From d7e2fddb75042b573faabef95fb96053b8c85d8f Mon Sep 17 00:00:00 2001
From: carla <kirkcohenc@gmail.com>
Date: Tue, 15 Dec 2020 21:17:11 +0200
Subject: [PATCH] github: add workflow that allows us to pin dependencies

This commit adds a workflow that pins certain dependencies in go.mod
that we do not want to bump.
---
 .github/workflows/main.yml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index bbc695aef..abeed5120 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -296,3 +296,24 @@ jobs:
         with:
           path-to-profile: coverage.txt
           parallel: true
+
+  ########################
+  # check pinned dependencies
+  ########################
+  dep-pin:
+    name: check pinned dependencies
+    runs-on: ubuntu-latest
+    strategy:
+      # Allow other tests in the matrix to continue if one fails.
+      fail-fast: false
+      matrix:
+        pinned_dep:
+          - google.golang.org/grpc v1.24.0
+          - github.com/golang/protobuf v1.3.2
+
+    steps:
+      - name: git checkout
+        uses: actions/checkout@v2
+
+      - name: ensure dependences at correct version
+        run:   if ! grep -q "${{ matrix.pinned_dep }}" go.mod; then echo dependency ${{ matrix.pinned_dep }} should not be altered ; exit 1 ; fi