diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 092d215..5ace1ee 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -13,6 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out Git repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+
       - name: Trunk Check
-        uses: trunk-io/trunk-action@v1
+        uses: trunk-io/trunk-action@4d5ecc89b2691705fd08c747c78652d2fc806a94 # v1.1.19
diff --git a/.github/workflows/release-please.yaml b/.github/workflows/release-please.yaml
index 13798ec..665a04a 100644
--- a/.github/workflows/release-please.yaml
+++ b/.github/workflows/release-please.yaml
@@ -13,6 +13,6 @@ jobs:
   release-please:
     runs-on: ubuntu-latest
     steps:
-      - uses: googleapis/release-please-action@7987652d64b4581673a76e33ad5e98e3dd56832f #v4.1.3
+      - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0
         with:
           release-type: terraform-module
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
new file mode 100644
index 0000000..b9d48f3
--- /dev/null
+++ b/.github/workflows/test.yaml
@@ -0,0 +1,28 @@
+name: Test
+
+on:
+  pull_request: {}
+  push:
+    branches:
+      - main
+
+permissions:
+  actions: read
+  checks: write
+  contents: read
+  pull-requests: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out Git repository
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+
+      - name: Install tools via aqua
+        uses: aquaproj/aqua-installer@11dd79b4e498d471a9385aa9fb7f62bb5f52a73c # v4.0.4
+        with:
+          aqua_version: v2.55.1
+
+      - name: Run BATS tests
+        run: bats tests/
diff --git a/aqua.yaml b/aqua.yaml
index 01a9de8..2f16f3d 100644
--- a/aqua.yaml
+++ b/aqua.yaml
@@ -9,3 +9,5 @@ packages:
     tags: [cursor]
   - name: cli/cli@v2.83.0
     tags: [gh]
+  - name: bats-core/bats-core@v1.13.0
+    tags: [cicd]
diff --git a/tests/README.md b/tests/README.md
new file mode 100644
index 0000000..fd0d16e
--- /dev/null
+++ b/tests/README.md
@@ -0,0 +1,52 @@
+# Taskit Test Suite
+
+BATS test suite for Taskit. Tests validate Task commands using dry-run mode (`task -n`).
+
+## Setup
+
+```bash
+aqua install  # Installs BATS and Task
+```
+
+## Running Tests
+
+```bash
+bats tests/                              # Run all
+bats tests/terraform_plan.bats           # Run specific file
+bats --filter-tags precondition tests/   # Run by tag
+```
+
+CI runs automatically on PRs and main branch pushes via `.github/workflows/test.yaml`.
+
+## Writing Tests
+
+Tests use Task's dry-run mode to verify command construction:
+
+```bash
+@test "terraform:plan validates environment argument" {
+  touch "tfvars/test-env.tfvars"  # Setup fixture
+  run task -v -n terraform:plan -- test-env
+  [ "$status" -eq 0 ]
+  [[ "$output" =~ "tofu plan -var-file ./tfvars/test-env.tfvars" ]]
+}
+```
+
+Key helpers: `setup()`, `teardown()`, `run`, `$status`, `$output`
+
+## Quick Reference
+
+**Debug failed tests:** `echo "Output: $output" >&3`
+**Test pattern:** `task -v -n <task> -- <args>`
+**Assertions:** `[ ]` for exit codes, `[[ =~ ]]` for regex matching
+**Tags:** terraform, plan, basic, args, precondition, config, error
+**Fixtures:** Create in `setup()`, clean in `teardown()`
+
+## Troubleshooting
+
+**CI/local mismatch:** Check `teardown()` cleanup and committed test fixtures.
+
+## Resources
+
+- [BATS Documentation](https://bats-core.readthedocs.io/en/stable/)
+- [Writing BATS Tests](https://bats-core.readthedocs.io/en/stable/writing-tests.html)
+- [Task Documentation](https://taskfile.dev/)
diff --git a/tests/terraform_plan.bats b/tests/terraform_plan.bats
new file mode 100755
index 0000000..176ed3b
--- /dev/null
+++ b/tests/terraform_plan.bats
@@ -0,0 +1,60 @@
+#!/usr/bin/env bats
+# Test suite for terraform:plan task command
+
+setup() {
+  cd "$(dirname "$BATS_TEST_FILENAME")/.."
+  export TEST_WORKSPACE="test-env"
+  mkdir -p tfvars backend-configurations
+  touch "tfvars/${TEST_WORKSPACE}.tfvars"
+  touch "backend-configurations/${TEST_WORKSPACE}.backend.tf"
+}
+
+teardown() {
+  rm -rf tfvars backend-configurations
+}
+
+# bats test_tags=terraform,plan,basic
+@test "terraform:plan generates correct command with workspace" {
+  run task -v -n tf:plan -- "$TEST_WORKSPACE"
+
+  echo "Output: $output" >&3
+
+  [ "$status" -eq 0 ]
+  [[ "$output" =~ terraform.*workspace.*select.*-or-create.*${TEST_WORKSPACE} ]]
+  [[ "$output" =~ terraform.*plan.*-var-file.*tfvars/${TEST_WORKSPACE}.tfvars ]]
+}
+
+# bats test_tags=terraform,plan,args
+@test "terraform:plan passes additional arguments to terraform" {
+  run task -v -n tf:plan -- "$TEST_WORKSPACE" -out=tfplan.out -lock=false
+
+  echo "Output: $output" >&3
+
+  [ "$status" -eq 0 ]
+  [[ "$output" =~ -out=tfplan.out ]]
+  [[ "$output" =~ -lock=false ]]
+  [[ "$output" =~ -var-file.*tfvars/${TEST_WORKSPACE}.tfvars ]]
+}
+
+# bats test_tags=terraform,plan,precondition
+@test "terraform:plan fails when tfvars file does not exist" {
+  rm -f "tfvars/${TEST_WORKSPACE}.tfvars"
+
+  run task -v -n tf:plan -- "$TEST_WORKSPACE"
+
+  echo "Output: $output" >&3
+
+  [ "$status" -ne 0 ]
+  [[ "$output" =~ "Variables file does not exist" ]]
+}
+
+# bats test_tags=terraform,plan,config
+@test "terraform:plan uses terraform when USE_TERRAFORM=true" {
+  run env USE_TERRAFORM=true task -v -n tf:plan -- "$TEST_WORKSPACE"
+
+  echo "Output: $output" >&3
+
+  [ "$status" -eq 0 ]
+  [[ "$output" =~ \[tf:plan\]\ terraform\ workspace\ select ]]
+  [[ "$output" =~ \[tf:plan\]\ terraform\ plan ]]
+}