test: prevent the container tests from depending on consul (#16029)

The consul container tests orchestrate running containers from various
versions of consul to test things like upgrades. Having the test
framework itself depend on the consul codebase inherently links it to a
specific version of consul which may make some test approaches in the
future difficult.

This change prohibits any such relationship via a custom linting rule.
Unfortunately because the api, sdk, and
test/integration/consul-container packages are submodules of
github.com/hashicorp/consul the gomodguard linter is incapable of
handling those separately hence the need for some custom bash instead.

.circleci/config.yml

@@ -190,6 +190,14 @@ jobs:
       - run: go install github.com/reillywatson/enumcover/cmd/enumcover@master && enumcover ./...
       - run: *notify-slack-failure
 
+  lint-container-test-deps:
+    docker:
+      - image: *GOLANG_IMAGE
+    steps:
+      - checkout
+      - run: make lint-container-test-deps
+      - run: *notify-slack-failure
+
   lint:
     description: "Run golangci-lint"
     parameters:
@@ -1076,6 +1084,7 @@ workflows:
       - check-generated-protobuf: *filter-ignore-non-go-branches
       - check-generated-deep-copy: *filter-ignore-non-go-branches
       - lint-enums: *filter-ignore-non-go-branches
+      - lint-container-test-deps: *filter-ignore-non-go-branches
       - lint-consul-retry: *filter-ignore-non-go-branches
       - lint: *filter-ignore-non-go-branches
       - lint:

GNUmakefile

@@ -314,18 +314,32 @@ other-consul:
 		exit 1 ; \
 	fi
 
-lint: lint-tools
+lint: -lint-main lint-container-test-deps
+
+.PHONY: -lint-main
+-lint-main: lint-tools
 	@echo "--> Running golangci-lint"
 	@golangci-lint run --build-tags '$(GOTAGS)' && \
 		(cd api && golangci-lint run --build-tags '$(GOTAGS)') && \
 		(cd sdk && golangci-lint run --build-tags '$(GOTAGS)')
 	@echo "--> Running golangci-lint (container tests)"
-	cd test/integration/consul-container && golangci-lint run --build-tags '$(GOTAGS)'
+	@cd test/integration/consul-container && golangci-lint run --build-tags '$(GOTAGS)'
 	@echo "--> Running lint-consul-retry"
 	@lint-consul-retry
 	@echo "--> Running enumcover"
 	@enumcover ./...
 
+.PHONY: lint-container-test-deps
+lint-container-test-deps:
+	@echo "--> Checking container tests for bad dependencies"
+	@cd test/integration/consul-container && ( \
+		found="$$(go list -m all | grep -c '^github.com/hashicorp/consul ')" ; \
+		if [[ "$$found" != "0" ]]; then \
+			echo "test/integration/consul-container: This project should not depend on the root consul module" >&2 ; \
+			exit 1 ; \
+		fi \
+	)
+
 # Build the static web ui inside a Docker container. For local testing only; do not commit these assets.
 ui: ui-docker