1, 2, & 3
In most cases, I'm okay with them having the tests ahead of time. The only thing that concerns me a bit is that they can edit the tests, and GitHub would use those.
What I do, and it's typically only on larger weight assignments, is to download all of the repositories. I'll then copy either a clean copy of the test files or a new set of test ...
In the auto grader I use, the following process is followed:
The students files are copied into a pristine work area
The "provided" file(s) are removed from the work area
If I intend to use MOSS, the remaining files are copied for later use
The "provided" file(s) are copied into the work directory
The result is built (if necessary)