make validate and CI have drifted apart in both directions

[Gerrrt]

scripts/validate.sh:3 says "Everything CI runs, runnable locally." It has
drifted in both directions, so neither is a superset of the other.

CI runs things make validate does not

• actionlint (ci.yml:42-43)
• editorconfig-checker (ci.yml:45-46)
• yamllint --strict (ci.yml:33-34) where validate.sh:204 and
  Makefile:111 run plain yamllint. Warnings fail CI and pass locally.

make validate runs something CI does not

• scripts/snmp-targets.sh --check (validate.sh:230), which asserts the
  device inventory agrees across targets/snmp.yaml, generator.yaml,
  render-config.sh's REQUIRED list, the secrets example and the Makefile
  flags.

That last one is the sharp edge: inventory drift can merge cleanly, because
the only thing that checks it never runs in CI. The whole point of
snmp-targets.sh being the single source of truth is undermined by the check
being optional.

seed-validation-env.sh is the model to follow — one script, both callers, so
they cannot disagree. The lint and check lists want the same treatment.

Found while verifying #12.

[Gerrrt]

#155 landed on main as 4f0e23b and closes the concrete half of this, but not the general problem — leaving this open.

What landed. Diffing the scripts each side invokes turned up exactly one asymmetry:

$ comm -13 <ci-scripts> <validate-scripts>
scripts/snmp-targets.sh

snmp-targets.sh --check ran in make validate and nowhere else, so the SNMP inventory had never been verified on a pull request — the check that exists because drift between snmp.yaml, generator.yaml, render-config.sh's REQUIRED array and the example secrets file "is invisible until a poll goes out with an empty community", and because the generator path fails open. It now runs in CI. The new check_docs.py was wired into both sides in the same commit for the same reason.

The two lists are identical today, in both directions.

What this issue still covers: nothing enforces that. The parity was restored by hand and can drift again by hand, in either direction, exactly as it did before — a check added to validate.sh and forgotten in ci.yml, or the reverse. That is the actual defect this issue names, and it is untouched.

The cheap fix, if you want one, is the same shape as everything else here: a check that extracts scripts/*.{sh,py} references from ci.yml and validate.sh and fails when the sets differ. It would live in check_docs.py as a seventh assertion, or as its own script. It needs a way to declare the legitimate exceptions — image-for.sh and seed-validation-env.sh are CI-side setup helpers and correctly appear on one side only — so it is an allow-list of two entries rather than a bare set comparison.

Not doing that here, because it is a different change from the one #154 asked for and widening a PR on my own initiative is how a reviewable diff stops being one.

---

Generated by Claude Code