[quality] test(default.just): BATS coverage for bios, bios-info, enroll-secure-boot-key, toggle-user-motd, check-local-overrides, check-idle-power-draw, benchmark

[kubestellar-hive]

Test Improvement

Adds tests/test_default_just.bats — 23 BATS tests for
system_files/shared/usr/share/ublue-os/just/default.just.

Before this PR, exactly one of the file's 12 recipes was under test
(clean-system, via tests/test_clean_system_podman_path.bats). The rest had
zero coverage, including a firmware reboot and a Secure Boot MOK enrollment.

Recipes claimed by this PR

Recipe	What is covered
bios	legacy-BIOS guard exits 1 and never reboots; EFI + confirm issues systemctl reboot --firmware-setup; declined confirmation does not reboot
bios-info	all four dmidecode -s fields read under sudo bash; every field is labelled
enroll-secure-boot-key	mokutil --timeout -1 precedes the import; akmods-ublue.der is the imported cert; enrollment password guidance is printed
toggle-user-motd	shim body is exactly uwelcome toggle
check-local-overrides	only-in-/etc reporting; content divergence reporting; silence when trees match; NO_COLOR=1 palette suppression; palette applied when unset; identity/credential --exclude set
check-idle-power-draw	missing-powerstat guard exits 1 without invoking it; present path runs powerstat -a -r
benchmark	stress-ng present runs the 1m matrix load without touching brew; accept path runs brew install/brew link then the load; decline path exits 0 with no install

Method

Each shebang recipe body is extracted verbatim from default.just and executed
against stubbed gum, sudo, systemctl, dmidecode, mokutil, powerstat,
stress-ng, brew, and uwelcome. /sys/firmware/efi and the /usr/etc /etc
diff operands are redirected into a sandbox with sed, so real control flow is
exercised instead of grepped. sudo execs its argv so the sudo bash <<EOF
heredocs run against the same stubs.

Incidental finding pinned, not fixed

check-local-overrides hardcodes diff --color="always". NO_COLOR=1
therefore suppresses only the palette the recipe applies itself with sed;
diff's own ANSI escapes still reach the terminal. One test documents that
current behaviour so a future fix is visible. No production code is changed by
this PR.

Disjointness

Explicitly claims only the seven recipes listed above in default.just, plus
the new test file.

• device-info (default.just) — left to PR [scanner] fix: remove sudo from device info status #1003, not touched or asserted on.
• clean-system (default.just) — already owned by tests/test_clean_system_podman_path.bats.
• shared.just — left to PR [quality] test: BATS coverage for shared.just (powerwash, toggle-tpm2) #1034.
• system.just — left to PR [quality] test(system.just): BATS coverage for toggle-testing, toggle-vms, install-system-flatpaks #1031.
• apps.just — left to PRs [scanner] fix: use valid brew tap trust commands #978, [scanner] fix: configure opt-in bluespeed tools #1007, [scanner] fix: add Bluespeed bootstrap recipe #1018.
• changelog.just / ublue-image-repo — left to PR [architect] refactor: single source of truth for image-name → upstream repo routing #1045.

Justfile: one line, bats tests/test_default_just.bats, inserted immediately
after the existing test_clean_system_podman_path.bats line rather than
appended to the end of the recipe, specifically so it does not collide with
PR #1031's append at the tail of the same recipe.

.github/workflows/unit-tests.yml is intentionally not modified — the hive
App token lacks the workflows permission, and that wiring gap is tracked
separately by common#968.

Verification

$ bats tests/test_default_just.bats
1..23
ok 1 .. ok 23

Related Issue

Refs #968 (the workflow-wiring half of the gap remains open).

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-opus-5

[hanthor]

Thorough tests/test_default_just.bats (23 cases) for previously-untested bios, bios-info, enroll-secure-boot-key, check-local-overrides, check-idle-power-draw, benchmark — verified against the actual default.just content, assertions match real recipe behavior including documenting a NO_COLOR gap rather than hiding it. CI test green; validate fails only on title-lint.

---

Generated by Claude Code