feat(repo-policy-sync): manage Bazel dev dependencies

repo_policy_sync/docs/reference/policy-format.md

@@ -237,3 +237,26 @@ commented-out dependencies do not count. Duplicate dependencies and malformed
 existing versions are rejected. The version may be a literal `X.Y.Z` string or
 an explicit reference to a policy-local value source, for example
 `version: {ref: devcontainer_version}`.
+
+### `ensure_bazel_dependency_dev_dependency`
+
+```yaml
+- type: ensure_bazel_dependency_dev_dependency
+  module_name: vsps_quality_packages
+  dev_dependency: false
+```
+
+Ensures that one existing direct `bazel_dep` in the repository-root
+`MODULE.bazel` has the configured development-only setting. The module file is
+fixed because bzlmod declares repository dependencies in that conventional
+root file. With `dev_dependency: true`, the operation adds the attribute when
+it is missing and changes an explicit `False` to `True`. With
+`dev_dependency: false`, it removes an explicit boolean `dev_dependency`
+attribute, including an explicit `False`; an omitted attribute is the compliant
+production form. Commented
+calls and arguments do not count. Duplicate target dependencies or duplicate
+`dev_dependency` arguments are rejected. The operation preserves the existing
+argument order and formatting style as far as possible, and is idempotent. If
+the named dependency is absent, the operation is compliant without making a
+change; this allows one policy to govern a set of optional dependencies selected
+by `when.bazel.any_direct_module_dependencies`.

repo_policy_sync/policies/README.md

@@ -28,6 +28,7 @@ use the [documentation index](../docs/README.md).
 
 | Policy | Responsibility | Typical lifecycle |
 | --- | --- | --- |
+| `dev-dependency-alignment` | Keep selected Bazel toolchain and validation dependencies development-only while keeping `score_docs_as_code` in the normal dependency graph. | Baseline maintenance |
 | `docs-as-code-gitignore` | Update `score_docs_as_code` Git ignore entries and remove legacy configuration files. | One-time cleanup |
 | `minimal-bazel-module-declaration` | Keep `MODULE.bazel` limited to the repository-owned module name by removing version metadata. | One-time cleanup |
 | `minimum-bazel-version` | Upgrade repositories to at least Bazel `8.6.0` and regenerate the lockfile when required. | Baseline maintenance |

repo_policy_sync/policies/dev-dependency-alignment/mixed-dependencies/after/MODULE.bazel

@@ -0,0 +1,23 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+
+module(name = "example")
+
+bazel_dep(name = "score_bazel_cpp_toolchains", version = "1.0.0", dev_dependency = True)
+bazel_dep(name = "aspect_rules_py", version = "1.0.0", dev_dependency = True)
+bazel_dep(name = "buildifier_prebuilt", version = "1.0.0", dev_dependency = True)
+bazel_dep(name = "aspect_rules_lint", version = "1.0.0", dev_dependency = True)
+bazel_dep(name = "toolchains_llvm", version = "1.0.0", dev_dependency = True)
+bazel_dep(name = "score_rules_imagefs", version = "1.0.0", dev_dependency = True)
+bazel_dep(name = "score_docs_as_code", version = "1.0.0")
+bazel_dep(name = "unrelated_dependency", version = "1.0.0")

repo_policy_sync/policies/dev-dependency-alignment/mixed-dependencies/before/MODULE.bazel

@@ -0,0 +1,23 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+
+module(name = "example")
+
+bazel_dep(name = "score_bazel_cpp_toolchains", version = "1.0.0")
+bazel_dep(name = "aspect_rules_py", version = "1.0.0", dev_dependency = False)
+bazel_dep(name = "buildifier_prebuilt", version = "1.0.0")
+bazel_dep(name = "aspect_rules_lint", version = "1.0.0", dev_dependency = True)
+bazel_dep(name = "toolchains_llvm", version = "1.0.0")
+bazel_dep(name = "score_rules_imagefs", version = "1.0.0", dev_dependency = False)
+bazel_dep(name = "score_docs_as_code", version = "1.0.0", dev_dependency = True)
+bazel_dep(name = "unrelated_dependency", version = "1.0.0")

repo_policy_sync/policies/dev-dependency-alignment/no-target-dependencies/after/MODULE.bazel

@@ -0,0 +1,16 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+
+module(name = "example")
+
+bazel_dep(name = "unrelated_dependency", version = "1.0.0")

repo_policy_sync/policies/dev-dependency-alignment/no-target-dependencies/before/MODULE.bazel

@@ -0,0 +1,16 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+
+module(name = "example")
+
+bazel_dep(name = "unrelated_dependency", version = "1.0.0")

repo_policy_sync/policies/dev-dependency-alignment/policy.yml

@@ -0,0 +1,58 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+title: "chore(bazel): align development-only dependencies"
+description: |
+  Keep Bazel toolchain, lint, image, and documentation dependencies in the
+  intended dependency graph. The listed build-support dependencies are
+  development-only, while score_docs_as_code is used by the normal build graph.
+
+when:
+  bazel:
+    any_direct_module_dependencies:
+      - score_bazel_cpp_toolchains
+      - aspect_rules_py
+      - buildifier_prebuilt
+      - aspect_rules_lint
+      - toolchains_llvm
+      - score_rules_imagefs
+      - score_docs_as_code
+
+ensure:
+  - type: ensure_bazel_dependency_dev_dependency
+    module_name: score_bazel_cpp_toolchains
+    dev_dependency: true
+    rationale: Toolchain setup is only needed for development and validation.
+  - type: ensure_bazel_dependency_dev_dependency
+    module_name: aspect_rules_py
+    dev_dependency: true
+    rationale: Python build rules are only needed for development and validation.
+  - type: ensure_bazel_dependency_dev_dependency
+    module_name: buildifier_prebuilt
+    dev_dependency: true
+    rationale: Buildifier is a development-time formatting tool.
+  - type: ensure_bazel_dependency_dev_dependency
+    module_name: aspect_rules_lint
+    dev_dependency: true
+    rationale: Lint rules are only needed for development and validation.
+  - type: ensure_bazel_dependency_dev_dependency
+    module_name: toolchains_llvm
+    dev_dependency: true
+    rationale: LLVM toolchains are only needed for development and validation.
+  - type: ensure_bazel_dependency_dev_dependency
+    module_name: score_rules_imagefs
+    dev_dependency: true
+    rationale: Image filesystem rules are only needed for development and validation.
+  - type: ensure_bazel_dependency_dev_dependency
+    module_name: score_docs_as_code
+    dev_dependency: false
+    rationale: Documentation rules are required by the normal build graph.

repo_policy_sync/src/models.py

@@ -141,12 +141,22 @@ class EnsureBazelDependency:
     rationale: str | None = None
 
 
+@dataclass(frozen=True)
+class EnsureBazelDependencyDevDependency:
+    """Ensure the ``dev_dependency`` setting of a direct bzlmod dependency."""
+
+    module_name: str
+    dev_dependency: bool
+    rationale: str | None = None
+
+
 EnsureOperation = (
     EnsureLine
     | RemoveFile
     | ReplaceRegex
     | EnsureMinimumVersion
     | EnsureBazelDependency
+    | EnsureBazelDependencyDevDependency
 )
 
 

repo_policy_sync/src/operations/README.md

@@ -27,6 +27,7 @@ authoritative source for the complete schema, validation rules, and examples.
 | Operation | Use it for | Main behavior | Tests |
 | --- | --- | --- | --- |
 | `ensure_bazel_dependency` | Declaring a direct bzlmod dependency | Adds a `bazel_dep` with the configured module name and version when it is missing. | [`test_ensure_bazel_dependency.py`](../../tests/operations/test_ensure_bazel_dependency.py) |
+| `ensure_bazel_dependency_dev_dependency` | Controlling whether a direct bzlmod dependency is development-only | Adds or changes `dev_dependency = True`, or removes the attribute when configured as false, in the repository-root `MODULE.bazel`. | [`test_ensure_bazel_dependency_dev_dependency.py`](../../tests/operations/test_ensure_bazel_dependency_dev_dependency.py) |
 | `ensure_line` | Keeping one exact line in a text file | Inserts the desired line, removes configured replacements and duplicates, and creates a missing file. | [`test_ensure_line.py`](../../tests/operations/test_ensure_line.py) |
 | `ensure_minimum_version` | Maintaining a simple version file such as `.bazelversion` | Replaces a lower `major.minor.patch` value; equal or higher versions and missing files are compliant. | [`test_ensure_minimum_version.py`](../../tests/operations/test_ensure_minimum_version.py) |
 | `remove_file` | Removing an obsolete file | Deletes an existing file; a missing file is compliant and directories are rejected. | [`test_remove_file.py`](../../tests/operations/test_remove_file.py) |

repo_policy_sync/src/operations/__init__.py

@@ -23,6 +23,9 @@
 from ..errors import RepoPolicySyncError
 from ..models import Change, EnsureOperation, ValueReference
 from .ensure_bazel_dependency import EnsureBazelDependencyOperation
+from .ensure_bazel_dependency_dev_dependency import (
+    EnsureBazelDependencyDevDependencyOperation,
+)
 from .ensure_line import EnsureLineOperation
 from .ensure_minimum_version import EnsureMinimumVersionOperation
 from .remove_file import RemoveFileOperation
@@ -54,6 +57,7 @@ def apply(
 
 _HANDLERS: tuple[OperationHandler, ...] = (
     EnsureBazelDependencyOperation(),
+    EnsureBazelDependencyDevDependencyOperation(),
     EnsureLineOperation(),
     EnsureMinimumVersionOperation(),
     RemoveFileOperation(),