test: add comprehensive test suite

- test_create_issue.py: arg parsing, remote resolution, payload, body-file, auth, HTTP errors
  (auto-skips if create_issue.py is inaccessible due to macOS sandbox)
- test_create_pr.py: arg parsing, remote resolution, payload fields, default base, auth, HTTP errors
- test_credentials.py: get_credentials() parsing, password with '=', empty output, stdin verification
- test_manage_labels.py: label creation (skip/create), dry run, mapping application, constant validation
- test_shell_scripts.py: close_issue.sh and mark_issue.sh arg validation and error messages

28 passed, 12 skipped (macOS sandbox on create_issue.py).

tests/test_credentials.py

@@ -0,0 +1,69 @@
+"""Tests for the shared get_credentials() function used by create_issue.py and create_pr.py.
+
+These test the credential parsing logic in isolation by mocking subprocess.Popen.
+"""
+import sys
+import unittest
+from unittest.mock import MagicMock, patch
+
+sys.path.insert(0, str(__import__("pathlib").Path(__file__).resolve().parent.parent))
+import create_pr  # noqa: E402  (get_credentials is identical in create_issue.py and create_pr.py)
+
+
+class TestGetCredentials(unittest.TestCase):
+    """Test the get_credentials function that parses git credential fill output."""
+
+    def _mock_popen(self, output_text):
+        """Create a mock Popen that returns the given text from communicate()."""
+        mock_proc = MagicMock()
+        mock_proc.communicate.return_value = (output_text, "")
+        return mock_proc
+
+    @patch("create_pr.subprocess.Popen")
+    def test_parses_standard_output(self, mock_popen_cls):
+        mock_popen_cls.return_value = self._mock_popen(
+            "protocol=https\nhost=gitea.example.com\nusername=admin\npassword=s3cret\n"
+        )
+        user, password = create_pr.get_credentials("gitea.example.com")
+        self.assertEqual(user, "admin")
+        self.assertEqual(password, "s3cret")
+
+    @patch("create_pr.subprocess.Popen")
+    def test_handles_password_with_equals(self, mock_popen_cls):
+        # Tokens often contain '=' characters
+        mock_popen_cls.return_value = self._mock_popen(
+            "username=bot\npassword=abc=def=ghi\n"
+        )
+        user, password = create_pr.get_credentials("example.com")
+        self.assertEqual(user, "bot")
+        self.assertEqual(password, "abc=def=ghi")
+
+    @patch("create_pr.subprocess.Popen")
+    def test_empty_output_returns_empty(self, mock_popen_cls):
+        mock_popen_cls.return_value = self._mock_popen("")
+        user, password = create_pr.get_credentials("example.com")
+        self.assertEqual(user, "")
+        self.assertEqual(password, "")
+
+    @patch("create_pr.subprocess.Popen")
+    def test_missing_password_returns_empty(self, mock_popen_cls):
+        mock_popen_cls.return_value = self._mock_popen("username=admin\n")
+        user, password = create_pr.get_credentials("example.com")
+        self.assertEqual(user, "admin")
+        self.assertEqual(password, "")
+
+    @patch("create_pr.subprocess.Popen")
+    def test_sends_correct_stdin(self, mock_popen_cls):
+        mock_proc = self._mock_popen("username=u\npassword=p\n")
+        mock_popen_cls.return_value = mock_proc
+
+        create_pr.get_credentials("gitea.prgs.cc")
+
+        # Verify the correct input was sent to git credential fill
+        mock_proc.communicate.assert_called_once_with(
+            "protocol=https\nhost=gitea.prgs.cc\n\n"
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()