Going towards the end of life of Python2 (18 months from now), we should start having CI vote -1/-2 if there is any new python2 files pushed in the repository.
Of course this is pretty easy to be done just checking the shebang, while might be impossible for scripts that don't have a shebang
Almost certainly impossible to catch all Python 2 code that doesn't have a shebang and is compatible with Python 3 syntax. Hopefully that's a pretty small set of things.
Should probably audit everything ending in .py without a python3 shebang and check what we're running it under (if python 2, port it)
Just in puppet checking shebangs:
alex@alex-laptop:~/Development/Wikimedia/Operations-Puppet (production)$ find -iname '*.py' | xargs grep -E "^#!" | wc -l 122 alex@alex-laptop:~/Development/Wikimedia/Operations-Puppet (production)$ find -iname '*.py' | xargs grep -E "^#!" | grep -v python3 -c 84
Another option might be to create a job that executes the python3 compiler against the script. Caveat: I am not sure what potential for abuse this brings to the table.
find -iname '*.py' | xargs -n1 python3 -m py_compile
(People interested in this task may also be interested in T197803: Python2: track Py2 softwares)
Bookworm no longer includes Python 2 at all and in Bullseye Python gets uninstalled unless one sets an explicit Hiera flag to keep it (pybal e.g.), we no longer need to forbid this in CI.