ci: add workflow to check Go versions of dependencies (#5340)

.github/workflows/check-go-versions.yaml

@@ -0,0 +1,31 @@
+name: Check Go versions of dependencies
+on:
+  pull_request:
+    paths:
+      - 'go.mod'
+  workflow_dispatch:
+
+jobs:
+  check-go-versions:
+    name: Check Go versions of dependencies
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out code into the Go module directory
+        uses: actions/[email protected]
+
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version: stable
+
+      # This workflow is a workaround before the "old stable" version becomes Go 1.21.
+      # To avoid updating dependencies that require Go 1.21, we use this workflow
+      # Example of wrong update:
+      # https://github.com/aquasecurity/trivy/discussions/5323#discussioncomment-7186321
+      - name: Check that dependencies doesn't require Go 1.21
+        run: |
+          go mod tidy
+          if grep -q "go 1.21" go.mod; then
+            echo "One of new dependencies requires Go '1.21'. Use 'go get [email protected]' to fix this."
+            exit 1
+          fi