locking: enforce Bzlmod lockfile consistency

[dcalavrezo-qorix]

• add reusable lockfile check workflow

• track MODULE.bazel.lock (remove from .gitignore)

• enforce --lockfile_mode=error in CI and scripts

Addresses eclipse-score/score#2628

Notes for Reviewer

Pre-Review Checklist for the PR Author

• PR title is short, expressive and meaningful
• Commits are properly organized
• Relevant issues are linked in the References section
• Tests are conducted
• Unit tests are added

Checklist for the PR Reviewer

• Commits are properly organized and messages are according to the guideline
• Unit tests have been written for new behavior
• Public API is documented
• PR title describes the changes

Post-review Checklist for the PR Author

• All open points are addressed and tracked via issues

References

Closes #

[github-actions]

License Check Results

🚀 The license check job ran with the Bazel command:

bazel run //:license-check

Status: ⚠️ Needs Review

Click to expand output

[License Check Output]
2026/03/04 15:18:45 Downloading https://releases.bazel.build/8.4.2/release/bazel-8.4.2-linux-x86_64...
Extracting Bazel installation...
Starting local Bazel server (8.4.2) and connecting to it...
INFO: Invocation ID: b8a5d9cf-eb3b-4632-9693-e9de10fce45c
Computing main repo mapping: 
Computing main repo mapping: 
Computing main repo mapping: 
Computing main repo mapping: 
Computing main repo mapping: 
WARNING: For repository 'rules_python', the root module requires module version rules_python@1.4.1, but got rules_python@1.8.3 in the resolved dependency graph. Please update the version in your MODULE.bazel or set --check_direct_dependencies=off
WARNING: For repository 'bazel_skylib', the root module requires module version bazel_skylib@1.7.1, but got bazel_skylib@1.8.2 in the resolved dependency graph. Please update the version in your MODULE.bazel or set --check_direct_dependencies=off
WARNING: For repository 'rules_rust', the root module requires module version rules_rust@0.61.0, but got rules_rust@0.67.0 in the resolved dependency graph. Please update the version in your MODULE.bazel or set --check_direct_dependencies=off
WARNING: For repository 'rules_cc', the root module requires module version rules_cc@0.1.1, but got rules_cc@0.2.14 in the resolved dependency graph. Please update the version in your MODULE.bazel or set --check_direct_dependencies=off
WARNING: For repository 'buildifier_prebuilt', the root module requires module version buildifier_prebuilt@7.3.1, but got buildifier_prebuilt@8.2.0.2 in the resolved dependency graph. Please update the version in your MODULE.bazel or set --check_direct_dependencies=off
Loading: 
Loading: 0 packages loaded
Loading: 0 packages loaded
Loading: 0 packages loaded
Loading: 0 packages loaded
    currently loading: 
Analyzing: target //:license-check (1 packages loaded)
Analyzing: target //:license-check (1 packages loaded, 0 targets configured)
Analyzing: target //:license-check (1 packages loaded, 0 targets configured)

Analyzing: target //:license-check (17 packages loaded, 9 targets configured)

Analyzing: target //:license-check (68 packages loaded, 9 targets configured)

Analyzing: target //:license-check (71 packages loaded, 9 targets configured)

Analyzing: target //:license-check (87 packages loaded, 9 targets configured)

Analyzing: target //:license-check (143 packages loaded, 1088 targets configured)

Analyzing: target //:license-check (143 packages loaded, 1088 targets configured)

Analyzing: target //:license-check (143 packages loaded, 1088 targets configured)

Analyzing: target //:license-check (153 packages loaded, 2723 targets configured)

Analyzing: target //:license-check (157 packages loaded, 3176 targets configured)

Analyzing: target //:license-check (165 packages loaded, 3236 targets configured)

Analyzing: target //:license-check (165 packages loaded, 3236 targets configured)

Analyzing: target //:license-check (165 packages loaded, 3236 targets configured)

Analyzing: target //:license-check (168 packages loaded, 5125 targets configured)

Analyzing: target //:license-check (169 packages loaded, 5249 targets configured)

Analyzing: target //:license-check (175 packages loaded, 5459 targets configured)
[4 / 16] Creating runfiles tree bazel-out/k8-fastbuild/bin/license.check.license_check.runfiles; 0s local
Analyzing: target //:license-check (193 packages loaded, 5543 targets configured)
[13 / 17] JavaToolchainCompileClasses external/rules_java+/toolchains/platformclasspath_classes; 0s disk-cache, processwrapper-sandbox
INFO: From Generating Dash formatted dependency file ...:
INFO: Successfully converted 4 packages from Cargo.lock to bazel-out/k8-fastbuild/bin/formatted.txt
Analyzing: target //:license-check (197 packages loaded, 5552 targets configured)
[14 / 17] JavaToolchainCompileClasses external/rules_java+/toolchains/platformclasspath_classes; 1s disk-cache, processwrapper-sandbox
Analyzing: target //:license-check (197 packages loaded, 5552 targets configured)
[15 / 17] JavaToolchainCompileBootClasspath external/rules_java+/toolchains/platformclasspath.jar; 0s disk-cache, processwrapper-sandbox
Analyzing: target //:license-check (197 packages loaded, 5552 targets configured)
[16 / 17] Building license.check.license_check.jar (); 0s disk-cache, multiplex-worker
Analyzing: target //:license-check (197 packages loaded, 5552 targets configured)
[17 / 17] no actions running
Analyzing: target //:license-check (198 packages loaded, 9884 targets configured)
[17 / 17] no actions running
INFO: Analyzed target //:license-check (198 packages loaded, 9886 targets configured).
INFO: Found 1 target...
Target //:license.check.license_check up-to-date:
  bazel-bin/license.check.license_check
  bazel-bin/license.check.license_check.jar
INFO: Elapsed time: 35.837s, Critical Path: 3.77s
INFO: 17 processes: 12 internal, 4 processwrapper-sandbox, 1 worker.
INFO: Build completed successfully, 17 total actions
INFO: Running command line: bazel-bin/license.check.license_check ./formatted.txt <args omitted>
usage: org.eclipse.dash.licenses.cli.Main [-batch <int>] [-cd <url>]
       [-confidence <int>] [-ef <url>] [-excludeSources <sources>] [-help] [-lic
       <url>] [-project <shortname>] [-repo <url>] [-review] [-summary <file>]
       [-timeout <seconds>] [-token <token>]

[github-actions]

The created documentation from the pull request is available at: docu-html