From c51fb704eef2e58f39fc3376ac957f34cab6feec Mon Sep 17 00:00:00 2001
From: Lakshman Patel <Lakshmanp230@gmail.com>
Date: Wed, 22 Jul 2026 05:49:37 +0530
Subject: [PATCH] ci: add replace-directive release guard script and Makefile
 target

---
 .github/workflows/ci.yml               |  2 ++
 Makefile                               |  9 +++++++--
 scripts/check-no-replace-directives.sh | 14 ++++++++++++++
 3 files changed, 23 insertions(+), 2 deletions(-)
 create mode 100755 scripts/check-no-replace-directives.sh

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 27a7262..c23ed9a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -86,6 +86,8 @@ jobs:
           fi
       - name: go mod verify
         run: go mod verify
+      - name: Check no local replace directives
+        run: make check-replace
       - name: no stray replace directives
         run: |
           if grep -q "^\s*replace" go.mod; then
diff --git a/Makefile b/Makefile
index ab3e66b..cecba9a 100644
--- a/Makefile
+++ b/Makefile
@@ -31,13 +31,18 @@ GOVULNCHECK  := $(GOBIN_DIR)/govulncheck
 # ---------------------------------------------------------------------------
 # Phony declarations (alphabetical).
 # ---------------------------------------------------------------------------
-.PHONY: all bench boundaries build ci clean cover fmt help lint lint-fix \
+.PHONY: all bench boundaries build check-replace ci clean cover fmt help lint lint-fix \
         security test test-10x test-race tidy version vet
 
 boundaries: ## Enforce support-repo import boundaries.
 	bash ./scripts/check-ecosystem-boundaries.sh
 	bash ./scripts/check-client-layering.sh
 
+.PHONY: check-replace
+check-replace: ## Fail if go.mod has local replace directives (run before tagging)
+	@bash scripts/check-no-replace-directives.sh
+
+
 # ---------------------------------------------------------------------------
 # Default target.
 # ---------------------------------------------------------------------------
@@ -101,7 +106,7 @@ tidy: ## Tidy go.mod / go.sum.
 # ---------------------------------------------------------------------------
 # Composite gate used by CI and pre-push.
 # ---------------------------------------------------------------------------
-ci: tidy fmt vet lint boundaries test-race security ## Run everything CI runs.
+ci: tidy fmt vet lint boundaries check-replace test-race security ## Run everything CI runs.
 	@echo "All CI checks passed."
 
 # ---------------------------------------------------------------------------
diff --git a/scripts/check-no-replace-directives.sh b/scripts/check-no-replace-directives.sh
new file mode 100755
index 0000000..b813b15
--- /dev/null
+++ b/scripts/check-no-replace-directives.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# CI guard: fail if go.mod has a local replace directive.
+# Local replace directives are for development only and must be removed before tagging a release.
+set -euo pipefail
+
+if grep -qE '^replace .+ => \.\./' go.mod; then
+  echo "ERROR: go.mod has a local replace directive:"
+  grep -nE '^replace .+ => \.\./' go.mod
+  echo ""
+  echo "Local replace directives must be removed before tagging a release."
+  echo "For a release, the published module version of hawk-core-contracts must be used."
+  exit 1
+fi
+echo "OK: no local replace directives in go.mod."