ci, justfile: lint every sub-module, not just the root

The root lint job (vet + staticcheck + golangci-lint + modernize) skipped the
sub-modules, so findings in their own module context — like the modernize one
that slipped into vfs/compress — went uncaught. Now each discovered sub-module
runs the same suite in its own context: the CI `submodules` matrix gains the
four lint steps before its test, and a new `just lint-submodules` recipe (wired
into `lint`) mirrors them. gofmt stays repo-wide in the root job, which already
covers every file. golangci-lint runs in the sub-module dir and walks up to the
repo-root .golangci.yml, so the exclusions apply uniformly across modules.

Author: ditalini

.github/workflows/ci.yml

@@ -200,9 +200,9 @@ jobs:
   # Every sub-module has its OWN go.mod (joined to the root via `replace
   # gosqlite.org`), so its private deps never reach the root graph: blobstore's
   # codec, vfs/crypto's adiantum + x/crypto, xorm-compat's xorm.io/xorm, gorm's
-  # dialector deps. Each is tested in its own module context. (xorm-compat is the
-  # CI-enforced proof gosqlite.org is a drop-in xorm SQLite driver — see
-  # dev/upstream/xorm.md.)
+  # dialector deps. Each is linted (vet + staticcheck + golangci-lint + modernize)
+  # and tested in its own module context. (xorm-compat is the CI-enforced proof
+  # gosqlite.org is a drop-in xorm SQLite driver — see dev/upstream/xorm.md.)
   #
   # The matrix is DISCOVERED, not hand-listed: `discover` finds every joined
   # sub-module's go.mod and emits the dir list as JSON; `submodules` fans out
@@ -237,6 +237,34 @@ jobs:
     steps:
       - uses: actions/checkout@v5
       - uses: ./.github/actions/setup
+      # Same lint gate as the root `lint` job, in the sub-module's own context.
+      # gofmt is not repeated here — the root job's `gofmt -d` already covers
+      # every .go file in the repo, sub-modules included.
+      - name: go vet
+        working-directory: ${{ matrix.dir }}
+        run: go vet -unsafeptr=false ./...
+      - name: staticcheck
+        working-directory: ${{ matrix.dir }}
+        run: |
+          go install honnef.co/go/tools/cmd/staticcheck@latest
+          staticcheck ./...
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v9
+        with:
+          version: v2.4.0
+          args: --timeout 5m
+          # Runs in the sub-module dir; golangci-lint walks up to the repo-root
+          # .golangci.yml, so its exclusions apply uniformly across modules.
+          working-directory: ${{ matrix.dir }}
+      - name: gopls modernize
+        working-directory: ${{ matrix.dir }}
+        # Forked upstream files (gorm's sqlite.go/migrator.go) are excluded by
+        # path tail, since modernize runs with the sub-module as the working dir.
+        run: |
+          out=$(go run golang.org/x/tools/gopls/internal/analysis/modernize/cmd/modernize@latest ./... 2>&1 \
+              | grep -v -E '(^|/)(sqlite|vtab|rows|migrator)\.go:' \
+              | grep -v '^exit status' | grep -v '^go: ' || true)
+          if [ -n "$out" ]; then echo "$out"; exit 1; fi
       - name: go test (${{ matrix.dir }} module)
         working-directory: ${{ matrix.dir }}
         run: go test -count=1 -timeout 5m -v ./...

justfile

@@ -67,10 +67,11 @@ bench-vec:
 bench-fts:
     go test -run=^$ -bench='^Benchmark' -benchmem -count=5 ./fts/
 
-# Lint with fmt-check + vet + staticcheck + golangci-lint + modernize
-# (matches CI). fmt-check runs first because it's the cheapest and the
-# most common cause of CI failures from local-only pushes.
-lint: fmt-check vet staticcheck golangci modernize
+# Lint the root module + every sub-module with fmt-check + vet + staticcheck +
+# golangci-lint + modernize (matches CI). fmt-check runs first because it's the
+# cheapest and the most common cause of CI failures from local-only pushes;
+# lint-submodules runs last because it lints N modules and is the slowest.
+lint: fmt-check vet staticcheck golangci modernize lint-submodules
 
 # go vet across all packages. unsafeptr=false suppresses the false-positive
 # storm from modernc's uintptr↔unsafe.Pointer conversions inherited in our
@@ -196,6 +197,31 @@ submodule DIR:
 test-submodules:
     @set -e; for d in {{submods}}; do echo "=== test $d ==="; (cd "$d" && go test -count=1 -timeout 5m ./...); done
 
+# Lint EVERY sub-module in its own module context: vet + staticcheck +
+# golangci-lint + modernize (gofmt is already repo-wide via fmt-check). Mirrors
+# the per-module lint the CI `submodules` matrix runs. Slow — lints N modules.
+# Assumes staticcheck + golangci-lint are installed (the root `staticcheck` /
+# `golangci` recipes that run before this in `lint` already check that).
+lint-submodules:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    for d in {{submods}}; do
+        echo "=== lint $d ==="
+        (
+            cd "$d"
+            go vet -unsafeptr=false ./...
+            staticcheck ./...
+            golangci-lint run --timeout 5m ./...
+            # Modernize, minus the forked upstream files we keep verbatim (gorm's
+            # sqlite.go/migrator.go; matched on the path tail since these run with
+            # the sub-module as the working dir).
+            out=$(go run golang.org/x/tools/gopls/internal/analysis/modernize/cmd/modernize@latest ./... 2>&1 \
+                | grep -v -E '(^|/)(sqlite|vtab|rows|migrator)\.go:' \
+                | grep -v '^exit status' | grep -v '^go: ' || true)
+            [ -z "$out" ] || { echo "$out"; exit 1; }
+        )
+    done
+
 # Full CI parity: everything CI runs, in order. Slower than `default`. Now mirrors
 # CI's submodule + pin coverage (the old `ci` skipped xorm-compat and the pins).
 ci: build test test-race lint cross-build test-submodules check-pins