Feature: Add workflow to see if code PRs also update documentation and/or add tests

[pnacht]

Is your feature request related to a problem? Please describe.
PRs that modify Scorecard's behavior are occasionally merged without updating documentation. For example, the documentation for Token-Permissions currently doesn't reflect the changes from #2355 and #2367 from late 2022.

Describe the solution you'd like
An on: pull_request workflow that checks whether a given PR modified anything in the /checks folder. If so, the workflow only "passes" if the PR also modified the checks.yml and checks.md files and the respective test file. Alternatively, maintainers could add comments (or labels) to the PR such as /skip_docs_change or /skip_tests_change (or equivalent labels) to consciously and intentionally allow the PR to pass without such changes (which aren't always necessary).

Describe alternatives you've considered
Add [ ] Relevant changes to documentation have been made to the pull-request template. This would help contributors remember to update the documentation, but doesn't actually "enforce" anything. (Though this solution would be great too!)

Additional context
A pushback against this would be that it increases the workload for contributors who might want to make a useful contribution to Scorecard but don't want to update the docs. However, given the importance of up-to-date docs for a project such as Scorecard, maintainers could consider pushing their own commits to the PR with the relevant documentation changes before merging the PR.

[naveensrinivasan]

This is a great suggestion! Thank you!
Would you like to lend a hand in tackling this?

[github-actions]

Stale issue message