ci: actually run the test suite

[tiXor-code]

Why

51 tests exist in this repo. No workflow has ever run any of them.

What

• tests.yml (new) — pytest on push-to-main and PRs
• nightly.yml — a smoke-gate step

Two decisions worth reviewing

paths allowlist, not paths-ignore. scrape.yml commits data/ every 15 minutes (~21-28 commits/day). A naive on: push fires on every one and buries real failures in the run history. I used an allowlist rather than paths-ignore: ['data/**'] because a future scraper output directory would silently re-enable that storm under paths-ignore, but stays excluded under an allowlist.

The nightly step runs BEFORE the backfill. This is the load-bearing bit. Once db/termo.db exists, 15 skipif-gated tests un-skip and assert frozen data constants — universe_size == 947, median_pt_days == 22, top slug pt-modul-toporasi. universe_size comes from data/harta.html, which the scraper rewrites from CMTEB's live map. So the day CMTEB adds one PT to that map, a post-backfill pytest would fail the nightly, and since validate/upload/deploy-hook all sit downstream, the site would silently serve stale data indefinitely.

Before the backfill, db/termo.db does not exist, those 15 stay skipped, and the step is a ~10s pure-code gate. Data invariants remain pipeline.validate's job, which already gates the release properly.

Expected CI result

36 passed, 15 skipped — the skips are correct, not a misconfiguration. A run reporting 51 passed would mean a stale local database was present.

Security

• Actions SHA-pinned (SEC005), matching the convention just landed in termo-site
• permissions: contents: read — this job never commits, uploads or deploys
• No ${{ github.event.* }} reaches any run: block

🤖 Generated with Claude Code

[claude]

Verified: paths-allowlist YAML is valid and matches real directories (pipeline/, scraper/, scripts/, tests/); the new pytest check on this PR already ran and passed in ~10s, self-confirming the trigger and the skip-count reasoning. Nightly gate is correctly placed before backfill so the 15 db-gated tests stay skipped and can't block a release on a legitimate CMTEB universe change. permissions: contents: read is correctly scoped, actions are SHA-pinned, no untrusted input reaches any run: block.