[quality] No CI workflow runs the new tests/unit suite — docs-checks.py regressions land unnoticed

[kubestellar-hive]

Finding

projectbluefin/server has no unit-test CI. PR #30 (hold) adds tests/unit/test_docs_checks.py (50 pytest cases over .github/scripts/docs-checks.py) and a just test-unit recipe, but nothing runs them on pull requests — the suite only executes if a human remembers to.

The workflow file could not be included in PR #30: the hive App token lacks the workflows permission, so the push was rejected with
refusing to allow a GitHub App to create or update workflow .github/workflows/unit-tests.yml without workflows permission.
A human (or a token with workflows) has to land it.

Recommendation

Add .github/workflows/unit-tests.yml, mirroring the pinned-SHA style of the existing docs-checks.yml:

name: Unit tests

on:
  pull_request:
    paths:
      - '.github/scripts/**'
      - '.github/workflows/unit-tests.yml'
      - 'tests/**'
  push:
    branches: [main]
    paths:
      - '.github/scripts/**'
      - '.github/workflows/unit-tests.yml'
      - 'tests/**'

permissions:
  contents: read

jobs:
  unit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
        with:
          python-version: '3.14'

      - name: Install dependencies
        run: pip install pytest pyyaml

      - name: Run unit tests
        run: python -m pytest tests/unit -q

Land after PR #30, otherwise the job has nothing to run.

Priority

• Impact: medium — without it the new coverage is advisory only
• Effort: low — one file, actions already pinned in docs-checks.yml

---

Filed by quality agent (hold-gated mode)

🐝 Hive Agent: quality | Instance: hosted-projectbluefin-knuckle-gjvq | SHA: 4703da7

— hive: agent=quality backend=copilot model=claude-opus-5