[quality] test: add BATS unit tests for bootc-build/preflight/action.yml

[kubestellar-hive]

Test Improvement

Adds tests/bats/test_preflight.bats — 24 BATS cases covering the three inline run: blocks in bootc-build/preflight/action.yml, which previously had zero test coverage.

Step in action.yml	Behaviour covered
Normalize image reference	${INPUT_REGISTRY,,}/${GITHUB_REPOSITORY_OWNER,,} lowercasing into registry-lowercase; image-ref emitted only when image-name is non-empty; image name lowercased; embedded slash preserved; image-ref always prefixed by registry-lowercase; key=value shape of GITHUB_OUTPUT
Validate registry auth	podman login success → exit 0 + "Registry auth OK"; failure → ::error::Registry auth failed for <registry> + exit 1 and no success message; exact argv login <registry> -u <actor> --password-stdin; token arrives on stdin and never on the command line; 2>/dev/null suppression means podman stderr cannot leak to the job log; non-default registry named in the annotation
Validate required secrets	all present → exit 0, no ::error::; unset var and set-but-empty var both reported as missing; every missing name listed space-separated; present names not listed; whitespace around the comma list stripped (" ALPHA , BETA "); single-entry list; a var set to whitespace counts as present

podman is stubbed on PATH (recording argv + stdin, configurable exit code), so the suite needs no container runtime, registry, network, or credentials.

The three snippets under test are byte-for-byte copies of the action.yml run blocks, defined with quoted heredocs and machine-verified against the YAML — this follows the convention established in tests/bats/test_detect_changes.bats and tests/bats/test_create_manifest.bats, so the tests break if the action logic changes without updating them.

Picked up automatically by the existing bats job in .github/workflows/unit-tests.yml (tests/** path filter). No production code, workflow, or docs files are touched.

Verification

$ bats --print-output-on-failure tests/bats/test_preflight.bats
1..24
ok 1 .. ok 24   # all pass

Claimed ground / overlap check

Claims exactly one new file: tests/bats/test_preflight.bats, testing bootc-build/preflight/action.yml only.

Checked against every open hold-gated PR in this repo:

• actions#428 (quality) claims tests/bats/test_create_manifest.bats / bootc-build/create-manifest/action.yml — different action, different test file.
• actions#427 claims bootc-build/scan-image/action.yml, tests/bats/test_scan_image.bats, docs/skills/*.md — disjoint.
• actions#431 (architect) claims scripts/render_pr_body.py, scripts/render_gate_section.py, tests/conftest.py, tests/test_render_single_source.py — disjoint (Python, scripts/).
• actions#434 (sec-check) claims .github/actions/install-cosign/action.yml — disjoint.
• actions#435 claims docs/skills/*.md — disjoint; this PR deliberately edits no docs.
• actions#426 claims .github/workflows/pkg-cadence.yml — disjoint.
• No open PR in any other authorized repo touches bootc-build/preflight/ or tests/bats/.

Related Issue

Refs #429 (9 bootc-build composite actions with zero BATS coverage) — this PR covers preflight only; the tracker stays open for the remaining actions.

---

Filed by quality agent (hold-gated mode). Human review required — do not merge without review.

— hive: agent=quality backend=copilot model=claude-opus-5

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[hanthor]

BATS coverage for bootc-build/preflight/action.yml. Verified the embedded snippets match the live action file. Notably tests a real security property — that the registry token is only ever passed via stdin, never argv, and stderr is suppressed around it — not just happy-path coverage. CI green (5/5).

---

Generated by Claude Code