You can't check .in files, because they are not valid Python files. I see two options:

1) Create the output files, then validate the output files (e.g. ipa-client-automount.in -> ipa-client-automount, then check ipa-client-automount)
2) Move all code out of the .in files into proper Python modules and convert the script files into two liners (import + main()).

I would prefer approach (2). The .in files have several disadvantages. The code is not reusable. IDEs don't recognize the files as Python files.

Thanks for the input @cheimes - after some experimentation #2 sounds like the best option.

Files to change:
./client/ipa-client-automount.in
./daemons/dnssec/ipa-dnskeysync-replica.in
./daemons/dnssec/ipa-dnskeysyncd.in
./daemons/dnssec/ipa-ods-exporter.in
./install/certmonger/dogtag-ipa-ca-renew-agent-submit.in
./install/certmonger/ipa-server-guard.in
./install/oddjob/com.redhat.idm.trust-fetch-domains.in
./install/tools/ipa-adtrust-install.in
./install/tools/ipa-ca-install.in
./install/tools/ipa-compat-manage.in
./install/tools/ipa-custodia-check.in
./install/tools/ipa-dns-install.in
./install/tools/ipa-httpd-kdcproxy.in
./install/tools/ipa-managed-entries.in
./install/tools/ipa-nis-manage.in
./install/tools/ipa-pki-retrieve-key.in
./install/tools/ipa-pki-wait-running.in
./install/tools/ipa-replica-conncheck.in
./install/tools/ipa-replica-manage.in
./install/tools/ipactl.in
and on a 2nd pass:
./install/restart_scripts/renew_ca_cert.in
./install/restart_scripts/renew_kdc_cert.in
./install/restart_scripts/renew_ra_cert.in
./install/restart_scripts/renew_ra_cert_pre.in
./install/restart_scripts/restart_dirsrv.in
./install/restart_scripts/restart_httpd.in
./install/restart_scripts/stop_pkicad.in
Those three can stay as-is:
./ipasetup.py.in
./makeaci.in
./makeapi.in

master:

• 6d02eddd3ef7f65c1a922125371fcbb83e35d7f8 Replace PYTHONSHEBANG with valid shebang

ipa-4-7:

• 452fe2fdc7a89f7b59cc07b17693eb649d41b7ec Replace PYTHONSHEBANG with valid shebang

For now I'll limit this to ipactl and ipa-client-automount.
We can do the others as we modify them.

master:

• c0cf65c4f78bdb410a472f63b98870321fd751e1 Move ipa-client-automount.in and ipactl into modules
• b49c627aa688e0eb1e9b34ff626f2a19aa4f6c3e ipa_client_automount.py and ipactl.py: fix codestyle
• 37ab150cc70be21ca57ca253d2a337533131457a Introduce minimal ipa-client-automount.in and ipactl.in

master:

• 6b2efdfae5302427543ef42686c35db737da6261 Makefile.am: add .in files to fastlint target