel
         run: |
-          bazel build --config x86_64-linux //...
+          bazel build --lockfile_mode=error --config x86_64-linux //...

.github/workflows/build_qnx8.yml

@@ -29,6 +29,7 @@ jobs:
     with:
       bazel-target: '//score/... //tests/...'
       bazel-config: ${{ matrix.config }}
+      extra-bazel-flags: '--lockfile_mode=error'
       credential-helper: 'scripts/internal/qnx_creds.py'
       environment-name: 'workflow-approval'
     secrets:

.github/workflows/bzlmod-lock.yml

@@ -0,0 +1,28 @@
+# *******************************************************************************
+# Copyright (c) 2025 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+name: Bzlmod Lockfile Check
+permissions:
+  contents: read
+on:
+  pull_request:
+    types: [opened, reopened, synchronize]
+  merge_group:
+    types: [checks_requested]
+  push:
+    branches:
+      - main
+jobs:
+  bzlmod-lock:
+    uses: eclipse-score/cicd-workflows/.github/workflows/bzlmod-lock-check.yml@main
+    with:
+      working-directory: .

.github/workflows/copyright.yml

@@ -24,4 +24,4 @@ jobs:
   copyright-check:
     uses: eclipse-score/cicd-workflows/.github/workflows/copyright.yml@main
     with:
-      bazel-target: "run //:copyright.check"
+      bazel-target: "run --lockfile_mode=error //:copyright.check"

.github/workflows/coverage_report.yml

@@ -27,3 +27,4 @@ jobs:
     uses: eclipse-score/cicd-workflows/.github/workflows/cpp-coverage.yml@main
     with:
       bazel-target: "//..."
+      extra-bazel-flags: "--lockfile_mode=error"

.github/workflows/docs.yml

@@ -39,5 +39,5 @@ jobs:
 
     with:
       # the bazel-target depends on your repo specific docs_targets configuration (e.g. "suffix")
-      bazel-target: "//:docs -- --github_user=${{ github.repository_owner }} --github_repo=${{ github.event.repository.name }}"
+      bazel-target: "--lockfile_mode=error //:docs -- --github_user=${{ github.repository_owner }} --github_repo=${{ github.event.repository.name }}"
       retention-days: 3

.github/workflows/format.yml

@@ -24,4 +24,4 @@ jobs:
   formatting-check:
     uses: eclipse-score/cicd-workflows/.github/workflows/format.yml@main
     with:
-      bazel-target: "test //:format.check" # optional, this is the default
+      bazel-target: "test --lockfile_mode=error //:format.check" # optional, this is the default

.github/workflows/license_check.yml

@@ -29,5 +29,6 @@ jobs:
     uses: eclipse-score/cicd-workflows/.github/workflows/license-check.yml@main
     with:
       repo-url: "${{ github.server_url }}/${{ github.repository }}"
+      bazel-target: "run --lockfile_mode=error //:license-check"
     secrets:
       dash-api-token: ${{ secrets.ECLIPSE_GITLAB_API_TOKEN }}

.gitignore

@@ -34,7 +34,6 @@
 
 # Bazel
 bazel-*
-MODULE.bazel.lock
 user.bazelrc
 
 # Compilation databases for code completion in IDEs

MODULE.bazel

@@ -87,7 +87,6 @@ python.toolchain(
     is_default = True,
     python_version = PYTHON_VERSION,
 )
-use_repo(python)
 
 # C++ dependencies