chore: add check-versions workflow via baton-admin

Author: Baton Admin

.github/workflows/check-versions.yaml

@@ -0,0 +1,80 @@
+# This file is managed by baton-admin. DO NOT EDIT!!!
+name: Check versions
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  block-versions-yaml-edits:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check for .versions.yaml changes
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          changed_files=$(gh api repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files --paginate --jq '.[].filename')
+          if echo "$changed_files" | grep -qx '.versions.yaml'; then
+            echo "::error::.versions.yaml is managed by baton-admin and must not be edited in PRs. Update versions from baton-admin first."
+            exit 1
+          fi
+          echo ".versions.yaml not modified — OK"
+
+  verify-versions-match:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Verify go.mod matches .versions.yaml
+        run: |
+          # Get .versions.yaml from base branch
+          base_ref="${{ github.event.pull_request.base.ref }}"
+          if ! git show "origin/${base_ref}:.versions.yaml" > /tmp/base-versions.yaml 2>/dev/null; then
+            echo "No .versions.yaml found on ${base_ref} — skipping check"
+            exit 0
+          fi
+
+          mismatch=0
+
+          # Compare go-version
+          expected_go=$(yq -r '.go-version' /tmp/base-versions.yaml)
+          actual_go=$(awk '/^go [0-9]/{print $2}' go.mod)
+          if [ "$expected_go" != "$actual_go" ]; then
+            echo "::error::Go version mismatch: .versions.yaml expects ${expected_go}, but go.mod has ${actual_go}. Update versions from baton-admin first."
+            mismatch=1
+          else
+            echo "Go version matches: ${expected_go}"
+          fi
+
+          # Compare baton-sdk version
+          expected_sdk=$(yq -r '.dependencies.baton-sdk // ""' /tmp/base-versions.yaml)
+          if [ -n "$expected_sdk" ]; then
+            actual_sdk=$(grep 'github.com/conductorone/baton-sdk' go.mod | grep -v '// indirect' | awk '{print $2}' | head -1)
+            if [ "$expected_sdk" != "$actual_sdk" ]; then
+              echo "::error::baton-sdk version mismatch: .versions.yaml expects ${expected_sdk}, but go.mod has ${actual_sdk}. Update versions from baton-admin first."
+              mismatch=1
+            else
+              echo "baton-sdk version matches: ${expected_sdk}"
+            fi
+          fi
+
+          # Compare baton-http version (warning only — not all repos use it)
+          expected_http=$(yq -r '.dependencies.baton-http // ""' /tmp/base-versions.yaml)
+          if [ -n "$expected_http" ]; then
+            actual_http=$(grep 'github.com/conductorone/baton-http' go.mod | grep -v '// indirect' | awk '{print $2}' | head -1)
+            if [ -z "$actual_http" ]; then
+              echo "::warning::baton-http is listed in .versions.yaml (${expected_http}) but not found in go.mod"
+            elif [ "$expected_http" != "$actual_http" ]; then
+              echo "::error::baton-http version mismatch: .versions.yaml expects ${expected_http}, but go.mod has ${actual_http}. Update versions from baton-admin first."
+              mismatch=1
+            else
+              echo "baton-http version matches: ${expected_http}"
+            fi
+          fi
+
+          if [ "$mismatch" -ne 0 ]; then
+            echo "::error::Version mismatches detected. Dependency versions in go.mod must match .versions.yaml on main. Update versions from baton-admin first."
+            exit 1
+          fi
+          echo "All versions match — OK"