[quality] unit-tests.yml paths filter skips BATS-covered actions: push-image, sign-and-publish, create-manifest, scan-image, preflight

[kubestellar-hive]

Finding

.github/workflows/unit-tests.yml gates the pytest and bats jobs behind a paths filter. The filter lists only:

actions/**
bootc-build/create-release/scripts/**
bootc-build/chunka/**
bootc-build/detect-changes/**
bootc-build/generate-tags/**
bootc-build/setup-runner/**
scripts/**
.github/actions/**
tests/**
.github/workflows/reusable-build.yml
.github/workflows/unit-tests.yml

Several composite actions already have BATS suites but are not in the filter, so a PR that edits only their action.yml runs no unit tests at all:

Action	Existing test	In paths?
bootc-build/push-image/action.yml	tests/bats/test_push_image.bats	❌
bootc-build/sign-and-publish/action.yml	tests/bats/test_sign_and_publish.bats	❌
bootc-build/scan-image/action.yml	tests/bats/test_scan_image.bats (open in #427)	❌
bootc-build/create-manifest/action.yml	tests/bats/test_create_manifest.bats (open in #428)	❌
bootc-build/preflight/action.yml	tests/bats/test_preflight.bats (open in #436)	❌

The tests in this repo deliberately inline verbatim copies of the action.yml run: blocks so they fail when the action drifts. That guarantee is void when the workflow never fires on an action.yml-only change — drift lands silently and is only caught later by whichever unrelated PR happens to touch tests/**.

sign-and-publish and scan-image are supply-chain steps (signing, SBOM, vulnerability gating). Silent drift there is the worst case.

Recommendation

Replace the hand-maintained per-action list with a single glob so new actions are covered by default:

paths:
  - "actions/**"
  - "bootc-build/**"
  - "scripts/**"
  - ".github/actions/**"
  - "tests/**"
  - ".github/workflows/reusable-build.yml"
  - ".github/workflows/unit-tests.yml"

bootc-build/** subsumes all six currently-listed bootc-build/* entries. The job is cheap (bats + pytest on ubuntu-24.04), so the extra triggers cost little compared to an undetected supply-chain regression.

If a narrower filter is preferred, at minimum add bootc-build/push-image/**, bootc-build/sign-and-publish/**, bootc-build/scan-image/**, bootc-build/create-manifest/** and bootc-build/preflight/**, and add a check that every tests/bats/test_<x>.bats has a matching path entry.

Claimed ground

This issue concerns .github/workflows/unit-tests.yml (paths filter) only. No open PR claims that file: #426 claims .github/workflows/pkg-cadence.yml, #434 claims .github/actions/install-cosign/action.yml, #427/#428/#436 claim bootc-build/*/action.yml and tests/bats/*, #431 claims scripts/render_*.py, #435 claims docs/skills/*. No PR is opened here — this needs a CI-owner decision on filter breadth.

Priority

• Impact: high (supply-chain actions can regress with a green CI)
• Effort: low (one workflow edit)

---

Filed by quality agent (hold-gated mode)

🐝 Hive Agent: quality | Instance: hosted-projectbluefin-knuckle-gjvq | SHA: 0337071

— hive: agent=quality backend=copilot model=claude-opus-5