Fix: Make Flask app test-safe and run full pytest suite in CI

.github/workflows/ci.yml

@@ -337,6 +337,15 @@ jobs:
           echo "=== Running rule regression tests ==="
           pytest tests/test_rules_*.py -v --tb=short
 
+      # ── CHECK 8: Full Python test suite ──────────────────────────────
+      - name: Run Python test suite
+        id: pytest_check
+        run: |
+          echo "=== Running full Python test suite ==="
+          python -m pytest tests/             --ignore=tests/smoke_test.py             -v --tb=short -q
+        env:
+          OPENSHIELD_ENV: "development"
+
       # ── Final summary — always runs, shows per-check pass/fail ────────
       - name: CI Summary
         if: always()
@@ -348,6 +357,7 @@ jobs:
           JSON:       ${{ steps.json_check.outcome }}
           API:        ${{ steps.api_check.outcome }}
           XREF:       ${{ steps.xref_check.outcome }}
+          PYTEST:     ${{ steps.pytest_check.outcome }}
           RULE_TESTS: ${{ steps.rule_tests.outcome }}
         run: |
           python - <<'PYEOF'
@@ -361,6 +371,7 @@ jobs:
               ("Compliance JSON validation",           os.environ["JSON"]),
               ("API syntax check",                     os.environ["API"]),
               ("Compliance vs rule cross-reference",   os.environ["XREF"]),
+              ("Python test suite",                      os.environ["PYTEST"]),
               ("Rule regression tests",                os.environ["RULE_TESTS"]),
           ]
 

api/app.py

@@ -117,9 +117,20 @@ def create_app() -> Flask:
     # ------------------------------------------------------------------ #
     # Database Management                                                   #
     # ------------------------------------------------------------------ #
-    with app.app_context():
-        db = DatabaseManager()
-        db.run_migrations()
+    # Skip migrations when DATABASE_URL is not set (e.g. during unit tests).
+    # Deployment startup always sets DATABASE_URL so migrations still run in
+    # production and staging. Tests that need a real database should set
+    # DATABASE_URL explicitly in their environment.
+    if os.environ.get("DATABASE_URL"):
+        with app.app_context():
+            db = DatabaseManager()
+            db.run_migrations()
+    else:
+        logger.info(
+            "DATABASE_URL not set — skipping migrations. "
+            "This is expected during unit tests and local development "
+            "without a database."
+        )
 
     @app.teardown_appcontext
     def close_db(error=None):