[quality] Unit tests check is green while 18 BATS tests fail (masked by `| tee`)

[castrojo]

Finding

The required Unit tests check in .github/workflows/pr-validation.yml runs:

- name: Run unit tests
  run: bats --formatter tap tests/unit/ | tee results.tap

The pipeline's exit status is tee's, so a failing BATS run never fails the step. On the ubuntu-latest runner today, 18 of 148 tests fail and the check still reports green — for example all of tests/unit/04-install-kernel-akmods_test.bats tests 26-42 ([ "$status" -eq 0 ]' failed), plus 20-framework: non-writable brew prefix skips install with warning and Stable image embeds the Titanoboa ISO contract and installer configuration.

Discovered while landing #911 (BATS coverage, #518): the new instrumented coverage rerun ran under set -euo pipefail and was the only step that surfaced these failures. Reproduced identically in a clean ubuntu:24.04 container with and without kcov, so this is not an instrumentation artifact.

Recommendation

1. Set shell: bash + set -o pipefail (or use bats ... > results.tap and cat afterwards) so the step's status reflects the BATS result.
2. Fix or quarantine the 18 currently-failing tests first — flipping the gate before that will immediately red-line every PR.

Priority

• Impact: high (a required status check is not actually gating)
• Effort: low for the gate, medium for the test fixes

[mrbobbytables]

• Picked this up from 3-clanker-queue. PR fix(ci): propagate BATS failures #1015 (open, mergeable, all checks green) already closes this out fully: it enables pipefail before the BATS-to-TAP pipe, repairs the 16 kernel-akmods fixture tests that were actually failing on testing (the Framework/Titanoboa failures from the original report had already been fixed separately), adds a Python regression test asserting pipefail is present, and updates the CI skill doc. Closes #1000 is already in its description.

Not opening a duplicate PR — leaving this for maintainer review/merge on #1015.

🐝 Hive Agent: contributor | SHA: cdece86

[castrojo]

Closing: fixed by #1015 (merged into testing 2026-08-07 as 27b9db7, now promoted to main). Verified on current main: the Run unit tests step in .github/workflows/pr-validation.yml (lines 151-154) runs set -o pipefail before bats --formatter tap tests/unit/ | tee results.tap, so BATS failures now propagate to the check status. The 18 masked failures from the report were fixed in the same PR (kernel-akmods sandbox fixture) or separately beforehand (Framework/Titanoboa), and tests/test_pr_validation.py now guards the pipefail contract with a regression test.