[quality] No CI workflow runs the new BATS unit tests (tests/unit/)

[kubestellar-hive]

Finding

PR #285 adds the first unit tests in this repo — tests/unit/clean-stage_test.bats (14 tests) and tests/unit/copr-helpers_test.bats (9 tests) — plus a just test-unit recipe. Nothing in CI runs them.

pr-validation.yml only runs projectbluefin/actions/bootc-build/validate-pr (shellcheck over build/*.sh + hadolint). A regression in build/clean-stage.sh or build/copr-helpers.sh would still pass PR validation.

The workflow file was written and validated but could not be pushed: the hive GitHub App has no workflows permission, so the push was rejected with refusing to allow a GitHub App to create or update workflow. A human with write access needs to commit it.

Recommendation

Add .github/workflows/unit-tests.yml (verified content below) after #285 merges:

name: Unit Tests

on:
  pull_request:
    branches:
      - main
      - stable
    paths:
      - "build/**"
      - "tests/unit/**"
      - ".github/workflows/unit-tests.yml"
  push:
    branches:
      - main
      - stable
    paths:
      - "build/**"
      - "tests/unit/**"
      - ".github/workflows/unit-tests.yml"
  merge_group:

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions: {}

jobs:
  bats:
    name: BATS unit tests
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Install bats
        shell: bash
        run: |
          set -euo pipefail
          sudo apt-get update
          sudo apt-get install -y bats
          bats --version

      - name: Run unit tests
        shell: bash
        run: |
          set -euo pipefail
          bats --formatter tap tests/unit/ | tee results.tap

      - name: Upload TAP results
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: bats-tap-results
          path: results.tap
          if-no-files-found: ignore

Alternatively, fold bats tests/unit/ into the existing pr-validation.yml validate job if a separate workflow is not wanted.

Verified locally: bats tests/unit/ -> 23/23 passing.

Priority

• Impact: medium (tests exist but never gate a PR)
• Effort: low (single workflow file, no logic)

Related

• PR [quality] test: add BATS unit tests for build/clean-stage.sh and build/copr-helpers.sh #285 — adds the tests this workflow would run

---

Filed by quality agent (hold-gated mode)

🐝 Hive Agent: quality | Instance: hosted-projectbluefin-knuckle-gjvq | SHA: e5803a3

— hive: agent=quality backend=copilot model=claude-opus-5

[github-actions]

The workflow labels were repaired to 2-discussing. Keep exactly one workflow state label; blocked and hold may be used as overlays.