ci: run the extension suites on pull requests and develop — the release gate's own script

The suites ran in CI at one moment only: when a tag was pushed. A pull request
got CodeQL and nothing else, so the first Linux run of any suite was the
release gate, after the merge. That is how v1.3.0 was tagged on a suite that
could not pass there (see the previous commit).

The gate moves, unchanged, into scripts/test-extensions.sh: discover every
extensions/*/test/*.test.js, stop at the first failing suite, and fail if the
glob matches nothing. release.yml calls it where the inline loop was, and a new
workflow, test.yml, calls it on every pull request and on pushes to develop —
same runner image, same Node. One script, so the two cannot drift apart.

test.yml asks for read access only and needs no secrets. A newer push to the
same branch cancels the run before it.

Checked: the script passes all 48 suites on a Mac and in a Linux container
under the runner's shell flags; it exits with a failing suite's own code
without running the next; it exits 1 when nothing matches. actionlint is clean
on both workflow files. release.yml's gate step is the one thing here not
exercised until a tag is pushed — but it is now a single line that test.yml
runs on this very pull request.

Author: ndemianc

.github/workflows/release.yml

@@ -40,30 +40,9 @@ jobs:
         with:
           node-version: "24"
       - name: Extension unit tests
-        # `shopt` is a bash builtin, so pin the shell instead of relying on the runner default (bash on
-        # Linux/macOS, but pwsh on Windows — where this step would break if the job were ever copied).
-        # Explicit `shell: bash` also upgrades the default `bash -e` to
-        # `bash --noprofile --norc -eo pipefail`, so a stray profile file can't perturb the gate either.
-        shell: bash
-        # DISCOVERS suites — it used to `cd extensions/levelcode-ai`, so levelcode-updater's tests never
-        # ran here, including the one guarding the updater's Download button against serving a raw
-        # .app.zip. Globbing every extension means a new suite is gated the moment it is added, with no
-        # list here to keep in sync. Requires are file-relative, so running from the repo root is fine.
-        run: |
-          shopt -s nullglob
-          count=0
-          for t in extensions/*/test/*.test.js; do
-            echo "── $t"
-            node "$t"          # `-e` (from `shell: bash` above) aborts the job on the first failure
-            count=$((count + 1))
-          done
-          # A zero-match glob would otherwise report success and gate nothing — the exact failure this
-          # step is fixing. Fail loudly instead.
-          if [ "$count" -eq 0 ]; then
-            echo "::error::No suites matched extensions/*/test/*.test.js — the gate would pass vacuously."
-            exit 1
-          fi
-          echo "──────── $count test files passed ────────"
+        # The gate itself lives in a script, so the pull-request workflow (test.yml) runs exactly what
+        # this does. It discovers every extensions/*/test/*.test.js and fails if it finds none.
+        run: ./scripts/test-extensions.sh
 
   build:
     name: Build ${{ matrix.arch }}

.github/workflows/test.yml

@@ -0,0 +1,33 @@
+name: Extension tests
+
+# The release gate (scripts/test-extensions.sh), on every pull request and on develop.
+#
+# release.yml runs the same script, but only when a tag is pushed — which made a tag the first time
+# the suites ran on Linux. v1.3.0's gate failed there on a suite that had only ever run on a Mac,
+# after the pull requests that wrote it had merged. Here a suite that passes on one machine and not
+# on the runner is found on the pull request that adds it.
+
+on:
+  pull_request:
+  push:
+    branches: [develop]
+
+permissions:
+  contents: read
+
+# A newer push to the same branch or pull request supersedes the run before it.
+concurrency:
+  group: extension-tests-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: Extension unit tests
+    runs-on: ubuntu-latest # the runner the release gate uses
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: "24" # as release.yml
+      - name: Extension unit tests
+        run: ./scripts/test-extensions.sh

scripts/test-extensions.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+#
+# Run every extension's unit suites. This is the gate: the release workflow runs it before spending
+# an hour of macOS build minutes, and every pull request runs it too (.github/workflows/test.yml).
+#
+# It DISCOVERS suites — extensions/*/test/*.test.js — so a new one is gated the moment it is added,
+# with no list to keep in sync. (The gate used to `cd extensions/levelcode-ai`; levelcode-updater's
+# suites never ran, including the one guarding the Download button against serving a raw .app.zip.)
+# Requires are file-relative, so the suites run from the repo root.
+#
+# Usage:
+#   ./scripts/test-extensions.sh
+#
+set -euo pipefail
+shopt -s nullglob
+
+cd "$(dirname "$0")/.."
+
+count=0
+for t in extensions/*/test/*.test.js; do
+  echo "── $t"
+  node "$t"          # `set -e` stops at the first suite that fails
+  count=$((count + 1))
+done
+# A glob that matches nothing would otherwise report success and gate nothing. Fail loudly instead.
+if [ "$count" -eq 0 ]; then
+  echo "::error::No suites matched extensions/*/test/*.test.js — the gate would pass vacuously."
+  exit 1
+fi
+echo "──────── $count test files passed ────────"