All CI/CD-related script/workflow tests must be executed in CI, and they must assert the behaviors that matter in production—especially fail-closed security gates and correct step ordering.

Apply it as a checklist: 1) Wire tests into CI: if you have scripts/tests/*.test.js (or npm run test:scripts), add a workflow step that runs it. Don’t rely on developers running tests locally. 2) Test logic, not strings alone: for security-sensitive workflow gating, include negative/deny scenarios and verify the intended allow/deny behavior (and any explanation/telemetry flags). 3) Assert ordering, not just presence: when workflow steps sweep/cleanup temporary dirs or delete symlinks, verify cleanup happens after any artifact staging/copying that must dereference symlinks, and before the final launch/upload step.

Example (ordering assertion pattern):

const sweep = "find tmp -maxdepth 2 -type d -name '*-verify-*' -exec rm -rf {} +";
const stepText = getRunStepText(); // however your test builds/extracts it

const cpIndex = stepText.indexOf('cp -r');
const sweepIndex = stepText.indexOf(sweep);
expect(cpIndex).toBeGreaterThan(-1);
expect(sweepIndex).toBeGreaterThan(-1);
expect(cpIndex).toBeLessThan(sweepIndex); // fail if deletion moves earlier

This prevents regressions where CI wiring is missing and prevents “false green” tests where commands exist but run in the wrong order or weaken fail-closed gating.