Add pull-request test workflow with least-privilege token permissions

.github/workflows/tests.yml

@@ -0,0 +1,41 @@
+name: Tests
+
+on:
+  pull_request:
+
+jobs:
+  test:
+    name: Run tests
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.x"
+
+      - name: Install package
+        run: python -m pip install -e . coverage
+
+      - name: Prepare local SSH server and key
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y openssh-server
+          sudo service ssh start
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          ssh-keygen -t rsa -N "" -f ~/.ssh/id_rsa
+          cat ~/.ssh/id_rsa.pub > ~/.ssh/authorized_keys
+          chmod 600 ~/.ssh/authorized_keys
+          ssh -o StrictHostKeyChecking=no localhost 'echo localhost ssh ok'
+
+      - name: Run tests with coverage
+        run: python -m coverage run -m unittest discover
+
+      - name: Print coverage report
+        run: python -m coverage report

.gitignore

@@ -2,6 +2,7 @@
 *.pyc
 *.pyo
 .pydevproject
+.coverage
 test/.coverage
 .activate
 .vscode

tests/test_integraiton.py

@@ -4,6 +4,7 @@
 import os
 import shutil
 
+@unittest.skipUnless(shutil.which('condor_submit'), 'condor_submit not found')
 class TestIntegration(unittest.TestCase):
 
     expected = None