ci: run BATS test suite on push and PR

[sabiut]

Summary

The /tests/ directory contains 186 BATS tests across launcher and cowork suites, but no CI workflow has ever invoked bats — the entire test suite is currently inert. A regression in launcher-common.sh or cowork-vm-service.js would not fail any check today. This PR adds a standalone tests.yml workflow that actually runs the suite on push and PR.

The problem

/tests/ has 6 BATS test files containing 186 tests total:

File	Owner (CODEOWNERS)
tests/launcher-common.bats (48 tests)	@sabiut
tests/launcher-xrdp-detection.bats (8 tests)	@sabiut
tests/cowork-backend-detection.bats	@RayCharlizard
tests/cowork-bwrap-config.bats	@RayCharlizard
tests/cowork-path-translation.bats	@RayCharlizard
tests/cowork-resources-staging.bats	@RayCharlizard

Audit on main (6d281c9):

$ grep -rn bats .github/workflows/
(no output)

Confirmed: test-artifacts.yml, test-flags.yml, ci.yml, and shellcheck.yml all run, but none invokes bats. PR #395's recently-merged launcher-common BATS suite (48 tests) landed under that same gap and has never actually executed in CI.

The fix

Adds .github/workflows/tests.yml — a standalone workflow that:

• Runs on every PR to main (unfiltered, so required-check semantics stay predictable)
• Runs on every push to main (path-filtered to tests/**, scripts/**, and the workflow itself)
• Installs bats and nodejs via apt — cowork tests shell out to node to load scripts/cowork-vm-service.js
• Executes bats --print-output-on-failure tests/*.bats
• Has a concurrency group to cancel superseded runs
• Declares explicit permissions: contents: read

Also updates .github/CODEOWNERS to claim the new workflow under @sabiut, matching the existing pattern for test-artifacts.yml and test-flags.yml. /tests/cowork-*.bats review ownership stays with @RayCharlizard.

Bug surfaced by wiring CI

The first CI run on this PR caught two pre-existing test failures in tests/cowork-bwrap-config.bats (tests 46 and 47 — doctor: reports custom bwrap mounts and doctor: warns about disabled critical mount /usr).

Root cause: _doctor_check_bwrap_mounts in scripts/doctor.sh resolves the config dir via ${XDG_CONFIG_HOME:-$HOME/.config}/Claude. The test setup() only sandboxed HOME via TEST_TMP. GitHub Actions runners export XDG_CONFIG_HOME ambient, which overrode the per-test HOME and made the function read the runner's real config dir. Assertions silently failed against empty output.

The bug existed on main before this PR, but was hidden because the BATS suite never ran in CI — exactly the gap this PR exists to close. Fixed in the second commit (fix(tests): unset XDG_CONFIG_HOME in cowork-bwrap-config setup) by adding unset XDG_CONFIG_HOME to the test's setup(). Verified locally that all 186 tests pass with XDG_CONFIG_HOME set ambient (reproduces CI env).

Why standalone instead of extending test-artifacts.yml?

• BATS unit tests should run in seconds on every push, not wait ~10 minutes for a full artifact build.
• Cleaner failure attribution — a red BATS Tests check means "your code broke a test", not "the build broke and we never reached tests".
• Smaller blast radius for a first-wiring PR — no ci.yml changes to coordinate, easier to roll back.
• Trivial to promote into ci.yml as a build gate later once it's proven stable.

[aaddrick]

@sabiut — 186 inert tests only show up when someone actually runs them. Nice catch wiring this in. _doctor_check_bwrap_mounts (scripts/doctor.sh:140) reads ${XDG_CONFIG_HOME:-$HOME/.config}/Claude, and GH runners export XDG_CONFIG_HOME ambient. That wins the :- expansion before the inline HOME= at the call site gets a chance. Your unset in setup() forces the fallback path so the HOME override takes effect.

I checked out the branch and ran the suite with deliberately polluted env: empty XDG_CONFIG_HOME, populated, and pointed at a config crafted to match the test's assertion patterns (the false-positive scenario). 186/186 in every case. Reverting the unset reproduces the failure deterministically. Fix is correct.

Workflow shape is what I'd have asked for. No reason to gate seconds-fast unit tests behind a 10-minute artifact build. Push path-filtered with PR unfiltered lines up with required-check semantics under GH branch protection, and the concurrency group plus permissions: contents: read are both good to see.

@RayCharlizard — tests/cowork-bwrap-config.bats is on your surface per CODEOWNERS. Soft tag for awareness, not blocking. Fix is verified, so ship-it whenever you've had a look. One optional observation if consistency matters: launcher-common.bats:21-30 does the full XDG sandbox in setup() itself rather than per-call inline. Converging cowork-bwrap-config on that pattern would be cleaner, but not for this PR.

---

Written by Claude Opus 4.7 (1M context) via Claude Code

[RayCharlizard]

Hey @sabiut — confirming the fix from the cowork side. Good catch.

Walking through the path-resolution claim: _doctor_check_bwrap_mounts at scripts/doctor.sh:140 resolves the config dir as ${XDG_CONFIG_HOME:-$HOME/.config}/Claude. The :- only falls back when XDG_CONFIG_HOME is unset or empty. The two failing tests use HOME="${TEST_TMP}" run _doctor_check_bwrap_mounts — that scoped HOME override is meaningless if XDG_CONFIG_HOME is already exported in the runner env, which it is on ubuntu-latest. Your unset XDG_CONFIG_HOME in setup() forces the fallback path so the inline HOME actually wins. Targeted and correct.

One thing worth noting that strengthens the case: the third doctor test in this file (doctor: no output when no custom mounts configured at line 657) was probably also reading from the runner's real config dir before this fix. It passes either way because it asserts empty output and the runner has no claude_desktop_linux_config.json to find — green for the wrong reason. Your unset in shared setup() fixes that too.

I checked the other cowork suites for the same ambient-leak pattern. cowork-backend-detection.bats and cowork-path-translation.bats only invoke node against pure JS functions — no XDG_* resolution, no shell. cowork-resources-staging.bats works on a TEST_TMP staging layout via claude_extract_dir/electron_resources_dest, no XDG paths. The fix is complete, not partial.

Workflow shape is fine. bats --print-output-on-failure tests/*.bats picks up all four cowork-.bats and both launcher-.bats files. Concurrency group, permissions: contents: read, path filters scoped to tests/** and scripts/**, PR trigger unfiltered for predictable required-check semantics — all the pieces I'd expect. CODEOWNERS update is clean: only adds the new tests.yml line under @sabiut, leaves cowork-*.bats ownership where it sits.

Echoing aaddrick's optional observation — launcher-common.bats:21-30 does the full XDG sandbox in setup() (exports HOME and all XDG_* into TEST_TMP, then mkdir -p). Converging cowork-bwrap-config on that pattern would be more defensive than a single targeted unset, since any future test in the file that touches a different XDG var inherits the same trap. Not a blocker, and expanding the sandbox here would belong in its own change.

Confirmed CI is green at HEAD (BATS unit tests passes in 35s alongside everything else). Approving from the cowork side — ship it whenever.

---

Written by Claude Opus 4.7 (1M context) via Claude Code