Fix #184 transitive external repo change now reaches main-repo consumers

[tinder-maxwellelliott]

Summary

Fixes #184. The same root cause sits behind the still-open part of #197 (alias-wrap chain), so this fix benefits both shapes.

Before. BazelQueryService.queryBzlmodRepos synthesised one //external:<repo> target per bzlmod-managed repo, hashed by repo metadata only. There was no rule_input edge between those synthetic targets and no content hash of the underlying directory, so a change inside @inner never propagated to @outer or to //:consume:

//:consume    → @outer//:lib
@outer//:lib  → @inner//:data
@inner//:data → inner/data.txt

The user in #184 saw this with rules_python's pip_parse where @cryptography sits behind @moto behind a py_test rule.

After. Two changes in BazelQueryService:

1. queryBzlmodRepos now parses bazel mod graph --output=json (via BazelModService, newly injected) and, for each repo, computes the list of direct bzlmod deps. For each dep, it emits addRuleInput("//external:<dep_apparent>") on the synthetic target so RuleHasher follows the chain //:consume → //external:outer → //external:inner during digest computation.

   Module name → canonical name is bridged by stripping the trailing +<version> suffix from canonical names (works for the no-version-conflict case; skips extension-generated repos like rules_jvm_external++maven+maven because they don't appear in bazel mod graph anyway). Build.Repository.module_key is not populated by current Bazel, so we cannot key off that.

2. repositoryToTarget now content-hashes the on-disk directory of every local_repository-rule repo (which is what local_path_override lowers to) and attaches the digest as a synthetic _bazel_diff_content_hash attribute. MODULE.bazel.lock is skipped because bazel regenerates it indeterministically. BCR-fetched repos are left alone — their version is already in the metadata, so a version bump flips the synthetic target's hash via that channel.

ModuleGraphParser gains a parseModuleGraphDepEdges helper that returns module_name → [dep_module_names] from the same JSON parseModuleGraph already consumes.

The reproducer test loses its @Ignore, picks up the standard Bazel 8.6.0+ skip guard (the fix relies on mod show_repo --output=streamed_proto), and is renamed …_reproducerForIssue184 → …_regressionForIssue184.

Test plan

• Manual end-to-end on Bazel 9.1 against the bzlmod_transitive_external fixture: editing inner/data.txt with no extra flags now lists //:consume in the impacted-targets output (was empty before).
• bazel test //cli:E2ETest --test_filter=testTransitiveExternalRepoChangeImpactsConsumer_regressionForIssue184 → PASSED in 2.9s.
• Full unit-test sweep across 12 kt_jvm_test targets → all 12 PASSED.
• Broad non-Maven E2ETest sweep (testTransitiveExternalRepo*, testBzlmodLocalPathOverride*, testModuleBazelCommentOnly*, testGoModUpdate*, testMacroBzlChange*, testBzlmodShowRepoDetects*, testExcludeExternalTargets*, testFineGrainedHashBzlMod, testBzlmodTransitiveDepsQuery, testGenerateHashesWithCquery, …) → PASSED in 113.6s.

🤖 Generated with Claude Code

[tinder-maxwellelliott]

Pushed cb20fa6 fixing the two go-test CI failures.

Root cause was a circular dependency in the synthetic dep edges this PR adds. bazel mod graph for the go_mod_change fixture contains:

rules_go -> gazelle  (gazelle is a bazel_dep of rules_go)
gazelle  -> rules_go (rules_go is a bazel_dep of gazelle)

Emitting both directions as rule_inputs on //external:rules_go and //external:gazelle made RuleHasher recurse infinitely and throw:

com.bazel_diff.hash.RuleHasher$CircularDependencyException: Circular dependency detected:
//external:rules_go -> //external:gazelle -> //external:rules_go

…so cli.execute("generate-hashes", ...) returned 1, which is what testGoModUpdateImpactsGoTargets_regressionForIssue266:1502 and testExternalGoDepsAppearInHashes_regressionForIssue228:1672 were asserting wouldn't happen.

Fix: new ModuleGraphParser.breakCycles that DFS-traverses the dep graph in sorted node/edge order and drops any edge to a node currently on the DFS path. Result is acyclic and deterministic across runs. Called from BazelQueryService.queryBzlmodRepos before deriving dep edges.

Dropping the back-edge is safe because each repo in the cycle already has its own synthetic //external:* hash entry, so a content change in either side still propagates to main-repo consumers via their direct dependency — we only lose the ability to propagate through the cycle, which would have been redundant anyway.

Local verification:

• testTransitiveExternalRepoChangeImpactsConsumer_regressionForIssue184 (this PR's reproducer) → PASS
• testGoModUpdateImpactsGoTargets_regressionForIssue266 → now PASS (was the CI failure)
• testExternalGoDepsAppearInHashes_regressionForIssue228 → now PASS (was the CI failure)
• 5 new unit tests for breakCycles covering acyclic, 2-node, 3-node, self-loop, and determinism → all PASS