Add checks to CI to ensure that generated golden files for xds tests are up to date

.github/scripts/goldenfile_checker.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+set -euo pipefail
+
+# check if there is a diff in the xds testdata directory after running `make envoy-regen`
+make envoy-regen
+
+changed_xds_files=$(git --no-pager diff --name-only HEAD "$(git merge-base HEAD "$GITHUB_BASE_REF")" | egrep "agent/xds/testdata/.*")
+
+# If we do not find a file in .changelog/, we fail the check
+if [ -z "$changed_xds_files" ]; then
+  # pass status check if no changes were found for xds files
+  echo "Found no changes to xds golden files"
+  exit 0
+else
+  echo "Found diffs with xds golden files run $(make envoy-regen) to update them and check that output is expected"
+  exit 0
+fi

.github/workflows/goldenfile-checker.yml

@@ -0,0 +1,30 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+# This workflow checks that are no changes necessary to golden files for xds 
+# tests ensuring they are up to date
+
+name: Golden File Checker
+
+on:
+  pull_request:
+    types: [opened, synchronize, labeled]
+    # Runs on PRs to main and all release branches
+    branches:
+      - main
+      - release/*
+
+jobs:
+  # checks that there is no diff between the existing golden files
+  goldenfile-check:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0 # by default the checkout action doesn't checkout all branches
+      - name: Check for golden file xds tests in diff
+        run: ./.github/scripts/goldenfile_checker.sh
+        env:
+          GITHUB_BASE_REF: ${{ github.event.pull_request.base.ref }}