[jasonwashburn]

Description

Adds check to CI to verify that ./vendor directory is up to date, matches the expected output of go mod vendor and contains no unintended or undesired changes. If there are modifications present after running go mod vendor, the job fails.

Evidence of expected failing behavior in 60aefad when adding an additional file, and modifying one of the vendored dependencies.
Action: https://github.com/defenseunicorns/uds-cli/actions/runs/34612830133/job/103307325591

Related Issue

N/A

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Other (security config, docs update, etc)

Checklist before merging

• Test, docs, adr added or updated as needed
• Contributor Guide Steps followed

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the new CI check consistently detects stale committed vendored dependencies.

Summary

• Runs go mod vendor after existing lint checks.
• Reports detected vendor changes with remediation instructions.
• Correctly scopes status detection to the repository’s single tracked vendor directory.

_{Reviews (1) · Last reviewed commit: "Revert "chore: validate that check fails..."}

[Copilot]

🟢 Approval recommended

No unresolved issues were identified.

Pull request overview

Adds a CI check to verify that the committed vendor/ directory matches go mod vendor.

Changes:

• Runs go mod vendor in the lint workflow.
• Fails if generated vendor changes are detected.

File summaries

File	Description
.github/workflows/test.yaml	Adds vendored dependency consistency validation.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.