diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 98c9bb150..23a9c3a8c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,20 +7,57 @@ on:
   pull_request:
 
 jobs:
+  check-integrity:
+    name: Check integrity
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: Set up Go
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe #v4.1.0
+        with:
+          go-version: 1.19
+
+      - name: Checkout code
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 #v3.5.3
+
+      - name: Check Go modules dependency file integrity
+        run: |
+          find . -type f -name go.mod | while read module_file; do
+            module=$(dirname "$module_file")
+            pushd "$module" > /dev/null
+            go mod tidy
+            if [ "$(git status --porcelain)" != "" ]; then
+              printf >&2 '\n`go mod tidy` in module `%s` results in a dirty state, Go mod files are not in sync with the source code files, differences:\n\n%s\n\n' "$module" "$(git diff)"
+              git reset --hard
+              exit 1
+            fi
+            popd > /dev/null
+          done
+
+      - name: Check generated file integrity
+        run: |
+          make generate manifests
+          if [ "$(git status --porcelain)" != "" ]; then
+            printf >&2 '\ngenerating code files and manifests results in a dirty state, generated files are not in sync with the source code files, differences:\n\n%s\n\n' "$(git diff)"
+            git reset --hard
+            exit 1
+          fi
+
   build:
-    runs-on: ubuntu-latest
+    name: Build
+    runs-on: ubuntu-22.04
 
     steps:
       - name: Set up Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe #v4.1.0
         with:
           go-version: 1.19
 
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 #v3.5.3
 
       - name: License cache
-        uses: actions/cache@v3
+        uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 #v3.3.1
         with:
           path: .licensei.cache
           key: license-v1-${{ hashFiles('**/go.sum') }}