Detect stale nested-module pins before release

.github/workflows/test.yml

@@ -15,6 +15,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
 
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
@@ -46,6 +48,7 @@ jobs:
 
       - name: Check standalone Redis modules
         run: |
+          ./scripts/test-validate-release.sh
           ./scripts/check-redisconn-modules.sh
           for module in redisconn redisconn/aws redisconn/azure redisconn/gcp; do
             (cd "$module" && GOWORK=off go mod tidy && GOWORK=off go mod verify && GOWORK=off go test -race ./... && GOWORK=off go vet ./...)

scripts/test-validate-release.sh

@@ -35,6 +35,14 @@ if (
 	echo "provider release unexpectedly accepted development core version" >&2
 	exit 1
 fi
+if (
+	cd scripts/testdata/release-stale-pin
+	../../../scripts/validate-release.sh v1.2.3 >/dev/null 2>&1
+); then
+	echo "root release unexpectedly accepted a real but stale (drifted) redisconn pin" >&2
+	exit 1
+fi
+
 if ./scripts/validate-release.sh redisconn/not-a-version >/dev/null 2>&1; then
 	echo "malformed release tag unexpectedly accepted" >&2
 	exit 1

scripts/testdata/release-stale-pin/go.mod

@@ -0,0 +1,10 @@
+module github.com/stacklok/toolhive-core
+
+go 1.27
+
+require (
+	github.com/stacklok/toolhive-core/redisconn v0.0.1
+	github.com/stacklok/toolhive-core/redisconn/aws v0.0.1
+	github.com/stacklok/toolhive-core/redisconn/azure v0.0.1
+	github.com/stacklok/toolhive-core/redisconn/gcp v0.0.1
+)

scripts/validate-release.sh

@@ -40,13 +40,20 @@ requirements=$(awk '
 	$1 == "require" && $2 ~ /^github\.com\/stacklok\/toolhive-core\/redisconn(\/(aws|azure|gcp))?$/ { print $2, $3 }
 ' "$manifest")
 
+repo_root=$(git rev-parse --show-toplevel)
+
 printf '%s\n' "$requirements" | while read -r module required_version; do
 	[ -n "$module" ] || continue
-	required_tag=${module#github.com/stacklok/toolhive-core/}/$required_version
+	child_dir=${module#github.com/stacklok/toolhive-core/}
+	required_tag=$child_dir/$required_version
 	if ! git rev-parse --verify --quiet "refs/tags/$required_tag^{commit}" >/dev/null; then
 		echo "$manifest requires $module $required_version, but released tag $required_tag is not available locally; fetch required previous tags before tagging $tag" >&2
 		exit 1
 	fi
+	if ! git -C "$repo_root" diff --quiet "$required_tag" -- "$child_dir"; then
+		echo "$manifest requires $module $required_version, but $child_dir has changed since $required_tag was tagged; publish a new $child_dir tag and update this manifest's requirement before tagging $tag" >&2
+		exit 1
+	fi
 done
 
 echo "release manifest validation passed for $tag ($manifest)"