Add GitHub Actions workflow to run tests on pull requests (#11)

* Add GitHub Actions workflow to run tests on pull requests

Run unit tests and e2e tests automatically when a PR is opened or updated.
E2E tests only run on PRs from the same repository (not forks) since they
require GitHub App credentials.

* Refactor e2e tests workflow to run directly in GHA

The .claude/run-e2e-tests.sh script was designed for Claude Code environment
which requires installing gh CLI. In GitHub Actions, gh is pre-installed.

Now the workflow directly:
- Generates the GitHub App token using the Python script
- Sets up gh authentication
- Runs the e2e tests

This avoids unnecessary gh installation and keeps the Claude-specific
script separate from CI.

* Simplify e2e tests workflow by merging shell steps

Combine token generation, gh auth setup, and test execution into a single
step to avoid step dependencies with inputs/outputs.

* Move get_github_app_token.py to tests directory

The script is shared test infrastructure used by both Claude Code
and GitHub Actions, so it belongs in tests/ rather than .claude/.

* Use vars.GH_APP_ID instead of secrets (App ID is public)

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: Phlogistique

.claude/run-e2e-tests.sh

@@ -69,7 +69,7 @@ acquire_token() {
     fi
 
     # Generate token using the Python script
-    if ! uv run "$SCRIPT_DIR/get_github_app_token.py" > "$TOKEN_FILE" 2>/dev/null; then
+    if ! uv run "$PROJECT_ROOT/tests/get_github_app_token.py" > "$TOKEN_FILE" 2>/dev/null; then
         log_error "Failed to generate GitHub App token"
         return 1
     fi

.github/workflows/tests.yml

@@ -0,0 +1,39 @@
+name: Tests
+
+on:
+  pull_request:
+    branches: ['*']
+
+jobs:
+  unit-tests:
+    name: Unit Tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Run unit tests
+        run: bash tests/test_update_pr_stack.sh
+
+  e2e-tests:
+    name: E2E Tests
+    runs-on: ubuntu-latest
+    # Only run if secrets are available (not available on forks)
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+        with:
+          version: "latest"
+
+      - name: Run e2e tests
+        env:
+          GH_APP_ID: ${{ vars.GH_APP_ID }}
+          GH_APP_PRIVATE_KEY_PEM_B64: ${{ secrets.GH_APP_PRIVATE_KEY_PEM_B64 }}
+        run: |
+          export GH_TOKEN=$(uv run tests/get_github_app_token.py)
+          gh auth setup-git
+          bash tests/test_e2e.sh