From 883eec9b38eb670f310b70ead1831a64906b74d6 Mon Sep 17 00:00:00 2001
From: barkz <rob.barker@outlook.com>
Date: Sun, 16 Aug 2026 17:50:42 -0500
Subject: [PATCH] Add CI workflow running the test suite on push and PR

Runs 721 tests on Python 3.9-3.13 (Linux) plus 3.12 on macOS, where the
installer's app-bundle path actually exercises.

Also guards two project invariants that are easy to break silently:
- no pyproject.toml/setup.py/requirements.txt, i.e. zero runtime dependencies
- the build leaves no artifacts in the working tree

Until now there were no workflows, so 'gh pr merge --admin' bypassed nothing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/tests.yml | 56 +++++++++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)
 create mode 100644 .github/workflows/tests.yml

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
new file mode 100644
index 0000000..dc65ba9
--- /dev/null
+++ b/.github/workflows/tests.yml
@@ -0,0 +1,56 @@
+name: tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: python ${{ matrix.python }} on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        # 3.9 is the documented floor (ships with macOS); 3.13 is the ceiling we claim.
+        os: [ubuntu-latest]
+        python: ["3.9", "3.10", "3.11", "3.12", "3.13"]
+        include:
+          # The installer's macOS app-bundle path only really exercises on macOS.
+          - os: macos-latest
+            python: "3.12"
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python }}
+
+      - name: Confirm zero runtime dependencies
+        run: |
+          test ! -f pyproject.toml && test ! -f setup.py && test ! -f requirements.txt \
+            && echo "no dependency manifests, as intended"
+
+      - name: Run the test suite
+        env:
+          PYTHONPYCACHEPREFIX: ${{ runner.temp }}/pycache
+        run: python -m unittest discover tests/ -v
+
+      - name: Build and smoke-test the installer artifact
+        env:
+          PYTHONPYCACHEPREFIX: ${{ runner.temp }}/pycache
+        run: |
+          python install.py --cli-only --prefix "$RUNNER_TEMP/bin"
+          echo '/status' | "$RUNNER_TEMP/bin/glean" | grep -q "mode" \
+            && echo "installed CLI responds"
+
+      - name: Confirm the build left no artifacts in the tree
+        run: |
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "::error::working tree dirty after build"; git status --short; exit 1
+          fi