ci: ensure tree is clean after build

To ensure Cargo.lock or other files that are committed are not modified
by the build in CI.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>

.cirrus.yml

@@ -54,6 +54,7 @@ build_task:
     reupload_on_changes: true
   setup_script: &setup "$SCRIPT_BASE/setup.sh $CIRRUS_TASK_NAME"
   main_script: &main "$SCRIPT_BASE/runner.sh $CIRRUS_TASK_NAME"
+  postbuild_script: &postbuild hack/tree_status.sh
   # N/B: This script comes from `main` on the netavark repo
   cache_grooming_script: &groom bash "$SCRIPT_BASE/netavark_cache_groom.sh"
   upload_caches: [ "cargo", "targets", "bin" ]
@@ -78,6 +79,7 @@ build_aarch64_task:
     fingerprint_key: "cargo_v1_${DEST_BRANCH}_aarch64"
   setup_script: *setup
   main_script: *main
+  postbuild_script: *postbuild
   cache_grooming_script: *groom
   upload_caches: [ "cargo", "targets", "bin" ]
   # Downstream CI needs the aarch64 binaries from this CI system.

hack/tree_status.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -e
+
+STATUS=$(git status --porcelain)
+if [[ -z $STATUS ]]
+then
+	echo "tree is clean"
+else
+	echo "tree is dirty"
+	echo ""
+	echo "$STATUS"
+	echo ""
+	echo "---------------------- Diff below ----------------------"
+	echo ""
+	git --no-pager diff
+	exit 1
+fi
+