Add GH workflow to check go mod tidy

We've had a couple occurrences of unused dependencies being merged.
Ensure this doesn't happen.

Signed-off-by: Adam Cmiel <acmiel@redhat.com>

Author: chmeliik

.github/workflows/gomod-tidy.yaml

@@ -0,0 +1,33 @@
+name: go mod tidy
+
+"on":
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  gomod-tidy:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up Go
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        with:
+          go-version-file: go.mod
+
+      - name: Check if dependencies are tidy
+        run: |
+          #!/bin/bash
+          set -o errexit -o nounset -o pipefail
+
+          go mod tidy
+
+          if ! git diff --quiet; then
+            git diff --color
+            echo "::error::go mod tidy made changes"
+            echo "Please run 'go mod tidy' and commit the changes."
+            exit 1
+          fi

renovate.json

@@ -1,7 +1,8 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:recommended"
+    "config:recommended",
+    "helpers:pinGitHubActionDigestsToSemver"
   ],
   "packageRules": [
     {