build: make check runs the nested-module loop, via the script CI uses

.github/workflows/ci.yml

@@ -199,21 +199,12 @@ jobs:
       # that scoping was itself the #136 bug one level up, and it silently
       # excluded scripts/ the day that module was added.
       - name: Nested modules (build + vet + test)
-        run: |
-          set -euo pipefail
-          mods=$(find . -mindepth 2 -name go.mod -not -path './.git/*' | sort)
-          if [ -z "$mods" ]; then
-            echo "::error::found no nested modules — the discovery is broken, not the repo"
-            exit 1
-          fi
-          fail=0
-          for mod in $mods; do
-            dir=$(dirname "$mod")
-            echo "::group::$dir"
-            ( cd "$dir" && go build ./... && go vet ./... && go test -short ./... ) || fail=1
-            echo "::endgroup::"
-          done
-          exit $fail
+        # The SAME script `make check` runs, so the local gate cannot be weaker
+        # than this one. It was, and that cost two round trips in one session:
+        # #770's template parameter wired into no Makefile, and #771's missing
+        # go.sum entry after pkg/aws gained six SDK imports. Both were found here
+        # rather than on a laptop.
+        run: scripts/nested-modules.sh
 
   # Tier 0 E2E — the real spawn binary driven against the Substrate AWS
   # emulator. No AWS account/credentials; exercises the full CLI surface

CHANGELOG.md

@@ -47,6 +47,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- **`make check` now runs the nested-module loop, via the same script CI uses.**
+  `go test ./...` does not descend into a directory with its own `go.mod`, so the
+  12 modules under `lambda/` and `scripts/` were invisible to the local gate while
+  CI checked them. A nested module that does not even **compile** passed
+  `make check` and failed in CI.
+  That gap cost two round trips in one session: #770's `LogRetentionDays` wired
+  into no Makefile (caught by `lambda/ttl-reaper`'s own test, which only CI ran)
+  and #771's missing `go.sum` entry after `pkg/aws` gained six SDK imports. Both
+  were found after a push, where the fix is a second commit and another wait.
+  Extracted to `scripts/nested-modules.sh` and called from **both** `make check`
+  and the workflow, rather than duplicated — a local gate that differs from CI
+  teaches people to push and find out, and two copies of the loop would drift
+  back apart. The script refuses to pass when it discovers no modules, since a
+  broken discovery is not a clean repo.
+
 - **An idle reaper now says so, and can be told to remove itself on a schedule**
   (#772). `spawn reaper status` reports when the in-account reaper has run
   regularly and reclaimed nothing, and `spawn reaper teardown --if-idle-for 720h`

Makefile

@@ -227,8 +227,20 @@ check:
 	@staticcheck ./... || echo "staticcheck not installed, skipping..."
 	@echo "4. Running short tests..."
 	@go test -short ./...
+	@echo "5. Nested modules (build + vet + test)..."
+	@$(MAKE) --no-print-directory check-nested
 	@echo "✓ All checks passed!"
 
+# The 12 nested modules, via the SAME script CI runs (#136).
+#
+# `go test ./...` does not descend into a directory with its own go.mod, so
+# without this `make check` is weaker than CI — and that gap cost two round trips
+# in one session (#770's unwired template parameter, #771's missing go.sum entry),
+# both found only after a push. One script, two callers, no drift.
+.PHONY: check-nested
+check-nested:
+	@scripts/nested-modules.sh
+
 # Development
 dev: build
 	@echo "Built for development"

scripts/nested-modules.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+#
+# Build, vet and test every nested Go module.
+#
+# Why this exists at all (#136): the root `go test ./...` does NOT descend into a
+# directory with its own go.mod, so the 12 modules under lambda/ and scripts/ are
+# invisible to it. Their tests would never run.
+#
+# Why it is a SCRIPT rather than steps in two places (#772's aftermath). CI ran
+# this loop and `make check` did not, so the local gate was weaker than the remote
+# one — and that gap cost two round trips in one session:
+#
+#   #770  LogRetentionDays was added to three templates and wired into none.
+#         ttl-reaper's own test caught it, and only CI runs that test.
+#   #771  pkg/aws gained six SDK imports; sweep-orchestrator needed re-tidying
+#         and failed on a missing go.sum entry.
+#
+# Both were found by CI after a push, by which point the fix is a second commit
+# and another wait. A local gate that differs from CI teaches people to push and
+# find out, which is slower for everyone. One script, called from both, cannot
+# drift.
+#
+# Usage: scripts/nested-modules.sh
+#
+# There is deliberately no --quiet. The first version had one documented as "only
+# report failures", which it did not do — go test writes its own output and the
+# flag only suppressed this script's headers. A flag whose name overstates what it
+# does is worse than no flag.
+set -euo pipefail
+
+# Discovered, not listed, and deliberately NOT scoped to lambda/*: that scoping
+# was the #136 bug one level up, and it silently excluded scripts/ on the day that
+# module was added. A list of modules is a list someone has to remember to
+# update — the same failure mode as the hardcoded function names in
+# lambda-deploy-census.sh and the three incomplete footprint inventories in #653.
+mods=$(find . -mindepth 2 -name go.mod -not -path './.git/*' | sort)
+if [ -z "$mods" ]; then
+  # Refusing to pass vacuously. A discovery that finds nothing has failed; it has
+  # not proven the repo clean.
+  echo "found no nested modules — the discovery is broken, not the repo" >&2
+  exit 1
+fi
+
+# GitHub's log-folding markers, only when running in Actions. Locally they would
+# just be noise.
+group_open() { [ -n "${GITHUB_ACTIONS:-}" ] && echo "::group::$1" || echo "  $1"; return 0; }
+group_close() { [ -n "${GITHUB_ACTIONS:-}" ] && echo "::endgroup::"; return 0; }
+
+fail=0
+for mod in $mods; do
+  dir=$(dirname "$mod")
+  group_open "$dir"
+  if ! ( cd "$dir" && go build ./... && go vet ./... && go test -short ./... ); then
+    echo "FAIL $dir" >&2
+    fail=1
+  fi
+  group_close
+done
+
+if [ "$fail" -eq 0 ]; then
+  echo "✅ all $(printf '%s\n' "$mods" | grep -c .) nested modules build, vet and test clean."
+fi
+exit $fail