Check license files in CI

This commit updates verify-codegen.sh to verify that licenses have been updated.
It also saves local state for go.mod and go.sum during verification, since
hack/update-codegen.sh (via hack/update-deps.sh) may modify these files.
This ensures that code is modified only by hack/update-codegen.sh and not hack/verify-codegen.sh.

go.mod

@@ -42,19 +42,9 @@ require github.com/benbjohnson/clock v1.1.0 // indirect
 
 require (
 	code.gitea.io/sdk/gitea v0.15.1
-	github.com/cenkalti/backoff/v3 v3.2.2
 	github.com/goccy/kpoward v0.1.0
 	github.com/google/go-containerregistry/pkg/authn/k8schain v0.0.0-20221030203717-1711cefd7eec
-	github.com/hashicorp/go-cleanhttp v0.5.2
-	github.com/hashicorp/go-retryablehttp v0.7.2
-	github.com/hashicorp/go-rootcerts v1.0.2
-	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7
-	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2
-	github.com/hashicorp/go-sockaddr v1.0.2
-	github.com/hashicorp/hcl v1.0.0
 	github.com/letsencrypt/boulder v0.0.0-20221109233200-85aa52084eaf
-	github.com/mitchellh/mapstructure v1.5.0
-	github.com/ryanuber/go-glob v1.0.0
 	github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399
 	go.opentelemetry.io/otel v1.14.0
 	go.opentelemetry.io/otel/exporters/jaeger v1.14.0
@@ -84,6 +74,7 @@ require (
 	github.com/Azure/go-autorest/autorest/validation v0.3.1 // indirect
 	github.com/aws/aws-sdk-go-v2/service/kms v1.20.5 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.4 // indirect
+	github.com/cenkalti/backoff/v3 v3.2.2 // indirect
 	github.com/cloudflare/circl v1.1.0 // indirect
 	github.com/emicklei/go-restful/v3 v3.9.0 // indirect
 	github.com/fatih/color v1.13.0 // indirect
@@ -93,12 +84,21 @@ require (
 	github.com/googleapis/enterprise-certificate-proxy v0.2.3 // indirect
 	github.com/googleapis/gax-go/v2 v2.7.0 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.2 // indirect
+	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
+	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7 // indirect
+	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
+	github.com/hashicorp/go-sockaddr v1.0.2 // indirect
+	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/hashicorp/vault/api v1.9.0 // indirect
 	github.com/jellydator/ttlcache/v2 v2.11.1 // indirect
 	github.com/kr/pretty v0.3.0 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/pjbgf/sha1cd v0.3.0 // indirect
 	github.com/rogpeppe/go-internal v1.8.0 // indirect
+	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/skeema/knownhosts v1.1.0 // indirect
 	github.com/theupdateframework/go-tuf v0.5.2 // indirect
 	github.com/zeebo/errs v1.3.0 // indirect
@@ -194,12 +194,12 @@ require (
 	go.uber.org/multierr v1.8.0 // indirect
 	golang.org/x/crypto v0.6.0
 	golang.org/x/mod v0.8.0 // indirect
-	golang.org/x/net v0.8.0
+	golang.org/x/net v0.8.0 // indirect
 	golang.org/x/sync v0.1.0
 	golang.org/x/sys v0.6.0 // indirect
 	golang.org/x/term v0.6.0 // indirect
 	golang.org/x/text v0.8.0 // indirect
-	golang.org/x/time v0.3.0
+	golang.org/x/time v0.3.0 // indirect
 	golang.org/x/tools v0.6.0 // indirect
 	google.golang.org/api v0.110.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect

hack/verify-codegen.sh

@@ -40,17 +40,26 @@ cp -aR "${REPO_ROOT_DIR}/vendor" "${TMP_DIFFROOT}"
 mkdir -p "${TMP_DIFFROOT}/docs"
 cp -aR "${REPO_ROOT_DIR}/docs" "${TMP_DIFFROOT}"
 
+mkdir -p "${TMP_DIFFROOT}/third_party"
+cp -aR "${REPO_ROOT_DIR}/third_party" "${TMP_DIFFROOT}"
+
+cp -aR "${REPO_ROOT_DIR}/go.mod" "${TMP_DIFFROOT}"
+cp -aR "${REPO_ROOT_DIR}/go.sum" "${TMP_DIFFROOT}"
+
+
 "${REPO_ROOT_DIR}/hack/update-codegen.sh"
 echo "Diffing ${REPO_ROOT_DIR} against freshly generated codegen"
 ret=0
 diff -Naupr "${REPO_ROOT_DIR}/pkg" "${TMP_DIFFROOT}/pkg" || ret=1
 diff -Naupr "${REPO_ROOT_DIR}/vendor" "${TMP_DIFFROOT}/vendor" || ret=1
 diff -Naupr "${REPO_ROOT_DIR}/docs/pipeline-api.md" "${TMP_DIFFROOT}/docs/pipeline-api.md" || ret=1
+diff -Naupr "${REPO_ROOT_DIR}/third_party" "${TMP_DIFFROOT}/third_party" || ret=1
 
 # Restore working tree state
 rm -fr "${REPO_ROOT_DIR}/pkg"
 rm -fr "${REPO_ROOT_DIR}/vendor"
 rm -fr "${REPO_ROOT_DIR}/docs"
+rm -fr "${REPO_ROOT_DIR}/third_party"
 cp -aR "${TMP_DIFFROOT}"/* "${REPO_ROOT_DIR}"
 
 if [[ $ret -eq 0 ]]