ci(gen): add apidiff exported-API gate

.github/workflows/go.yaml

@@ -10,6 +10,8 @@ jobs:
     steps:
       - name: checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
 
       - name: install Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
@@ -19,6 +21,11 @@ jobs:
       - name: get modules
         run: go mod vendor
 
+      - name: install tools
+        run: |
+          make tools
+          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
+
       - name: generate
         run: make generate
 
@@ -32,3 +39,6 @@ jobs:
 
       - name: run tests
         run: make test
+
+      - name: apidiff
+        run: make apidiff

Makefile

@@ -1,9 +1,20 @@
 PACKAGES = $(shell go list ./...)
 GO := CGO_ENABLED=0 go
+GOFUMPT_VERSION := v0.7.0
+APIDIFF_VERSION := v0.0.0-20260811152304-ee035b5b010f
 
 .PHONY: all
 all: build
 
+.PHONY: tools
+tools:
+	$(GO) install mvdan.cc/gofumpt@$(GOFUMPT_VERSION)
+	$(GO) install golang.org/x/exp/cmd/apidiff@$(APIDIFF_VERSION)
+
+.PHONY: apidiff
+apidiff:
+	./scripts/apidiff.sh
+
 .PHONY: clean
 clean:
 	$(GO) clean -i ./...

scripts/apidiff.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# Fail if the exported API of ./githubevents changed incompatibly vs a base ref.
+set -euo pipefail
+
+BASE="${1:-origin/main}"
+PKG="./githubevents"
+
+command -v apidiff >/dev/null 2>&1 || { echo "apidiff not installed; run 'make tools'"; exit 1; }
+
+work="$(mktemp -d)"
+base_wt="$work/base"
+cleanup() { git worktree remove --force "$base_wt" >/dev/null 2>&1 || true; rm -rf "$work"; }
+trap cleanup EXIT
+
+git worktree add --quiet --detach "$base_wt" "$BASE"
+( cd "$base_wt" && go mod download && apidiff -w "$work/base.api" "$PKG" )
+
+out="$(apidiff "$work/base.api" "$PKG")"
+printf '%s\n' "$out"
+if printf '%s\n' "$out" | grep -q '^Incompatible changes:'; then
+  echo ">> incompatible API changes detected"
+  exit 1
+fi
+echo ">> API compatible"