ci: run unit tests before releases

[jamiekostelac-cyber]

Fixes #679

Add a reusable cross-platform unit-test workflow for pull requests, pushes to main, and release calls. The release workflow now gates PyPI publishing on the test job. Add the pytest optional dependency and document the local command.

Verification:

• Workflow YAML parse: passed
• Unit suite: 266 passed, 1 skipped
• Fresh independent Luna audit: PASS

---

Summary by cubic

Fixes #679 by adding a reusable unit-test workflow that gates releases on the unit suite. The workflow runs on Linux, macOS, and Windows for Python 3.11 and 3.12 on PRs, main pushes, and release calls, and the PyPI publish job now waits for these tests. Also adds pytest as a test optional dependency, documents local testing in CONTRIBUTING.md, installs the mcp extra in the test job, and makes test mocks Windows-compatible.

^{Written for commit 4453443. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 4 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/test.yml">

<violation number="1" location=".github/workflows/test.yml:16">
P1: Adding `windows-latest` makes this workflow fail before collecting tests: `tests/unit/test_admin.py` monkeypatches Unix-only `os.killpg`, which does not exist on Windows. Because `release.yml` makes `publish` depend on this matrix, every release is blocked until those POSIX-only tests are guarded or made Windows-safe.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[jamiekostelac-cyber]

Review follow-up: the Windows P1 is addressed in commit 4453443. All four Unix-only os.killpg monkeypatches now use raising=False, so the Windows test module can collect without requiring that attribute. The current Cubic check, GitGuardian, and skill-review checks pass. Local verification with both extras: 268 passed. The release gate remains protected by the six-job matrix timeout.

[jamiekostelac-cyber]

@codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[jamiekostelac-cyber]

titan-review-substitute bot=codex sha=4453443f7596d085aab8dd4e52c9be018b2ed7bd tool=codex-cli

[jamiekostelac-cyber]

The test workflow run 35897798753 for head 4453443 is still action_required and ran no jobs. Could a repository admin approve the run so CI can collect its test evidence?

[jamiekostelac-cyber]

Correction: GitHub documents workflow approval as an action available to repository maintainers with write access; an administrator is not necessarily required. The current ask is for any maintainer with write access to approve run 35897798753. Source: https://docs.github.com/en/actions/how-tos/manage-workflow-runs/approve-runs-from-forks