ci: enforce reproducible quality gates

scripts/check_diff.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ -n "${GITHUB_BASE_REF:-}" ]] && git rev-parse --verify --quiet "origin/$GITHUB_BASE_REF" >/dev/null; then
+  git diff --check "origin/$GITHUB_BASE_REF...HEAD"
+elif [[ -n "${GITHUB_EVENT_BEFORE:-}" ]] && [[ "$GITHUB_EVENT_BEFORE" != "0000000000000000000000000000000000000000" ]] && git cat-file -e "$GITHUB_EVENT_BEFORE^{commit}" 2>/dev/null; then
+  git diff --check "$GITHUB_EVENT_BEFORE..HEAD"
+elif git rev-parse --verify --quiet HEAD^ >/dev/null; then
+  git diff --check HEAD^..HEAD
+else
+  git diff --check HEAD
+fi
+
+git diff --check