Presubmit sweep

dev/ci/presubmits/* are the scripts CI runs. A green local sweep is the same green run as remote CI, which is the whole reason to do it here: pushing first and reading the failure off GitHub costs a full CI cycle to learn something a local minute would have told you.

Run them before every push. Not before every commit — before every push.

The sweep

Run everything in dev/ci/presubmits/ except the two e2e-* scripts. That is the whole rule, and it is simpler than the conditional table you might expect because CI has no conditional table either: of the eighteen scripts, sixteen run on every pull request and only e2e-real-provider and e2e-recipe-gke-troubleshoot-agent are gated on credentials.

for s in dev/ci/presubmits/*; do
  n=$(basename "$s")
  case "$n" in e2e-*) continue ;; esac
  echo "=== $n ==="
  "$s" >/tmp/ps-$n.log 2>&1 && echo PASS || { echo FAIL; tail -30 /tmp/ps-$n.log; }
done

Globbing the directory rather than listing names is deliberate: a presubmit added to CI and not to this skill would otherwise be a silent gap, and the skill cannot be the thing that has to be remembered.

Capture to a file and tail on failure rather than letting output stream. Some of these produce far more than a screen, and piping a long producer into head is how you get a SIGPIPE that looks like a crash.

The loop is one compound command, and a permission gate's prefix rules never match a compound command, so it goes to a person for approval. To run the sweep as separate calls instead, list the directory and run each script as its own call, by its path and with nothing appended: dev/ci/presubmits/build, then dev/ci/presubmits/vet, and so on. Run from outside any git work tree, each script checks the tree it lives in, so an absolute path into another working copy works too.

Three of them are the ones most often wrongly assumed to be conditional:

• examples-smoke is unconditional in the required test job (#852). A pkg/ API change that an example consumes turns it red without anything under examples/ being touched — exactly the case a paths filter would miss, which is why it does not have one.
• verify-gke-drill is the offline check. It runs on every PR as "GKE drill (offline)" and needs no cluster and no credentials. The scripts that need a live cluster are the e2e-* pair.
• verify-docs-lint and verify-version-fallback live in their own workflows with no paths: filter, precisely because ci.yml skips markdown-only changes and these two guard markdown drift.
• verify-no-agent-attribution also has its own unfiltered workflow. It scans the commits in origin/main..HEAD, so run it after you commit. CI also scans the PR title and body, which a local run can't see.

e2e-real-provider and e2e-recipe-gke-troubleshoot-agent need credentials or a live cluster. Run them only when asked, and never assume their absence means the change is unverified.

Reading a failure

• lint-go fails but the same code passed a minute ago. The golangci-lint cache goes stale across worktrees, and it is stale in both directions — phantom failures and false local passes. golangci-lint cache clean using the binary from GOPATH/bin, then re-run.
• verify-go-format fails. Just run gofmt -w on the named files; there is nothing to think about.
• verify-mod-tidy fails. go mod tidy and stage the result.
• test-unit fails in a package you did not touch. Check it fails on a clean tree too before assuming you caused it.
• A registry test fails after you added a package, config key or harness script. These are deliberate tripwires; each wants one line, in the same PR:
  • TestEveryImportablePackageIsADecision (internal/testutil): a new pkg/... package needs promised or unsupported in dev/api-surface.txt, and the same name in the unsupported list in docs/compatibility-policy.md and in the CHANGELOG "Stability promise" paragraph (the test checks all three).
  • TestConfigSurfaceIsAccountedFor (examples/internal/recipecheck): a new config path. Decide whether it is version-gated (registers a tool, changes topology or loaded content, or asserts a safety or durability property → add a GatedFeatures row), then go test ./examples/internal/recipecheck -run TestConfigSurfaceIsAccountedFor -update.
  • TestInvocationCensus (dev/harness-config-check): a new script under dev/ that runs the binary needs its expected count in the census.

What the sweep does not prove

It proves the change does not break what is already checked. It does not prove the new behaviour is correct, and it does not prove a new test would have caught the bug it is supposed to catch — that is the prefix-failure-verification skill, and it is a separate step.