github: add workflow that allows us to pin dependencies

This commit adds a workflow that pins certain dependencies in go.mod
that we do not want to bump.

.github/workflows/main.yml

@@ -296,3 +296,24 @@ jobs:
         with:
           path-to-profile: coverage.txt
           parallel: true
+
+  ########################
+  # check pinned dependencies
+  ########################
+  dep-pin:
+    name: check pinned dependencies
+    runs-on: ubuntu-latest
+    strategy:
+      # Allow other tests in the matrix to continue if one fails.
+      fail-fast: false
+      matrix:
+        pinned_dep:
+          - google.golang.org/grpc v1.24.0
+          - github.com/golang/protobuf v1.3.2
+
+    steps:
+      - name: git checkout
+        uses: actions/checkout@v2
+
+      - name: ensure dependences at correct version
+        run:   if ! grep -q "${{ matrix.pinned_dep }}" go.mod; then echo dependency ${{ matrix.pinned_dep }} should not be altered ; exit 1 ; fi