bzlmod: Verify that the lockfile is platform-independent

By committing a single lockfile and running CI with
`--lockfile_mode=error`, we can ensure that the same lockfile works
across OSes and architectures.

Since the lockfile can get pretty large, we exclude it from the release
archive and hence also don't check the lockfile.

.bazelci/presubmit.yml

@@ -27,9 +27,11 @@ tasks:
     - bazel run //:gazelle -- update pkg
     - bazel run //:gazelle -- pkg
     build_flags:
-    - "--allow_yanked_versions=all"
+    # Verify that the committed lockfile is platform-independent.
+    - "--lockfile_mode=error"
     test_flags:
-    - "--allow_yanked_versions=all"
+    # Verify that the committed lockfile is platform-independent.
+    - "--lockfile_mode=error"
     build_targets:
     - "//..."
     - "//:gazelle"

.bcr/presubmit.yml

@@ -11,8 +11,6 @@ bcr_test_module:
     run_test_module:
       name: Run test module
       platform: ${{ platform }}
-      build_flags:
-      - --experimental_isolated_extension_usages
       shell_commands:
       # Regenerate the BUILD file for the test module using Gazelle.
       - rm pkg/BUILD.bazel

.gitattributes

@@ -0,0 +1,3 @@
+.gitattributes export-ignore
+# The lockfile is not used by downstream projects and tends to be large.
+tests/bcr/MODULE.bazel.lock export-ignore

tests/bcr/.bazelrc

@@ -1,2 +1,3 @@
 common --enable_bzlmod
 common --experimental_isolated_extension_usages
+common --lockfile_mode=update

tests/bcr/.bazelversion

@@ -1 +1 @@
-6.3.1
+6.3.2