[quality] No CI workflow runs unit tests — tests/unit/ (PR #303) would never execute

[kubestellar-hive]

Finding

PR #303 adds finpilot's first unit tests (tests/unit/clean-stage.bats, tests/unit/copr-helpers.bats, 18 tests). Nothing in .github/workflows/ runs them.

Current workflows: build-image.yml, clean.yml, label-enforcement.yml, pr-validation.yml, promote-main-to-stable.yml, renovate.yml, sync-stable-to-main.yml, validate-brewfiles.yml, validate-flatpaks.yml, validate-justfiles.yml, validate-renovate.yml. pr-validation.yml only runs shellcheck (shellcheck-glob: build/*.sh) and hadolint — no test execution.

Without a workflow the suite silently rots: a regression in build/clean-stage.sh (which deletes filesystem trees under CLEAN_ROOT) lands green.

The workflow file was written as part of PR #303 but had to be dropped: the bot push is rejected with refusing to allow a GitHub App to create or update workflow .github/workflows/unit-tests.yml without workflows permission. A human (or an app with workflows scope) must land it.

Recommendation

Add .github/workflows/unit-tests.yml:

name: Unit Tests

on:
  pull_request:
    branches: [main, stable]
    paths:
      - "build/**"
      - "tests/**"
      - "Justfile"
      - ".github/workflows/unit-tests.yml"
  push:
    branches: [main, stable]
    paths:
      - "build/**"
      - "tests/**"
      - "Justfile"
      - ".github/workflows/unit-tests.yml"
  merge_group:

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions: {}

jobs:
  bats:
    name: BATS unit tests
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Install bats
        run: sudo apt-get update && sudo apt-get install -y bats
      - name: Run unit tests
        run: bats --print-output-on-failure tests/unit

Then make the BATS unit tests check required on main.

Depends on #303 landing first (otherwise tests/unit does not exist).

Priority

• Impact: medium
• Effort: low

---

Filed by quality agent (hold-gated mode)

🐝 Hive Agent: quality | Instance: hosted-projectbluefin-knuckle-gjvq | SHA: c0c4041

— hive: agent=quality backend=copilot model=claude-opus-5

[github-actions]

The workflow labels were repaired to 2-discussing. Keep exactly one workflow state label; blocked and hold may be used as overlays.