locking: enforce Bzlmod lockfile consistency

.github/workflows/build.yml

@@ -55,4 +55,4 @@ jobs:
 
       - name: Build with Bazel
         run: |
-          bazel build --config x86_64-linux //...
+          bazel build --lockfile_mode=error --config x86_64-linux //...

.github/workflows/build_qnx8.yml

@@ -29,6 +29,7 @@ jobs:
     with:
       bazel-target: '//src/...'
       bazel-config: ${{ matrix.config }}
+      extra-bazel-flags: '--lockfile_mode=error'
       credential-helper: 'scripts/internal/qnx_creds.py'
       environment-name: 'workflow-approval'
     secrets:

.github/workflows/bzlmod-lock.yml

@@ -0,0 +1,26 @@
+# *******************************************************************************
+# Copyright (c) 2025 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+name: Bzlmod Lockfile Check
+on:
+  pull_request:
+    types: [opened, reopened, synchronize]
+  merge_group:
+    types: [checks_requested]
+  push:
+    branches:
+      - main
+jobs:
+  bzlmod-lock:
+    uses: eclipse-score/cicd-workflows/.github/workflows/bzlmod-lock-check.yml@main
+    with:
+      working-directory: .

.github/workflows/component_integration_tests_bazel.yml

@@ -61,16 +61,16 @@ jobs:
 
       - name: Build Test Scenarios with Bazel
         run: |
-          bazel build --config x86_64-linux //tests/test_scenarios/rust:test_scenarios
+          bazel build --lockfile_mode=error --config x86_64-linux //tests/test_scenarios/rust:test_scenarios
 
       - name: Build Test Scenarios with Bazel (PR)
         if: github.event_name == 'pull_request' || github.event_name == 'push'
         run: |
-          bazel test --config x86_64-linux //tests/test_cases:cit
+          bazel test --lockfile_mode=error --config x86_64-linux //tests/test_cases:cit
 
       - name: Build Test Scenarios with Bazel (Nightly)
         if: github.event_name == 'schedule'
         env:
           NIGHTLY: TRUE
         run: |
-          bazel test --config x86_64-linux //tests/test_cases:cit_repeat --test_timeout=1200
+          bazel test --lockfile_mode=error --config x86_64-linux //tests/test_cases:cit_repeat --test_timeout=1200

.github/workflows/copyright.yml

@@ -24,4 +24,4 @@ jobs:
   copyright-check:
     uses: eclipse-score/cicd-workflows/.github/workflows/copyright.yml@main
     with:
-      bazel-target: "run //:copyright.check"
+      bazel-target: "run --lockfile_mode=error //:copyright.check"

.github/workflows/docs.yml

@@ -38,5 +38,5 @@ jobs:
       id-token: write
 
     with:
-      bazel-target: "//:docs -- --github_user=${{ github.repository_owner }} --github_repo=${{ github.event.repository.name }}"
+      bazel-target: "--lockfile_mode=error //:docs -- --github_user=${{ github.repository_owner }} --github_repo=${{ github.event.repository.name }}"
       retention-days: 3

.github/workflows/format.yml

@@ -24,4 +24,4 @@ jobs:
   formatting-check:
     uses: eclipse-score/cicd-workflows/.github/workflows/format.yml@main
     with:
-      bazel-target: "test //:format.check" # optional, this is the default
+      bazel-target: "test --lockfile_mode=error //:format.check" # optional, this is the default

.github/workflows/license_check.yml

@@ -28,5 +28,6 @@ jobs:
     uses: eclipse-score/cicd-workflows/.github/workflows/license-check.yml@main
     with:
       repo-url: "${{ github.server_url }}/${{ github.repository }}"
+      bazel-target: "run --lockfile_mode=error //:license-check"
     secrets:
       dash-api-token: ${{ secrets.ECLIPSE_GITLAB_API_TOKEN }}

.github/workflows/release.yml

@@ -55,26 +55,26 @@ jobs:
 
       - name: Build via Bazel
         run: |
-          echo "Running: bazel build //src/..."
-          bazel build --config=x86_64-linux //src/...
+          echo "Running: bazel build --lockfile_mode=error //src/..."
+          bazel build --lockfile_mode=error --config=x86_64-linux //src/...
 
       - name: Run Unit Tests via Bazel
         run: |
-          echo "Running: bazel test //:unit_tests"
-          bazel test --config=x86_64-linux --config=ferrocene-coverage \
+          echo "Running: bazel test --lockfile_mode=error //:unit_tests"
+          bazel test --lockfile_mode=error --config=x86_64-linux --config=ferrocene-coverage \
             --nocache_test_results \
             //src/...
 
       - name: Generate Ferrocene coverage reports
         run: |
           set -euo pipefail
-          bazel run //:rust_coverage
+          bazel run --lockfile_mode=error //:rust_coverage
 
       - name: Create archive of test report
         run: |
           mkdir -p artifacts
           find bazel-testlogs/src -name 'test.xml' -print0 | xargs -0 -I{} cp --parents {} artifacts/
-          cp -r $(bazel info bazel-bin)/coverage/rust-tests artifacts/
+          cp -r $(bazel info --lockfile_mode=error bazel-bin)/coverage/rust-tests artifacts/
           zip -r ${{ github.event.repository.name }}_coverage_report.zip artifacts/
         shell: bash
 

.github/workflows/rust_coverage.yml

@@ -29,14 +29,14 @@ jobs:
       - name: Run Rust tests with coverage instrumentation
         run: |
           set -euo pipefail
-          bazel test --config=x86_64-linux --config=ferrocene-coverage \
+          bazel test --lockfile_mode=error --config=x86_64-linux --config=ferrocene-coverage \
             --nocache_test_results \
             //src/...
 
       - name: Generate Ferrocene coverage reports
         run: |
           set -euo pipefail
-          bazel run //:rust_coverage -- --min-line-coverage 44
+          bazel run --lockfile_mode=error //:rust_coverage -- --min-line-coverage 44
 
       - name: Locate coverage artifacts
         run: |

.github/workflows/tests.yml

@@ -54,5 +54,5 @@ jobs:
 
       - name: Run Tests via Bazel
         run: |
-          echo "Running: bazel test //src/..."
-          bazel test --config x86_64-linux //src/...
+          echo "Running: bazel test --lockfile_mode=error --config x86_64-linux //src/..."
+          bazel test --lockfile_mode=error --config x86_64-linux //src/...

.gitignore

@@ -34,7 +34,6 @@
 
 # Bazel
 bazel-*
-MODULE.bazel.lock
 user.bazelrc
 
 # Ruff

MODULE.bazel

@@ -100,9 +100,6 @@ pip.parse(
     python_version = PYTHON_VERSION,
     requirements_lock = "//tests/test_cases:requirements.txt.lock",
 )
-
-use_repo(python)
-
 use_repo(pip, "pip_score_venv_test")
 
 bazel_dep(name = "score_virtualization", version = "0.0.3", dev_dependency = True)