fix: guarantee replaces (#6905)

This adds a check into lint process to guarantee that
imports of providers from a provider will get caught if they are not
replaced by their local folder.

Fixes: #6897

Signed-off-by: Jean-Philippe Evrard <jean-philippe.evrard+rochepub@external.roche.com>

Makefile

@@ -154,7 +154,11 @@ build-%: generate ## Build binary for the specified arch
 		go build -tags $(PROVIDER) -o '$(OUTPUT_DIR)/external-secrets-linux-$*' main.go
 	@$(OK) go build $*
 
-lint: golangci-lint ## Run golangci-lint (set LINT_TARGET to run on specific module, LINT_JOBS for parallel jobs)
+.PHONY: provider-replaces.check
+provider-replaces.check: ## Ensure cross-provider dependencies use local replacements
+	@./hack/check-provider-replaces.sh
+
+lint: golangci-lint provider-replaces.check ## Run golangci-lint (set LINT_TARGET to run on specific module, LINT_JOBS for parallel jobs)
 	@if [ -n "$(LINT_TARGET)" ]; then \
 		$(INFO) Running golangci-lint on $(LINT_TARGET); \
 		(cd $(LINT_TARGET) && $(GOLANGCI_LINT) run ./...) || exit 1; \

hack/check-provider-replaces.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+provider_prefix="github.com/external-secrets/external-secrets/providers/v1"
+failed=0
+
+for provider_dir in providers/v1/*/; do
+    [[ -f "${provider_dir}go.mod" ]] || continue
+
+    if ! module_path=$(GOWORK=off go -C "$provider_dir" list -m -mod=readonly -f '{{.Path}}'); then
+        failed=1
+        continue
+    fi
+
+    # Load production and test imports without the workspace, which would
+    # otherwise hide missing requirements by resolving sibling modules locally.
+    if ! GOWORK=off go -C "$provider_dir" list -mod=readonly -deps -test ./... >/dev/null; then
+        failed=1
+        continue
+    fi
+
+    if ! module_graph=$(GOWORK=off go -C "$provider_dir" list -m -mod=readonly -f '{{.Path}}{{with .Replace}} => {{.Path}}{{end}}' all); then
+        failed=1
+        continue
+    fi
+
+    while read -r dependency arrow replacement; do
+        [[ -n "${dependency:-}" ]] || continue
+        [[ "$dependency" == "$module_path" ]] && continue
+        [[ "$dependency" == "$provider_prefix/"* ]] || continue
+
+        expected="../${dependency##*/}"
+        if [[ "${arrow:-}" != "=>" || "${replacement:-}" != "$expected" ]]; then
+            printf '%sgo.mod: provider dependency %s must have:\n' "$provider_dir" "$dependency" >&2
+            printf 'replace %s => %s\n' "$dependency" "$expected" >&2
+            failed=1
+        fi
+    done <<< "$module_graph"
+done
+
+exit "$failed"