chore(bazel): add bazel .lock to pre-commit

.github/workflows/lint.yml → .github/workflows/on-pr.yml

@@ -11,7 +11,7 @@
 # SPDX-License-Identifier: Apache-2.0
 # *******************************************************************************
 
-name: Linting Checks
+name: PR Checks
 
 on:
   pull_request:
@@ -20,21 +20,22 @@ on:
     types: [checks_requested]
 
 jobs:
-  lint:
+  pre-commit:
+    name: Run pre-commit checks
     runs-on: ubuntu-latest
-    continue-on-error: true
     steps:
 
       - name: 🛡️ Harden Runner
         if: github.repository_owner == 'eclipse-score'
         uses: step-security/harden-runner@v2.18.0
         with:
           egress-policy: audit
+
       - name: Checkout repository
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v6
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.15.0
+        uses: bazel-contrib/setup-bazel@0.19.0
         with:
           disk-cache: true
           repository-cache: true

.pre-commit-config.yaml

@@ -35,6 +35,14 @@ repos:
         language: system
         pass_filenames: false
         files: '(^|/)(MODULE\.bazel|.*\.bzl|BUILD(\.bazel)?)$'
+
+      - id: bzlmod-lockfile
+        name: bazel mod deps lockfile check
+        entry: bazel mod deps --lockfile_mode=error
+        language: system
+        pass_filenames: false
+        files: '(^|/)MODULE\.bazel(\.lock)?$'
+
       - id: actionlint
         name: actionlint
         # Disable shellcheck and pyflakes for now, to enforce consistent behavior.