ci: run the test suite on pull requests and pushes to main

[CybotTM]

tests/ exists and passes, but none of the four workflows referenced pytest, unittest or tests/ — so the suite had never been executed by CI. Two changes to production-behaviour scripts were merged with tests attached that nothing ran.

This adds .github/workflows/tests.yml, running pytest tests/ on every pull request and on pushes to main, with contents: read and both actions pinned to the same SHAs the sibling workflows already use.

Dependencies come from a new requirements/tests.txt, hash-pinned and wheels-only. beautifulsoup4 is not optional there: tests/test_check_stars.py imports scripts/check-stars.py at module scope, so in a venv without it pytest fails during collection rather than in a single test — verified, ModuleNotFoundError: No module named 'bs4' at scripts/check-stars.py:11, Interrupted: 1 error during collection.

Verification

Run locally in a clean venv, with the same two commands the workflow issues:

$ pip install --only-binary :all: --require-hashes -r requirements/tests.txt
Successfully installed beautifulsoup4-4.15.0 certifi-2026.7.22 charset-normalizer-3.4.9 idna-3.18 iniconfig-2.3.0 packaging-26.3 pluggy-1.6.0 pygments-2.20.0 pytest-9.1.1 requests-2.34.2 soupsieve-2.9.2 typing-extensions-4.16.0 urllib3-2.7.0

$ pytest tests/ -v
platform linux -- Python 3.14.6, pytest-9.1.1, pluggy-1.6.0
collected 10 items
tests/test_check_stars.py::test_empty_repo_returns_no_dependents_without_scraping PASSED
tests/test_check_stars.py::test_get_org_repos_maps_archived_flag PASSED
tests/test_check_stars.py::test_archived_repo_skips_token_gated_fetches PASSED
tests/test_check_stars.py::test_per_repo_autherror_is_skipped_not_fatal PASSED
tests/test_check_stars.py::test_rate_limit_wait_prefers_retry_after PASSED
tests/test_check_stars.py::test_rate_limit_wait_waits_for_the_primary_reset PASSED
tests/test_check_stars.py::test_rate_limit_wait_floors_secondary_backoff_at_a_minute PASSED
tests/test_check_stars.py::test_secondary_rate_limit_waits_minutes_and_stays_within_budget PASSED
tests/test_check_stars.py::test_rate_limit_give_up_message_names_the_cause PASSED
tests/test_check_stars.py::test_permission_403_is_still_an_autherror PASSED
============================== 10 passed in 0.12s ==============================

actionlint .github/workflows/tests.yml exits 0.

Notes

No ruff format was run and no ruff config was added — at ruff's 88-column default it would reformat every existing file, and this PR adds no Python.

persist-credentials: false is not set on the checkout, because no sibling workflow in this repo sets it; adding it here alone would be the first instance of a convention rather than an application of one. Worth doing across all five workflows in a separate change if wanted.

This does not depend on #44 and shares no file with it. #44 adds requirements/scheduled-failures.txt; this adds requirements/tests.txt. In whichever order they land, the workflow here picks up the test files #44 brings with it.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package	Version	Score	Details
actions/actions/checkout	3d3c42e5aac5ba805825da76410c181273ba90b1	🟢 6.9	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 24 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches
actions/actions/setup-python	5fda3b95a4ea91299a34e894583c3862153e4b97	🟢 6.6	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 17 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST 🟢 9 SAST tool is not run on all commits -- score normalized to 9
pip/beautifulsoup4	4.15.0	Unknown	Unknown
pip/certifi	2026.7.22	🟢 6.4	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Maintained 🟢 10 13 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 3 Found 1/3 approved changesets -- score normalized to 3 Security-Policy 🟢 10 security policy file detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Pinned-Dependencies 🟢 5 dependency not pinned by hash detected -- score normalized to 5 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found License 🟢 9 license file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Packaging 🟢 10 packaging workflow detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
pip/charset-normalizer	3.4.9	Unknown	Unknown
pip/idna	3.18	Unknown	Unknown
pip/iniconfig	2.3.0	Unknown	Unknown
pip/packaging	26.3	Unknown	Unknown
pip/pluggy	1.6.0	Unknown	Unknown
pip/pygments	2.20.0	Unknown	Unknown
pip/pytest	9.1.1	Unknown	Unknown
pip/requests	2.34.2	Unknown	Unknown
pip/soupsieve	2.9.2	Unknown	Unknown
pip/typing-extensions	4.16.0	Unknown	Unknown
pip/urllib3	2.7.0	Unknown	Unknown

Scanned Files

• .github/workflows/tests.yml
• requirements/tests.txt

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.