From 2d2682c61ed7fdf4fd5260d4390523814fd82af0 Mon Sep 17 00:00:00 2001
From: Lutz Reinhardt <lutz.reinhardt@elektrobit.com>
Date: Mon, 10 Aug 2026 10:53:13 +0000
Subject: [PATCH] chore: Ensure bazel lockfile is checked

The lockfile was never checked and could become corrupted. Now a checked in lock file is checked before.
---
 .devcontainer/post_create_command.sh |  2 +-
 .pre-commit-config.yaml              | 10 ++++++++++
 MODULE.bazel                         |  2 --
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/.devcontainer/post_create_command.sh b/.devcontainer/post_create_command.sh
index 6101a47..4185353 100755
--- a/.devcontainer/post_create_command.sh
+++ b/.devcontainer/post_create_command.sh
@@ -18,7 +18,7 @@ npm install -g @devcontainers/cli
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
 REPOSITORY_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd -P)"
 
-sudo "${REPOSITORY_ROOT}/tools/tool_installer.py" install shellcheck yamlfmt
+sudo "${REPOSITORY_ROOT}/tools/tool_installer.py" install bazelisk shellcheck yamlfmt
 
 pre-commit install
 
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 9a33895..e8016e2 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -25,6 +25,16 @@ repos:
         exclude: ^MODULE\.bazel\.lock$
   - repo: local
     hooks:
+      - id: bzlmod-tidy
+        name: bazel mod tidy
+        entry: bazelisk mod tidy
+        language: system
+        pass_filenames: false
+      - id: bzlmod-lockfile
+        name: bazel mod deps lockfile check
+        entry: bazelisk mod deps --lockfile_mode=error
+        language: system
+        pass_filenames: false
       - id: yamlfmt
         name: yamlfmt
         entry: tools/run_tool.sh yamlfmt
diff --git a/MODULE.bazel b/MODULE.bazel
index 913a6ae..b94440b 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -16,7 +16,6 @@ module(name = "score_devcontainer")
 bazel_dep(name = "rules_multitool", version = "1.11.1")
 
 multitool = use_extension("@rules_multitool//multitool:extension.bzl", "multitool")
-
 multitool.hub(lockfile = "//tools:lockfiles/actionlint.lock.json")
 multitool.hub(lockfile = "//tools:lockfiles/ruff.lock.json")
 multitool.hub(lockfile = "//tools:lockfiles/shellcheck.lock.json")
@@ -25,7 +24,6 @@ multitool.hub(lockfile = "//tools:lockfiles/uv.lock.json")
 multitool.hub(lockfile = "//tools:lockfiles/buildifier.lock.json")
 multitool.hub(lockfile = "//tools:lockfiles/starpls.lock.json")
 multitool.hub(lockfile = "//tools:lockfiles/bazelisk.lock.json")
-
 use_repo(multitool, "multitool")
 
 register_toolchains("@multitool//toolchains:all")