ci: warn when Cargo.lock is edited

.github/workflows/prebuild.yml

@@ -6,6 +6,9 @@ on:
   schedule:
     - cron: '13 23 * * *'  # every day @ 23:13
 
+env:
+  CARGOLOCK_COMMENT: Looks like you changed `Cargo.lock`. Please make sure to review the dependencies and update internal version list.
+
 jobs:
   block-fixup:
     name: Block fixup
@@ -69,6 +72,41 @@ jobs:
       - name: "Run changelog check"
         run: ./ci/check_changelog.sh
 
+  cargolock_check:
+    name: Cargo.lock check
+    if: ${{ github.ref != 'main' && github.event_name == 'pull_request' }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Ask git
+        id: gitdiff
+        run: |
+          git diff --exit-code origin/main -- core/embed/rust/Cargo.lock; echo cargo_modified=$? >> $GITHUB_OUTPUT
+          cat $GITHUB_OUTPUT
+
+      - name: Find Comment
+        uses: peter-evans/find-comment@v3
+        if: ${{ steps.git_diff.outputs.cargo_modified == '1' }}
+        id: fc
+        with:
+          issue-number: ${{ github.event.pull_request.number }}
+          comment-author: 'github-actions[bot]'
+          body-includes: cargolock-comment-${{ github.workflow }}
+
+      - name: Create comment
+        uses: peter-evans/create-or-update-comment@v4
+        if: ${{ steps.git_diff.outputs.cargo_modified == '1' && steps.fc.outputs.comment-id == '' }}
+        with:
+          issue-number: ${{ github.event.pull_request.number }}
+          body: |
+            <!-- cargolock-comment-${{ github.workflow }} -->
+            ${{ env.CARGOLOCK_COMMENT }}
+          edit-mode: replace
+
   # Checking the format of release commit messages.
   release_commit_msg_check:
     name: Release commit message check