ci: run the unit suite on every PR and push to main

[crisng95]

Adds the repo's first CI. .github/ held only FUNDING.yml, so nothing ran the tests until someone ran them by hand.

Why now

PR #48 reached review carrying an ImportError:

ImportError: cannot import name 'USE_BATCH_RPC' from 'agent.config'

agent.config.USE_BATCH_RPC and agent/services/headers.py were both deleted by #49, which merged while #48 was open. The code could not import on main at all, and the only reason that surfaced is that someone happened to try it. This job is what catches that.

What it runs

python -m pytest tests/unit on pull_request and on push to main, across Python 3.10 and 3.13 — the floor the README badge advertises, and the version development runs on.

3.10 was verified, not assumed: the full suite runs there and all 259 non-ffmpeg tests pass. Had it not, this matrix would have arrived red.

Two things the run needs that are easy to get wrong

fonts-dejavu-core is installed alongside ffmpeg. The drawtext call in video_reviewer.py:204 passes no fontfile=, so it asks fontconfig for a default family. With --no-install-recommends, a runner can end up with an ffmpeg that has drawtext and no font for it to use.

The ffmpeg check renders a frame rather than grepping ffmpeg -filters. Grep proves the filter is compiled in, not that a font exists. And the first failure mode is not hypothetical — a stock Homebrew ffmpeg ships without --enable-libfreetype, and 13 tests then fail with Error opening output files: Filter not found, which reads like a test bug rather than a missing codec. Rendering one frame through the same filter the tests use catches both modes in a step whose name says what is wrong:

::error::ffmpeg cannot render drawtext — missing --enable-libfreetype, or no font installed.

Verified in both directions locally — against a good ffmpeg (exit 0) and a drawtext-less one (exit 1) — running the script exactly as PyYAML parses it, so the %{pts\:hms} escaping through YAML into bash is checked too.

Other choices

• timeout-minutes: 10 against a ~7s suite. That ceiling only trips on a hang, which this suite has had: an aiosqlite connection left open by a missing mock keeps a non-daemon worker thread alive and the interpreter never exits.
• concurrency with cancel-in-progress, so a new push supersedes the run in flight.
• pip cache keyed on both requirements files.
• fail-fast: false, so a 3.10-only break still shows the 3.13 result.

Note

This PR is the first thing that will exercise the workflow — a workflow file only really runs once it is on a branch GitHub evaluates. If the runner's ffmpeg surprises us, the assert step is the thing that will say so plainly.

🤖 Generated with Claude Code