feat: distinct module and package checks

.github/workflows/module-check.yaml

@@ -7,8 +7,9 @@ on:
   pull_request:
 
 env:
-    # comma separated list of restricted Go modules
-    RESTRICTED_MODULES: "cosmossdk.io/x/circuit"
+    # comma separated list of restricted Go modules/packages
+    RESTRICTED_MODULES: "cosmossdk.io/x/circuit, cosmossdk.io/x/group"
+    RESTRICTED_PACKAGES: "github.com/cosmos/cosmos-sdk/x/gov, github.com/cosmos/cosmos-sdk/x/group"
 
 jobs: 
     go-mod-check:
@@ -33,3 +34,17 @@ jobs:
                         exit 1
                     fi
                 done
+
+                for PACKAGE in "${RESTRICTED_PACKAGES[@]}"; do
+                    OUTPUT=$(go mod why -vendor "$PACKAGE")
+                    if echo "$OUTPUT" | grep -q "main module does not need to vendor package $PACKAGE"; then
+                        echo "$PACKAGE is not imported ✓"
+
+                    # if the shortest import path is the E2E suite, is is safe to assume the package is not used in the main module
+                    elif echo "$OUTPUT" | grep -q "github.com/noble-assets/noble/e2e"; then
+                      echo "$PACKAGE is not imported into main Noble module ✓"
+                    else
+                        echo "$PACKAGE is currently restricted as an import in Noble ✘"
+                        exit 1
+                    fi
+                done