Verify Bazel module dependency integrity

It is imperative that the 'bazel mod graph' command works, to be able to
troubleshoot future module issues. Some problems in the module setup do
not rear their ugly heads in regular build and tests. This makes sure
that the debugging tool works when it is needed the most.

.github/workflows/master.yaml

@@ -71,6 +71,10 @@
                "name": "Test Kubernetes deployment",
                "run": "tools/test-deployment-kubernetes"
             },
+            {
+               "name": "bazel mod integrity",
+               "run": "bazel mod graph"
+            },
             {
                "name": "linux_amd64: build and test",
                "run": "bazel build --platforms=@rules_go//go/toolchain:linux_amd64 //..."

.github/workflows/pull-requests.yaml

@@ -71,6 +71,10 @@
                "name": "Test Kubernetes deployment",
                "run": "tools/test-deployment-kubernetes"
             },
+            {
+               "name": "bazel mod integrity",
+               "run": "bazel mod graph"
+            },
             {
                "name": "linux_amd64: build and test",
                "run": "bazel build --platforms=@rules_go//go/toolchain:linux_amd64 //..."

MODULE.bazel

@@ -23,6 +23,15 @@ bazel_dep(name = "rules_pkg", version = "0.10.1")
 bazel_dep(name = "rules_proto", version = "6.0.0-rc2")
 bazel_dep(name = "toolchains_llvm", version = "1.0.0")
 
+# # Workarounds 2026-06-27
+# ERROR: in tag at https://bcr.bazel.build/modules/grpc-java/1.62.2/MODULE.bazel:89:15: no repository visible as '@com_google_protobuf_javalite' to the repository '@@grpc-java~', but referenced by label '@com_google_protobuf_javalite//:protobuf_javalite' in attribute 'target' of tag 'override'. Is the module 'grpc-java' missing a bazel_dep or use_repo(..., "com_google_protobuf_javalite")?
+# https://github.com/grpc/grpc-java/issues/11275
+# This can be removed once the dep that introduces `grpc-java` as a transitive
+# dependency is updated to use a newer version.
+# ├───googleapis@0.0.0-20240326-1c8d509c5
+# │   ├───grpc-java@1.64.0 (*)
+bazel_dep(name = "grpc-java", version = "1.64.0")
+
 bazel_dep(name = "buildifier_prebuilt", version = "6.4.0", dev_dependency = True)
 
 http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")