Skip to content

Commit MODULE.bazel.lock files#4484

Merged
jayconrod merged 5 commits intobazel-contrib:masterfrom
jayconrod:commit-lock
Oct 23, 2025
Merged

Commit MODULE.bazel.lock files#4484
jayconrod merged 5 commits intobazel-contrib:masterfrom
jayconrod:commit-lock

Conversation

@jayconrod
Copy link
Copy Markdown
Collaborator

What type of PR is this?

Other

What does this PR do? Why is it needed?

This ensures rules_go developers always see the same bits when downloading
files. We should see a security error if a module version changes upstream.

Which issues(s) does this PR fix?

Fixes #4483

Other notes for review

@jayconrod jayconrod changed the title Check in MODULE.bazel.lock files Commit MODULE.bazel.lock files Oct 22, 2025
@jayconrod
Copy link
Copy Markdown
Collaborator Author

jayconrod commented Oct 22, 2025

Should tests/bcr/MODULE.bazel.lock be committed? I'm not sure how that's used exactly.

Should examples/*/MODULE.bazel.lock be committed? I think examples ought to have lock files. I added .bazelversion files there too so the lock files stay consistent.

Does it matter if MODULE.bazel.lock changes with different Bazel versions? Probably not. If so, we could add explicit dependencies on Bazel's implicit module dependencies so that we select the same versions across known Bazel versions. I don't know if that would be enough though.

@jayconrod jayconrod marked this pull request as ready for review October 23, 2025 00:03
@jayconrod jayconrod requested a review from fmeum October 23, 2025 00:03
@jayconrod jayconrod merged commit 4f25f44 into bazel-contrib:master Oct 23, 2025
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Commit MODULE.bazel.lock files

2 participants