Run the test suites on every push

[pavel-te]

There was no CI in this repository — no workflow file, nothing ran the suites automatically. They take four seconds and need no network (four stub curl, the rest only use --dry-run, which skips preflight), so nothing stood in the way.

It matters more than usual here: the script is downloaded by tag from customer pipelines and vendored into the action, so a broken main becomes a release, and a release becomes what those pipelines fetch.

suites — the same tests, twice

runner	bash
macos-latest	/bin/bash, still 3.2.57
ubuntu-latest	current bash

The macOS leg is not decoration: the CLI targets bash 3.2 deliberately, and current bash quietly accepts syntax 3.2 rejects — a contributor on Linux cannot see that break. Each suite gets its own log group, and one failure does not mask the rest.

checks — four things that used to need a human

• --version agrees with the VERSION constant.
• No config/examples/*.config comes back — those were KEY=VALUE files the parser rejected.
• Every fenced block in README.md and docs/*.md is what it claims to be: yaml parses, bash survives bash -n. Output samples belong in text.
• Only the double-brace placeholder appears; a single-brace one is taken literally.

The guards were verified against the broken state, not just the fixed one:

• the block check catches both bad blocks in the previous revision of the README
• single-bracing a placeholder in an example is caught
• a deliberately failing suite dropped into tests/ turns the step red and names it

What adding CI found on its first run

A CI checkout leaves the tree on a detached HEAD, and there the file-tag auto-detection produces nothing — six of the twelve invocation tests stopped before doing any work.

The workflow puts the checkout on a branch, and the behaviour itself is now asserted deliberately in tests/test-git-context.sh rather than left to whichever checkout style a runner uses:

• on a branch → tag detected, run completes
• detached HEAD → refused with an explicit message
• detached HEAD + explicit --file-tag-name → completes

That file also records an asymmetry it exposed: no repository at all falls back to a default tag, while a repository on a detached HEAD falls back to nothing. The chain is

git branch --show-current || git rev-parse --abbrev-ref HEAD || echo "main"

which assumes the first command fails on a detached HEAD. It does not — it prints an empty string and exits 0, so neither fallback is reached. Left exactly as it stands and asserted, because changing it changes CLI behaviour and belongs in its own change.

Verification

• 234 assertions across eight suites, no failures
• links is a separate advisory job: a dead link is a real defect, but an upstream hiccup must not turn main red

Also fixes what the new checks immediately found in docs/DEVELOPMENT.md, which nothing had ever validated: git clone <repository-url> is not valid shell, the directory it then entered was never the repository name, three examples used the single-brace placeholder, and the --timeout illustration is a fragment rather than a script.