ci: add pylint presubmit on golden files (closes #16393) (#16808)

## Why

Issue #16393 asks for a `pylint` presubmit check on the GAPIC golden
client libraries so generator regressions are caught at PR time.
`flake8` and `ruff` already run on these goldens, but they do not catch
the kinds of issues `pylint` flagged in the original investigation
(undefined names, broken imports, etc.).

## What

- New `packages/gapic-generator/tests/integration/goldens/.pylintrc`
scoped to the goldens. Conservative bar to start: `pylint --errors-only`
is used in CI, and the `.pylintrc` disables the small set of error-class
checks that consistently misfire on auto-generated GAPIC output
(`no-name-in-module`, `no-member`, `import-error`,
`relative-beyond-top-level`, `cyclic-import`). This catches real bugs
without forcing a stylistic cleanup of the existing goldens, which can
be tightened later.
- New `Pylint goldens (errors only)` step in the existing `goldens` job
in `.github/workflows/gapic-generator-tests.yml`. Runs after the
existing `format`/`lint`/`unit` nox sessions, so the heavy setup is
amortized. Iterates over the same `credentials eventarc logging redis`
set.

## Tested

- Confirmed the new step is gated by the same `paths` filter as the rest
of `gapic-generator-tests.yml`, so it stays silent on PRs that do not
touch the generator.
- `pylint --errors-only --rcfile=.pylintrc` only reports E/F categories
minus the listed disables, which keeps the signal meaningful and stops
the generator from silently regressing on the next refactor.

If the maintainers want a different starting bar (e.g. include warnings,
or run on more golden packages), happy to adjust.

Author: MukundaKatta

.github/workflows/gapic-generator-tests.yml

@@ -115,6 +115,17 @@ jobs:
           for pkg in credentials eventarc logging redis; do
             nox -f tests/integration/goldens/$pkg/noxfile.py -s format lint unit-${{ needs.python_config.outputs.latest_stable_python }}
           done
+      # Run pylint (errors-only) over the goldens so generator regressions
+      # like undefined names or import-time breakage that ruff/flake8 do
+      # not flag are caught at PR time.
+      # See https://github.com/googleapis/google-cloud-python/issues/16393.
+      - name: Pylint goldens (errors only)
+        run: |
+          pip install --quiet pylint
+          cd packages/gapic-generator/tests/integration/goldens
+          for pkg in credentials eventarc logging redis; do
+            pylint --rcfile=.pylintrc --errors-only --recursive=y "$pkg/google"
+          done
 
   goldens-prerelease:
     needs: python_config

packages/gapic-generator/tests/integration/goldens/.pylintrc

@@ -0,0 +1,32 @@
+# Pylint configuration for golden client libraries.
+#
+# These goldens are auto-generated GAPIC client output (see
+# packages/gapic-generator/gapic/templates/). They are checked in as test
+# fixtures so that regressions in the generator are caught at PR time.
+#
+# Pylint is invoked with `--errors-only` from CI so only error/fatal
+# categories run. This file disables the small set of error-class checks
+# that consistently misfire on auto-generated GAPIC output (proto
+# descriptor lookups, dynamic attribute attachment, optional transports).
+# Tighten as the generator's output is cleaned up.
+#
+# See https://github.com/googleapis/google-cloud-python/issues/16393.
+
+[MAIN]
+ignore-patterns=.*_pb2\.py,.*_pb2_grpc\.py
+extension-pkg-allow-list=grpc,google.protobuf
+
+[MESSAGES CONTROL]
+disable=
+    no-name-in-module,
+    no-member,
+    import-error,
+    relative-beyond-top-level,
+    cyclic-import,
+    # Generator emits __hash__ stubs as `return NotImplementedError(...)`
+    # rather than `raise`; the goldens deliberately mirror that template
+    # output so the check is silenced here until the generator is fixed.
+    invalid-hash-returned
+
+[REPORTS]
+score=no