*REPIN environment variables in MODULE.bazel.lock

[rdesgroppes]

Hi! We're using rules_rust (0.68.1 as we speak) with bzlmod and found out it stores environment variables in the MODULE.bazel.lock file, i.e. something like:

    "@@rules_rust+//crate_universe:extension.bzl%crate": {
      "general": {
        "bzlTransitiveDigest": "SqazcQEz84W3wQi2J4ebdKrFZp/WOUJ0OleBKT6lD/M=",
        "usagesDigest": "b+S0vdA9o/ApqttLmUlwN9sHqbpn0HvD1kr0NH8M0JI=",
        "recordedFileInputs": {},
        "recordedDirentsInputs": {},
        "envVariables": {
          "CARGO_BAZEL_DEBUG": null,
          "CARGO_BAZEL_GENERATOR_SHA256": null,
          "CARGO_BAZEL_GENERATOR_URL": null,
          "CARGO_BAZEL_ISOLATED": null,
          "CARGO_BAZEL_REPIN": null,
          "CARGO_BAZEL_REPIN_ONLY": null,
          "CARGO_BAZEL_TIMEOUT": null,
          "REPIN": null
        },

When repinning, (CARGO_BAZEL_REPIN=1 bazel ..., REPIN=1 bazel ..., bazel ... --repo_env=CARGO_BAZEL_REPIN=1, bazel ... --repo_env=REPIN=1), the corresponding environment variable is reflected in the updated MODULE.bazel.lock, either:

        "envVariables": {
          "CARGO_BAZEL_DEBUG": null,
          "CARGO_BAZEL_GENERATOR_SHA256": null,
          "CARGO_BAZEL_GENERATOR_URL": null,
          "CARGO_BAZEL_ISOLATED": null,
          "CARGO_BAZEL_REPIN": 1,
          "CARGO_BAZEL_REPIN_ONLY": null,
          "CARGO_BAZEL_TIMEOUT": null,
          "REPIN": null
        },

or:

        "envVariables": {
          "CARGO_BAZEL_DEBUG": null,
          "CARGO_BAZEL_GENERATOR_SHA256": null,
          "CARGO_BAZEL_GENERATOR_URL": null,
          "CARGO_BAZEL_ISOLATED": null,
          "CARGO_BAZEL_REPIN": null,
          "CARGO_BAZEL_REPIN_ONLY": null,
          "CARGO_BAZEL_TIMEOUT": null,
          "REPIN": 1
        },

This poses problem with bazel ... --lockfile_mode=error which then fails due to the discrepancy:

ERROR: MODULE.bazel.lock is no longer up-to-date because: The environment variables the extension '@@rules_rust+//crate_universe:extension.bzl%crate' depends on (or their values) have changed. Please run `bazel mod deps --lockfile_mode=update` to update your lockfile.
<root> (@_)

ERROR: Results may be incomplete as 1 extension failed.

I'd therefore have a few questions:

1. is it by design/intended?
2. is there a way to repin by other means?