add new CI step to validate go mod integrity

.github/workflows/golang.yaml

@@ -17,15 +17,27 @@ name: Golang
 on:
   pull_request:
     branches:
-      - master
-      - release-*
+    - master
+    - release-*
   push:
     branches:
-      - master
-      - release-*
+    - master
+    - release-*
 
 jobs:
-  check:
+  validate-go-modules:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.20'
+      - run: make validate-modules
+
+  lint:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
@@ -36,17 +48,19 @@ jobs:
         version: latest
         args: -v --timeout 5m
         skip-cache: true
+
   test:
       name: Unit test
       runs-on: ubuntu-latest
       steps:
-        - name: Checkout code
-          uses: actions/checkout@v4
-        - name: Install Go
-          uses: actions/setup-go@v5
-          with:
-            go-version: '1.20'
-        - run: make test
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.20'
+      - run: make test
   build:
     runs-on: ubuntu-latest
     steps:

Makefile

@@ -14,6 +14,7 @@
 
 DOCKER   ?= docker
 MKDIR    ?= mkdir
+GO       ?= go
 
 include $(CURDIR)/versions.mk
 
@@ -78,3 +79,14 @@ PHONY: .shell
 		-w /work \
 		--user $$(id -u):$$(id -g) \
 		$(BUILDIMAGE)
+
+.PHONY: validate-modules
+validate-modules:
+	@echo "- Verifying that the dependencies have expected content..."
+	$(GO) mod verify
+	@echo "- Checking for any unused/missing packages in go.mod..."
+	$(GO) mod tidy
+	@git diff --exit-code -- go.sum go.mod
+	@echo "- Checking if the vendor dir is in sync..."
+	$(GO) mod vendor
+	@git diff --exit-code -- vendor