ci: add k8s to provider matrix, split provider tests, fix setup-bun SHA

- providers-tests + providers-tests-serial matrices now include k8s
  (was aws-only), so the k8s provider's full test taxonomy runs in CI
  for the first time. Guarded so a not-yet-existent provider path skips
  cleanly instead of failing collection.
- Provider unit/mocked/contract tests run per-provider in the matrix
  rather than in the monolithic unit-tests job.
- Correct the oven-sh/setup-bun v2 SHA pin — Dependabot pinned a
  non-existent SHA that broke Semantic Release, dev-pypi and prod-release.

Author: fgogolli

.github/workflows/ci-tests.yml

@@ -105,7 +105,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        provider: [aws]
+        provider: [aws, k8s]
     uses: ./.github/workflows/reusable-test.yml
     with:
       test-type: providers
@@ -133,7 +133,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        provider: [aws]
+        provider: [aws, k8s]
     uses: ./.github/workflows/reusable-test.yml
     with:
       test-type: providers-serial

.github/workflows/dev-pypi.yml

@@ -88,7 +88,7 @@ jobs:
         fail-on-cache-miss: false
 
     - name: Setup Bun (for UI static bundle)
-      uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f4b11  # v2
+      uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
       with:
         bun-version: latest
 

.github/workflows/prod-release.yml

@@ -79,7 +79,7 @@ jobs:
         fail-on-cache-miss: false
 
     - name: Setup Bun (for UI static bundle)
-      uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f4b11  # v2
+      uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
       with:
         bun-version: latest
 
@@ -182,7 +182,7 @@ jobs:
         fail-on-cache-miss: false
 
     - name: Setup Bun (for UI static bundle)
-      uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f4b11  # v2
+      uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
       with:
         bun-version: latest
 
@@ -268,7 +268,7 @@ jobs:
         fail-on-cache-miss: false
 
     - name: Setup Bun (for UI static bundle)
-      uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f4b11  # v2
+      uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
       with:
         bun-version: latest
 

.github/workflows/semantic-release.yml

@@ -110,7 +110,7 @@ jobs:
         uses: astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3  # v8.3.0
 
       - name: Setup Bun (for UI static bundle)
-        uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f4b11  # v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
         with:
           bun-version: latest
 

makefiles/ci.mk

@@ -146,11 +146,15 @@ PROVIDER_SERIAL_PATH := $(if $(PROVIDER),$(TESTS_PROVIDERS)/$(PROVIDER)/live,$(T
 PYTEST_LIVE ?=
 ci-tests-providers:  ## Run providers tests (PROVIDER=<name> scopes to one provider)
 	@echo "Running provider tests (parallel): $(if $(PROVIDER),$(PROVIDER),all)..."
-	$(call run-tool,pytest,$(PROVIDER_PATH) $(PYTEST_PARALLEL) $(PYTEST_ARGS) $(PYTEST_COV_ARGS) --cov-report=xml:coverage-providers$(PROVIDER_SUFFIX).xml --junitxml=junit-providers$(PROVIDER_SUFFIX).xml)
+	$(if $(and $(PROVIDER),$(if $(wildcard $(PROVIDER_PATH)),,skip)),\
+		@echo "Provider path $(PROVIDER_PATH) does not exist yet — skipping (no tests to run).",\
+		$(call run-tool,pytest,$(PROVIDER_PATH) $(PYTEST_PARALLEL) $(PYTEST_ARGS) $(PYTEST_COV_ARGS) --cov-report=xml:coverage-providers$(PROVIDER_SUFFIX).xml --junitxml=junit-providers$(PROVIDER_SUFFIX).xml))
 
 ci-tests-providers-serial:  ## Run the serial-marked subset of provider tests (live AWS, etc.)
 	@echo "Running serial provider tests: $(if $(PROVIDER),$(PROVIDER),all)..."
-	$(call run-tool,pytest,$(PROVIDER_SERIAL_PATH) $(PYTEST_SERIAL) $(PYTEST_LIVE) $(PYTEST_ARGS) $(PYTEST_COV_ARGS) --cov-report=xml:coverage-providers$(PROVIDER_SUFFIX)-serial.xml --junitxml=junit-providers$(PROVIDER_SUFFIX)-serial.xml)
+	$(if $(and $(PROVIDER),$(if $(wildcard $(PROVIDER_SERIAL_PATH)),,skip)),\
+		@echo "Provider serial path $(PROVIDER_SERIAL_PATH) does not exist yet — skipping (no tests to run).",\
+		$(call run-tool,pytest,$(PROVIDER_SERIAL_PATH) $(PYTEST_SERIAL) $(PYTEST_LIVE) $(PYTEST_ARGS) $(PYTEST_COV_ARGS) --cov-report=xml:coverage-providers$(PROVIDER_SUFFIX)-serial.xml --junitxml=junit-providers$(PROVIDER_SUFFIX)-serial.xml))
 
 ci-tests-infrastructure:  ## Run infrastructure tests only (matches ci.yml infrastructure-tests job)
 	@echo "Running infrastructure tests (parallel)..."