ci: ensure lockfile is up-to-date

.github/workflows/ci.yaml

@@ -11,6 +11,14 @@ permissions:
   contents: read
 
 jobs:
+  lockfile:
+    name: Check lockfile up to date
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check lockfile
+        run: bazel mod deps --lockfile_mode=error
+
   ci-build-test:
     name: CI build and unit test
     runs-on: distroless-ci-large-ubuntu-20.04 # custom runner most compatible with debian 11

.github/workflows/update-deb-package-snapshots.yml

@@ -33,6 +33,10 @@ jobs:
           done
           bazel run @//private/pkg/test/oci_image:test_sboms
 
+      - name: Run update lockfile
+        if: env.DISTROLESS_DIFF
+        run: bazel mod deps --lockfile_mode=update
+
       - name: Create commits
         if: env.DISTROLESS_DIFF
         id: create-commits

.github/workflows/update-temurin-packages.yml

@@ -45,6 +45,10 @@ jobs:
           git commit -s -m "Bumping temurin archives to latest stable versions"
           git push --force origin HEAD
 
+      - name: Run update lockfile
+        if: env.DISTROLESS_DIFF
+        run: bazel mod deps --lockfile_mode=update
+
       - name: Create Pull Request
         if: env.DISTROLESS_DIFF
         env: