Migrate remaining Python validators to Go

[devantler]

🤖 Generated by the Daily AI Engineer

Objective

Migrate the remaining first-party Python validation scripts and tests to Go so repository automation follows the Bash-or-Go scripting standard introduced alongside #2622.

Details

The repository still tracks three Python validators, one Python test module, and a generated bytecode artifact:

• scripts/validate-embedded-json.py
• scripts/validate-homepage-bookmarks.py
• scripts/validate-naming.py
• scripts/tests/test_validate_homepage_bookmarks.py
• scripts/tests/__pycache__/test_validate_homepage_bookmarks.cpython-311.pyc

CI and AGENTS.md also invoke or document the Python entry points. Keeping two implementation stacks increases maintenance cost, leaves generated bytecode in source control, and makes the repository scripting convention inconsistent.

Port one validator at a time to a small Go command under scripts/, using table-driven tests while preserving each validator's accepted inputs, diagnostics, exit behavior, and fail-closed rules. Update CI, path filters, and documentation with each migration, then remove the superseded Python sources and bytecode.

Checklist

• All three validators have Go replacements with equivalent valid and invalid behavior.
• Go tests cover representative success cases, malformed input, and each important validation failure.
• CI, path filters, documentation, and local command examples invoke the Go replacements.
• No first-party validator or validator test requires Python.
• No tracked .py, .pyc, or __pycache__ validator artifacts remain under scripts/.
• go test -race ./..., go vet ./..., and actionlint pass.
• No existing validation rule is weakened.

Dependencies

Builds on the Go module and validator pattern introduced by #2622. The embedded-JSON validator originated in #2480.

Notes

Rough size: medium, likely two to three focused PRs with one validator migrated per increment.

[coderabbitai]

🔗 Related PRs

#2491 - ci: validate rendered talos patches on the PR event [merged]
#2502 - feat(ci): validate embedded JSON blobs in ConfigMaps [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[devantler]

🤖 Generated by the Daily AI Engineer

Heads-up for whoever picks this up: the Go substrate is now in place and one script is already ported.

#2584 ports scripts/generate-kubescape-exceptions from Python to Go (it was about to ship as new Python; a review caught that the scan job had no interpreter deps, and the standard says bash-or-Go, so it was ported rather than patched). It follows the scripts/validate-merge-group-heal convention — go test ./scripts/<name> + go run ./scripts/<name>, go-version-file: go.mod — and adds gopkg.in/yaml.v3 to the module, which is the dependency the three remaining validators will also need.

That leaves this issue scoped to the three pre-existing validators:

• scripts/validate-naming.py
• scripts/validate-embedded-json.py
• scripts/validate-homepage-bookmarks.py (+ its Python test in scripts/tests/)

Each is a mechanical port with the pattern and the YAML dependency already established. Worth landing #2584 first so they can follow it rather than re-derive the layout.