[7.2.0] Add a git merge driver for MODULE.bazel.lock

MODULE.bazel

@@ -307,6 +307,30 @@ gvm.graalvm(
 )
 use_repo(gvm, "graalvm_toolchains")
 
+http_file = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_file")
+
+# DO NOT UPDATE the jq version, this is used to verify compatibility with old versions.
+http_file(
+    name = "jq_linux_amd64",
+    executable = True,
+    integrity = "sha256-xrOn19PntwxvUbcGo7kL0BgzhGxU0yyjLwAn8AIm/20=",
+    urls = ["https://github.com/jqlang/jq/releases/download/jq-1.5/jq-linux64"],
+)
+
+http_file(
+    name = "jq_macos_amd64",
+    executable = True,
+    integrity = "sha256-OG6SyYKlb+SFFGjXqTHfyilWDO4wag5mxqG9QGXT2sU=",
+    urls = ["https://github.com/jqlang/jq/releases/download/jq-1.5/jq-osx-amd64"],
+)
+
+http_file(
+    name = "jq_windows_amd64",
+    executable = True,
+    integrity = "sha256-6+zYQLpH779mgihoF4zHIaFRBgk396xAbj0xvQFb3pQ=",
+    urls = ["https://github.com/jqlang/jq/releases/download/jq-1.5/jq-win64.exe"],
+)
+
 # =========================================
 # Other Bazel testing dependencies
 # =========================================

scripts/BUILD

@@ -40,6 +40,32 @@ sh_test(
     ],
 )
 
+filegroup(
+    name = "jq",
+    srcs = select({
+        "@platforms//os:linux": ["@jq_linux_amd64//file"],
+        "@platforms//os:macos": ["@jq_macos_amd64//file"],
+        "@platforms//os:windows": ["@jq_windows_amd64//file"],
+    }),
+)
+
+sh_test(
+    name = "bazel_lockfile_merge_test",
+    size = "small",
+    srcs = ["bazel_lockfile_merge_test.sh"],
+    data = [
+        "bazel-lockfile-merge.jq",
+        "testenv.sh",
+        ":jq",
+        "//src/test/shell:bashunit",
+        "//src/test/tools/bzlmod:MODULE.bazel.lock",
+        "@bazel_tools//tools/bash/runfiles",
+    ],
+    env = {
+        "JQ_RLOCATIONPATH": "$(rlocationpath :jq)",
+    },
+)
+
 filegroup(
     name = "srcs",
     srcs = glob(["**"]) + [

scripts/bazel-lockfile-merge.jq

@@ -0,0 +1,54 @@
+# Merges an arbitrary number of MODULE.bazel.lock files.
+#
+# Input: an array of MODULE.bazel.lock JSON objects (as produced by `jq -s`).
+# Output: a single MODULE.bazel.lock JSON object.
+#
+# This script assumes that all files are valid JSON and have a numeric
+# "lockFileVersion" field. It will not fail on any such files, but only
+# preserves information for files with a version of 10 or higher.
+#
+# The first file is considered to be the base when deciding which values to
+# keep in case of conflicts.
+
+# Like unique, but preserves the order of the first occurrence of each element.
+def stable_unique:
+  reduce .[] as $item ([]; if index($item) == null then . + [$item] else . end);
+
+# Given an array of objects, shallowly merges the result of applying f to each
+# object into a single object, with a few special properties:
+# 1. Values are uniquified before merging and then merged with last-wins
+#    semantics. Assuming that the first value is the base, this ensures that
+#    later occurrences of the base value do not override other values. For
+#    example, when this is called with B A1 A2 and A1 contains changes to a
+#    field but A2 does not (compared to B), the changes in A1 will be preserved.
+# 2. Object keys on the top level are sorted lexicographically after merging,
+#    but are additionally split on ":". This ensures that module extension IDs,
+#    which start with labels, sort as strings in the same way as they due as
+#    structured objects in Bazel (that is, //python/extensions:python.bzl
+#    sorts before //python/extensions/private:internal_deps.bzl).
+def shallow_merge(f):
+  map(f) | stable_unique | add | to_entries | sort_by(.key | split(":")) | from_entries;
+
+(
+    # Ignore all MODULE.bazel.lock files that do not have the maximum
+    # lockFileVersion.
+    (map(.lockFileVersion) | max) as $maxVersion
+    | map(select(.lockFileVersion == $maxVersion))
+    | {
+        lockFileVersion: $maxVersion,
+        registryFileHashes: shallow_merge(.registryFileHashes),
+        selectedYankedVersions: shallow_merge(.selectedYankedVersions),
+        # Group extension results by extension ID across all lockfiles with
+        # shallowly merged factors map, then shallowly merge the results.
+        moduleExtensions:  (map(.moduleExtensions | to_entries)
+                           | flatten
+                           | group_by(.key)
+                           | shallow_merge({(.[0].key): shallow_merge(.value)}))
+    }
+)? //
+    # We get here if the lockfiles with the highest lockFileVersion could not be
+    # processed, for example because all lockfiles have lockFileVersion < 10.
+    # In this case Bazel 7.2.0+ would ignore all lockfiles, so we might as well
+    # return the first lockfile for the proper "mismatched version" error
+    # message.
+    .[0]