ci: note that golang bumps require an upstream PR (#13885)

* ci: note that golang bumps require an upstream PR

* use the right parenthesis

* more docs

.github/workflows/ci.yml

@@ -113,3 +113,27 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
       - run: make publish-docker-images
+
+  # Only for forked PRs, when changing the .go-version, then we need to note that the wolfi docker image needs to be
+  # validated
+  validate-wolfi-docker-image:
+    runs-on: ubuntu-latest
+    if: ( github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true ) || github.actor == 'dependabot[bot]'
+    steps:
+      - uses: actions/checkout@v4
+      - name: Get changed files
+        id: changed-files
+        uses: tj-actions/changed-files@c65cd883420fd2eb864698a825fc4162dd94482c # v44.5.7
+        with:
+          files: .go-version
+
+      - name: If .go-version changed validate docker image is available.
+        if: steps.changed-files.outputs.any_changed == 'true'
+        run: |
+          echo "If you change the .go-version please use a branch in the upstream repository to validate the wolfi images with test-package-and-push."
+          echo "Otherwise, this validation will run and fail the CI build."
+          echo "Please validate the wolfi image is available by running the following command:"
+          echo "::notice::docker pull docker.elastic.co/wolfi/go:$(cat .go-version)"
+          echo "If they are available you could skip this validation."
+          echo "However, we recommend to use an upstream branch to run the CI specialised steps for the packaging system."
+          exit 1