From 507dc887b24d25c4a2857c87036f69f7321e5020 Mon Sep 17 00:00:00 2001
From: quick <quick@ricon.family>
Date: Tue, 16 Jun 2026 15:33:14 -0400
Subject: [PATCH] ci: add hosted validation workflow

---
 .github/workflows/test.yml | 48 ++++++++++++++++++++++++++++++++++++++
 mise.toml                  |  1 +
 test/test_helper.bash      | 16 +++++++++++++
 3 files changed, 65 insertions(+)
 create mode 100644 .github/workflows/test.yml

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..e7d4c21
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,48 @@
+name: Test
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  GH_TOKEN: ${{ github.token }}
+  GITHUB_TOKEN: ${{ github.token }}
+  MISE_JOBS: 1
+
+jobs:
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up mise
+        uses: jdx/mise-action@v4
+        with:
+          install: true
+
+      - name: Install git-crypt backend
+        run: rudi install
+
+      - name: Check whitespace
+        run: git diff --check
+
+      - name: Run tests
+        run: mise run test
+
+      - name: Run codebase lints
+        run: codebase lint "$PWD"
+
+      - name: Check README.md is up to date
+        uses: KnickKnackLabs/readme@v0.3.1
+        with:
+          check: true
diff --git a/mise.toml b/mise.toml
index 6ae170c..f09c238 100644
--- a/mise.toml
+++ b/mise.toml
@@ -25,4 +25,5 @@ lint = [
   "shellcheck",
   "gum-table",
   "caller-pwd-contract",
+  "github-actions",
 ]
diff --git a/test/test_helper.bash b/test/test_helper.bash
index 238f270..5b90d37 100644
--- a/test/test_helper.bash
+++ b/test/test_helper.bash
@@ -8,6 +8,14 @@ REPO_DIR="$(cd "$BATS_TEST_DIRNAME/.." && pwd)"
 # points at a different repo.
 eval "$(cd "$REPO_DIR" && mise env)"
 
+# Tests create and commit in many temporary repos, including cloned module repos
+# that do not inherit local fixture git config. Provide a deterministic identity
+# without relying on a developer or CI runner's global git config.
+export GIT_AUTHOR_NAME="${GIT_AUTHOR_NAME:-modules tests}"
+export GIT_AUTHOR_EMAIL="${GIT_AUTHOR_EMAIL:-modules-tests@example.invalid}"
+export GIT_COMMITTER_NAME="${GIT_COMMITTER_NAME:-modules tests}"
+export GIT_COMMITTER_EMAIL="${GIT_COMMITTER_EMAIL:-modules-tests@example.invalid}"
+
 # Run a modules task through mise.
 modules() {
   if [ -z "${MODULES_CALLER_PWD:-}" ]; then
@@ -18,6 +26,12 @@ modules() {
 }
 export -f modules
 
+configure_test_git_identity() {
+  local path="$1"
+  git -C "$path" config user.name "modules tests"
+  git -C "$path" config user.email "modules-tests@example.invalid"
+}
+
 # Create a local "remote" repo with some commits.
 # Usage: create_remote_repo <path>
 # Returns: the path, with a repo containing 2 commits.
@@ -25,6 +39,7 @@ create_remote_repo() {
   local path="$1"
   mkdir -p "$path"
   git -C "$path" init -b main
+  configure_test_git_identity "$path"
   git -C "$path" commit --allow-empty -m "initial commit"
   echo "hello" > "$path/README.md"
   git -C "$path" add README.md
@@ -37,6 +52,7 @@ create_parent_repo() {
   local path="$1"
   mkdir -p "$path"
   git -C "$path" init -b main
+  configure_test_git_identity "$path"
   git -C "$path" commit --allow-empty -m "initial commit"
 }