From e52407b36943e8841ab60451bfbc47ffda374bdd Mon Sep 17 00:00:00 2001
From: James Wainwright <james.wainwright@lowrisc.org>
Date: Thu, 9 Jan 2025 11:57:49 +0000
Subject: [PATCH] [ci] Check lock files in CI

This script regenerates the Bazel, Cargo, and Python lock files and
checks for a diff.

Signed-off-by: James Wainwright <james.wainwright@lowrisc.org>
---
 .github/workflows/ci.yml       |  2 ++
 ci/scripts/check-lock-files.sh | 42 ++++++++++++++++++++++++++++++++++
 2 files changed, 44 insertions(+)
 create mode 100755 ci/scripts/check-lock-files.sh

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2eaae69b59f9a7..2bbe41174161eb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -72,6 +72,8 @@ jobs:
         run: ./ci/scripts/check-links.sh
       - name: Generated documentation
         run: ./ci/scripts/check-cmdgen.sh
+      - name: Lock files
+        run: ./ci/scripts/check-lock-files.sh
 
   slow_lint:
     name: Lint (slow)
diff --git a/ci/scripts/check-lock-files.sh b/ci/scripts/check-lock-files.sh
new file mode 100755
index 00000000000000..91c7d2099812ca
--- /dev/null
+++ b/ci/scripts/check-lock-files.sh
@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+
+# Copyright lowRISC contributors (OpenTitan project).
+# Licensed under the Apache License, Version 2.0, see LICENSE for details.
+# SPDX-License-Identifier: Apache-2.0
+
+set -e
+
+REPO_TOP="$(git rev-parse --show-toplevel)"
+
+cd "$REPO_TOP"
+
+fail() {
+  file="$1"
+  command="$2"
+
+  echo "::error::${file} is not up to date"             >&2
+  echo "Regenerate this lock file using \`${command}\`" >&2
+
+  exit 1
+}
+
+# Regenerate `MODULE.bazel.lock` file.
+bazel mod deps
+if ! git diff --exit-code MODULE.bazel.lock; then
+  fail MODULE.bazel.lock "bazel mod deps"
+fi
+
+# Regenerate `Cargo.lock` files.
+# We use the Cargo from Bazel to ensure there are no resolver version differences.
+cargo=(bazel run @rules_rust//tools/upstream_wrapper:cargo --)
+for toml in third_party/rust/Cargo.toml third_party/tock/Cargo.toml; do
+  if ! "${cargo[@]}" update -w --locked --manifest-path "$toml"; then
+    fail "${toml/toml/lock}" "${cargo[*]} update -w --manifest-path ${toml}"
+  fi
+done
+
+# Regenerate python lock file.
+./util/sh/scripts/gen-python-requirements.sh
+if ! git diff --exit-code python-requirements.txt; then
+  fail python-requirements.txt ./util/sh/scripts/gen-python-requirements.txt
+fi