bzlmod: Verify that the lockfile is platform-independent (#1617)

By committing a single lockfile and running CI with
`--lockfile_mode=error`, we can ensure that the same lockfile works
across OSes and architectures.

Since the lockfile can get pretty large, we exclude it from the release
archive and hence also don't check the lockfile in the BCR presubmit.

.bazelci/presubmit.yml

@@ -27,9 +27,18 @@ tasks:
     - bazel run //:gazelle -- update pkg
     - bazel run //:gazelle -- pkg
     build_flags:
-    - "--allow_yanked_versions=all"
+    # Verify that the committed lockfile is platform-independent.
+    # In case of expected changes, regenerate the lockfile with
+    # `bazel mod graph`, which evaluates all module extensions.
+    # Note: `go_sdk`s *is* platform-dependent since it registers the first
+    # host-compatible SDK, but the result only differs if there is also a
+    # matching SDK with manual goos/goarch set, which isn't the case in CI.
+    # TODO: Make this more realistic after
+    # https://github.com/bazelbuild/bazel/issues/19154.
+    - "--lockfile_mode=error"
     test_flags:
-    - "--allow_yanked_versions=all"
+    # See above.
+    - "--lockfile_mode=error"
     build_targets:
     - "//..."
     - "//:gazelle"

.bcr/presubmit.yml

@@ -11,8 +11,6 @@ bcr_test_module:
     run_test_module:
       name: Run test module
       platform: ${{ platform }}
-      build_flags:
-      - --experimental_isolated_extension_usages
       shell_commands:
       # Regenerate the BUILD file for the test module using Gazelle.
       - rm pkg/BUILD.bazel

.gitattributes

@@ -0,0 +1,3 @@
+.gitattributes export-ignore
+# The lockfile is not used by downstream projects and tends to be large.
+tests/bcr/MODULE.bazel.lock export-ignore

tests/bcr/.bazelrc

@@ -1,2 +1,3 @@
 common --enable_bzlmod
 common --experimental_isolated_extension_usages
+common --lockfile_mode=update

tests/bcr/.bazelversion

@@ -1 +1 @@
-6.3.1
+6.3.2