From d6e168da571cbaffb93f6f458ae05959b8dc15bb Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 21 Sep 2026 11:04:33 +0000
Subject: [PATCH] ci: run the t9 integration suite on every pull request
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Nothing under t/ had a CI job. ci.yml's `select` skips its jobs for a diff
that only touches t/, and no job invoked the test-subdir task, so the suite
was invisible: t9014 and t90010 were red for months, and a t9007 assertion
had never passed since it was added in #139. The last three PRs to touch
these files each merged with CI validating nothing.

The new workflow is deliberately ungated and runs on every pull request, the
way js-build.yml does, so the suite cannot go dark again.

Two things the job has to supply:

- A git identity. t/test-lib.sh sets none, and several tests commit without
  configuring one per repository, so they lean on a global the suite never
  establishes. On a stock runner they die with "unable to auto-detect email
  address". Setting it in the job keeps the change contained; making the
  suite self-sufficient would mean touching test-lib.sh, which is worth
  doing separately.
- The release binary, which t/test-lib.sh looks for first. The test-subdir
  task now declares its build dependency rather than assuming one was built.

The task's filter also widens from `t900` plus `t902` to plain `t9`. It is a
substring match, so the old pair still skipped t9011-t9018 — part of why
these failures went unseen.

Verified by running `bash t/run-tests.sh t9` under `env -i` with an empty
HOME and only the two config lines this workflow sets: 21 of 21 pass.
protocol.file.allow is not needed, so the job does not set it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VDVUJHu38YtVAr6sKZtRDB
---
 .github/workflows/t9-suite.yml | 61 ++++++++++++++++++++++++++++++++++
 Taskfile.pkl                   | 12 +++----
 2 files changed, 67 insertions(+), 6 deletions(-)
 create mode 100644 .github/workflows/t9-suite.yml

diff --git a/.github/workflows/t9-suite.yml b/.github/workflows/t9-suite.yml
new file mode 100644
index 00000000..658aeee4
--- /dev/null
+++ b/.github/workflows/t9-suite.yml
@@ -0,0 +1,61 @@
+name: t9 Suite
+
+# The t/ integration tests had no CI job at all: ci.yml's `select` skips its
+# jobs for a diff that only touches t/, and nothing invoked the test-subdir
+# task. That blind spot let t9014, t90010 and a t9007 assertion sit broken for
+# months. This workflow is deliberately ungated — it runs on every pull
+# request, like js-build.yml — so the suite cannot go dark again.
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  t9-suite:
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      # t9020 and t9021 stand up a smart HTTP server with tools/http-test-server.js.
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: 24
+
+      - name: Install pkfire
+        uses: mizchi/pkfire@v0.12.1
+        with:
+          version: 0.12.1
+      - name: Install pkspec
+        uses: mizchi/pkspec@v0.4.1
+        with:
+          version: 0.4.1
+          pkl-version: none
+
+      - name: Install MoonBit CLI
+        uses: ./.github/actions/setup-moonbit
+
+      - name: Moon update
+        run: moon update
+
+      # t/test-lib.sh sets no identity of its own, and several tests commit
+      # without configuring one per repository, so they rely on a global it
+      # never establishes. Without this the suite dies on "unable to
+      # auto-detect email address".
+      - name: Configure git identity
+        run: |
+          git config --global user.name "Bit Test"
+          git config --global user.email "test@example.com"
+
+      # Builds the release binary at the path t/test-lib.sh looks for, via the
+      # test-subdir task's build dependency.
+      - name: Run t9 suite
+        run: pkf run test-subdir
diff --git a/Taskfile.pkl b/Taskfile.pkl
index b3b4a75b..15649b0b 100644
--- a/Taskfile.pkl
+++ b/Taskfile.pkl
@@ -332,12 +332,12 @@ local e2e: Task = new {
 
 local testSubdir: Task = new {
   name = "test-subdir"
-  description = "subdir-clone/push and transport integration tests (t/ directory)"
-  // The filter is a substring match, so `t900` alone silently skips t902x.
-  cmd = #"""
-    bash t/run-tests.sh t900
-    bash t/run-tests.sh t902
-    """#
+  description = "t9 integration tests: subdir clone/push, workspace, transports"
+  // The filter is a substring match, so `t9` covers the whole t9 range in one
+  // pass — `t900` alone skipped t9011-t9021, which is how several of these
+  // tests stayed broken unnoticed.
+  cmd = "bash t/run-tests.sh t9"
+  deps { build }
 }
 
 local testDistributed: Task = new {