Description of the bug:

It's invalid to specify a patch in your MODULE.bazel that is from a repo that's also being loaded in the MODULE.bazel. If you do this you end up corrupting your lockfile and it results in bazel crashes until you delete the lockfile.

It looks like the issue is the invalid patch path gets encoded in the lockfile before it's rejected:

      "repoSpec": {
        "bzlFile": "@@bazel_tools//tools/build_defs/repo:http.bzl",
        "ruleClassName": "http_archive",
        "attributes": {
          "urls": [
            "https://github.com/keith/buildifier-prebuilt/archive/refs/tags/6.4.0.tar.gz"
          ],
          "integrity": "sha256-itqdiOUev1of3/N9de1B1R9eZ3zb6vsKIt2lR0fW4H4=",
          "strip_prefix": "buildifier-prebuilt-6.4.0",
          "remote_patches": {
            "https://bcr.bazel.build/modules/buildifier_prebuilt/6.4.0/patches/module_dot_bazel_version.patch": "sha256-FpUp/q4zJ2H12lwezrYaPUGLY2rr1XoWpiDRaE19udw="
          },
          "remote_patch_strip": 0,
          "patches": [
            "@@[unknown repo 'buildozer' requested from @@]//:foo.patch"
          ],
          "patch_cmds": [],

Then bazel crashes with:

Caused by: com.google.devtools.build.lib.cmdline.LabelSyntaxException: invalid repository name '[unknown repo 'buildozer' requested from @@]': repo names may contain only A-Z, a-z, 0-9, '-', '_', '.' and '~' and must not start with '~'

Which category does this issue belong to?

No response

What's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

1. checkout this branch Add support for bzlmod google/copybara#287
2. add something like this to the MODULE.bazel

single_version_override(
    module_name = "buildifier_prebuilt",
    patches = [
        "@buildozer//:foo.patch",
    ],
)

It has to be patching a module that is used during the build

3. Build like USE_BAZEL_VERSION=last_green bazelisk build //java/com/google/copybara:copybara_deploy.jar
4. Note the build failure for the invalid patch
5. build again

Which operating system are you running Bazel on?

macOS

What is the output of bazel info release?

e03de75

If bazel info release returns development version or (@non-git), tell us how you built Bazel.

No response

What's the output of git remote get-url origin; git rev-parse HEAD ?

No response

Is this a regression? If yes, please try to identify the Bazel commit where the bug was introduced.

No response

Have you found anything relevant by searching the web?

No response

Any other information, logs, or outputs that you want to share?

No response