feat(repo-policy-sync): manage Bazel dev dependencies

[AlexanderLanin]

Why

This PR adds reusable policy support for keeping selected Bazel dependencies in the correct development graph. This is necessary because expressing dev_dependency changes as repository-wide regular-expression policies is fragile: the same rule must safely handle inline and multiline bazel_dep calls, existing boolean values, comments, and different subsets of dependencies across repositories.

Review

Please focus on the module set and whether I marked them correctly as dev or non dev dependencies. This is not meant to be complete. But it is meant to be correct.

What

• Add the ensure_bazel_dependency_dev_dependency operation for the repository-root MODULE.bazel; dev_dependency: true adds or enables the attribute, while false removes it.
• Add the bundled dev-dependency-alignment policy. It requires score_bazel_cpp_toolchains, aspect_rules_py, buildifier_prebuilt, aspect_rules_lint, toolchains_llvm, and score_rules_imagefs to be development-only, while keeping score_docs_as_code in the normal dependency graph.
• Make absent target dependencies compliant so one policy can govern optional dependencies selected by any_direct_module_dependencies.
• Add policy fixtures and documentation for the operation and policy.

[AlexanderLanin]

Manual plan result: eclipse-score

Ran the upstream dev-dependency-alignment policy in plan-only mode against the public eclipse-score organization, using feat/ensure-bazel-dev-dependency at 607252d. No repository changes or policy PRs were created.

Summary: 60 repositories, 60 evaluations, 14 compliant, 27 requiring changes, 19 not applicable, 0 failures.

Repositories requiring changes

• eclipse-score.github.io: set Bazel dependency 'buildifier_prebuilt' dev_dependency to true; set Bazel dependency 'aspect_rules_lint' dev_dependency to true
• reference_integration: set Bazel dependency 'buildifier_prebuilt' dev_dependency to true; set Bazel dependency 'aspect_rules_lint' dev_dependency to true
• tooling: set Bazel dependency 'aspect_rules_py' dev_dependency to true; set Bazel dependency 'buildifier_prebuilt' dev_dependency to true; set Bazel dependency 'aspect_rules_lint' dev_dependency to true
• communication: remove dev_dependency from Bazel dependency 'score_docs_as_code'
• module_template: set Bazel dependency 'score_bazel_cpp_toolchains' dev_dependency to true
• docs-as-code: set Bazel dependency 'aspect_rules_py' dev_dependency to true; set Bazel dependency 'buildifier_prebuilt' dev_dependency to true
• orchestrator: set Bazel dependency 'buildifier_prebuilt' dev_dependency to true; set Bazel dependency 'aspect_rules_lint' dev_dependency to true
• bazel_registry_ui: set Bazel dependency 'buildifier_prebuilt' dev_dependency to true
• testing_tools: set Bazel dependency 'buildifier_prebuilt' dev_dependency to true; set Bazel dependency 'aspect_rules_lint' dev_dependency to true
• feo: set Bazel dependency 'buildifier_prebuilt' dev_dependency to true; set Bazel dependency 'aspect_rules_lint' dev_dependency to true
• inc_daal: set Bazel dependency 'buildifier_prebuilt' dev_dependency to true; set Bazel dependency 'aspect_rules_lint' dev_dependency to true
• os_autosd: set Bazel dependency 'buildifier_prebuilt' dev_dependency to true; set Bazel dependency 'aspect_rules_lint' dev_dependency to true
• lifecycle: set Bazel dependency 'buildifier_prebuilt' dev_dependency to true; set Bazel dependency 'aspect_rules_lint' dev_dependency to true
• logging: set Bazel dependency 'buildifier_prebuilt' dev_dependency to true; set Bazel dependency 'aspect_rules_lint' dev_dependency to true
• scrample: set Bazel dependency 'buildifier_prebuilt' dev_dependency to true; set Bazel dependency 'aspect_rules_lint' dev_dependency to true
• inc_someip_gateway: remove dev_dependency from Bazel dependency 'score_docs_as_code'
• tools: set Bazel dependency 'aspect_rules_py' dev_dependency to true
• inc_diagnostics: remove dev_dependency from Bazel dependency 'score_docs_as_code'
• os_images: set Bazel dependency 'buildifier_prebuilt' dev_dependency to true; set Bazel dependency 'aspect_rules_lint' dev_dependency to true
• bazel_cpp_toolchains: set Bazel dependency 'buildifier_prebuilt' dev_dependency to true; set Bazel dependency 'aspect_rules_lint' dev_dependency to true
• score_rust_policies: set Bazel dependency 'aspect_rules_lint' dev_dependency to true
• kyron: set Bazel dependency 'buildifier_prebuilt' dev_dependency to true; set Bazel dependency 'aspect_rules_lint' dev_dependency to true
• config_management: set Bazel dependency 'buildifier_prebuilt' dev_dependency to true; set Bazel dependency 'aspect_rules_lint' dev_dependency to true
• inc_security_crypto: set Bazel dependency 'buildifier_prebuilt' dev_dependency to true; set Bazel dependency 'aspect_rules_lint' dev_dependency to true; set Bazel dependency 'score_rules_imagefs' dev_dependency to true
• rules_imagefs: set Bazel dependency 'buildifier_prebuilt' dev_dependency to true; set Bazel dependency 'aspect_rules_lint' dev_dependency to true
• score_cpp_policies: set Bazel dependency 'aspect_rules_lint' dev_dependency to true
• qnx_unit_tests: set Bazel dependency 'score_rules_imagefs' dev_dependency to true

The generated compliance matrix is included in the run output; this comment records the actionable drift found by the manual plan.

[Copilot]

🟡 Changes recommended

The operation can emit invalid Bazel syntax around trailing comments, and the policy misclassifies a dependency required by a public macro.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds reusable Bazel dev_dependency alignment to repository policies.

Changes:

• Adds and registers a new dependency operation.
• Introduces the bundled alignment policy and fixtures.
• Adds tests and reference documentation.

File summaries

File	Description
repo_policy_sync/tests/operations/test_ensure_bazel_dependency_dev_dependency.py	Tests parsing and transformations.
repo_policy_sync/src/operations/README.md	Documents the operation.
repo_policy_sync/src/operations/ensure_bazel_dependency_dev_dependency.py	Implements dependency alignment.
repo_policy_sync/src/operations/__init__.py	Registers the operation.
repo_policy_sync/src/models.py	Adds the operation model.
repo_policy_sync/policies/README.md	Lists the new policy.
repo_policy_sync/policies/dev-dependency-alignment/policy.yml	Defines dependency classifications.
repo_policy_sync/policies/dev-dependency-alignment/no-target-dependencies/before/MODULE.bazel	Adds absent-target input fixture.
repo_policy_sync/policies/dev-dependency-alignment/no-target-dependencies/after/MODULE.bazel	Adds absent-target expected fixture.
repo_policy_sync/policies/dev-dependency-alignment/mixed-dependencies/before/MODULE.bazel	Adds mixed-dependency input fixture.
repo_policy_sync/policies/dev-dependency-alignment/mixed-dependencies/after/MODULE.bazel	Adds aligned expected fixture.
repo_policy_sync/docs/reference/policy-format.md	Documents configuration and behavior.

Review details

• Files reviewed: 12/12 changed files
• Comments generated: 2
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[AlexanderLanin]

copilot findings not relevant / incorrect

[MaximilianSoerenPollak]

Judging by the tests, it seems to work fine as is.

Waiting for copilot review to see something that I overlooked.

Not a fan of the regex but there is not much else that can be used here.

[MaximilianSoerenPollak]

Might be worth using the same logic as far as possible that we use in bazel_registry, so we don't have two regex that behave differently.
Though unsure if they are too far apart in usage.

[MaximilianSoerenPollak]

I know this will come back one day to bite us.

[AlexanderLanin]

Addressed the actionable feedback in commit 7914dbf.

The operation could place the comma inside a trailing inline comment when adding dev_dependency, producing invalid Starlark. It now masks comments while locating the last active token and inserts the separator before the comment. A regression test covers this case.

I also centralized the shared Bazel module-name and name argument regexes and reused them across the dependency operation and policy engine. The existing regex-based parsing approach remains unchanged.

The aspect_rules_py policy remains unchanged because cr_checker is intentionally an internal development tool rather than a public dependency of this module.

Validation passed: 302 tests, Ruff, pre-commit hooks, and git diff --check.