Migrate remaining Python tooling and tests to Go

[devantler]

🤖 Generated by the Daily AI Engineer

Objective

Eliminate the remaining first-party Python scripts, validators, and test harnesses so Platform follows the portfolio-wide Bash-or-Go scripting constitution.

Current inventory

The repository still tracks Python on these first-party automation surfaces:

• scripts/validate-embedded-json.py
• scripts/validate-homepage-bookmarks.py
• scripts/validate-naming.py
• scripts/tests/test_validate_homepage_bookmarks.py
• scripts/tests/test_refresh_flux_ghcr_auth.py
• tracked .pyc or pycache artifacts under scripts

PR #2635 also introduced an alert-coverage test harness in Python while expanding the GHCR harness. Those additions must be replaced with native Go tests before that PR can land; they are part of this migration, not an exception to it.

Delivery shape

Port one focused surface at a time to a small Go command or native Go test package. Preserve every accepted input, diagnostic, exit code, failure-path assertion, and fail-closed safety rule before removing the superseded Python source or CI invocation. Bash remains acceptable for small direct shell-function tests; larger harnesses belong in Go.

Checklist

• Embedded-JSON validation has an equivalent Go implementation and tests.
• Homepage-bookmark validation has an equivalent Go implementation and tests.
• Naming validation has an equivalent Go implementation and tests.
• The Flux GHCR credential-bridge harness is native Go with equivalent success, failure, ordering, and rollout-race coverage.
• Alert-coverage validation tests are native Go.
• CI, path filters, documentation, and local examples invoke only Bash or Go.
• No first-party .py, .pyc, or pycache artifacts remain under scripts.
• go test -race ./..., go vet ./..., actionlint, ShellCheck, and the affected repository validators pass.
• No validation or rollout safety rule is weakened.

Dependencies

Builds on the Go module and validator pattern introduced by #2622. The embedded-JSON validator originated in #2480. PR #2635 is the active delivery surface for the GHCR and alert-test slices.

Notes

This is an umbrella issue. Each slice should remain reviewable and may close a child issue while staying Part of #2623 until the inventory is empty.

[coderabbitai]

🔗 Related PRs

#2317 - ci: migrate deploy-prod Flux diagnostics to shared diagnose-flux composite [merged]
#2502 - feat(ci): validate embedded JSON blobs in ConfigMaps [merged]
#2622 - fix(ci): heal cancelled merge-group deploys [merged]
#2625 - fix(deploy): synchronize production GHCR pull auth [merged]
#2633 - fix(deploy): verify incoming image on Talos nodes [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[devantler]

🤖 Generated by the Daily AI Engineer

Heads-up for whoever picks this up: the Go substrate is now in place and one script is already ported.

#2584 ports scripts/generate-kubescape-exceptions from Python to Go (it was about to ship as new Python; a review caught that the scan job had no interpreter deps, and the standard says bash-or-Go, so it was ported rather than patched). It follows the scripts/validate-merge-group-heal convention — go test ./scripts/<name> + go run ./scripts/<name>, go-version-file: go.mod — and adds gopkg.in/yaml.v3 to the module, which is the dependency the three remaining validators will also need.

That leaves this issue scoped to the three pre-existing validators:

• scripts/validate-naming.py
• scripts/validate-embedded-json.py
• scripts/validate-homepage-bookmarks.py (+ its Python test in scripts/tests/)

Each is a mechanical port with the pattern and the YAML dependency already established. Worth landing #2584 first so they can follow it rather than re-derive the layout.

[devantler]

🤖 Generated by the Daily AI Engineer

One more Python file belongs in this migration's scope: scripts/tests/test_refresh_flux_ghcr_auth.py (the ~71 KB unittest harness for refresh-flux-ghcr-auth.sh, invoked in CI as python3 -m unittest scripts.tests.test_refresh_flux_ghcr_auth). It isn't a validator test, but it's the same bash-or-Go convention and the same "no tracked .py under scripts/" goal.

It's now also a blocker on a real fix: a Codex P1 on #2635 requires versioning/renaming the ghcr-pull-verified-* marker keys so a legacy no-reboot-era annotation can't satisfy the new reboot-based verification. That change touches this Python harness, and rather than extend a to-be-migrated Python suite, the marker fix should land together with this harness's port to a Go (or bash) test. Suggest adding it to the checklist so the migration is complete and unblocks the #2635 marker work.