CI: Test gopkg.lock is up to date

[ValarDragon]

Test that for imports which use a branch, that the revisions in Gopkg.lock are up to date with the latest revisions. I briefly looked at dep status but I was having trouble getting just diffs, and reliable status code errors out of it.

This should also check that Gopkg.lock wasn't deleted, and that it isn't missing any new dependencies in Gopkg.toml.

This should hopefully eliminate issues with Gopkg.lock being removed from develop, and also make us aware quickly when an upstream change breaks the sdk. (In addition to just ensuring we always update the lock file)

[ebuchman]

We should minimize as much as possible the use of branched in the toml

[cwgoes]

We should minimize as much as possible the use of branched in the toml

Agreed; when no version has been released yet, I think pinning to exact revisions is preferable to pinning to branches.

[ValarDragon]

Should we just make a simple script then to ensure that the file exists, no branches are ref'd, and add this to lint?

[cwgoes]

Should we just make a simple script then to ensure that the file exists, no branches are ref'd, and add this to lint?

Yes; can we additionally check that the result of running dep ensure matches the committed Gopkg.lock?

[ValarDragon]

dep status can take care of most of this for us.

It makes sure that Gopkg.toml and lock are in sync, and that Gopkg.lock exists. To check revisions, we can just grep branch in the Gopkg.toml, and exploit that it returns exit status codes based on if there are matches or not.