feat(eyrie): CI release guard for replace directives

.github/workflows/ci.yml

@@ -86,6 +86,8 @@ jobs:
           fi
       - name: go mod verify
         run: go mod verify
+      - name: Check no local replace directives
+        run: make check-replace
       - name: no stray replace directives
         run: |
           if grep -q "^\s*replace" go.mod; then

Makefile

@@ -31,13 +31,18 @@ GOVULNCHECK  := $(GOBIN_DIR)/govulncheck
 # ---------------------------------------------------------------------------
 # Phony declarations (alphabetical).
 # ---------------------------------------------------------------------------
-.PHONY: all bench boundaries build ci clean cover fmt help lint lint-fix \
+.PHONY: all bench boundaries build check-replace ci clean cover fmt help lint lint-fix \
         security test test-10x test-race tidy version vet
 
 boundaries: ## Enforce support-repo import boundaries.
 	bash ./scripts/check-ecosystem-boundaries.sh
 	bash ./scripts/check-client-layering.sh
 
+.PHONY: check-replace
+check-replace: ## Fail if go.mod has local replace directives (run before tagging)
+	@bash scripts/check-no-replace-directives.sh
+
+
 # ---------------------------------------------------------------------------
 # Default target.
 # ---------------------------------------------------------------------------
@@ -101,7 +106,7 @@ tidy: ## Tidy go.mod / go.sum.
 # ---------------------------------------------------------------------------
 # Composite gate used by CI and pre-push.
 # ---------------------------------------------------------------------------
-ci: tidy fmt vet lint boundaries test-race security ## Run everything CI runs.
+ci: tidy fmt vet lint boundaries check-replace test-race security ## Run everything CI runs.
 	@echo "All CI checks passed."
 
 # ---------------------------------------------------------------------------

scripts/check-no-replace-directives.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# CI guard: fail if go.mod has a local replace directive.
+# Local replace directives are for development only and must be removed before tagging a release.
+set -euo pipefail
+
+if grep -qE '^replace .+ => \.\./' go.mod; then
+  echo "ERROR: go.mod has a local replace directive:"
+  grep -nE '^replace .+ => \.\./' go.mod
+  echo ""
+  echo "Local replace directives must be removed before tagging a release."
+  echo "For a release, the published module version of hawk-core-contracts must be used."
+  exit 1
+fi
+echo "OK: no local replace directives in go.mod."