fix(ci): separate dotnet unit and integration event selection

[Vincent Biret (baywet)]

Motivation & Context

.NET unit checks should remain available for all pull requests and merge-queue runs. Integration checks should also run before merging eligible repository PRs and reviewer-approved merge groups, while direct fork and Dependabot-triggered PR runs remain unit-only.

Description & Review Guide

• What are the major changes? Separate unit and integration jobs while reusing their steps through a YAML anchor. Select integration and Foundry hosted checks for same-repository PRs except Dependabot-triggered runs, merge groups, and configured push, scheduled, and manual runs, without an additional main/feature ref restriction. Keep coverage with the unit job and connect integration results to the final status and report. Serialize the dedicated Foundry hosted job across runs because its scenario-agent endpoints are shared.
• What is the impact of these changes? Eligible same-repository PRs and merge groups retain integration checks before merging, including queued fork and Dependabot PRs after reviewer approval. Direct fork PRs and Dependabot-triggered PR runs do not select integration jobs; the latter lack ordinary Actions credentials. Branch and merge-queue runs continue starting local emulators for unit tests independently of path-specific changes. Foundry hosted jobs use one noncanceling concurrency group with queue: max (up to 100 pending jobs), avoiding cross-run deployment interference without replacing older pending checks. Other jobs remain parallel.
• What do you want reviewers to focus on? Event and branch selection, per-job configuration, and coverage/result dependencies.

Validation:
node --test .github\tests\*.js passed (78 existing tests).
git diff --check passed.
actionlint -shellcheck= -ignore 'unknown permission scope "code-quality"' -ignore 'unexpected key "queue" for "concurrency" section' .github\workflows\dotnet-build-and-test.yml .github\workflows\github-automation-tests.yml passed. The installed actionlint v1.7.12 reports the same existing code-quality permission diagnostic on both the base revision and this change, and does not yet recognize concurrency.queue. The latter was checked against GitHub's documented job-concurrency syntax and the repository's existing queue: max usage.
Live integration tests were not run locally.
Local selection checks passed for 118 event, source-repository, ref, path-change, and emulator cases.
Additional temporary checks reproduced both Dependabot selectors failing before the correction and passed afterward for 120 event, actor, source-repository, ref, and path combinations, including Dependabot merge groups.
A temporary Foundry scheduling-declaration check failed before the job-level concurrency configuration and passed afterward; actual cross-run scheduling is enforced by GitHub Actions, not simulated locally.
GitHub Actions validation on 9fd1bf55fd1aad789013c8d390b5974703da515e passed: all four builds, both unit-test jobs, both integration-test jobs, the Foundry hosted job, coverage upload, integration report, and required aggregate checks. See the .NET workflow run. CodeQL passed and coverage remained at 86%.
Workflow-specific unit tests used during development were removed at the maintainer's request; they are not part of this change.

Related Issue

N/A - maintainer-directed workflow correction; no public issue. No competing open pull request was found in the checked scope.

AI Assistance

• No material AI assistance was used.
• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details: Copilot assisted with workflow analysis, implementation, validation, and this PR description.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and the title prefix in sync automatically.

[Copilot]

🟡 Changes recommended

The split skips Azurite-dependent unit tests on branch runs without Azure Storage-specific changes.

1 open finding

• Linux unit job disables Azurite and skips Azure storage tests · New

What changed in this PR

Separates .NET unit and integration checks so pull requests and merge-queue runs retain unit validation without selecting integration jobs.

Changes:

• Splits jobs while sharing test steps through a YAML anchor.
• Restricts integration checks to configured branch events and updates result dependencies.
• Adds workflow regression tests and automation triggers.

File	Description
.github/​workflows/​github-automation-tests.yml	Triggers automation tests for .NET workflow changes.
.github/​workflows/​dotnet-build-and-test.yml	Separates test jobs, event gates, coverage, and reporting.
.github/​tests/​test_dotnet_build_and_test_workflow.js	Tests job selection, step conditions, and dependencies.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MAF Automated Review — Iteration 1

Result: No findings
Scope: full PR (2 commit(s)): 63fd65323535, eb6f5c977e24
Model: gpt-5.6-sol

Overview

The PR separates unprivileged unit checks from integration jobs while keeping their implementation aligned through a shared YAML anchor. Explicit event and branch gates, job-scoped OIDC permissions, integration-environment isolation, aggregate-result dependencies, and focused regression tests constrain the changed behavior. No publishable Critical, High, or Medium defect was established.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.

[Copilot]

🟢 Approval recommended

Event selection, job isolation, and reporting dependencies are consistent, with no unresolved blocking findings.

0 open findings

1 resolved since last review

• Linux unit job disables Azurite and skips Azure storage tests

🧠 Review effort: Balanced

[github-code-quality]

Code coverage overview

Languages: C#

C# / code-coverage/dotnet

main cae4955	fix/dotnet-integrati... 9fd1bf5	+/-
86%	86%	0%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

---

_{Updated October 15, 2026 15:10 UTC}

[Copilot]

🟢 Approval recommended

The event gates, job permissions, emulator conditions, and reporting dependencies are consistent, with no blocking issues identified.

0 open findings

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

Both integration selectors admit Dependabot PR runs without the Actions secrets needed for authentication, risking failed required checks.

1 open finding

• Exclude Dependabot PRs from jobs requiring unavailable credentials · New

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

Concurrent Foundry runs can share endpoints and test another run’s deployed image.

1 open finding

• Concurrent PR runs share hosted-agent versions via @​latest · New

1 resolved since last review

• Exclude Dependabot PRs from jobs requiring unavailable credentials

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

Expanded credentialed PR execution against shared infrastructure warrants human confirmation of environment protections and live scheduling behavior.

0 open findings

1 resolved since last review

• Concurrent PR runs share hosted-agent versions via @​latest

🧠 Review effort: Balanced