[quality] missing-workflow: unit-tests.yml runs 27 of 40 suites — 13 maintained test suites never execute in CI

[hivecommons-hive]

Finding

.github/workflows/unit-tests.yml is the only workflow that runs this repository's unit suites. It names 27 of the 40 runnable suites in tests/. The Justfile test recipe names 38 — but no workflow ever invokes just test; Justfile appears in unit-tests.yml only as a paths: filter. So 13 maintained, committed suites execute on no CI run, on any branch, ever.

Verified at 44b4b9f:

$ grep -rn "just test" .github/workflows/   # no output

Never executed by CI

suite	assertions	state at 44b4b9f
tests/test_bazaar_hook.py	(69 across the four .py modules)	green
tests/test_curated_config.py		green
tests/test_check_oci_refs.py		green
tests/test_skill_docs.py		green, but needs jsonschema
tests/test_bling_preexec_rearm.bats	14	green
tests/test_system_just.bats	24	green
tests/test_default_just.bats	23	green
tests/test_hardware_hooks.bats	12	green
tests/test_nvidia_flatpak_sync.bats	10	green
tests/test_brew_tap_trust.bats	7	green, but needs just on PATH
tests/test_theming_hook.bats	5	green
tests/test_clean_system_podman_path.bats	2	green
tests/test_ujust.bats	12	5 red — repair is #1106's ground

That is 166 passing assertions that guard shipped behaviour and cost CI nothing to run, plus one red suite that should be added only once #1106 lands.

Provenance: executed locally at commit 44b4b9f with bats 1.14.0, CPython 3.13, pytest + pyyaml + jsonschema, and just 1.58.0 on PATH. Example:

$ bats tests/test_system_just.bats | tail -1
ok 24 install-system-flatpaks: TARGET_FLATPAK_FILE overrides the Brewfile
$ python3 -m pytest tests/test_bazaar_hook.py tests/test_curated_config.py \
    tests/test_check_oci_refs.py tests/test_skill_docs.py -q | tail -1
69 passed in 0.96s

Two dependencies are missing from the workflow's Install test deps step and are part of the fix, not a reason to skip a suite:

• test_skill_docs.py imports scripts/generate_skill_index.py, which imports jsonschema. Without it, 4 of its tests error on collection.
• test_brew_tap_trust.bats shells out to just --justfile .../apps.just. Without just, its cases exit 127.

test_default_just.bats and test_system_just.bats do not need just; they extract recipe bodies.

Recommendation

This is mechanical. Apply the following to .github/workflows/unit-tests.yml.

• 1. Add the two missing test dependencies. Replace the Install test deps step's run: body:

      - name: Install test deps
        run: |
          sudo apt-get install -y bats fish zsh
          pip install pytest pytest-cov pyyaml jsonschema

• 2. Install just, reusing the block already proven in .github/workflows/validate.yml. Insert immediately after Install test deps:

      - name: Install just
        shell: bash
        run: |
          set -euo pipefail

          if command -v just >/dev/null 2>&1; then
            echo "just is already installed"
            just --version
            exit 0
          fi

          if ! command -v cargo >/dev/null 2>&1; then
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal
          fi

          source "$HOME/.cargo/env"
          cargo install --locked just
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"

• 3. Run the four unregistered pytest modules. Add as a separate step after the existing Run pytest (hooks.py) step — separate so the existing --cov=system_files/bluefin/etc/bazaar --cov-fail-under=80 gate keeps its current denominator and cannot be diluted by unrelated modules:

      - name: Run pytest (scripts and config validators)
        run: |
          python3 -m pytest \
            tests/test_bazaar_hook.py \
            tests/test_curated_config.py \
            tests/test_check_oci_refs.py \
            tests/test_skill_docs.py \
            -v

• 4. Run the seven green unregistered bats suites. Append after the existing Run bats (bonedigger report) step:

      - name: Run bats (bling preexec re-arm)
        run: bats tests/test_bling_preexec_rearm.bats

      - name: Run bats (clean-system podman path)
        run: bats tests/test_clean_system_podman_path.bats

      - name: Run bats (default.just)
        run: bats tests/test_default_just.bats

      - name: Run bats (system.just)
        run: bats tests/test_system_just.bats

      - name: Run bats (hardware hooks)
        run: bats tests/test_hardware_hooks.bats

      - name: Run bats (theming hook)
        run: bats tests/test_theming_hook.bats

      - name: Run bats (nvidia flatpak sync)
        run: bats tests/test_nvidia_flatpak_sync.bats

      - name: Run bats (brew tap trust)
        run: bats tests/test_brew_tap_trust.bats

• 5. Widen the paths: filter. The workflow currently triggers on scripts/validate-brewfiles.sh but not on the other files the newly added suites cover, so a change to scripts/check-oci-refs.py or scripts/generate_skill_index.py would not run the tests that guard it. In both the pull_request: and push: paths: lists, replace the single scripts/validate-brewfiles.sh entry with:

      - "scripts/**"

• 6. Leave tests/test_ujust.bats out until test: repair broken-at-birth bats suites (test_ujust mock brew, powerwash bctl) #1106 lands. It is red at 44b4b9f (5 of 12 cases fail); adding it now would make the required check red on every PR. Once test: repair broken-at-birth bats suites (test_ujust mock brew, powerwash bctl) #1106 merges, add:

      - name: Run bats (ujust)
        run: bats tests/test_ujust.bats

• 7. Add the two suites from test: gate the Justfile test recipe against tests/ — tests/test_suite_registration.bats #1166 once it merges, so the new registration gate runs in CI too:

      - name: Run bats (ublue-image-repo)
        run: bats tests/test_image_repo.bats

      - name: Run bats (test suite registration)
        run: bats tests/test_suite_registration.bats

Why there is no PR attached to this issue

The whole fix lives in .github/workflows/unit-tests.yml. The GitHub App token available to this agent is minted at the contributor tier, which does not carry the workflows permission, so GitHub rejects any push whose diff touches .github/workflows/** regardless of what the installation grants. This change needs a human, or an agent running with workflow-write scope, to land it. It is not a judgement call that a PR was withheld — nothing this agent can push could contain the change.

The related, pushable half — registering the orphaned tests/test_image_repo.bats in the Justfile recipe and adding a drift gate so the recipe can no longer silently omit a suite — is #1165 / #1166.

Priority

• Impact: high — 166 green assertions over shipped ujust recipes, hardware/theming setup hooks, the Bazaar config validators and the OCI-ref checker are maintained but never gate a merge, so any of them can rot undetected
• Effort: low — additive workflow steps only, no test code changes

---

Filed by quality agent (hold-gated mode)

— hive: agent=quality backend=copilot model=claude-opus-5