evidence: lock_refresh regenerates MODULE.bazel.lock on the platform (part of #9754)

.github/workflows/README.md

@@ -7,7 +7,7 @@
 - `ci.yml`: this repository's own `ci` gate. A failed Windows preflight build uploads `rmeta-diagnostics-<platform>` (#4850).
 - `issue-labels.yml`: daily warning for open issues older than one day, except pinned ones, that have no P0 to P3 label. Writes a job summary. Runs on `ubuntu-slim`.
   A second job warns about labels named in `CONTRIBUTING.md` or issue template front matter that do not exist in the repository (#6643).
-- `evidence.yml`: native evidence on hosted runners, dispatched per run. The `evidence-<platform>` artifact holds `evidence.log` and each test's log, XML and undeclared outputs. Set `platforms` to `["macos_arm64"]` for Apple runs. Set `android` to boot an emulator and run the Rust Android device scenarios on `linux_x86_64`. Set `qualify` on `windows_x86_64` to run `//cc/context:qualify` for llvm and msvc. Set `relocate` (test or build) to rerun the task under a fresh `--output_base` with the disk cache off and remote cache hits refused; the second run logs to `relocated.log`, and `bazel-testlogs` then points at the relocated base. With `task=build` it also hashes every output of `scope` in both bases, writes `match` or `differ <file> <first> <relocated>` lines to `determinism.txt`, copies each differing file into `determinism/first/` and `determinism/relocated/`, and fails when any differ. The first build may hit the remote cache and the relocated one cannot, so a `first` copy can come from the cache. Set `release_cell` to build and qualify the platform's release cell first with `tools/ci/release_cell.sh`, the script `release-cells.yml` runs, uncached and without RBE; the files land in `release-cell/` of the artifact.
+- `evidence.yml`: native evidence on hosted runners, dispatched per run. The `evidence-<platform>` artifact holds `evidence.log` and each test's log, XML and undeclared outputs. Set `platforms` to `["macos_arm64"]` for Apple runs. Set `android` to boot an emulator and run the Rust Android device scenarios on `linux_x86_64`. Set `qualify` on `windows_x86_64` to run `//cc/context:qualify` for llvm and msvc. Set `relocate` (test or build) to rerun the task under a fresh `--output_base` with the disk cache off and remote cache hits refused; the second run logs to `relocated.log`, and `bazel-testlogs` then points at the relocated base. With `task=build` it also hashes every output of `scope` in both bases, writes `match` or `differ <file> <first> <relocated>` lines to `determinism.txt`, copies each differing file into `determinism/first/` and `determinism/relocated/`, and fails when any differ. The first build may hit the remote cache and the relocated one cannot, so a `first` copy can come from the cache. Set `lock_refresh` to regenerate `MODULE.bazel.lock` on the platform before the scope task and fail when it differs from the checkout; the refreshed lock and `lock.diff` land in `lock/` of the artifact, so a lock entry that only changes on Windows can be copied back. Set `release_cell` to build and qualify the platform's release cell first with `tools/ci/release_cell.sh`, the script `release-cells.yml` runs, uncached and without RBE; the files land in `release-cell/` of the artifact.
 - `evidence-command.yml`: a comment on an issue or pull request whose first line starts with `/evidence`, from an owner, member or collaborator, dispatches `evidence.yml` and replies with the run URL. On a pull request it runs on the PR branch, otherwise on `main`. Arguments are `platforms=`, `task=`, `scope=`, `test_timeout=`, `displays=`, `android=`, `qualify=`, `relocate=` and `release_cell=`, for example `/evidence platforms=["macos_arm64"] task=test scope=//haskell/...`. `evidence.yml` validates them and a rejected run fails there.
 - `dx-update.yml`: weekly `tools/dx update --pr` for dependency updates. `dx init` writes the same file. Where `lock-refresh.yml` exists, it then dispatches that workflow for each open `dx-update/` branch whose `MODULE.bazel.lock` changes the `rules_python` `python` or `rules_go` `go_sdk` entries.
 - `pin-android-maven.yml`: dispatch-only. Runs `REPIN=1 bazel run @rules_android_maven//:pin` on `ubuntu-latest` and uploads `rules_android_maven_install.json` as an artifact to commit after a rules_android or rules_flutter bump, so the lock is not resolved through Coursier on a throttled network (#7184).

.github/workflows/evidence.yml

@@ -41,6 +41,11 @@ on:
         type: boolean
         required: false
         default: false
+      lock_refresh:
+        description: "Regenerate MODULE.bazel.lock on the platform and fail when it differs; the refreshed lock and diff land in lock/ of the artifact."
+        type: boolean
+        required: false
+        default: false
       release_cell:
         description: "Build and qualify the dx release cell of each platform with the script release-cells.yml runs, uncached, before the scope task."
         type: boolean
@@ -223,6 +228,14 @@ jobs:
           done
           bazel run --noshow_progress "${flags[@]}" //tools/testing/hermetic:appcontainer_run -- \
             --backend user --ensure-host-denies "${denies[@]}"
+      - name: Regenerate MODULE.bazel.lock
+        if: ${{ inputs.lock_refresh }}
+        run: |
+          out="$RUNNER_TEMP/evidence/lock"
+          mkdir -p "$out"
+          bazel mod deps --lockfile_mode=update 2>&1 | tee "$out/mod-deps.log"
+          cp MODULE.bazel.lock "$out/MODULE.bazel.lock"
+          git diff --exit-code MODULE.bazel.lock > "$out/lock.diff" || { cat "$out/lock.diff"; exit 1; }
       - name: Run evidence task
         env:
           DX_SCOPE: ${{ steps.inputs.outputs.scope }}