diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 7661bb86..29f7b738 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -4,12 +4,18 @@ on:
   push:
   pull_request:
 
+concurrency:  # Cancel pending and in-progress workflows for the same PR, branch or tag:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+env:
+  # No warnings for pip and pytest themselves; pytest enables warnings in conftest.py
+  PYTHONWARNINGS: ignore
+  # Development Mode for stronger checks: https://docs.python.org/3/library/devmode.html
+  PYTHONDEVMODE: yes
 jobs:
   python-checks:
     name: Python checks
     runs-on: ubuntu-20.04
-    strategy:
-      fail-fast: false
     steps:
       - name: Checkout code
         uses: actions/checkout@v3
@@ -17,12 +23,14 @@ jobs:
       - name: Install dependencies
         run: |
           #: Install Python 2.7 from Ubuntu 20.04 using apt-get install
-          sudo apt-get update && sudo apt-get install -y python2-dev
-          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
-          if [ -f requirements-dev.txt ]; then pip install -r requirements-dev.txt; fi
-          pip install pylint==1.9.4
+          sudo apt-get update && sudo apt-get install -y python2
+          curl -sSL https://bootstrap.pypa.io/pip/2.7/get-pip.py -o get-pip.py
+          python2 get-pip.py
+          if [ -f requirements.txt ]; then pip2 install -r requirements.txt; fi
+          if [ -f requirements-dev.txt ]; then pip2 install -r requirements-dev.txt; fi
+          pip2 install pylint==1.9.4
 
       - name: Run pylint-1.9.4 for pylint --py3k linting (configured in .pylintrc)
-        if: ${{ matrix.python-version == 2.7 }}
-        run: |
-          pylint xen-bugtool
+        run: python2 -m pylint xen-bugtool
+      - name: Run python2 -m pytest to execute unit tests
+        run: python2 -m pytest
diff --git a/.pylintrc b/.pylintrc
index ac4d321e..273cf59f 100644
--- a/.pylintrc
+++ b/.pylintrc
@@ -92,7 +92,7 @@ max-attributes=11
 
 # Maximum number of branch for function / method body.
 # defaults to: max-branches=12
-max-branches=62
+max-branches=64
 
 # Maximum number of locals for function / method body.
 # defaults to: max-locals=15
@@ -177,9 +177,13 @@ disable=anomalous-backslash-in-string,
         too-few-public-methods,
         too-many-lines,
         too-many-locals,
+        # Skip complaining about checkers only present in newer pylint for Python3
+        unknown-option-value,
         unspecified-encoding,
         unused-argument,
         use-set-for-membership,
+        # Skip complaining about checkers only present in older pylint for Python2
+        useless-option-value,
         wrong-import-order,
         # Py2 compat: Python2 requires calls to super() to have it's arguments:
         super-with-arguments,
diff --git a/requirements-dev.txt b/requirements-dev.txt
new file mode 100644
index 00000000..e079f8a6
--- /dev/null
+++ b/requirements-dev.txt
@@ -0,0 +1 @@
+pytest
diff --git a/tests/unit/test_xapidb_filter.py b/tests/unit/test_xapidb_filter.py
new file mode 100644
index 00000000..ec42f25b
--- /dev/null
+++ b/tests/unit/test_xapidb_filter.py
@@ -0,0 +1,59 @@
+# This uses the deprecated imp module because it has to run with Python2.7 for now:
+import imp  # pylint: disable=deprecated-module
+import os
+import xml.dom.minidom
+
+
+testdir = os.path.dirname(__file__)
+bugtool = imp.load_source("bugtool", testdir + "/../../xen-bugtool")
+original = r"""<?xml version="1.0" ?>
+<root>
+    <table name="secret">
+        <row id="1">
+            <value>mysecretpassword</value>
+        </row>
+        <row id="2">
+            <value>anotherpassword</value>
+        </row>
+    </table>
+    <table name="Cluster">
+        <row id="1">
+            <cluster_token>cluster_password</cluster_token>
+        </row>
+    </table>
+    <table name="VM">
+        <row id="1"
+        NVRAM="(('EFI-variables'%.'myprivatedata'))"
+        snapshot_metadata="('NVRAM'%.'(('_%.'_')%.(\'EFI-variables\'%.\'mydata\')()">
+        </row>
+    </table>
+</root>
+"""
+
+# Same as original, but with passwords and private data replaced by: "REMOVED"
+expected = r"""<?xml version="1.0" ?>
+<root>
+    <table name="secret">
+        <row id="1" value="REMOVED">
+            <value/>
+        </row>
+        <row id="2" value="REMOVED">
+            <value/>
+        </row>
+    </table>
+    <table name="Cluster">
+        <row cluster_token="REMOVED" id="1">
+            <cluster_token/>
+        </row>
+    </table>
+    <table name="VM">
+        <row NVRAM="(('EFI-variables'%.'REMOVED'))" id="1" snapshot_metadata="('NVRAM'%.'(('_%.'_')%.(\'EFI-variables\'%.\'REMOVED\')()"/>
+    </table>
+</root>
+"""
+
+
+def test_xapi_database_filter():
+    """Assert that bugtool.DBFilter().output() filters the xAPI database as expected"""
+    filtered = bugtool.DBFilter(original).output()
+    assert xml.dom.minidom.parseString(filtered).toprettyxml(indent="    ") == expected