locking: enforce Bzlmod lockfile consistency

.github/workflows/bzlmod-lock.yml

@@ -0,0 +1,28 @@
+# *******************************************************************************
+# Copyright (c) 2025 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+name: Bzlmod Lockfile Check
+permissions:
+  contents: read
+on:
+  pull_request:
+    types: [opened, reopened, synchronize]
+  merge_group:
+    types: [checks_requested]
+  push:
+    branches:
+      - main
+jobs:
+  bzlmod-lock:
+    uses: eclipse-score/cicd-workflows/.github/workflows/bzlmod-lock-check.yml@main
+    with:
+      working-directory: .

.github/workflows/consumer_test.yml

@@ -33,7 +33,7 @@ jobs:
 
       - name: Prepare Python
         run: |
-          bazel run //:ide_support
+          bazel run --lockfile_mode=error //:ide_support
 
       - name: Prepare report directory
         run: |

.github/workflows/copyright.yml

@@ -21,4 +21,4 @@ jobs:
   copyright-check:
     uses: eclipse-score/cicd-workflows/.github/workflows/copyright.yml@main
     with:
-      bazel-target: "run //:copyright.check"
+      bazel-target: "run --lockfile_mode=error //:copyright.check"

.github/workflows/license_check.yml

@@ -28,6 +28,6 @@ jobs:
     uses: eclipse-score/cicd-workflows/.github/workflows/license-check.yml@main
     with:
       repo-url: "${{ github.server_url }}/${{ github.repository }}"
-      bazel-target: "run //src:license-check"
+      bazel-target: "run --lockfile_mode=error //src:license-check"
     secrets:
       dash-api-token: ${{ secrets.ECLIPSE_GITLAB_API_TOKEN }}

.github/workflows/test.yml

@@ -38,8 +38,8 @@ jobs:
           bazelisk-cache: true
       - name: Run test targets
         run: |
-          bazel run //:ide_support
-          bazel test //src/...
+          bazel run --lockfile_mode=error //:ide_support
+          bazel test --lockfile_mode=error //src/...
 
       - name: Prepare bundled consumer report
         if: always()

.github/workflows/test_and_docs.yml

@@ -37,7 +37,7 @@ jobs:
       pull-requests: write
       contents: read
     with:
-      bazel-docs-verify-target: "//:docs_check"
+      bazel-docs-verify-target: "--lockfile_mode=error //:docs_check"
 
   # This is the user configurable part of the workflow
   unit-tests:
@@ -55,6 +55,6 @@ jobs:
       pull-requests: write
       id-token: write
     with:
-      bazel-target: "//:docs -- --github_user=${{ github.repository_owner }} --github_repo=${{ github.event.repository.name }}"
+      bazel-target: "--lockfile_mode=error //:docs -- --github_user=${{ github.repository_owner }} --github_repo=${{ github.event.repository.name }}"
       retention-days: 3
       tests-report-artifact: tests-report

.github/workflows/test_links.yml

@@ -15,7 +15,7 @@ jobs:
       # Run your link checker and generate log
       - name: Run LinkChecker
         run: |
-          bazel run //:link_check > linkcheck_output.txt
+          bazel run --lockfile_mode=error //:link_check > linkcheck_output.txt
         continue-on-error: true
 
       # Run your Python script to parse the linkcheck log and generate issue body

.gitignore

@@ -3,7 +3,6 @@
 
 # Bazel
 bazel-*
-MODULE.bazel.lock
 user.bazelrc
 
 # Ruff

MODULE.bazel

@@ -33,7 +33,6 @@ python.toolchain(
     is_default = True,
     python_version = PYTHON_VERSION,
 )
-use_repo(python)
 
 ###############################################################################
 #