ci: run unit tests before releases

[jamiekostelac-cyber]

Fixes #679

Add a reusable cross-platform unit-test workflow for pull requests, pushes to main, and release calls. The release workflow now gates PyPI publishing on the test job. Add the pytest optional dependency and document the local command.

Verification:

• Workflow YAML parse: passed
• Unit suite: 266 passed, 1 skipped
• Fresh independent Luna audit: PASS

---

Summary by cubic

Fixes #679 by adding a reusable unit-test workflow that gates releases on the unit suite. The workflow runs on Linux, macOS, and Windows for Python 3.11 and 3.12 on PRs, main pushes, and release calls, and the PyPI publish job now waits for these tests. Also adds pytest as a test optional dependency, documents local testing in CONTRIBUTING.md, installs the mcp extra in the test job, and makes test mocks Windows-compatible.

^{Written for commit 4453443. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 4 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/test.yml">

<violation number="1" location=".github/workflows/test.yml:16">
P1: Adding `windows-latest` makes this workflow fail before collecting tests: `tests/unit/test_admin.py` monkeypatches Unix-only `os.killpg`, which does not exist on Windows. Because `release.yml` makes `publish` depend on this matrix, every release is blocked until those POSIX-only tests are guarded or made Windows-safe.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

P1: Adding windows-latest makes this workflow fail before collecting tests: tests/unit/test_admin.py monkeypatches Unix-only os.killpg, which does not exist on Windows. Because release.yml makes publish depend on this matrix, every release is blocked until those POSIX-only tests are guarded or made Windows-safe.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/test.yml, line 16:

<comment>Adding `windows-latest` makes this workflow fail before collecting tests: `tests/unit/test_admin.py` monkeypatches Unix-only `os.killpg`, which does not exist on Windows. Because `release.yml` makes `publish` depend on this matrix, every release is blocked until those POSIX-only tests are guarded or made Windows-safe.</comment>

<file context>
@@ -0,0 +1,28 @@
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        python-version: ["3.11", "3.12"]
+    steps:
</file context>

[jamiekostelac-cyber]

Review follow-up: the Windows P1 is addressed in commit 4453443. All four Unix-only os.killpg monkeypatches now use raising=False, so the Windows test module can collect without requiring that attribute. The current Cubic check, GitGuardian, and skill-review checks pass. Local verification with both extras: 268 passed. The release gate remains protected by the six-job matrix timeout.