Nothing requires that a tests/release/*.test.sh is actually invoked by a gate

[vladimirrott]

tests/release/database-path-agreement.test.sh was in the tree, correct, and wired into nothing. Zero references in ci.yml, e2e.yml, release.yml or scripts/ci-local.sh, and it never had any since the day it was added.

It guards a real past defect: the installer and the daemon resolving different SQLite paths, which splits the audit chain in two and leaves audit verify reading a store nothing writes to. Reverting the installer's path resolution to the old value left every required check green.

#330 wires that one file in. The gap it exposes is not that one file.

The gap

scripts/check_repo_completeness.sh checks that required files exist. Nothing checks that a release test is reachable from a gate, so adding tests/release/foo.test.sh and forgetting the two lines in ci.yml and ci-local.sh produces a test that runs only when someone types its name. There is no error, no warning, and the file looks maintained.

Same shape as #278: an artifact that is correct and unread.

Scope

A check that, for every tests/release/*.test.sh, the filename appears in at least one of .github/workflows/ci.yml, .github/workflows/e2e.yml, .github/workflows/release.yml or scripts/ci-local.sh.

Two details that decide whether it is worth having:

• It must fail when the glob comes back empty. A broken glob passes over zero files and reports success, which is the same defect the check exists to catch, one level up. That shape has shipped in this repository before: see Five hygiene guards exit 1 with no output when their grep anchor moves #347 and Four more hygiene guards exit 1 with no output when their anchor moves #355, where nine guards exited 1 with no output because a grep that matched nothing killed the script before its own diagnostic could run.
• Path-filtered jobs count as wired. e2e.yml only runs on some paths, and a test reachable only from there is still reachable.

Worth extending the same idea to tests/e2e/*.test.sh, which has the same exposure.

Tests first

Add a tests/release/foo.test.sh that nothing invokes and watch the new check name it. Then delete the ci.yml line for an existing one and watch it name that. Both directions, because a check that only fires on a new file misses the deletion case, which is how this one got lost.

Difficulty

easy. One shell script and two lines of wiring, and the derivation is a glob plus a grep.

Getting started

CONTRIBUTING.md has the build and test commands. bash scripts/ci-local.sh runs the whole board locally. No CLA and no copyright waiver. The project is MIT.

[vladimirrott]

@ITSMERNB this one is yours if you want it, and it is close to your #262.

tests/release/database-path-agreement.test.sh sat in the tree, correct, and wired into nothing. #330 wired that one file in. The gap it exposed is that nothing checks the others, so the next release test someone adds and forgets to wire is invisible in exactly the same way.

Your #262 fixed an assertion that could not fail. This is the same defect one level up: a whole test that never runs. no-secrets.test.sh, the file you fixed, is one of the ones that would go quiet if its two wiring lines were deleted, and nothing today would say so.

The two details in the body are the ones that decide whether the check is worth having: it has to fail on an empty glob rather than pass over zero files, and it has to catch a deleted wiring line as well as an unwired new file. A check that only fires on a new file misses the direction this bug actually arrived from.

Say so here and I will mark it claimed. No rush, and #328 comes first.

[ITSMERNB]

Thanks. #328 is merged now. #331 is the better next fit; I will verify the gate wiring path first and only claim it once I know I can carry it through cleanly.

[vladimirrott]

@be-student held this for you as a follow-up to your #376. You just wired a release test into a gate, so you already have the map for this one. No pressure, and no deadline. Reply here that you want it and it is formally yours.

[be-student]

I’ll take this one—thank you for reserving it. I’ll add a completeness check that proves every release test is reachable from at least one gate, fails when no release tests are discovered, and has hermetic regressions for both gaps.

[vladimirrott]

@be-student one data point for #377, from an audit sweep at b2c823e6. Every release test is currently reachable from a gate:

$ for f in tests/release/*.test.sh; do b=$(basename "$f"); if ! grep -rqF "$b" .github/workflows/ scripts/ci-local.sh; then echo "UNWIRED: $b"; fi; done
$ ls tests/release/*.test.sh | wc -l
24

Twenty-four files, nothing unwired, including the one that started this:

$ grep -rn 'database-path-agreement' .github/workflows/ scripts/ci-local.sh
.github/workflows/ci.yml:87:        run: bash tests/release/database-path-agreement.test.sh

So your check goes green the moment it lands, which is the comfortable outcome and also the dangerous one. A guard that has never been observed to fail is indistinguishable from a guard that cannot fail, and the tree can no longer tell you which you wrote. Both fixtures under Tests first in the body are doing the entire job: the unwired new file, and the deleted ci.yml line for an existing one.

The empty-glob case matters just as much here. With twenty-four files and zero failures, a glob that silently selects nothing produces the same output as a clean pass.

No change to what the issue asks for, and no rush.