build/ci: add bazel mod tidy step

Running `bazel mod tidy` on the current main branch causes a change in
build/bazel/rust.MODULE.bazel. If `bazel run //:go -- mod tidy` changes
go.mod, it will also also run `bazel mod tidy`, which means that this
will eventually be noticed in a later unrelated change. But it is better
if this is noticed and fixed immediately, so I added `bazel mod tidy` to
the steps run by CI. It looks like we then don't need `bazel mod deps`
anymore.

I also moved the git status step to the post always block, such that it
is run even if one of the previous steps fails. For example,
`bazel run //:gazelle -- update` can fail if a change to
MODULE.bazel.lock is necessary. This should make it easier to understand
why the pipeline failed, because you can then still see which files have
changed, and the "Unclean working directory" message is printed.
I tested that this works, and that the pipeline still fails if a step
in the always block fails.

Change-Id: I05e3f1a5d9e45ba16058cc6758b0acb106458cae
Reviewed-on: https://review.monogon.dev/c/monogon/+/3609
Tested-by: Jenkins CI
Reviewed-by: Tim Windelschmidt <tim@monogon.tech>
diff --git a/build/ci/jenkins-presubmit.groovy b/build/ci/jenkins-presubmit.groovy
index 3b9e719..4d85229 100644
--- a/build/ci/jenkins-presubmit.groovy
+++ b/build/ci/jenkins-presubmit.groovy
@@ -47,28 +47,29 @@
                         gerritCheck checks: ['jenkins:gazelle': 'RUNNING'], message: "Running on ${env.NODE_NAME}"
                         echo "Gerrit change: ${GERRIT_CHANGE_URL}"
                         sh "git clean -fdx -e '/bazel-*'"
-                        sh "JENKINS_NODE_COOKIE=dontKillMe tools/bazel --bazelrc=.bazelrc.ci mod deps --lockfile_mode=update"
+                        sh "JENKINS_NODE_COOKIE=dontKillMe tools/bazel --bazelrc=.bazelrc.ci mod tidy --lockfile_mode=update"
                         sh "JENKINS_NODE_COOKIE=dontKillMe tools/bazel --bazelrc=.bazelrc.ci run //:go -- mod tidy"
                         sh "JENKINS_NODE_COOKIE=dontKillMe tools/bazel --bazelrc=.bazelrc.ci run //:gazelle -- update"
-
-                        script {
-                            def diff = sh script: "git status --porcelain", returnStdout: true
-                            if (diff.trim() != "") {
-                                sh "git diff HEAD"
-                                error """
-                                    Unclean working directory after running gazelle.
-                                    Please run:
-
-                                       \$ bazel mod deps --lockfile_mode=update
-                                       \$ bazel run //:go -- mod tidy
-                                       \$ bazel run //:gazelle -- update
-
-                                    In your git checkout and amend the resulting diff to this changelist.
-                                """
-                            }
-                        }
                     }
                     post {
+                        always {
+                            script {
+                                def diff = sh script: "git status --porcelain", returnStdout: true
+                                if (diff.trim() != "") {
+                                    sh "git diff HEAD"
+                                    error """
+                                        Unclean working directory after running gazelle.
+                                        Please run:
+
+                                        \$ bazel mod tidy --lockfile_mode=update
+                                        \$ bazel run //:go -- mod tidy
+                                        \$ bazel run //:gazelle -- update
+
+                                        In your git checkout and amend the resulting diff to this changelist.
+                                    """
+                                }
+                            }
+                        }
                         success {
                             gerritCheck checks: ['jenkins:gazelle': 'SUCCESSFUL']
                         }