[quality] tests/test_apps_just.bats runs in the Justfile but not in CI — unit-tests.yml needs a step

[hivecommons-hive]

Finding

PR #1064 adds tests/test_apps_just.bats (21 cases covering the apps.just
recipes install-opentabletdriver and cncf) and wires it into the Justfile
test recipe. It is not wired into .github/workflows/unit-tests.yml.

unit-tests.yml enumerates each BATS suite as its own explicit step
(bats tests/test_libsetup.bats, bats tests/test_update_just.bats, …) rather
than globbing tests/*.bats. A suite that is not listed simply never runs in
CI, silently, with a green check.

The workflow step could not be added in #1064 because the hive GitHub App token
has no workflows permission — the push is rejected outright:

! [remote rejected] quality/test-apps-just-otd-cncf -> quality/test-apps-just-otd-cncf
  (refusing to allow a GitHub App to create or update workflow
   `.github/workflows/unit-tests.yml` without `workflows` permission)

Recommendation

Add the step to unit-tests.yml, next to the other BATS steps:

      - name: Run bats (apps.just — install-opentabletdriver, cncf)
        run: bats tests/test_apps_just.bats

Structural follow-up

The explicit per-suite enumeration is itself the underlying gap — it makes
"suite exists but never runs in CI" the default failure mode for every new test
file, and it has to be kept in sync with the Justfile test recipe by hand.
Two lists, no gate that they agree.

Two options worth considering:

1. Replace the enumerated steps with a single bats tests/ (or bats tests/*.bats) invocation, excluding the suites that genuinely cannot run in
   CI (e.g. test_libvirt_helper.bats, which the Justfile already documents
   as needing a live libvirtd session) via an explicit skip list.
2. Keep the enumeration but add a check that every tests/*.bats file appears
   in both unit-tests.yml and the Justfile test recipe, failing CI when a
   new suite is added to neither.

Option 1 is less machinery and removes the drift class entirely.

Priority

• Impact: medium — a passing local just test does not imply CI coverage
• Effort: low for the single step; medium for the structural fix

---

Filed by quality agent (hold-gated mode).

🐝 Hive Agent: quality | Instance: hosted-projectbluefin-knuckle-gjvq | SHA: unknown

— hive: agent=quality backend=copilot model=claude-opus-5

[Danathar]

This looks valid, but it is currently blocked on #1064 since tests/test_apps_just.bats does not exist on main yet.

There is also overlap with #968, which already tracks the broader problem of BATS/Python test files being present locally but not wired into unit-tests.yml.

I’m marking this blocked for now. Once #1064 lands, we should either fold this into #968 if that issue is still open, or move this directly into the implementation queue if #968 has already been resolved.

[Danathar]

Folding this into #968, which already tracks test files that exist on disk but aren't wired into unit-tests.yml. Once #1064 lands, test_apps_just.bats should be added to that list.