go-mod-tidy-diff-check.yml

name: Go Mod Tidy Diff Check

on:
    push:
        branches:
            - main
    pull_request:
        branches:
            - main

permissions: # set contents: read at top-level, per OpenSSF ScoreCard rule TokenPermissionsID
    contents: read

jobs:
    tidy-check:
        runs-on: ubuntu-latest
        steps:
            - name: Checkout code
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

            - name: Set up Go
              uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
              with:
                  go-version: "1.25.7"

            - name: Cache Go modules
              uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
              with:
                  path: ~/go/pkg/mod
                  key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
                  restore-keys: |
                      ${{ runner.os }}-go-

            - name: Run go mod tidy and check for changes
              run: |
                  go mod tidy
                  git diff --exit-code go.mod go.sum