[Chris-Wolfgang]

Part of #307

Configuration-only PR (protected files only): syncs two merged repo-template changes.

Changes

.github/workflows/pr.yaml (Stage 1) — from Chris-Wolfgang/repo-template#654 (48c7e2b)

• Stage 1 runs every test project; the -not -name "*.Tests.Integration.*" exclusion and its "excluded from the coverage gate" notice are removed.
• Each test project that runs appends its assembly name (<AssemblyName> or the project file basename) to $RUNNER_TEMP/stage1-ran-test-assemblies.txt.
• "Check for coverage files" fails when tests ran but no coverage.cobertura.xml was produced (previously it set has-coverage=false and every later coverage step was skipped, green).
• The coverage gate fails for any assembly that ran but has no row in CoverageReport/Summary.txt (exact module-name match, not a prefix match).

scripts/build-pr.ps1 — from Chris-Wolfgang/repo-template#656 (2151df4)

• New Restore-LocalTools helper (dotnet tool restore once per run).
• ReportGenerator and DevSkim run as pinned local tools (dotnet reportgenerator, dotnet devskim) instead of global lookups with unversioned dotnet tool install -g fallbacks.
• A DevSkim non-zero exit now fails the step (previously a DevSkim that never ran reported "No security issues found").

Adaptations

None. Both template hunks applied with git apply (line offsets only, no conflicts); repo-specific content is untouched.

Verification (local, no CI)

• pr.yaml parses with PyYAML (9 jobs).
• Every run: step extracted with its resolved shell: 29 bash steps pass bash -n, 9 pwsh steps parse with 0 errors.
• Changed steps: "Run tests with coverage" runs under explicit shell: bash (pipefail), so the new asm=$(grep ... || true) line is guarded for the no-<AssemblyName> case; "Check for coverage files" and "Enforce 90% coverage threshold" run under the implicit bash -e (no pipefail) and add no pipelines whose status matters.
• The asm= extraction was run under set -eo pipefail against a csproj with and without <AssemblyName>, and the awk row check against a summary where one module name is a prefix of another.
• scripts/build-pr.ps1 parses with 0 errors; .config/dotnet-tools.json already pins dotnet-reportgenerator-globaltool and microsoft.cst.devskim.cli.
• None of this proves runner behaviour or tool availability on the runner.

On this PR / after merge

pr.yaml here runs on pull_request, using the PR's own copy of the workflow, so this PR's own Stage 1 already exercises the new gate. The repo has no *.Tests.Integration* project, so the visible change is the new ran-assembly ledger and the two new failure paths.

Open Dependabot PR #303 also edits .github/workflows/pr.yaml (action pins); whichever merges second may need a rebase.

Round 2 (2026-10-04)

Two more merged repo-template changes, protected files only:

• repo-template#701, .github/workflows/pr.yaml Stage 2 (Windows): *.Tests.Integration.* projects are skipped after TFM discovery, as on Stage 3. Stage 1 (Linux) runs and gates them. An integration TFM that Stage 1 cannot run still gets the "TFM(s) not covered by any CI stage" warning. Applied with git apply with no drift. This repo has no integration project today, so nothing is skipped yet.
• repo-template#702, coverlet.runsettings: the file is replaced with the template's, adapting for drift. <Exclude> was already only [*]AutoGeneratedProgram, but ExcludeByFile was ;-separated (**/bin/**/*.cs;**/obj/**/*.cs, one pattern that matches nothing), and ExcludeByAttribute lacked GeneratedCode. Both lists are now comma-separated, with **/*.g.cs and GeneratedCode added. The AotSmoke-specific comment is replaced by the template's comment.

Verified: pr.yaml parses with PyYAML; the changed Stage 2 step (pwsh) parses with 0 errors.

Impact, measured locally (Release, net8.0 + net10.0, #314's head a1aa6ef + each runsettings): no change. src 100%, Tests.DocExamples 100%, Tests.Fuzz 100%, Tests.Unit 100% under both the old and the new file.

Merge order: #314 first, then this PR.

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟢 Approval recommended

The changes correctly implement the linked template updates without introducing unresolved issues.

Review effort: Balanced
Findings: None

What changed in this PR

Syncs protected CI tooling with the repository template to prevent silent coverage and security-scan passes.

Changes:

• Tracks executed test assemblies and fails when coverage is missing.
• Uses pinned local ReportGenerator and DevSkim tools.
• Propagates DevSkim execution failures.

File	Description
.github/​workflows/​pr.yaml	Strengthens Stage 1 test and coverage enforcement.
scripts/​build-pr.ps1	Restores and runs pinned local analysis tools.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.