Add a test suite; the repo had zero tests

[jfmercer]

CI proved that shell parses (zsh -n, shellcheck, py_compile) and that chezmoi apply is idempotent. Nothing asserted that a single line of this code behaves correctly. 112 tests now do — 69 bats + 43 stdlib unittest, run by ./tests/run and gated by a new matrixed CI job.

Coverage is deliberately uneven

The git-* helpers are 1–13 line wrappers around one git command each; testing them would only restate them, so they have none. Effort went where a bug is invisible or dangerous:

Suite	Tests	Why it earns its keep
secret.bats	28	shell_quote's output is eval'd by every interactive shell via eval "$(secret env)" in ~/.localrc. A quoting bug there is code execution at shell startup, not a formatting nit. 13 adversarial values round-tripped through eval in bash and zsh, compared byte for byte.
herdr_reload_all.bats	15	Reloading an agent pane types reload into a running agent's prompt. The select(.agent == null) filter that prevents it is asserted by pane id.
templates.bats	12	The traps CLAUDE.md documents, several of which already bit once.
invariants.bats	14	Cross-file contracts no linter can see.
test_bump_deps.py	43	A fixture repo makes check_invariants()'s violation branches reachable — --self-test cannot reach them without corrupting the real files.

The zsh leg of the quoting test matters: bin/secret rejects printf %q precisely because $'...' is not portable, and only a second-shell test defends that reasoning.

The suite found a real bug

bin/herdr-reload-all's || true guards only the first jq call. Plain-text output from herdr pane list sailed past it as an empty error code, then died in the reload pipeline with a raw jq: parse error and exit 5 via pipefail — exactly the leaked-internals failure the protocol_mismatch branch exists to prevent. Fixed by validating the envelope up front, plus // [] so a result with no panes key is a quiet no-op rather than "cannot iterate over null".

Choices worth reviewing

• bats-core is pinned to an exact release tarball with its sha256 verified, for the same reason shellcheck is: Ubuntu's apt bats trails Homebrew's by several minors and they disagree about which helpers exist. bump-deps tracks the tag as a VERSION pin so it can't rot; the checksum sits beside it in ci.yaml and is checked at install time, so a bumped tag with a stale hash fails loudly rather than silently skipping verification.
• Python tests are stdlib unittest — keeps bump-deps' documented "no pip dependencies" promise and adds no install step.
• security and herdr are stubbed; jq is not. security is macOS-only, so without a stub none of bin/secret could be tested on Ubuntu — and a test suite must not reach a real login keychain even by accident ($SECRET_ACCOUNT/$SECRET_ENV_NAME are throwaway values as a second line of defense). But herdr-reload-all's behavior largely is its jq filters, so stubbing jq would test nothing.
• Two production files gained a sourced-guard so tests can call individual functions. if/then, not [ ... ] && main "$@" — the latter leaves a non-zero status when sourced and set -e kills the caller. herdr-reload-all's dependency checks moved inside main() for the same reason.
• CI asserts nothing skipped. A missing jq/zsh/chezmoi makes tests skip rather than fail — deliberate, so the suite runs on a half-configured laptop — but on a runner a skip means the job silently tested less than it claims.

Three of my planned assertions were wrong

Worth flagging since they came out of reading CLAUDE.md:

• verbose is deliberately false, and the rendered config has legitimate # comments. The real guard is anchored ^key: matching plus a check that no comment line swallowed a key.
• zsh/exports.zsh:27 does export TERM — inside a guard that fires only when zsh/terminfo reports zero capabilities. Sanctioned; the test anchors at column zero to catch only an unguarded export. CLAUDE.md's flat "TERM is deliberately not set anywhere" is now slightly stale — left alone rather than edited unasked.
• The # tmux: comments in the herdr config include prose lines, so parsing them yields false failures. The parity test uses a curated table instead.

Verification

112 tests pass. shellcheck, zsh -n, py_compile, bump-deps --self-test and chezmoi status --exclude=scripts all still clean, and tests/ is unmanaged.

A test that cannot fail is worse than no test, so each was checked against a deliberate breakage — neutering shell_quote's sed, removing the agent filter, raising .chezmoiversion above install.sh's, dropping bin/ from .chezmoiignore, drifting HOMEBREW_CASK_OPTS, swapping get . "work" for .work, making env-import print values, making the version compare lexical. All nine turn the suite red. The ninth initially survived: dropping the , 1 bound in replace_value is unobservable with the current pin set, since no pattern's match contains its value twice — so a test with a synthetic pin was added to make that bound observable rather than leave it unspecified.

The first commit is a small unrelated spelling fix (colours → colors in a comment). dot_tmux.conf's colour235 is tmux's own option syntax and LICENSE.md is verbatim GPL, so neither was touched.

---

What CI caught that local runs did not

Two follow-up commits, both worth reading as evidence the gating works:

1. b978334 — the "every chezmoiscripts template renders" test rendered with no --config, so it silently used whatever ~/.config/chezmoi/chezmoi.yaml my machine had. A fresh runner has installed chezmoi but never run chezmoi init, so .set_git_to_ssh and .install_linux_apps were missing and two templates failed to render. Now rendered against the config .chezmoi.yaml.tmpl itself generates. Re-verified locally with HOME/XDG_CONFIG_HOME pointed at an empty directory — a far better CI proxy than a configured laptop, and the check that should have caught this before the first push.

2. 796e395 — the "assert nothing was skipped" guard fired on its first real outing:

   ok 31 shell_quote: ... round-trips through zsh eval # skip zsh not installed
   

   Ubuntu runners ship neither jq nor zsh. Without that guard the job would have reported green while the single most valuable test in the suite quietly opted out — and the bash leg does not prove the zsh leg, which is the entire reason bin/secret hand-rolls its quoting instead of using printf %q. Both tools are now installed in the job.

All 9 checks pass on the final commit (796e395): lint, test, apply and bootstrap across macOS + Ubuntu, plus secrets.