ci: pin setup-envtest and gate go.mod/go.sum tidiness

Two independent hardening items found while adopting the DGXC Go proxy
(#2372), neither of which belongs to that work.

Pin setup-envtest. `go install ...setup-envtest@latest` was the only
unpinned tool install of the four in CI; apidiff, addlicense, and
go-licenses all take a version from .settings.yaml via load-versions. It
runs in the merge gate, so an upstream release could change what every PR
is tested against with no commit here. Now pinned through the same path,
under testing_tools.setup_envtest with a renovate annotation.

Pinned to v0.24.1, which is what @latest resolves to today and matches
sigs.k8s.io/controller-runtime v0.24.1 in go.mod. The envtest control-plane
binaries it fetches are matched to the controller-runtime the tests link
against, so the two should move together. Behaviorally a no-op right now;
that is the point.

Add `go mod tidy -diff`. Nothing verified that go.mod and go.sum are
correct for the source. The existing check only proves vendor/ matches
those manifests, which it cannot fail on a wrong manifest: `go mod vendor`
regenerates from whatever go.mod says, so a bad manifest produces a vendor
tree that matches it perfectly. A requirement nothing imports, or a stale
go.sum entry, passed CI.

`-diff` prints the needed changes and exits non-zero without writing,
which is what makes it usable as a gate. Verified clean on main before
wiring it (rc=0, no output), so it does not turn the gate red on landing.

Also picks up the license header make license added to the probe
workflow, and documents the new required input in .github/actions/README.md.

Signed-off-by: Mark Chmarny <mark@chmarny.com>

Author: mchmarny

.github/actions/README.md

@@ -22,6 +22,7 @@ executable bits or `./script.sh` invocation.
 - `coverage_report` (optional): Whether to generate a coverage report (default: "false")
 - `coverage_threshold` (optional): Minimum coverage percentage (default: empty)
 - `helm_version` (required): Helm version from `load-versions`
+- `setup_envtest_version` (required): setup-envtest version from `load-versions`
 - `apidiff_version` (optional): apidiff version from `load-versions`; when set, installs apidiff and runs `make api-diff` (default: empty, which skips both steps)
 
 Callers that set `apidiff_version` must check out full history with
@@ -382,6 +383,7 @@ jobs:
         with:
           go_version: ${{ steps.versions.outputs.go }}
           helm_version: ${{ steps.versions.outputs.helm }}
+          setup_envtest_version: ${{ steps.versions.outputs.setup_envtest }}
           apidiff_version: ${{ steps.versions.outputs.apidiff }}
           coverage_report: 'true'
       - uses: ./.github/actions/go-lint

.github/actions/go-test/action.yml

@@ -34,6 +34,9 @@ inputs:
     description: 'Optional apidiff version pinned in .settings.yaml (linting.apidiff, via load-versions); leave empty to skip the SDK API compatibility check'
     required: false
     default: ''
+  setup_envtest_version:
+    description: 'setup-envtest version pinned in .settings.yaml (testing_tools.setup_envtest, via load-versions)'
+    required: true
 
 runs:
   using: 'composite'
@@ -48,6 +51,24 @@ runs:
           vendor/modules.txt
         check-latest: true
 
+    # Two different questions, checked in dependency order.
+    #
+    # `go mod tidy -diff` asks whether go.mod/go.sum are correct for the source:
+    # no requirement the code does not import, none missing, no stale go.sum
+    # entries. It prints the needed changes and exits non-zero without writing.
+    # Nothing checked this before, so a requirement could be added to go.mod
+    # that nothing imports and CI stayed green.
+    #
+    # The vendor check then asks whether vendor/ matches those manifests. It
+    # cannot answer the first question: `go mod vendor` regenerates from
+    # whatever go.mod says, so a wrong manifest yields a vendor tree that
+    # matches it perfectly.
+    - name: Verify go.mod and go.sum are tidy
+      shell: bash
+      run: |
+        go mod tidy -diff \
+          || { echo "go.mod/go.sum are not tidy; run 'make tidy' and commit the result" >&2; exit 1; }
+
     - name: Verify vendor is in sync
       shell: bash
       run: |
@@ -65,10 +86,17 @@ runs:
         install_helm: 'true'
         helm_version: '${{ inputs.helm_version }}'
 
+    # Pinned, not @latest: this runs in the merge gate, so an unpinned install
+    # lets an upstream release change what every PR is tested against with no
+    # commit here. Kept in step with sigs.k8s.io/controller-runtime in go.mod.
     - name: Install envtest binaries
       shell: bash
+      env:
+        SETUP_ENVTEST_VERSION: ${{ inputs.setup_envtest_version }}
       run: |
-        go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest
+        [ -n "${SETUP_ENVTEST_VERSION}" ] \
+          || { echo "setup_envtest_version input is required" >&2; exit 1; }
+        go install "sigs.k8s.io/controller-runtime/tools/setup-envtest@${SETUP_ENVTEST_VERSION}"
         setup-envtest use --print path >/dev/null 2>&1
 
     - name: Install API-diff tool

.github/actions/load-versions/action.yml

@@ -52,6 +52,9 @@ outputs:
   tilt:
     description: 'Tilt version'
     value: ${{ steps.versions.outputs.tilt }}
+  setup_envtest:
+    description: 'setup-envtest version'
+    value: ${{ steps.versions.outputs.setup_envtest }}
   helm:
     description: 'Helm version'
     value: ${{ steps.versions.outputs.helm }}
@@ -191,6 +194,7 @@ runs:
         echo "nvkind=$(yq eval '.testing_tools.nvkind' .settings.yaml)" >> $GITHUB_OUTPUT
         echo "ctlptl=$(yq eval '.testing_tools.ctlptl' .settings.yaml)" >> $GITHUB_OUTPUT
         echo "tilt=$(yq eval '.testing_tools.tilt' .settings.yaml)" >> $GITHUB_OUTPUT
+        echo "setup_envtest=$(yq eval '.testing_tools.setup_envtest' .settings.yaml)" >> $GITHUB_OUTPUT
         echo "helm=$(yq eval '.testing_tools.helm' .settings.yaml)" >> $GITHUB_OUTPUT
         echo "helmfile=$(yq eval '.testing_tools.helmfile' .settings.yaml)" >> $GITHUB_OUTPUT
         echo "helmfile_sha256_linux_amd64=$(yq eval '.testing_tools.helmfile_checksums.linux_amd64' .settings.yaml)" >> $GITHUB_OUTPUT

.github/workflows/dgxc-goproxy-probe.yaml

@@ -1,3 +1,17 @@
+# Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 ---
 # Proves the DGXC Go proxy path works before any production job depends on it.
 #

.github/workflows/qualification.yaml

@@ -64,6 +64,7 @@ jobs:
           go_version: ${{ steps.versions.outputs.go }}
           coverage_report: ${{ inputs.coverage_report }}
           coverage_threshold: ${{ steps.versions.outputs.coverage_threshold }}
+          setup_envtest_version: ${{ steps.versions.outputs.setup_envtest }}
           helm_version: ${{ steps.versions.outputs.helm }}
           apidiff_version: ${{ steps.versions.outputs.apidiff }}
 

.settings.yaml

@@ -80,6 +80,12 @@ testing_tools:
   ctlptl: '0.9.4'
   # renovate: datasource=github-releases depName=tilt-dev/tilt depType=testing_tools
   tilt: '0.37.7'
+  # Keep in step with sigs.k8s.io/controller-runtime in go.mod: setup-envtest is
+  # released from that repo under the tools/setup-envtest/vX.Y.Z tag series, and
+  # the envtest control-plane binaries it fetches are matched to the
+  # controller-runtime the tests link against.
+  # renovate: datasource=go depName=sigs.k8s.io/controller-runtime/tools/setup-envtest depType=testing_tools
+  setup_envtest: 'v0.24.1'
   # renovate: datasource=github-releases depName=helm/helm depType=testing_tools
   helm: 'v4.2.4'
   # renovate: datasource=github-releases depName=databus23/helm-diff depType=testing_tools