Add resolved-dependency override mechanism for DR-008

.github/workflows/internal_tests.yml

@@ -21,4 +21,4 @@ jobs:
   internal_tests:
     uses: eclipse-score/cicd-workflows/.github/workflows/tests.yml@main
     with:
-      bazel-target: "test //scripts/tooling:tooling_tests"
+      bazel-target: "test //scripts/tooling:tooling_tests //scripts/known_good:known_good_tests"

MODULE.bazel

@@ -41,6 +41,11 @@ include("//bazel_common:score_modules_target_sw.MODULE.bazel")
 # Score test images
 include("//bazel_common:score_images.MODULE.bazel")
 
+# Single-version locks for the deps Stage 2 collects test artifacts from (GTest, the Rust
+# test rules, the ferrocene coverage tooling). Read after the includes above so it pins the
+# versions they bring in transitively.
+include("//bazel_common:score_test_artifact_versions.MODULE.bazel")
+
 bazel_dep(name = "rules_boost", repo_name = "com_github_nelhage_rules_boost")
 archive_override(
     module_name = "rules_boost",

bazel_common/score_images.MODULE.bazel

@@ -10,11 +10,13 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 # *******************************************************************************
+# Spelled as a commit, not `tag = "v2.3.1"`: the Stage-1 manifest carries immutable commits only, so
+# a tag-pinned git_override was dropped from it silently and every module resolved its own rules_oci.
 bazel_dep(name = "rules_oci", version = "2.3.1")
 git_override(
     module_name = "rules_oci",
+    commit = "f214185dcf149090cb3212e878f692eb2c8c0d3d",  # v2.3.1
     remote = "https://github.com/bazel-contrib/rules_oci.git",
-    tag = "v2.3.1",
 )
 
 oci = use_extension("@rules_oci//oci:extensions.bzl", "oci")

bazel_common/score_test_artifact_versions.MODULE.bazel

@@ -0,0 +1,41 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+#
+# Deliberate ceilings for the deps Stage 2 collects test artifacts from.
+#
+# ref_int's resolved set is imposed on every module under test whether a dependency is named here or
+# not; this file does not decide *which* deps get pinned. It decides which of those pins are a
+# decision rather than an inheritance. `bazel_dep(version = ...)` is only a floor that MVS raises
+# silently, while `single_version_override` is also a ceiling, so the versions below are ones Stage 1
+# reports as `asserted` rather than `incidental`.
+#
+# Every version here equals what MVS resolves today, so this changes no build now -- only what
+# happens the day something in the graph asks for more.
+
+# C++ test binaries and the coverage .dat files genhtml reads.
+single_version_override(
+    module_name = "googletest",
+    version = "1.17.0.bcr.2",
+)
+
+# Rust test rules that build the .profraw-emitting binaries.
+single_version_override(
+    module_name = "rules_rust",
+    version = "0.68.2-score",
+)
+
+# Ferrocene coverage tooling behind those .profraw files.
+single_version_override(
+    module_name = "score_toolchains_rust",
+    version = "0.8.0",
+)

scripts/known_good/BUILD

@@ -0,0 +1,63 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+load("@rules_python//python:defs.bzl", "py_binary", "py_library")
+load("@score_tooling//python_basics:defs.bzl", "score_py_pytest")
+
+# Library target: the known_good package (models + generators).
+# Depended on by the test and binary targets below. Note //scripts/tooling has its own separate
+# lib/known_good package and does not use this one.
+py_library(
+    name = "known_good",
+    srcs = glob(
+        ["**/*.py"],
+        exclude = ["tests/**"],
+    ),
+    visibility = ["//visibility:public"],
+)
+
+# Tests for the known_good package (currently: ResolvedDependencies).
+# Not part of //scripts/tooling:tooling_tests, whose glob is scoped to scripts/tooling/tests/.
+score_py_pytest(
+    name = "known_good_tests",
+    srcs = glob(["tests/**/*.py"]),
+    data = ["//:known_good.json"],
+    pytest_config = "//:pyproject.toml",
+    deps = [":known_good"],
+)
+
+# Runnable binary for the resolve + inject workflow.
+#
+# Stage 1 (export) — 'bazel mod graph' is a prerequisite; run it first and pass the result:
+#       bazel mod graph --verbose --output=json > graph.json
+#       bazel run //scripts/known_good:resolve_deps -- \
+#           --mod-graph graph.json --export _resolved_deps/resolved_versions.json
+#   Writes the manifest, graph.json and resolved_pins_report.json side by side; all three are
+#   published as the stage1-resolved-deps artifact. Paths are resolved against
+#   BUILD_WORKSPACE_DIRECTORY, so graph.json does not need to be listed in data = [...].
+#
+#   '--verbose' adds 'originalVersion' to each edge, the only record of a consumer asking for a
+#   version other than the one ref_int imposes. It is a strict superset, so Stage 2 reads the same
+#   graph.json either way; without it the export still succeeds, with every verdict 'unknown'.
+#
+# Stage 2 (inject) — consumes that same directory:
+#       bazel run //scripts/known_good:resolve_deps -- \
+#           _module/MODULE.bazel --resolved-deps _resolved_deps/
+#   The manifest supplies each module's resolved version; graph.json identifies the
+#   module-under-test's transitive closure so all of it is pinned, not only direct deps.
+py_binary(
+    name = "resolve_deps",
+    srcs = ["resolved_dependencies.py"],
+    main = "resolved_dependencies.py",
+    visibility = ["//visibility:public"],
+    deps = [":known_good"],
+)