ensure enterprise deps are not made directly to root go.mod in ENT

.github/workflows/go-tests.yml

@@ -62,10 +62,35 @@ jobs:
   get-go-version:
     uses: ./.github/workflows/reusable-get-go-version.yml
 
+  check-no-go-mod-changes-in-ent:
+    needs:
+      - setup
+      - get-go-version
+    runs-on: ${{ fromJSON(needs.setup.outputs.compute-small) }}
+    if: ${{ endsWith(github.repository, '-enterprise') }}
+    steps:
+    - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
+    # NOTE: This step is specifically needed for ENT. It allows us to access the required private HashiCorp repos.
+    - name: Setup Git
+      if: ${{ endsWith(github.repository, '-enterprise') }}
+      run: git config --global url."https://${{ secrets.ELEVATED_GITHUB_TOKEN }}:@github.com".insteadOf "https://github.com"
+    - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+      with:
+        go-version: ${{ needs.get-go-version.outputs.go-version }}
+    - run: |
+        # On a PR, base_ref is usually going to be main or, for a backport,
+        # the release branch.  base_ref will be unset if this is being triggered
+        # by a push instead of a PR.
+        target_branch="${{ github.base_ref }}"
+        branch="${{ github.ref_name }}"
+        
+        ./.github/scripts/check-ent-dependencies.sh "${branch}" "${target_branch}"
+
   check-go-mod:
     needs:
     - setup
     - get-go-version
+    - check-no-go-mod-changes-in-ent
     uses: ./.github/workflows/reusable-check-go-mod.yml
     with:
       runs-on: ${{ needs.setup.outputs.compute-small }}