test: Replace test_num_dependencies with github action

The purpose of the test_num_dependencies test was to be a "prompt" about
dependency changes in PRs. However, manually updating the
dependencies.txt file is incompatible with letting dependabot manage
automated dependency updates (firecracker-microvm#3585). We therefore decided to replace
the test with a different "prompt" in the form of an optional GitHub
Actions check that fails whenever a lockfile is touched.

Signed-off-by: Patrick Roy <[email protected]>

Author: roypat

.github/workflows/dependency_modification_check.yml

@@ -0,0 +1,18 @@
+name: Check no dependencies were modified
+
+on:
+  pull_request
+
+jobs:
+  dependency_changed_check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Checkout repository"
+        uses: actions/checkout@v3
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: "Check Cargo.lock not in changeset" 
+        run: |
+          git fetch origin
+          git diff origin/$GITHUB_BASE_REF.. --name-only| ( ! grep "Cargo.lock")

tests/framework/dependencies.txt

@@ -2,7 +2,6 @@
 # SPDX-License-Identifier: Apache-2.0
 """Enforces controls over dependencies."""
 
-import ast
 import os
 
 import pytest
@@ -29,47 +28,3 @@ def test_licenses():
     utils.run_cmd(
         "cargo deny --locked --manifest-path {} check licenses".format(toml_file)
     )
-
-
-@pytest.mark.parametrize("dep_file", ["framework/dependencies.txt"])
-def test_num_dependencies(dep_file):
-    """Enforce minimal dependency check.
-
-    @type: build
-    """
-    _, stdout, _ = utils.run_cmd(
-        "cargo tree --locked --prefix none -e no-dev " "--workspace"
-    )
-    deps = stdout.splitlines()
-
-    current_deps = set()
-    # cargo tree displays a tree of dependencies which means
-    # some of them will repeat. Below is a mechanism for filtering
-    # unique dependencies.
-    # cargo tree tries to display a (*) at the end of each non-leaf dependency
-    # that was already encountered (crates without dependencies, such as libc
-    # appear multiple times).
-    for line in deps:
-        if line and "(*)" not in line:
-            # only care about dependency name, not version/path/github repo
-            current_deps.add(line.split()[0])
-
-    # Use the code below to update the expected dependencies.
-    # with open(dep_file, "w", encoding='utf-8') as prev_deps:
-    #     prev_deps.write(repr(sorted(current_deps)).replace(',', ',\n'))
-
-    with open(dep_file, encoding="utf-8") as prev_deps:
-        prev_deps = ast.literal_eval(prev_deps.read())
-
-    difference = current_deps - set(prev_deps)
-
-    if difference:
-        assert (
-            False
-        ), f"New build dependencies detected. Is this expected? New dependencies {difference}"
-
-    difference = set(prev_deps) - current_deps
-    if difference:
-        assert (
-            False
-        ), f"Some build dependencies have been removed: {difference}. Please update the test accordingly."