diff --git a/action.yml b/action.yml
index 87e09ef..86e1a77 100644
--- a/action.yml
+++ b/action.yml
@@ -15,6 +15,11 @@ runs:
       shell: bash
       run: |
         uv python install 3.12
+    - name: Install bats
+      shell: bash
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y bats bats-support bats-assert
     - name: Checkout jumpstarter controller
       uses: actions/checkout@v4
       with:
@@ -77,7 +82,7 @@ runs:
     - name: Run jumpstarter
       shell: bash
       run: |
-        ENDPOINT=$(helm get values jumpstarter --output json | jq -r '."jumpstarter-controller".grpc.endpoint')
+        export ENDPOINT=$(helm get values jumpstarter --output json | jq -r '."jumpstarter-controller".grpc.endpoint')
 
         sudo mkdir -p /etc/jumpstarter/exporters
         sudo chown $USER /etc/jumpstarter/exporters
@@ -89,95 +94,4 @@ runs:
         kubectl create -n default sa test-client-sa
         kubectl create -n default sa test-exporter-sa
 
-        jmp admin create client   test-client-oidc     --unsafe --out /dev/null \
-          --oidc-username dex:test-client-oidc
-        jmp admin create client   test-client-sa       --unsafe --out /dev/null \
-          --oidc-username dex:system:serviceaccount:default:test-client-sa
-        jmp admin create client   test-client-legacy   --unsafe --save
-
-        jmp admin create exporter test-exporter-oidc   --out /dev/null \
-          --oidc-username dex:test-exporter-oidc \
-          --label example.com/board=oidc
-        jmp admin create exporter test-exporter-sa     --out /dev/null \
-          --oidc-username dex:system:serviceaccount:default:test-exporter-sa \
-          --label example.com/board=sa
-        jmp admin create exporter test-exporter-legacy --save \
-          --label example.com/board=legacy
-
-        jmp config client   list
-        jmp config exporter list
-
-        jmp login --client test-client-oidc \
-          --endpoint "$ENDPOINT" --namespace default --name test-client-oidc \
-          --issuer https://dex.dex.svc.cluster.local:5556 \
-          --username test-client-oidc@example.com --password password --unsafe
-
-        jmp login --client test-client-sa \
-          --endpoint "$ENDPOINT" --namespace default --name test-client-sa \
-          --issuer https://dex.dex.svc.cluster.local:5556 \
-          --connector-id kubernetes \
-          --token $(kubectl create -n default token test-client-sa) --unsafe
-
-        jmp login --exporter test-exporter-oidc \
-          --endpoint "$ENDPOINT" --namespace default --name test-exporter-oidc \
-          --issuer https://dex.dex.svc.cluster.local:5556 \
-          --username test-exporter-oidc@example.com --password password
-
-        jmp login --exporter test-exporter-sa \
-          --endpoint "$ENDPOINT" --namespace default --name test-exporter-sa \
-          --issuer https://dex.dex.svc.cluster.local:5556 \
-          --connector-id kubernetes \
-          --token $(kubectl create -n default token test-exporter-sa)
-
-        go run github.com/mikefarah/yq/v4@latest -i ". * load(\"$GITHUB_ACTION_PATH/exporter.yaml\")" \
-          /etc/jumpstarter/exporters/test-exporter-oidc.yaml
-        go run github.com/mikefarah/yq/v4@latest -i ". * load(\"$GITHUB_ACTION_PATH/exporter.yaml\")" \
-          /etc/jumpstarter/exporters/test-exporter-sa.yaml
-        go run github.com/mikefarah/yq/v4@latest -i ". * load(\"$GITHUB_ACTION_PATH/exporter.yaml\")" \
-          /etc/jumpstarter/exporters/test-exporter-legacy.yaml
-
-        jmp config client list
-        jmp config exporter list
-
-        jmp run --exporter test-exporter-oidc &
-        jmp run --exporter test-exporter-sa &
-        jmp run --exporter test-exporter-legacy &
-
-        kubectl -n default wait --for=condition=Online --for=condition=Registered exporters.jumpstarter.dev/test-exporter-oidc
-        kubectl -n default wait --for=condition=Online --for=condition=Registered exporters.jumpstarter.dev/test-exporter-sa
-        kubectl -n default wait --for=condition=Online --for=condition=Registered exporters.jumpstarter.dev/test-exporter-legacy
-
-        jmp config client use test-client-oidc
-
-        jmp create lease     --selector example.com/board=oidc --duration 1d
-        jmp get    leases
-        jmp get    exporters
-        jmp delete leases    --all
-
-        jmp admin get client
-        jmp admin get exporter
-        jmp admin get lease
-
-        jmp run --exporter test-exporter-oidc &
-        kubectl -n default wait --for=condition=Online --for=condition=Registered exporters.jumpstarter.dev/test-exporter-oidc
-
-        jmp shell --client test-client-oidc --selector example.com/board=oidc <<EOF
-        j power on
-        EOF
-
-        jmp shell --client test-client-sa --selector example.com/board=sa <<EOF
-        j power on
-        EOF
-
-        jmp shell --client test-client-legacy --selector example.com/board=legacy <<EOF
-        j power on
-        EOF
-
-        kubectl -n default get secret test-client-oidc-client
-        kubectl -n default get secret test-exporter-oidc-exporter
-
-        jmp admin delete client   test-client-oidc -d
-        jmp admin delete exporter test-exporter-oidc -d
-
-        ! kubectl -n default get secret test-client-oidc-client
-        ! kubectl -n default get secret test-exporter-oidc-exporter
+        bats --show-output-of-passing-tests --verbose-run "$GITHUB_ACTION_PATH"/tests.bats
diff --git a/tests.bats b/tests.bats
new file mode 100644
index 0000000..06d741f
--- /dev/null
+++ b/tests.bats
@@ -0,0 +1,161 @@
+setup() {
+  bats_load_library bats-support
+  bats_load_library bats-assert
+}
+
+@test "can create clients with admin cli" {
+  jmp admin create client   test-client-oidc     --unsafe --out /dev/null \
+    --oidc-username dex:test-client-oidc
+  jmp admin create client   test-client-sa       --unsafe --out /dev/null \
+    --oidc-username dex:system:serviceaccount:default:test-client-sa
+  jmp admin create client   test-client-legacy   --unsafe --save
+}
+
+@test "can create exporters with admin cli" {
+  jmp admin create exporter test-exporter-oidc   --out /dev/null \
+    --oidc-username dex:test-exporter-oidc \
+    --label example.com/board=oidc
+  jmp admin create exporter test-exporter-sa     --out /dev/null \
+    --oidc-username dex:system:serviceaccount:default:test-exporter-sa \
+    --label example.com/board=sa
+  jmp admin create exporter test-exporter-legacy --save \
+    --label example.com/board=legacy
+}
+
+@test "can login with oidc" {
+  jmp config client   list
+  jmp config exporter list
+
+  jmp login --client test-client-oidc \
+    --endpoint "$ENDPOINT" --namespace default --name test-client-oidc \
+    --issuer https://dex.dex.svc.cluster.local:5556 \
+    --username test-client-oidc@example.com --password password --unsafe
+
+  jmp login --client test-client-sa \
+    --endpoint "$ENDPOINT" --namespace default --name test-client-sa \
+    --issuer https://dex.dex.svc.cluster.local:5556 \
+    --connector-id kubernetes \
+    --token $(kubectl create -n default token test-client-sa) --unsafe
+
+  jmp login --exporter test-exporter-oidc \
+    --endpoint "$ENDPOINT" --namespace default --name test-exporter-oidc \
+    --issuer https://dex.dex.svc.cluster.local:5556 \
+    --username test-exporter-oidc@example.com --password password
+
+  jmp login --exporter test-exporter-sa \
+    --endpoint "$ENDPOINT" --namespace default --name test-exporter-sa \
+    --issuer https://dex.dex.svc.cluster.local:5556 \
+    --connector-id kubernetes \
+    --token $(kubectl create -n default token test-exporter-sa)
+
+  go run github.com/mikefarah/yq/v4@latest -i ". * load(\"$GITHUB_ACTION_PATH/exporter.yaml\")" \
+    /etc/jumpstarter/exporters/test-exporter-oidc.yaml
+  go run github.com/mikefarah/yq/v4@latest -i ". * load(\"$GITHUB_ACTION_PATH/exporter.yaml\")" \
+    /etc/jumpstarter/exporters/test-exporter-sa.yaml
+  go run github.com/mikefarah/yq/v4@latest -i ". * load(\"$GITHUB_ACTION_PATH/exporter.yaml\")" \
+    /etc/jumpstarter/exporters/test-exporter-legacy.yaml
+ 
+  jmp config client   list
+  jmp config exporter list
+}
+
+@test "can run exporters" {
+  cat <<EOF | bash 3>&- &
+while true; do
+  jmp run --exporter test-exporter-oidc
+done
+EOF
+
+  cat <<EOF | bash 3>&- &
+while true; do
+  jmp run --exporter test-exporter-sa
+done
+EOF
+
+  cat <<EOF | bash 3>&- &
+while true; do
+  jmp run --exporter test-exporter-legacy
+done
+EOF
+
+  kubectl -n default wait --for=condition=Online --for=condition=Registered \
+    exporters.jumpstarter.dev/test-exporter-oidc
+  kubectl -n default wait --for=condition=Online --for=condition=Registered \
+    exporters.jumpstarter.dev/test-exporter-sa
+  kubectl -n default wait --for=condition=Online --for=condition=Registered \
+    exporters.jumpstarter.dev/test-exporter-legacy
+}
+
+@test "can specify client config only using environment variables" {
+  kubectl -n default wait --for=condition=Online --for=condition=Registered \
+    exporters.jumpstarter.dev/test-exporter-oidc
+
+  JMP_NAMEPSACE=default \
+  JMP_NAME=test-exporter-legacy \
+  JMP_ENDPOINT=$(kubectl get clients.jumpstarter.dev -n default test-client-legacy -o 'jsonpath={.status.endpoint}') \
+  JMP_TOKEN=$(kubectl get secrets -n default test-client-legacy-client -o 'jsonpath={.data.token}' | base64 -d) \
+  jmp shell --selector example.com/board=oidc j power on
+}
+
+@test "can operate on leases" {
+  kubectl -n default wait --for=condition=Online --for=condition=Registered \
+    exporters.jumpstarter.dev/test-exporter-oidc
+
+  jmp config client use test-client-oidc
+
+  jmp create lease     --selector example.com/board=oidc --duration 1d
+  jmp get    leases
+  jmp get    exporters
+  jmp delete leases    --all
+}
+
+@test "can lease and connect to exporters" {
+  kubectl -n default wait --for=condition=Online --for=condition=Registered \
+    exporters.jumpstarter.dev/test-exporter-oidc
+  kubectl -n default wait --for=condition=Online --for=condition=Registered \
+    exporters.jumpstarter.dev/test-exporter-sa
+  kubectl -n default wait --for=condition=Online --for=condition=Registered \
+    exporters.jumpstarter.dev/test-exporter-legacy
+
+  jmp shell --client test-client-oidc   --selector example.com/board=oidc   j power on
+  jmp shell --client test-client-sa     --selector example.com/board=sa     j power on
+  jmp shell --client test-client-legacy --selector example.com/board=legacy j power on
+}
+
+@test "can get crds with admin cli" {
+  jmp admin get client
+  jmp admin get exporter
+  jmp admin get lease
+}
+
+@test "can delete clients with admin cli" {
+  kubectl -n default get secret test-client-oidc-client
+  kubectl -n default get clients.jumpstarter.dev/test-client-oidc
+  kubectl -n default get clients.jumpstarter.dev/test-client-sa
+  kubectl -n default get clients.jumpstarter.dev/test-client-legacy
+
+  jmp admin delete client   test-client-oidc   --delete
+  jmp admin delete client   test-client-sa     --delete
+  jmp admin delete client   test-client-legacy --delete
+
+  run ! kubectl -n default get secret test-client-oidc-client
+  run ! kubectl -n default get clients.jumpstarter.dev/test-client-oidc
+  run ! kubectl -n default get clients.jumpstarter.dev/test-client-sa
+  run ! kubectl -n default get clients.jumpstarter.dev/test-client-legacy
+}
+
+@test "can delete exporters with admin cli" {
+  kubectl -n default get secret test-exporter-oidc-exporter
+  kubectl -n default get exporters.jumpstarter.dev/test-exporter-oidc
+  kubectl -n default get exporters.jumpstarter.dev/test-exporter-sa
+  kubectl -n default get exporters.jumpstarter.dev/test-exporter-legacy
+
+  jmp admin delete exporter test-exporter-oidc   --delete
+  jmp admin delete exporter test-exporter-sa     --delete
+  jmp admin delete exporter test-exporter-legacy --delete
+
+  run ! kubectl -n default get secret test-exporter-oidc-exporter
+  run ! kubectl -n default get exporters.jumpstarter.dev/test-exporter-oidc
+  run ! kubectl -n default get exporters.jumpstarter.dev/test-exporter-sa
+  run ! kubectl -n default get exporters.jumpstarter.dev/test-exporter-legacy
+}