From c1aec4ac820532bab364f02a81873c555a0ba3a1 Mon Sep 17 00:00:00 2001
From: naveen <172697+naveensrinivasan@users.noreply.github.com>
Date: Tue, 15 Feb 2022 16:04:04 +0000
Subject: [PATCH] :seedling: Verify clean env in build

- Verify go mod tidy and go mod verify
- Verify git porcelain
---
 .github/workflows/tests.yaml | 33 +++++++++++++++++++++++++++++++++
 go.mod                       |  2 +-
 go.sum                       |  1 +
 3 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index f7c50cf1..8d039dde 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -38,3 +38,36 @@ jobs:
       - name: Run Go tests
         # cannot run tests with race because we are mutating state (setting ENV variables)
         run: go test ./...
+
+  verify:
+    name: Run verify
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ ubuntu-latest ]
+    steps:
+      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 #v2.4.0
+        # https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
+      - uses: actions/cache@937d24475381cd9c75ae6db12cb4e79714b926ed #v2.1.7
+        with:
+          # In order:
+          # * Module download cache
+          # * Build cache (Linux)
+          # * Build cache (Mac)
+          # * Build cache (Windows)
+          path: |
+            ~/go/pkg/mod
+            ~/.cache/go-build
+            ~/Library/Caches/go-build
+            %LocalAppData%\go-build
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
+      - uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 #v2.1.5
+        with:
+          go-version: '1.17.x'
+      - name: Run Go verify
+        run: |
+            go mod tidy && go mod verify
+            git diff --exit-code
+
diff --git a/go.mod b/go.mod
index 7f617137..bb44a9a5 100644
--- a/go.mod
+++ b/go.mod
@@ -2,4 +2,4 @@ module github.com/ossf/scorecard-action
 
 go 1.17
 
-require github.com/google/go-cmp v0.5.7 // indirect
+require github.com/google/go-cmp v0.5.7
diff --git a/go.sum b/go.sum
index a365b082..a6ca3a47 100644
--- a/go.sum
+++ b/go.sum
@@ -1,3 +1,4 @@
 github.com/google/go-cmp v0.5.7 h1:81/ik6ipDQS2aGcBfIN5dHDB36BwrStyeAQquSYCV4o=
 github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=