Inspect committed module replacements

check.go

@@ -63,6 +63,9 @@ type ModuleDistributionValidationSpec struct {
 	// WorkspaceFiles rejects committed go.work and go.work.sum blobs, including
 	// nested paths and symlink entries. It does not select Go's test workspace.
 	WorkspaceFiles bool
+	// LocalReplacements rejects filesystem replacements in committed go.mod
+	// declarations, including nested modules. It does not select Go's workspace.
+	LocalReplacements bool
 }
 
 // GoValidationSpec selects checks performed by the Go toolchain.
@@ -93,6 +96,9 @@ type GoValidationSpec struct {
 // Validation.ModuleDistribution.WorkspaceFiles rejects committed workspace
 // files after the other selected shared checks. Its zero value disables the
 // distribution check and does not change Go's workspace environment.
+// Validation.ModuleDistribution.LocalReplacements parses committed go.mod
+// declarations, including nested modules, and rejects filesystem replacements
+// after workspace-file inspection. Its zero value disables that check.
 // The zero values of all selections preserve the ordinary suite. If
 // Build selects targets, Check builds them after validation in temporary
 // storage outside the worktree, then rechecks
@@ -121,7 +127,8 @@ func candidateRequest(request ReleaseRequest) candidate.Request {
 			CompileTargets: make([]validation.Target, len(request.Validation.Go.CompileTargets)),
 			GoFormat:       request.Validation.GoFormat,
 			ModuleDistribution: validation.ModuleDistributionSettings{
-				WorkspaceFiles: request.Validation.ModuleDistribution.WorkspaceFiles,
+				WorkspaceFiles:    request.Validation.ModuleDistribution.WorkspaceFiles,
+				LocalReplacements: request.Validation.ModuleDistribution.LocalReplacements,
 			},
 		},
 		AdditionalChecks: candidateChecks(request.AdditionalChecks),