The #4363 guard asserts "Every bin/ test suite is wired into something". There is no equivalent for src/deploy/, and the gap is not hypothetical.
Measured now
Of the 30 src/deploy/test_*.sh suites, five are absent from v2-ci.yml. Four of those run in a different workflow, which is fine:
| Suite |
Runs in |
test_ambient_cap_runtime.sh |
suid-contract.yml |
test_image_suid_inventory.sh |
docker.yml, suid-contract.yml |
test_manifest_caps_runtime.sh |
suid-contract.yml |
test_quadlet_generator_gate.sh |
quadlet-gate.yml |
test_entrypoint_symlinks.sh |
nowhere — no workflow references it |
I checked every file under .github/workflows/ for each name, so "nowhere" means nowhere, not "not in the obvious place."
Why this keeps happening
src/deploy/ suites are wired individually, by name. A new suite is therefore never picked up automatically, and an omission produces no failure — nothing fails when a test file is simply never named. That is the property #4363 calls out for bin/: "Each omission it catches is individually invisible."
Two live instances already found this way:
Both are the same failure as the guards #5388 catalogues: something that reads as coverage while asserting nothing. A test file present in the tree looks like a test that runs.
Proposed
Extend the #4363 guard, or add a sibling, asserting every src/deploy/test_*.sh is referenced by at least one workflow under .github/workflows/. Referenced anywhere is the right bar — four of the five above are correctly placed in specialised lanes, and requiring v2-ci.yml specifically would produce false failures.
Acceptance
Refs #4363, #5388, #5504
The
#4363guard asserts "Everybin/test suite is wired into something". There is no equivalent forsrc/deploy/, and the gap is not hypothetical.Measured now
Of the 30
src/deploy/test_*.shsuites, five are absent fromv2-ci.yml. Four of those run in a different workflow, which is fine:test_ambient_cap_runtime.shsuid-contract.ymltest_image_suid_inventory.shdocker.yml,suid-contract.ymltest_manifest_caps_runtime.shsuid-contract.ymltest_quadlet_generator_gate.shquadlet-gate.ymltest_entrypoint_symlinks.shI checked every file under
.github/workflows/for each name, so "nowhere" means nowhere, not "not in the obvious place."Why this keeps happening
src/deploy/suites are wired individually, by name. A new suite is therefore never picked up automatically, and an omission produces no failure — nothing fails when a test file is simply never named. That is the property#4363calls out forbin/: "Each omission it catches is individually invisible."Two live instances already found this way:
test_entrypoint_system_gitconfig.shwas wired into nothing and had never run in CI. Found incidentally during 🔍 analysis: four CI guards this week could not fail — assert properties, not shapes #5388 and registered there; it passes 10/0, so nothing was broken — but nothing was being checked either.test_hive_snapshot_unit_contract.shmerged in [sec-check] fix(systemd): guard hive-snapshot.service against planted /tmp checkout (#5483) #5499 without registration and would never have run. Caught only because a duplicate PR (🔒 fix(security): stop hive-snapshot.service executing code planted under /tmp (#5483) #5503) happened to include the registration; see 🐛 #5483 shipped incomplete: snapshot unit test is unregistered in CI, and ProtectHome=read-only may break the push path #5504.Both are the same failure as the guards #5388 catalogues: something that reads as coverage while asserting nothing. A test file present in the tree looks like a test that runs.
Proposed
Extend the
#4363guard, or add a sibling, asserting everysrc/deploy/test_*.shis referenced by at least one workflow under.github/workflows/. Referenced anywhere is the right bar — four of the five above are correctly placed in specialised lanes, and requiringv2-ci.ymlspecifically would produce false failures.Acceptance
test_entrypoint_symlinks.shis genuinely unwired — demonstrate that, then wire the suite and show it pass. Per 🔍 analysis: four CI guards this week could not fail — assert properties, not shapes #5388's standard, a guard that has only ever been observed passing is not evidence.src/deploy/test_*.shfails CI.v2-ci.ymlworkflow passes.test_entrypoint_symlinks.shis wired somewhere, or deleted if obsolete — deciding which requires reading it.Refs #4363, #5388, #5504