ci: run unit tests on pull requests and pushes to main

[edusperoni]

PR Checklist

• The PR title follows our guidelines.
• There is an issue for the bug/feature this PR is for. (no tracking issue — happy to open one)
• You have signed the CLA.
• All existing tests are passing.
• Tests for the changes are included. (this PR is the test infrastructure itself)

What is the current behavior?

Nothing runs the unit tests in CI. The existing workflows cover releases, CodeQL, Scorecard and dependency review, but never npm test.

The suite runs in exactly one place: prepack → grunt prepare → shell:npm_test, which only fires during npm pack. So a broken test first surfaces while cutting a release rather than on the PR that broke it.

What is the new behavior?

Adds .github/workflows/tests.yml, running npm ci --ignore-scripts && npm test on pull requests and pushes to main.

• Matrixed over Node 20.x and 22.x, matching engines and the version the release workflow publishes with
• concurrency group so superseded runs are cancelled
• Action SHAs pinned to the ones already in use in this repo, plus the harden-runner step, to stay consistent with the existing workflows
• npm ci resolves cleanly without --legacy-peer-deps (verified), so unlike the release workflow this one gets a reproducible install from the lockfile

Worth noting separately: engines currently allows >=20.0.0, but Node 20 reached end of life in April 2026. Adding 24.x to the matrix and raising the floor is probably worth a follow-up.

Summary by CodeRabbit

• Tests
  • Added an automated “Tests” workflow for pull requests and for pushes to the main branch.
  • Tests now run across supported Node.js versions for broader compatibility coverage.
  • Enabled dependency caching and improved test execution security and concurrency behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 92a2ff6f-a59d-489c-801c-066958689562

📥 Commits

Reviewing files that changed from the base of the PR and between eacf487 and 2ad6600.

📒 Files selected for processing (1)

• .github/workflows/tests.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/tests.yml

---

📝 Walkthrough

Walkthrough

Adds a GitHub Actions test workflow for pull requests and pushes to main, testing on Node.js 20.x and 22.x with hardened runners, npm caching, clean dependency installation, and npm test.

Changes

Automated Test Workflow

Layer / File(s)	Summary
Workflow triggers and test execution .github/workflows/tests.yml	Configures pull request and main push triggers, read-only contents permissions, concurrency cancellation, Node.js 20.x and 22.x jobs, runner hardening, npm caching, dependency installation, and test execution.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

A rabbit hops through Actions bright,
Testing Node by day and night.
With cached carrots, scripts run,
Twenty, twenty-two—tests done!
Clean paws leave the pipeline light.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the new CI workflow that runs unit tests on pull requests and main pushes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/tests.yml:
- Line 32: Update the actions/checkout step in the tests workflow to disable
credential persistence by setting persist-credentials to false, while leaving
the pinned checkout action and existing workflow behavior unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2e048e2e-4d48-40df-8712-fb5438cc469a

📥 Commits

Reviewing files that changed from the base of the PR and between 1084bc7 and eacf487.

📒 Files selected for processing (1)

• .github/workflows/tests.yml