depscheck.yaml

---
name: Vendor Dependencies Check

permissions:
  contents: read

on:
  pull_request:
    types: ['opened', 'synchronize']
    paths:
      - '.github/workflows/depscheck.yaml'
      - 'vendor/**'
      - '**.go'

jobs:
  depscheck:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
        with:
          go-version-file: ./.go-version
      - run: bash scripts/gogetcookie.sh
      - run: make depscheck
      - name: Guidance on failure
        if: failure()
        run: |
          echo "::error::Vendor Dependencies Check failed."
          echo ""
          echo "Do not modify files in the vendor/ directory directly."
          echo "Instead, update dependencies in go.mod and run 'go mod tidy && go mod vendor' to sync the vendor directory."
          echo "Then run 'make depscheck' locally to verify before pushing."
  save-artifacts-on-fail:
    needs: depscheck
    if: ${{ failure() }}
    uses: ./.github/workflows/save-artifacts.yaml
  comment-on-fail:
    needs: depscheck
    if: ${{ failure() }}
    uses: ./.github/workflows/comment-failure.yaml