[quality] test: unit coverage for .github/scripts/check-k0s-version.py (read, scalar, expand, main fail-closed branches)

[kubestellar-hive]

Test Improvement

Adds tests/unit/test_check_k0s_version.py — 42 pytest cases for .github/scripts/check-k0s-version.py.

Claimed ground (files / functions)

• New file: tests/unit/test_check_k0s_version.py (only file touched — no production code)
• Script under test: .github/scripts/check-k0s-version.py
• Functions covered: read(), scalar(), expand(), fail(), main(), plus SAFE_VERSION_RE and LITERAL_VERSION_RE
• Cluster: k0s version-axis invariant gate (include/k0s.yml -> elements/k0s/k0s-bin.bst, elements/oci/k0s-sysext.bst, files/k0s/sysext/extension-release.k0s, files/os/sysupdate.d/70-k0s.transfer)

Why

The script is a gate: Justfile validate runs it and .pre-commit-config.yaml registers it as the check-k0s-version hook. It had no direct test. tests/unit/test_k0s_version.py only asserts the repository files current contents and never executes the script, so any of its ~12 fail-closed rejection paths could regress to fail-open unnoticed and the k0s sysext would silently stop updating.

Coverage added

• read() — contents returned; missing file exits with a repo-relative path
• scalar() — double- and single-quoted values, unquoted value rejected, missing name exits
• expand() — literal passthrough, nested substitution, undefined reference, circular reference
• fail() — problem and fix both surfaced
• Both module-level regexes, including that a %{...} reference is not treated as a literal version
• main() passing path, and the comment-line exemption in the literal-version scan
• main() rejections: non-filename-safe version; missing source url:; hardcoded upstream tag in the URL; missing FNAME; FNAME on the OS %{release-version} axis; FNAME not derived from %{k0s-version}; missing generated VERSION_ID=; hardcoded VERSION_ID= in extension-release.k0s (flush and indented); literal k0s version in each of the three consumers; missing MatchPattern; MatchPattern without the .zst suffix; prefix, suffix and over-capture drift between FNAME and the sysupdate @v wildcard

Verification

python3 -m pytest tests/unit -q -> 170 passed, 1 xfailed (42 new).

Disjointness

Checked against the open-PR snapshot. The only open server PR is #27 ([scanner] fix: enable PXE DDI downloads), which touches the installer/PXE export path, not the k0s version gate or tests/unit/. No other open PR names check-k0s-version.py or tests/unit/test_check_k0s_version.py.

---

Filed by quality agent (hold-gated mode). Human review required — do not merge without review.

— hive: agent=quality backend=copilot model=claude-opus-5

[castrojo]

Quality pass review: verified 42 unit test cases covering .github/scripts/check-k0s-version.py edge cases and fail-closed validation paths. CI checks passed. Ready to merge.