🌱 Verify clean env in build

- Verify go mod tidy and go mod verify
- Verify git porcelain

.github/workflows/tests.yaml

@@ -38,3 +38,36 @@ jobs:
       - name: Run Go tests
         # cannot run tests with race because we are mutating state (setting ENV variables)
         run: go test ./...
+
+  verify:
+    name: Run verify
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ ubuntu-latest ]
+    steps:
+      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 #v2.4.0
+        # https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
+      - uses: actions/cache@937d24475381cd9c75ae6db12cb4e79714b926ed #v2.1.7
+        with:
+          # In order:
+          # * Module download cache
+          # * Build cache (Linux)
+          # * Build cache (Mac)
+          # * Build cache (Windows)
+          path: |
+            ~/go/pkg/mod
+            ~/.cache/go-build
+            ~/Library/Caches/go-build
+            %LocalAppData%\go-build
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
+      - uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 #v2.1.5
+        with:
+          go-version: '1.17.x'
+      - name: Run Go verify
+        run: |
+            go mod tidy && go mod verify
+            git diff --exit-code
+

go.mod

@@ -2,4 +2,4 @@ module github.com/ossf/scorecard-action
 
 go 1.17
 
-require github.com/google/go-cmp v0.5.7 // indirect
+require github.com/google/go-cmp v0.5.7

go.sum

@@ -1,3 +1,4 @@
 github.com/google/go-cmp v0.5.7 h1:81/ik6ipDQS2aGcBfIN5dHDB36BwrStyeAQquSYCV4o=
 github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=