bzlmod: Verify that the lockfile is platform-independent

.bazelci/presubmit.yml

@@ -27,9 +27,18 @@ tasks:
     - bazel run //:gazelle -- update pkg
     - bazel run //:gazelle -- pkg
     build_flags:
-    - "--allow_yanked_versions=all"
+    # Verify that the committed lockfile is platform-independent.
+    # In case of expected changes, regenerate the lockfile with
+    # `bazel mod graph`, which evaluates all module extensions.
+    # Note: `go_sdk`s *is* platform-dependent since it registers the first
+    # host-compatible SDK, but the result only differs if there is also a
+    # matching SDK with manual goos/goarch set, which isn't the case in CI.
+    # TODO: Make this more realistic after
+    # https://github.com/bazelbuild/bazel/issues/19154.
+    - "--lockfile_mode=error"
     test_flags:
-    - "--allow_yanked_versions=all"
+    # See above.
+    - "--lockfile_mode=error"
     build_targets:
     - "//..."
     - "//:gazelle"

.bcr/presubmit.yml

@@ -11,8 +11,6 @@ bcr_test_module:
     run_test_module:
       name: Run test module
       platform: ${{ platform }}
-      build_flags:
-      - --experimental_isolated_extension_usages
       shell_commands:
       # Regenerate the BUILD file for the test module using Gazelle.
       - rm pkg/BUILD.bazel

.gitattributes

@@ -0,0 +1,3 @@
+.gitattributes export-ignore
+# The lockfile is not used by downstream projects and tends to be large.
+tests/bcr/MODULE.bazel.lock export-ignore

tests/bcr/.bazelrc

@@ -1,2 +1,3 @@
 common --enable_bzlmod
 common --experimental_isolated_extension_usages
+common --lockfile_mode=update

tests/bcr/.bazelversion

@@ -1 +1 @@
-6.3.1
+6.3.2