No test suite and no CI

[fahadsiddiqui]

Summary

The repository has no tests, no test fixtures, and no CI. go vet and go build pass, which is the entire current quality signal — and every issue filed alongside this one is a behavioural bug that a test would have caught.

Why this is the blocking issue

The bug list splits into two kinds:

• Pure functions, testable today: calculateFilePriority (Substring/suffix keyword matching mis-scores originals (copyright, template, attempt, renew) #8, Multi-part extensions (.tar.gz) defeat numbered-copy detection #9, Numeric suffixes in real filenames misread as copy numbers (IMG_1234, report-2024) #10).
• Everything else, currently untestable: findDuplicates (main.go:235-335) scans, decides, formats, and prints in a single function that returns only error. There is no way to assert on its results without capturing stdout and parsing prose — and the output is nondeterministic anyway (Report ordering is nondeterministic (map iteration), blocking snapshot tests #11).

So the order of work is forced: extract a pure scan(dir) (*Report, error) (#13) and make ordering deterministic (#11), then the rest of the fixes can be driven test-first.

Proposed structure

main.go              # CLI wiring only
priority.go          # calculateFilePriority + tests
scan.go              # scan() -> *Report, no printing
report.go            # presentation: text + JSON
shellquote.go        # per-platform quoting (#4)
testdata/            # fixture trees

Test layers

1. Unit — priority scoring. Table-driven over the names in Substring/suffix keyword matching mis-scores originals (copyright, template, attempt, renew) #8/Multi-part extensions (.tar.gz) defeat numbered-copy detection #9/Numeric suffixes in real filenames misread as copy numbers (IMG_1234, report-2024) #10, split into "is a copy" and "is an original".
2. Unit — shell quoting. Hostile filenames ($(cmd), backticks, ", ', \, newline, leading -) asserted to round-trip through each target shell's parser. Highest-value tests in the suite, given Security: generated deletion commands are unsafely quoted (command injection via filename) #4.
3. Integration — scan over fixtures. t.TempDir() trees covering duplicates, ties, empty files, symlinks, hard links, multi-part extensions. Assert on the returned Report struct.
4. Golden files — report rendering. Snapshot text and JSON output; depends on Report ordering is nondeterministic (map iteration), blocking snapshot tests #11.
5. Skip guards. Symlink and hard-link tests need runtime.GOOS guards for Windows.

CI

GitHub Actions on push and PR: go build, go vet, gofmt -l (fail if non-empty), go test -race -cover ./..., across linux/macos/windows since the deletion-command generation is per-platform and currently has zero coverage on any of them.

Suggested first step

Land the scan() extraction with golden-file tests over the current (correct) duplicate-detection behaviour before changing any scoring rules. That pins down what already works and turns every subsequent fix into a visible, reviewable diff in expected output.