check-deps.yml

name: "[Informing] Check dependencies"
on:
  push:
    branches:
      - main
      - release-*
  pull_request:
    branches:
      - main
      - release-*

permissions: read-all

jobs:
  check-deps:
    name: "Check dependencies"
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
        with:
          egress-policy: audit

      - name: Check out code into the Go module directory
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
        with:
          go-version: "1.24"
          check-latest: true
      - name: Check go.mod
        shell: bash
        run: |
          # there should be no go.mod changes
          go mod tidy
          git diff --exit-code