Run the test suites on every pull request and push

[namespaceMarcello]

./test/all has no workflow in this repository, while omarchy-iso and omarchy-pkgs run their suites on every pull request. This adds one for the CLI and shell suites, shaped like omarchy-iso's unit-test.yml: an Arch container that boots systemd, the two companion checkouts next to the repo, and the suite run by an ordinary user with no sudo. It takes about fourteen minutes on a standard runner.

The reason to want it is on quattro now. On October 11 three commits each broke a test file in an area they did not touch: 201de1c0 (power-test.sh), cf473b5c (shell-shortcuts-test.sh) and 14987189 (toggle-input-device-test.sh). Focused tests passed each time and nothing ran the rest. #15157, #15156 and #15158 fix those three.

Four details came out of running it rather than writing it, and each is explained where it sits in the file:

• Ubuntu's AppArmor restricts unprivileged user namespaces on the runner, in a privileged container too. Without the sysctl step fourteen tests of the root helpers (lock, sudoers, factory reset, fingerprint, the Windows VM mounts) skip and the suite stays green: 5742 assertions instead of 5799.
• Because that failure is silent, the job probes for user namespaces before the suite and stops with an error if they are missing.
• /run is mounted exec: agent-account-test.sh runs a file from XDG_RUNTIME_DIR and fails with Permission denied on Docker's default noexec tmpfs.
• The Arch image has newuidmap and newgidmap without their file capabilities, so shadow is reinstalled.

Trial runs on a fork, where a commit on top adds the trial branch to the push trigger and nothing else:

• On quattro at 4c1b4cb3: 5 of 384 test files fail, 5799 assertions pass. The five are the three above, default-agent-test.sh (Expect mise unuse -y in the Grok migration tests #14493 and Match Grok migration fixtures to noninteractive cleanup #14660 are open for it) and passwordless-grant-lifecycle-test.sh, which waits for a pre_remove in omarchy-pkgs.
• The same with Restore the toggle alias the Toggle menu shortcut uses #15156, Update the power test for the bar button's percentage label #15157 and Stub hl.get_windows in the input device toggle test #15158 merged in: 2 of 384 fail, 5822 pass.

34 tests skip in both. Most need a Wayland compositor; the others need Quickshell, Chromium, Kitty, qmltestrunner, a user manager, a hiddev device or the en_US.UTF-8 locale, none of which the container has.

Two things to weigh before merging. quattro is red today, so a run on any pull request based on it would fail the same way until those five files are fixed: this should land after them. And system-sleep-ownership-migration-test.sh picks between two symlinks in an order that depends on a random suffix, so it can fail a run by chance until #14829 is in; it passed in every trial run here.

#10181 also proposes a workflow for these suites. This one differs in booting systemd, allowing user namespaces and installing more of what the tests call, and it has been run.

Validation: the two runs linked above, and the same suite in a local container with systemd as PID 1, which gives the same counts file by file as the first of them.

Not checked: the pull_request and workflow_dispatch triggers, since the trial runs came from pushes; and the graphical acceptance suite, which this does not run.

Written by Claude Code (AI assistant) on behalf of @namespaceMarcello, who directs this work.

🤖 Generated with Claude Code

[greptile-apps]

Confidence Score: 5/5

[High impact] The latest changes appear safe to merge; no new blocking issue was found.

Summary

Adds an Arch-based workflow that runs ./test/all on pull requests, pushes to quattro, and manual starts.

• The CLI and shell suites now run on pull requests and quattro pushes.

_{Reviews (2) · Last reviewed commit: "Record the revisions a test run saw" · Reviewed by Greptile}

[jandrusk]

Nice, having ./test/all gate PRs would have caught the three Oct 11 breakages you fixed in #15156/#15157/#15158.

A few non-blocking thoughts:

• ghcr.io/archlinux/archlinux:latest and pacman -Syu mean a run depends on whatever Arch shipped that morning (Qt 6.12 is the obvious recent example). I'd consider pinning the image by digest, or at least logging pacman -Q for qt6-base/quickshell/lua next to the revisions you already record, so a red run can be traced to the package that moved.
• At ~14 min a run and the current PR volume here, this is a lot of runner time. Maybe add a paths-ignore for manual/** and *.md-only changes so docs PRs skip it.
• The security side looks right to me: pull_request (not _target), contents: read, persist-credentials: false, and the privileged container only lives on the ephemeral runner.