[Chris-Wolfgang]

Summary

Refs #308. Protected file only (.github/workflows/pr.yaml). First PR of the CI series, stacked on the security PR #345 because the Dependabot series below it also edits pr.yaml (merge #341 -> #342 -> #343 -> #344 -> #345 first). #308 needs a manual close after merge.

Status of the three items in #308 on this repo, checked against pr.yaml:

1. Coverage gate skipped silently when no coverage file appears. Stage 1 already fails (synced from repo-template in ci: sync Stage 1 coverage gate and build-pr.ps1 local tools from repo-template #313). Stage 2 (Windows) still skipped: it now records the test assemblies that ran a coverage-collecting framework in a ledger and fails with "Tests ran but produced no coverage files" instead of skipping.
2. InspectCode gate passes when it cannot read the SARIF. Fixed: set -euo pipefail, and explicit failures for a missing/empty inspect.sarif, a missing jq, and a non-numeric count.
3. A test assembly that ran but recorded no coverage drops out. Stage 1 already had the row check. Stage 2 gains it: new step "Every test assembly that ran must be in the coverage report" (exact module-name match, not prefix).

• "Stage 1 still excludes *.Tests.Integration.*": already fixed on main (ci: sync Stage 1 coverage gate and build-pr.ps1 local tools from repo-template #313); the remaining exclusion is Stage 3 (macOS, no Docker) by design.

Also: inspectcode-upload tests the PR author (github.event.pull_request.user.login) instead of github.actor for Dependabot, like every other Dependabot guard in the file.

The file is ICollection-Extensions #341's (repo-template's) pr.yaml; the only other difference between the two repos' files was the upload-sarif pin, kept at this branch's v4.39.0.

Verification

Verified locally; CI blocked by the account billing lock.

• actionlint -shellcheck= exit 0; zizmor --offline no findings.
• All 39 run: steps syntax-checked (bash -n / PowerShell Parser::ParseFile): 0 failures.
• InspectCode gate extracted and run: SARIF missing -> exit 1; empty -> 1; malformed -> 5 (jq parse error); clean -> 0; one error-level result -> 1; jq not on PATH -> 1.
• Stage 2 row check extracted and run against a real CoverageReport/Summary.txt from a local build-pr.ps1 run: real ledger (Unit, Fuzz, DocExamples) -> 0; a claimed-but-absent Tests.Integration row -> 1; a name that is a prefix of a real row (...Tests) -> 1; empty ledger -> 1; missing ledger -> 1; missing Summary.txt -> 1.

🤖 Generated with Claude Code