Add CI check to prevent release-compiled lock files

.github/workflows/ci.yml

@@ -633,6 +633,53 @@ jobs:
 
           echo "✅ No ANSI escape sequences found in YAML files"
 
+      - name: Check for release-compiled lock files
+        run: |
+          echo "🔍 Checking .lock.yml files for release build compilation..."
+
+          # Find all .lock.yml files in the repository
+          LOCK_FILES=$(find . -type f -name "*.lock.yml" | sort)
+
+          # Track if any release-compiled files are found
+          FOUND_RELEASE=0
+
+          # Check each file for version numbers in the header
+          # Release builds include version like: "# This file was automatically generated by gh-aw (v1.0.0). DO NOT EDIT."
+          # Dev builds do not: "# This file was automatically generated by gh-aw. DO NOT EDIT."
+          for file in $LOCK_FILES; do
+            # Look for the pattern: "by gh-aw (v" or "by gh-aw (0" or similar version patterns
+            # This matches versions like (v1.0.0), (0.1.0), etc.
+            if grep -E '# This file was automatically generated by gh-aw \([v0-9]' "$file" > /dev/null 2>&1; then
+              echo "❌ ERROR: Found release-compiled lock file: $file"
+              echo ""
+              echo "Header line:"
+              grep -E '# This file was automatically generated by gh-aw \([v0-9]' "$file" || true
+              echo ""
+              FOUND_RELEASE=1
+            fi
+          done
+
+          if [ $FOUND_RELEASE -eq 1 ]; then
+            echo ""
+            echo "💡 Lock files should NOT be compiled with a release build!"
+            echo ""
+            echo "Lock files in the repository must be compiled with development builds."
+            echo "Release builds include version numbers in the header, which should only"
+            echo "appear in released binaries, not in source-controlled workflow files."
+            echo ""
+            echo "To fix:"
+            echo "  1. Build the CLI with 'make build' (dev build, no release flag)"
+            echo "  2. Run 'make recompile' to regenerate all lock files"
+            echo "  3. Commit the updated lock files"
+            echo ""
+            echo "The release build flag is only set during the release process via:"
+            echo "  scripts/build-release.sh (sets -X main.isRelease=true)"
+            echo ""
+            exit 1
+          fi
+
+          echo "✅ All lock files compiled with development build (no version in header)"
+
   js:
     runs-on: ubuntu-latest
     needs: validate-yaml