Add a test to verify the list of expected modules in the default lock file.

This test will help us be more aware of what transitive dependencies are introduced by `@bazel_tools`, we should keep the list of modules as small as possible because they are dependencies of all Bazel users, although fetched lazily.

PiperOrigin-RevId: 690616792
Change-Id: I50aec1fce87bae108cb2f6cb315c75c0ef0c7a4c

Author: meteorcloudy

src/test/tools/bzlmod/verify_default_lock_file.sh

@@ -29,6 +29,31 @@ source "$(grep -sm1 "^$f " "$0.exe.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/
 source "$(rlocation "io_bazel/src/test/shell/integration_test_setup.sh")" \
   || { echo "integration_test_setup.sh not found!" >&2; exit 1; }
 
+# List of expected modules in the default lock file.
+# You may need to update this list if MODULE.tools changes,
+# but we should keep the list as small as possible because
+# they are tranitive dependencies for all Bazel users (although fetched lazily).
+expected_modules=(
+  abseil-cpp
+  bazel_features
+  bazel_skylib
+  buildozer
+  googletest
+  jsoncpp
+  platforms
+  protobuf
+  rules_cc
+  rules_java
+  rules_jvm_external
+  rules_license
+  rules_pkg
+  rules_proto
+  rules_python
+  rules_shell
+  stardoc
+  zlib
+)
+
 function test_verify_lock_file() {
   rm -f MODULE.bazel
   touch MODULE.bazel
@@ -37,6 +62,10 @@ function test_verify_lock_file() {
   bazel mod deps --lockfile_mode=update
   diff -u $(rlocation io_bazel/src/test/tools/bzlmod/MODULE.bazel.lock) MODULE.bazel.lock || fail "Default lockfile for empty workspace is no longer in sync with MODULE.tools. Please run \"bazel run //src/test/tools/bzlmod:update_default_lock_file\""
 
+  # Verify the list of expected modules in the lock file.
+  grep -o '"https://bcr\.bazel\.build[^"]*source.json"' MODULE.bazel.lock | sed -E 's|.*modules/([^/]+)/.*|\1|' | sort -u > actual_modules
+  diff -u <(printf '%s\n' "${expected_modules[@]}" | sort) actual_modules || fail "Expected modules in lockfile do not match the actual modules. Please update 'expected_modules' if necessary."
+
   # Verify if python toolchain version matches Bazel's lock file to ensure it's cached in integration tests.
   # Check strings like `"default_version": "3.11"`` for default python version.
   python_version=$(grep -o '"default_version": "[0-9.]*"' MODULE.bazel.lock | grep -o '[0-9.]*')