Using of `lock_file` and `fail_if_repin_required` in the `maven.install`

[al-babych-fivetran]

Is there any reason not to use the lock_file and fail_if_repin_required in the maven.install of the MODULE.bazel?

I understand that you have to run an additional re-pin command if the dependency was updated.

But this allows us to use the native Bazel downloader instead of Courcier.

Our use case is to use grpc-java as a Bazel 9 module. And with the Courcier, we have to download Maven artifacts from the https://repo.maven.apache.org/maven2/ each time. This fact makes our CI builds unstable. And we can't benefit from --repository_cache (local cache on each CI worker) or --downloader_config (rewriting repo.maven.apache.org to the private proxy).

[AgraVator]

Thanks for the detailed context. We understand the CI pain caused by Coursier bypassing Bazel's caching, but we are against adding a lock file to grpc-java for two reasons:

Maintainability: It forces serial dependency updates. Concurrent PRs bumping different versions would constantly hit merge conflicts on the lock file.

Architecture: A lock file belongs at the root application level, not the library level. Any dependencies you add downstream in your project would immediately invalidate our lock file anyway.

[al-babych-fivetran]

Thanks for the clarification.