From 02e9f98073cc396fe94722e8678bd28967015c82 Mon Sep 17 00:00:00 2001
From: Armando Montanez <amontanez@google.com>
Date: Thu, 5 Sep 2024 03:33:53 +0000
Subject: [PATCH] pw_presubmit: Enable strict Bazel lockfile checks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Enables `--lockfile_mode=error` for Bazel actions in Pigweed's presubmit
actions to ensure that dirty lockfiles are not checked in.

Change-Id: Ia692c4c027530137e3aa34cd056e62f1fec044ec
Reviewed-on: https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/234056
Presubmit-Verified: CQ Bot Account <pigweed-scoped@luci-project-accounts.iam.gserviceaccount.com>
Lint: Lint 🤖 <android-build-ayeaye@system.gserviceaccount.com>
Reviewed-by: Ted Pudlik <tpudlik@google.com>
Pigweed-Auto-Submit: Armando Montanez <amontanez@google.com>
Commit-Queue: Auto-Submit <auto-submit@pigweed-service-accounts.iam.gserviceaccount.com>
---
 pw_presubmit/py/pw_presubmit/build.py             | 6 ++++++
 pw_presubmit/py/pw_presubmit/pigweed_presubmit.py | 4 +++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/pw_presubmit/py/pw_presubmit/build.py b/pw_presubmit/py/pw_presubmit/build.py
index cd32d0b6c5..52fccb5659 100644
--- a/pw_presubmit/py/pw_presubmit/build.py
+++ b/pw_presubmit/py/pw_presubmit/build.py
@@ -76,6 +76,7 @@ def bazel(
     ctx: PresubmitContext,
     cmd: str,
     *args: str,
+    strict_module_lockfile: bool = False,
     use_remote_cache: bool = False,
     stdout: TextIO | None = None,
     **kwargs,
@@ -93,6 +94,10 @@ def bazel(
     if ctx.continue_after_build_error:
         keep_going.append('--keep_going')
 
+    strict_lockfile: list[str] = []
+    if strict_module_lockfile:
+        strict_lockfile.append('--lockfile_mode=error')
+
     remote_cache: list[str] = []
     if use_remote_cache and ctx.luci:
         remote_cache.append('--config=remote_cache')
@@ -128,6 +133,7 @@ def bazel(
                 f'--symlink_prefix={ctx.output_dir / "bazel-"}',
                 *num_jobs,
                 *keep_going,
+                *strict_lockfile,
                 *remote_cache,
                 *args,
                 cwd=ctx.root,
diff --git a/pw_presubmit/py/pw_presubmit/pigweed_presubmit.py b/pw_presubmit/py/pw_presubmit/pigweed_presubmit.py
index 35c50d99e1..3fcae9eea5 100755
--- a/pw_presubmit/py/pw_presubmit/pigweed_presubmit.py
+++ b/pw_presubmit/py/pw_presubmit/pigweed_presubmit.py
@@ -95,7 +95,9 @@ def add_default_gn_args(self, args):
 
 
 def build_bazel(*args, **kwargs) -> None:
-    build.bazel(*args, use_remote_cache=True, **kwargs)
+    build.bazel(
+        *args, use_remote_cache=True, strict_module_lockfile=True, **kwargs
+    )
 
 
 #