ci: pin deployment config validation toolchain

.github/workflows/ci.yml

@@ -33,6 +33,10 @@ jobs:
       PROVIDER_B_TOKEN: ci-provider-b-token
     steps:
       - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
       - name: Render Compose configuration
         run: docker compose -f deploy/docker-compose.yml config --quiet
       - name: Render Kubernetes base

deploy/ci_test.go

@@ -38,4 +38,25 @@ func TestCIValidatesProtocolAndDeploymentAssets(t *testing.T) {
 			t.Errorf("ci workflow does not validate %q", required)
 		}
 	}
+	deployment, ok := jobs["deployment"].(map[string]any)
+	if !ok {
+		t.Fatal("ci deployment job has invalid definition")
+	}
+	steps, ok := deployment["steps"].([]any)
+	if !ok {
+		t.Fatal("ci deployment job has no steps")
+	}
+	for _, step := range steps {
+		definition, ok := step.(map[string]any)
+		if !ok || definition["uses"] != "actions/setup-go@v5" {
+			continue
+		}
+		options, ok := definition["with"].(map[string]any)
+		if !ok || options["go-version-file"] != "go.mod" {
+			t.Error("ci deployment job must pin actions/setup-go to go.mod")
+			return
+		}
+		return
+	}
+	t.Error("ci deployment job must install the Go version declared by go.mod before running configcheck")
 }