test(system.just): BATS coverage for toggle-testing, toggle-vms, install-system-flatpaks by kubestellar-hive[bot] · Pull Request #1031 · projectbluefin/common

kubestellar-hive · 2026-08-28T06:08:51Z

Cluster claimed

File under test: system_files/bluefin/usr/share/ublue-os/just/system.just
Recipes: toggle-testing, toggle-vms, install-system-flatpaks
Files changed: tests/test_system_just.bats (new), Justfile (one line)

No other file is touched. In particular this PR does not modify
.github/workflows/unit-tests.yml — see Known follow-up below.

Why

system.just is 388 lines and the largest file in the repo with zero test
coverage. toggle-testing builds the image ref passed to
bootc switch --enforce-container-sigpolicy; a wrong channel mapping moves a
user's machine to the wrong image, and today nothing catches that.

What

tests/test_system_just.bats extracts each recipe body from the justfile into a
standalone script and runs it against mocked jq, gum, pkexec, bootc,
flatpak, brew and just. Nothing on the host is read or written. 24 tests:

Recipe	Tests	Covers
`toggle-testing`	14	stable/latest → testing; lts → lts-testing; lts-hwe → lts-hwe-testing; testing → stable; lts-testing → lts; lts-hwe-testing → lts-hwe; unknown channel exits 1 with no switch; transport-prefix stripping (`ostree-image-signed:docker://`, `ostree-unverified-registry:`, bare ref); both declined prompts are no-ops; switch goes through `pkexec`
`toggle-vms`	6	install when absent / remove when present; QEMU extension included in removal; only the session `uri_default` line stripped from `libvirt.conf`; declined prompts are no-ops
`install-system-flatpaks`	4	`confirm=0` skips the prompt, `confirm=1` requires it; declining installs nothing; `TARGET_FLATPAK_FILE` override honoured

The lts-testing → lts and lts-hwe-testing → lts-hwe cases specifically pin
the ${IMAGE_TAG/-testing/} branch, which must not collapse the LTS channels
down to stable.

Verification

$ bats tests/test_system_just.bats
1..24
ok 1 .. ok 24

Mutation-checked: flipping the lts-hwe mapping to testing fails the suite,
so the tests bite rather than merely execute.

Known follow-up — CI wiring

The new file is wired into just test, but not into
.github/workflows/unit-tests.yml: the hive App token lacks the workflows
permission and GitHub rejects the push. A maintainer adding this one step makes
it run in CI:

      - name: Run bats (system.just)
        run: bats tests/test_system_just.bats

Same blocker applies to #968 (9 test files already in tests/ and in
just test that unit-tests.yml never runs — all 95 of those tests were
confirmed passing locally while investigating this).

Overlap check

Compared against every open PR in the snapshot. Nearest neighbours:

fix(ci): unit-tests.yml add permissions block (contents: read) #961 ([sec-check] permissions block) and fix(ci): declare top-level permissions: {} in e2e.yml pr-e2e.yml promotion-candidate-e2e.yml #969/fix(brew): use valid brew tap trust commands #978/feat: add richer Bluefin fastfetch colors #980/fix: add consistent bootc sudo policy #932 — none
touch system.just, tests/ or the Justfile. fix(ci): unit-tests.yml add permissions block (contents: read) #961 edits
unit-tests.yml, which this PR deliberately leaves alone, so there is no
conflict.
No open PR in any authorized repo tests system.just recipes.

Disjoint.

Filed by the quality agent (hold-gated mode). Human review required — do not merge on my account.

— hive: agent=quality backend=copilot model=claude-opus-5

…install-system-flatpaks system_files/bluefin/usr/share/ublue-os/just/system.just is the largest untested file in the repo — 388 lines, zero tests — and toggle-testing is the recipe that computes the ref handed to `bootc switch`. A mistake in its channel mapping moves a user's machine onto the wrong image, and nothing in the repo would catch it. tests/test_system_just.bats extracts each recipe body out of the justfile into a standalone script and runs it against mocked jq/gum/pkexec/bootc/ flatpak/brew/just, so no host state is touched. 24 tests: toggle-testing (14) - stable/latest -> testing, lts -> lts-testing, lts-hwe -> lts-hwe-testing - testing -> stable, lts-testing -> lts, lts-hwe-testing -> lts-hwe (guards the ${IMAGE_TAG/-testing/} path that must not collapse to "stable" for the LTS channels) - unrecognised channel exits 1 and issues no switch - transport-prefix stripping for ostree-image-signed:docker:// and ostree-unverified-registry:, plus a bare registry ref - declining either gum confirm switches nothing - the switch is issued through pkexec toggle-vms (6) - installs when virt-manager is absent, removes when present - removal covers the QEMU extension and strips only the session uri_default line from libvirt.conf - both declined prompts are no-ops install-system-flatpaks (4) - confirm=0 skips the prompt, confirm=1 requires it - declining installs nothing - TARGET_FLATPAK_FILE overrides the default Brewfile Wired into `just test`. The extractor asserts a non-empty recipe body so a rename fails loudly instead of silently testing nothing. Verified by mutation: flipping the lts-hwe mapping fails the suite. The unit-tests.yml step is deliberately not in this PR — see the PR body. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: kubestellar-hive[bot] <kubestellar-hive[bot]@users.noreply.github.com>

hanthor

New tests/test_system_just.bats (24 cases) for toggle-testing, toggle-vms, install-system-flatpaks, including the lts/lts-hwe vs. stable collapse-prevention cases and libvirt.conf uri_default stripping. CI test green; validate fails only on title-lint.

Generated by Claude Code

castrojo

Review: PR #1031 (`[quality] test(system.just): BATS coverage for toggle-testing, toggle-vms, install-system-flatpaks`)

Findings

Scope and Implementation:
- Adds 24 BATS tests in tests/test_system_just.bats covering toggle-testing (both directions, collapse-prevention for lts/lts-hwe), toggle-vms (install/remove paths, libvirt.conf cleanup), and install-system-flatpaks (prompting, file overrides).
- Clean recipe extraction and mocking without modifying production code or executing host changes.
Verification:
- CI suite passes (validate, test, Build, PR E2E).

Verdict

Approved.

…boot-key, toggle-user-motd, check-local-overrides, check-idle-power-draw, benchmark (projectbluefin#1048) ## Test Improvement Adds `tests/test_default_just.bats` — 23 BATS tests for `system_files/shared/usr/share/ublue-os/just/default.just`. Before this PR, exactly one of the file's 12 recipes was under test (`clean-system`, via `tests/test_clean_system_podman_path.bats`). The rest had zero coverage, including a firmware reboot and a Secure Boot MOK enrollment. ### Recipes claimed by this PR | Recipe | What is covered | |---|---| | `bios` | legacy-BIOS guard exits 1 and never reboots; EFI + confirm issues `systemctl reboot --firmware-setup`; declined confirmation does not reboot | | `bios-info` | all four `dmidecode -s` fields read under `sudo bash`; every field is labelled | | `enroll-secure-boot-key` | `mokutil --timeout -1` precedes the import; `akmods-ublue.der` is the imported cert; enrollment password guidance is printed | | `toggle-user-motd` | shim body is exactly `uwelcome toggle` | | `check-local-overrides` | only-in-`/etc` reporting; content divergence reporting; silence when trees match; `NO_COLOR=1` palette suppression; palette applied when unset; identity/credential `--exclude` set | | `check-idle-power-draw` | missing-`powerstat` guard exits 1 without invoking it; present path runs `powerstat -a -r` | | `benchmark` | `stress-ng` present runs the 1m matrix load without touching brew; accept path runs `brew install`/`brew link` then the load; decline path exits 0 with no install | ### Method Each shebang recipe body is extracted verbatim from `default.just` and executed against stubbed `gum`, `sudo`, `systemctl`, `dmidecode`, `mokutil`, `powerstat`, `stress-ng`, `brew`, and `uwelcome`. `/sys/firmware/efi` and the `/usr/etc /etc` diff operands are redirected into a sandbox with `sed`, so real control flow is exercised instead of grepped. `sudo` execs its argv so the `sudo bash <<EOF` heredocs run against the same stubs. ### Incidental finding pinned, not fixed `check-local-overrides` hardcodes `diff --color="always"`. `NO_COLOR=1` therefore suppresses only the palette the recipe applies itself with `sed`; `diff`'s own ANSI escapes still reach the terminal. One test documents that current behaviour so a future fix is visible. No production code is changed by this PR. ### Disjointness Explicitly claims only the seven recipes listed above in `default.just`, plus the new test file. - `device-info` (`default.just`) — **left to PR projectbluefin#1003**, not touched or asserted on. - `clean-system` (`default.just`) — already owned by `tests/test_clean_system_podman_path.bats`. - `shared.just` — left to PR projectbluefin#1034. - `system.just` — left to PR projectbluefin#1031. - `apps.just` — left to PRs projectbluefin#978, projectbluefin#1007, projectbluefin#1018. - `changelog.just` / `ublue-image-repo` — left to PR projectbluefin#1045. `Justfile`: one line, `bats tests/test_default_just.bats`, inserted immediately after the existing `test_clean_system_podman_path.bats` line rather than appended to the end of the recipe, specifically so it does not collide with PR projectbluefin#1031's append at the tail of the same recipe. `.github/workflows/unit-tests.yml` is intentionally **not** modified — the hive App token lacks the `workflows` permission, and that wiring gap is tracked separately by common#968. ### Verification ``` $ bats tests/test_default_just.bats 1..23 ok 1 .. ok 23 ``` ## Related Issue Refs projectbluefin#968 (the workflow-wiring half of the gap remains open). --- *Filed by quality agent (hold-gated mode). Human review required.* — hive: agent=quality backend=copilot model=claude-opus-5 Signed-off-by: quality <sec-check[bot]@users.noreply.github.com> Co-authored-by: quality <sec-check[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

kubestellar-hive Bot added the hold Work is intentionally paused. label Aug 28, 2026

hanthor approved these changes Sep 2, 2026

View reviewed changes

castrojo changed the title ~~[quality] test(system.just): BATS coverage for toggle-testing, toggle-vms, install-system-flatpaks~~ test(system.just): BATS coverage for toggle-testing, toggle-vms, install-system-flatpaks Sep 6, 2026

castrojo closed this Sep 7, 2026

castrojo reopened this Sep 7, 2026

castrojo approved these changes Sep 10, 2026

View reviewed changes

castrojo added lgtm This PR has been approved by a maintainer and removed hold Work is intentionally paused. labels Sep 10, 2026

castrojo enabled auto-merge September 10, 2026 02:15

Merge branch 'main' into quality/system-just-bats-tests

42d3b20

castrojo added this pull request to the merge queue Sep 10, 2026

Merged via the queue into main with commit dff365d Sep 10, 2026
10 checks passed

castrojo deleted the quality/system-just-bats-tests branch September 10, 2026 02:29

Navigation Menu

Uh oh!

test(system.just): BATS coverage for toggle-testing, toggle-vms, install-system-flatpaks - #1031

test(system.just): BATS coverage for toggle-testing, toggle-vms, install-system-flatpaks#1031
castrojo merged 2 commits into
mainfrom
quality/system-just-bats-tests

kubestellar-hive Bot commented Aug 28, 2026

Uh oh!

hanthor left a comment

Uh oh!

castrojo left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

kubestellar-hive Bot commented Aug 28, 2026

Cluster claimed

Why

What

Verification

Known follow-up — CI wiring

Overlap check

Uh oh!

hanthor left a comment

Choose a reason for hiding this comment

Uh oh!

castrojo left a comment

Choose a reason for hiding this comment

Review: PR #1031 ([quality] test(system.just): BATS coverage for toggle-testing, toggle-vms, install-system-flatpaks)

Findings

Verdict

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Review: PR #1031 (`[quality] test(system.just): BATS coverage for toggle-testing, toggle-vms, install-system-flatpaks`)