audit and harden workspace

scripts/verify-workspace.ps1

@@ -0,0 +1,34 @@
+[CmdletBinding()]
+param(
+    [switch]$SkipVet
+)
+
+$ErrorActionPreference = "Stop"
+$workspaceRoot = Split-Path -Parent $PSScriptRoot
+Push-Location $workspaceRoot
+try {
+    $unformatted = @(gofmt -l all module)
+    if ($unformatted.Count -gt 0) {
+        throw ("gofmt required:" + [Environment]::NewLine + ($unformatted -join [Environment]::NewLine))
+    }
+
+    $modules = @(go list -m -f '{{.Dir}}')
+    foreach ($module in $modules) {
+        Write-Host "==> $module"
+        Push-Location $module
+        try {
+            if (-not $SkipVet) {
+                go vet ./...
+                if ($LASTEXITCODE -ne 0) { throw "go vet failed: $module" }
+            }
+            go test ./...
+            if ($LASTEXITCODE -ne 0) { throw "go test failed: $module" }
+        }
+        finally {
+            Pop-Location
+        }
+    }
+}
+finally {
+    Pop-Location
+}

scripts/verify-workspace.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+readonly SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+readonly WORKSPACE_ROOT="$(cd -- "${SCRIPT_DIR}/.." && pwd)"
+
+cd -- "${WORKSPACE_ROOT}"
+
+unformatted="$(gofmt -l all module)"
+if [[ -n "${unformatted}" ]]; then
+  printf 'error: gofmt required:\n%s\n' "${unformatted}" >&2
+  exit 1
+fi
+
+mapfile -t modules < <(go list -m -f '{{.Dir}}')
+for module_dir in "${modules[@]}"; do
+  echo "==> ${module_dir}"
+  (
+    cd -- "${module_dir}"
+    if [[ "${SKIP_VET:-0}" != "1" ]]; then
+      go vet ./...
+    fi
+    go test ./...
+  )
+done
+
+echo "Workspace verification completed successfully."