[FR]: repin command

[alexeagle]

What is the current behavior?

JavaScript

After changing package.json, users must remember to bazel run -- @pnpm --dir $PWD install or else translate_pnpm_lock uses stale information from the pnpm-lock.yaml file. There's a hacky thing https://github.com/aspect-build/rules_js/blob/main/docs/pnpm.md#update_pnpm_lock that can automate it but I think we killed that for bzlmod / rules_js2 right @jbedard ?

Python

I added pip-compile as a write_source_files-style test that the requirements-lock.txt file is up-to-date. However it can only check on the current platform. It prints a bazel run command when the requirements need to be re-pinned.

Rust

Developers get an error when Cargo.Bazel.lock is out-of-date.

The current `lockfile` is out of date for 'crate_index'. Please re-run bazel using `CARGO_BAZEL_REPIN=true` if this is expected and the lockfile should be updated.

Java

https://github.com/bazelbuild/rules_jvm_external/tree/6.0?tab=readme-ov-file#requiring-lock-file-repinning-when-the-list-of-artifacts-changes

It can be easy to forget to update the maven_install.json lock file when updating artifacts in a maven_install. Normally, rules_jvm_external will print a warning to the console and continue the build when this happens

Go

Under bzlmod, rules_go reads the go.sum file to get integrity hashes. After changing go.mod they're expected to bazel run @go_sdk//:bin/go -- mod tidy

Describe the feature

It's a PITA that every language has a different setup and instructions for developers. Aspect CLI could give one DX on top of this variability, like aspect repin, which would take any changes to any third-party dependency listing and update the pinned/generated code.

[jbedard]

update_pnpm_lock runs pnpm import to convert yarn or npm to pnpm-lock, not pnpm install. But pnpm import sounds like another use case for aspect repin? 👍

[jbedard]

With bzlmod update_pnpm_lock can't reload the lockfile after updating it, so it must fail the build which then needs to be re-run. With rules_js v2 workspace + bzlmod were just aligned to require reloading (aspect-build/rules_js#1701).