Allow homoicon's local copy of sobek in the canonical .golangci.yml (closes #134)

sneak decided that homoicon keeps a local copy of sobek, its JavaScript
engine, and fixes it in its own tree
(sneak/homoicon#1759 (comment)).
homoicon's go.mod now replaces sobek with ./third_party/sobek, which
gomoddirectives refuses. The canonical .golangci.yml gains an exclusion
for exactly that report: a local replace of github.com/grafana/sobek in
a repository's root go.mod. Every other local replace is still refused.
It is an exclusion rather than a replace-allow-list entry because
gomoddirectives does not check that list for a replace that points at a
local path. TODO.md records the change.

Model: opus-5-5

.golangci.yml

@@ -95,6 +95,17 @@ linters:
           recommendations:
             - github.com/aymanbagabas/go-udiff
           reason: "Unmaintained fork; use go-udiff."
+  exclusions:
+    rules:
+      # homoicon keeps a local copy of sobek, its JavaScript engine, as sneak
+      # decided in
+      # https://git.eeqj.de/sneak/homoicon/issues/1759#issuecomment-153261.
+      # This is an exclusion because gomoddirectives does not check its
+      # replace-allow-list for a replace that points at a local path.
+      - path: ^go\.mod$
+        linters:
+          - gomoddirectives
+        text: '^local replacement are not allowed: github\.com/grafana/sobek$'
 
 issues:
   max-issues-per-linter: 0

TODO.md

@@ -21,6 +21,14 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-10-21: The canonical `.golangci.yml` now accepts a local `replace` of
+  `github.com/grafana/sobek` in a repository's root `go.mod` (issue 134), for
+  homoicon, which keeps a local copy of sobek on sneak's decision in
+  https://git.eeqj.de/sneak/homoicon/issues/1759#issuecomment-153261. Every
+  other local `replace` is still refused. It is an exclusion rather than a
+  `replace-allow-list` entry because gomoddirectives does not check that list
+  for a `replace` that points at a local path. homoicon picks this up on its
+  next re-vendor.
 - 2026-10-18: Check builds may now also keep Go's downloaded modules,
   golangci-lint's cache and the layers that install system packages (issue 130),
   on sneak's ruling there. In each stage of the canonical Go `Dockerfile`, the