Add pull-request test workflow with least-privilege token permissions

[Copilot]

This PR adds GitHub Actions coverage for pull requests by introducing a dedicated test workflow. It runs the repository’s CI-safe unittest modules on every PR and hardens workflow security with explicit minimal token permissions.

• New PR test workflow

  • Added .github/workflows/tests.yml triggered on pull_request.
  • Defines a single test job on ubuntu-latest with Python setup and editable install.

• Test execution scope

  • Runs targeted unittest modules that are stable in standard GitHub-hosted runners:
    • tests.test_job
    • tests.test_node
    • tests.test_templates
    • tests.test_workflow
    • tests.test_remote_reuse

• Runtime environment prep

  • Adds SSH key/bootstrap step required by the remote-related test paths in the selected suite.

• Workflow security posture

  • Sets explicit job-level permissions:
    • contents: read

on:
  pull_request:

jobs:
  test:
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
      - run: python -m pip install -e .
      - run: python -m unittest tests.test_job tests.test_node tests.test_templates tests.test_workflow tests.test_remote_reuse

[Copilot]

Pull request overview

This PR introduces a dedicated GitHub Actions workflow to run a CI-safe subset of the project’s unittest suite on every pull request, while explicitly constraining the workflow token permissions to least privilege.

Changes:

• Added a new pull_request-triggered workflow that sets up Python and runs selected unittest modules.
• Added a bootstrap step intended to support remote/SSH-related test paths.
• Hardened workflow security by explicitly setting contents: read token permissions at the job level.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.