fix: Ensure go.mod tidy is executed before WireGuard tests in CI workflow

Author: dsfkjlweuyr

.github/workflows/ci.yml

@@ -40,7 +40,11 @@ jobs:
         run: ./run lib core
       - name: WireGuard endpoint schema and box tests
         working-directory: libcore
-        run: go test -v -tags='with_conntrack,with_gvisor,with_quic,with_wireguard,with_utls,with_clash_api' -run 'Test(WireGuardEndpointConfigsCreateAndClose|MissingWireGuardRouteTagDoesNotFallbackToDirect|LegacyWireGuardOutboundIsRejected)$' .
+        # go.sum is generated in CI and intentionally not committed. Prepare it
+        # here even when the AAR cache skips Native Build (and its go mod tidy).
+        run: |
+          go mod tidy
+          go test -v -tags='with_conntrack,with_gvisor,with_quic,with_wireguard,with_utls,with_clash_api' -run 'Test(WireGuardEndpointConfigsCreateAndClose|MissingWireGuardRouteTagDoesNotFallbackToDirect|LegacyWireGuardOutboundIsRejected)$' .
       - name: Verify LibCore AAR
         run: |
           test -s app/libs/libcore.aar

tools/diagnostics/roo_check_wireguard_endpoint.py

@@ -74,6 +74,14 @@ def main() -> None:
             f"missing={sorted(production_tags - ci_test_tags)}, "
             f"extra={sorted(ci_test_tags - production_tags)}"
         )
+    ci_tidy_index = ci_workflow.find("go mod tidy")
+    ci_wireguard_test_index = ci_workflow.find(
+        "go test -v -tags='with_conntrack,with_gvisor,with_quic,with_wireguard,with_utls,with_clash_api'"
+    )
+    if ci_tidy_index == -1 or ci_wireguard_test_index == -1 or ci_tidy_index > ci_wireguard_test_index:
+        raise SystemExit(
+            "WireGuard Go tests must generate the ignored libcore/go.sum before execution"
+        )
 
     diagnostic_lines = [
         line.strip()