Check generated CTAN archive with pkgcheck

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/main.yml

@@ -13,10 +13,13 @@ jobs:
         engine: [pdflatex, lualatex, xelatex, latex]
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
       with:
         fetch-depth: 0
 
+    - name: 'Fixup Run actions/checkout'
+      run: git config --global --add safe.directory '*'
+
     - name: 'Install pgf-umlcd'
       run: |
         tlmgr init-usertree --usertree $PWD
@@ -48,6 +51,16 @@ jobs:
             --xform='s$^$pgf-umlcd/$g' \
             -czvf pgf-umlcd_${GIT_TAG}.tar.gz $(cat FILES)
 
+    - name: 'ZIP: Check'
+      run: |
+        apt-get update -y
+        DEBIAN_FRONTEND=noninteractive apt-get install -y curl poppler-utils
+        curl --retry 3 --retry-all-errors -L -o pkgcheck https://mirrors.ctan.org/support/pkgcheck/bin/pkgcheck
+        chmod +x pkgcheck
+        PKGDIR=$(mktemp -d)
+        tar xzf "pgf-umlcd_${GIT_TAG}.tar.gz" -C "$PKGDIR"
+        ./pkgcheck -d "$PKGDIR/pgf-umlcd"
+
     - name: "ZIP: Sign"
       if: |
         matrix.engine == 'pdflatex' &&