locking: enforce Bzlmod lockfile consistency (#89)

add reusable lockfile check workflow

track MODULE.bazel.lock (remove from .gitignore)

enforce --lockfile_mode=error in CI and scripts

Addresses eclipse-score/score#2628

Co-authored-by: Dan Calavrezo <195309321+dcalavrezo-qorix@users.noreply.github.com>

Author: artemsheinacn

.github/workflows/bzlmod-lock.yml

@@ -0,0 +1,28 @@
+# *******************************************************************************
+# Copyright (c) 2025 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+name: Bzlmod Lockfile Check
+permissions:
+  contents: read
+on:
+  pull_request:
+    types: [opened, reopened, synchronize]
+  merge_group:
+    types: [checks_requested]
+  push:
+    branches:
+      - main
+jobs:
+  bzlmod-lock:
+    uses: eclipse-score/cicd-workflows/.github/workflows/bzlmod-lock-check.yml@main
+    with:
+      working-directory: .

.github/workflows/ci.yml

@@ -36,10 +36,10 @@ jobs:
         run: bazel mod tidy
 
       - name: Build all workspace targets
-        run: bazel build --config=x86_64-linux //...
+        run: bazel build --lockfile_mode=error --config=x86_64-linux //...
 
       - name: Run all workspace tests
-        run: bazel test --config=x86_64-linux //...
+        run: bazel test --lockfile_mode=error --config=x86_64-linux //...
 
       - name: Lint rust code (with clippy)
-        run: bazel build --config=lint-rust //...
+        run: bazel build --lockfile_mode=error --config=lint-rust //...

.github/workflows/copyright.yml

@@ -21,4 +21,4 @@ jobs:
   copyright-check:
     uses: eclipse-score/cicd-workflows/.github/workflows/copyright.yml@c1c90b1a82a1fab0fc202979dde6686b2162d5a8 # v0.0.0
     with:
-      bazel-target: "run //:copyright.check"
+      bazel-target: "run --lockfile_mode=error //:copyright.check"

.github/workflows/docs.yml

@@ -39,5 +39,5 @@ jobs:
 
     with:
       # the bazel-target depends on your repo specific docs_targets configuration (e.g. "suffix")
-      bazel-target: "//:docs -- --github_user=${{ github.repository_owner }} --github_repo=${{ github.event.repository.name }}"
+      bazel-target: "--lockfile_mode=error //:docs -- --github_user=${{ github.repository_owner }} --github_repo=${{ github.event.repository.name }}"
       retention-days: 3

.github/workflows/format.yml

@@ -23,4 +23,4 @@ jobs:
   formatting-check:
     uses: eclipse-score/cicd-workflows/.github/workflows/format.yml@c1c90b1a82a1fab0fc202979dde6686b2162d5a8 # v0.0.0
     with:
-      bazel-target: "test //:format.check" # optional, this is the default
+      bazel-target: "test --lockfile_mode=error //:format.check" # optional, this is the default

.github/workflows/release.yml

@@ -60,18 +60,18 @@ jobs:
 
       - name: Build via Bazel
         run: |
-          echo "Running: bazel build //..."
-          bazel build //...
+          echo "Running: bazel build --lockfile_mode=error //..."
+          bazel build --lockfile_mode=error //...
 
       - name: Run Unit Tests via Bazel
         run: |
-          echo "Running: bazel test //:unit_tests"
-          bazel test //:unit_tests
+          echo "Running: bazel test --lockfile_mode=error //:unit_tests"
+          bazel test --lockfile_mode=error //:unit_tests
 
       - name: Run Unit Test with Coverage for Rust
         run: |
           # Run tests
-          bazel coverage //:unit_tests \
+          bazel coverage --lockfile_mode=error //:unit_tests \
             --collect_code_coverage \
             --combined_report=lcov \
             --experimental_generate_llvm_lcov \

.gitignore

@@ -34,7 +34,6 @@
 
 # Bazel
 bazel-*
-MODULE.bazel.lock
 user.bazelrc
 
 # Ruff

MODULE.bazel.lock

@@ -19,9 +19,9 @@ SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
 
 buildifier -r $SCRIPT_DIR
 bazelisk mod tidy
-bazelisk run //:format.fix
-bazelisk run  //:format.check_Rust_with_rustfmt
-bazelisk run //:copyright.check
-bazelisk build --config=lint-rust //...
-bazelisk build --config=x86_64-linux //...
-bazelisk test --config=x86_64-linux //...
+bazelisk run --lockfile_mode=error //:format.fix
+bazelisk run --lockfile_mode=error //:format.check_Rust_with_rustfmt
+bazelisk run --lockfile_mode=error //:copyright.check
+bazelisk build --lockfile_mode=error --config=lint-rust //...
+bazelisk build --lockfile_mode=error --config=x86_64-linux //...
+bazelisk test --lockfile_mode=error --config=x86_64-linux //...