Inspect committed workspace files

check.go

@@ -52,6 +52,17 @@ type ValidationSpec struct {
 	// GoFormat checks the formatting of committed regular Go source files. It
 	// does not modify repository contents and is disabled when false.
 	GoFormat bool
+	// ModuleDistribution selects checks for files that affect module-source
+	// distribution. Its zero value disables those checks.
+	ModuleDistribution ModuleDistributionValidationSpec
+}
+
+// ModuleDistributionValidationSpec selects independent module-source
+// distribution checks.
+type ModuleDistributionValidationSpec struct {
+	// WorkspaceFiles rejects committed go.work and go.work.sum blobs, including
+	// nested paths and symlink entries. It does not select Go's test workspace.
+	WorkspaceFiles bool
 }
 
 // GoValidationSpec selects checks performed by the Go toolchain.
@@ -79,6 +90,9 @@ type GoValidationSpec struct {
 // compilation produces no artifacts and does not execute target binaries.
 // Validation.GoFormat checks regular committed Go source after those selected
 // Go checks and before AdditionalChecks. Its zero value disables formatting.
+// Validation.ModuleDistribution.WorkspaceFiles rejects committed workspace
+// files after the other selected shared checks. Its zero value disables the
+// distribution check and does not change Go's workspace environment.
 // The zero values of all selections preserve the ordinary suite. If
 // Build selects targets, Check builds them after validation in temporary
 // storage outside the worktree, then rechecks
@@ -106,6 +120,9 @@ func candidateRequest(request ReleaseRequest) candidate.Request {
 			FullVet:        request.Validation.Go.FullVet,
 			CompileTargets: make([]validation.Target, len(request.Validation.Go.CompileTargets)),
 			GoFormat:       request.Validation.GoFormat,
+			ModuleDistribution: validation.ModuleDistributionSettings{
+				WorkspaceFiles: request.Validation.ModuleDistribution.WorkspaceFiles,
+			},
 		},
 		AdditionalChecks: candidateChecks(request.AdditionalChecks),
 		AfterValidate:    internalbuild.CandidateCallback(internalBuildSpec(request.Build), request.Output),