[ci] Check lock files in CI

This script regenerates the Bazel, Cargo, and Python lock files and
checks for a diff.

Signed-off-by: James Wainwright <[email protected]>

.github/workflows/ci.yml

@@ -72,6 +72,8 @@ jobs:
         run: ./ci/scripts/check-links.sh
       - name: Generated documentation
         run: ./ci/scripts/check-cmdgen.sh
+      - name: Lock files
+        run: ./ci/scripts/check-lock-files.sh
 
   slow_lint:
     name: Lint (slow)

ci/scripts/check-lock-files.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+
+# Copyright lowRISC contributors (OpenTitan project).
+# Licensed under the Apache License, Version 2.0, see LICENSE for details.
+# SPDX-License-Identifier: Apache-2.0
+
+set -e
+
+REPO_TOP="$(git rev-parse --show-toplevel)"
+
+cd "$REPO_TOP"
+
+fail() {
+  file="$1"
+  command="$2"
+
+  echo "::error::${file} is not up to date"             >&2
+  echo "Regenerate this lock file using \`${command}\`" >&2
+
+  exit 1
+}
+
+# Regenerate `MODULE.bazel.lock` file.
+bazel mod deps
+if ! git diff --exit-code MODULE.bazel.lock; then
+  fail MODULE.bazel.lock "bazel mod deps"
+fi
+
+# Regenerate `Cargo.lock` files.
+# We use the Cargo from Bazel to ensure there are no resolver version differences.
+cargo=(bazel run @rules_rust//tools/upstream_wrapper:cargo --)
+for toml in third_party/rust/Cargo.toml third_party/tock/Cargo.toml; do
+  if ! "${cargo[@]}" update -w --locked --manifest-path "$toml"; then
+    fail "${toml/toml/lock}" "${cargo[*]} update -w --manifest-path ${toml}"
+  fi
+done
+
+# Regenerate python lock file.
+./util/sh/scripts/gen-python-requirements.sh
+if ! git diff --exit-code python-requirements.txt; then
+  fail python-requirements.txt ./util/sh/scripts/gen-python-requirements.txt
+fi