Enforce the C# coverage floors in CI and add a Pester gate for scripts/vscode

[drmoisan]

Enforce the C# coverage floors in CI and add a Pester gate for scripts/vscode

Summary

• Adds a C# branch-coverage assertion at 75 percent and wires it into the coverage entry point immediately after the existing line assertion, so both floors are evaluated on every run.
• Rewrites the MSTest coverage workflow to run scripts/vscode/Invoke-MSTestWithCoverage.ps1 instead of an inline vstest.console.exe block, which is what makes the pre-existing 80 percent line assertion actually execute in CI.
• Adds .github/workflows/_pester.yml, a new reusable callee that runs the tests/scripts/vscode suite with JaCoCo coverage and fails the job below an 80 percent LINE figure or on any test failure.
• Guards the top-level bodies of Invoke-VSBuild.ps1 and Invoke-Restore.ps1 behind extracted main functions, so dot-sourcing them in a test no longer builds the solution or rewrites project files.
• Raises scripts/vscode line coverage from 78.90 percent to 83.93 percent, clearing the floor the new gate enforces.
• One acceptance criterion is intentionally left unchecked: the live check-run context name cannot be captured until a pull request run exists.

Why

Two coverage gates were specified but not enforced. The MSTest workflow produced a Cobertura document through an inline vstest invocation that never reached the threshold assertion, so the 80 percent line floor existed in code and was never evaluated by CI. No PowerShell coverage gate existed at all, despite scripts/vscode carrying the repository's build, restore, test and coverage tooling.

A second, narrower defect blocked the PowerShell gate from being added safely. Invoke-VSBuild.ps1 and Invoke-Restore.ps1 executed their work at file scope, so any Pester file that dot-sourced them ran a real build and, through the package-reference sync script, rewrote .csproj files in the working tree. Coverage of those scripts was therefore both unmeasurable and destructive to measure. Extracting the bodies behind an invocation guard is what makes the measurement deterministic, which the determinism proof in this change demonstrates against the pre-change per-file counters.

What Changed

CI workflows

• .github/workflows/_mstest-coverage.yml — replaces the inline vstest block with a single pwsh step invoking the coverage entry point; pins the dotnet-coverage install version; repoints the artifact upload at coverage/coverage.cobertura.xml and changes the no-files behaviour from warn to error.
• .github/workflows/_pester.yml — new reusable callee: windows-latest, 10-minute job timeout, contents: read, both workflow_call and workflow_dispatch, no concurrency block, pinned Pester 5.x install and import, artifact upload with if-no-files-found: error.
• .github/workflows/ci.yml — adds the pester caller job in the existing leading-dot relative form.
• .github/workflows/README.md — updates the gate table, records both pinned tool versions, and adds the new required check-run context. The prior claim that the vstest invocation was moved rather than edited is withdrawn, because this change deliberately replaces it and thereby changes the gate's pass criterion.

Production PowerShell

• scripts/vscode/Invoke-MSTestWithCoverage.Threshold.ps1 — adds Assert-CoberturaBranchCoverageThreshold, with distinct terminating messages for a missing rate, a non-numeric rate, a rate outside the closed unit interval, zero valid branches, and a below-floor rate.
• scripts/vscode/Invoke-MSTestWithCoverage.ps1 — one statement, calling the branch assertion on the same post-processed document, immediately after the line assertion and before the first-party report.
• scripts/vscode/Invoke-VSBuild.ps1 — body extracted into Invoke-VSBuildMain behind an invocation guard; three wrapper seams (Get-MSBuildPath, Invoke-SyncPackageReferences, Invoke-MSBuildExe). Guard order, guard messages and the argument list are unchanged.
• scripts/vscode/Invoke-Restore.ps1 — the same pattern via Invoke-RestoreMain, with deliberately distinct seam names (Get-RestoreMSBuildPath, Invoke-RestoreMSBuildExe) because Pester runs every container in one runspace and same-named functions dot-sourced from two files would shadow each other.

Tests

New: Invoke-Restore.Tests.ps1, TestProcessCleanup.Tests.ps1. Extended: the threshold, assembly-discovery, merge, SDK-install, main and VSBuild suites. Repaired: three files whose mocked post-processed Cobertura document carried no branch-rate and which the new assertion would otherwise turn red.

Documentation and evidence

Feature documents and the full per-phase evidence tree, including fail-before artifacts for every regression test and negative-path proofs for both gates.

Architecture / How It Fits Together

ci.yml calls both reusable callees. The MSTest callee runs the coverage entry point, which collects via dotnet-coverage, post-processes the Cobertura document, then evaluates the line assertion and the new branch assertion against the document root before emitting the first-party report and the JaCoCo projection. The Pester callee builds a Pester configuration over tests/scripts/vscode with coverage scoped to scripts/vscode, writes JaCoCo to an explicit path, prints the counts and the measured figure, and only then evaluates its exit condition — the explicit exit is placed after the figure-emitting statements so a failure is always diagnosable from the log.

Note that the C# gate is judged on the document-root attributes, which are computed over every package surviving third-party removal. The First-party coverage: line the run prints is computed over the first-party allowlist and is a different denominator. Both are recorded, labelled, and compared only like with like.

Verification

Completed in this change. All figures below come from the final toolchain pass, which completed cleanly in a single pass.

Gate	Threshold	Result
PowerShell LINE, scripts/vscode	80 percent	83.93 percent (731/871)
New PowerShell code	90 percent	98.36 percent (60/61)
C# line, document root	80 percent	85.88 percent
C# branch, document root	75 percent	80.05 percent, 17022 valid branches

• Pester 5.6.1: 174 passed, 0 failed, 0 skipped.
• PSScriptAnalyzer: 16 diagnostics, equal to the recorded baseline; the four diagnostics naming a write-set path are byte-identical by rule and file to the baseline rows.
• PoshQC formatter: rewrote no file, established from before-and-after porcelain rather than from the exit code.
• actionlint: exit 0 across the eight workflow files now present.
• CSharpier check: 1639 files, unformatted list identical to the baseline list. No C# source file is modified by this change.
• Both gates were additionally proven to fail closed: a below-floor branch projection and a zero-valid-branch projection each produce a non-zero exit, and the Pester gate goes red both on reduced coverage and on a failing test case.

Recommended for the reviewer.

pwsh -NoProfile -ExecutionPolicy Bypass -File scripts/vscode/Invoke-MSTestWithCoverage.ps1 -SearchRoot . -Configuration Debug
pwsh -NoProfile -ExecutionPolicy Bypass -File scripts/dev-tools/run-actionlint.ps1

Backward Compatibility / Migration Notes

• No public API changes. No C# source, project, properties or targets file is modified.
• The MSTest coverage job's pass criterion changes: it can now fail on coverage where previously it could not.
• CI adopts the runsettings the local script passes, which declares class-level test scope with one worker per core. This is accepted for the first run; any new failure should be treated as a finding rather than a flake.
• The trx logger is no longer passed, because the script's argument builder does not pass it. The artifact upload is repointed at the Cobertura document accordingly.
• Requires a maintainer action outside this change: the branch ruleset must add the one new required context. The change adds exactly one new context, not two — the C# branch assertion changes no job name.

Risks and Mitigations

• A new gate can turn CI red on unrelated work. Both floors were measured against the current tree with margin before being enforced, and the delivery raises the PowerShell figure well past the floor rather than setting the floor to fit the tree.
• Class-level parallelization is new to CI. Recorded explicitly as an accepted behaviour change with the two runsettings values it depends on quoted.
• Rollback is a straight revert. The gates are additive; reverting restores the prior non-enforcing behaviour without touching production C#.

Review Guide

1. scripts/vscode/Invoke-MSTestWithCoverage.Threshold.ps1 and the single call site — the smallest and most load-bearing diff.
2. .github/workflows/_pester.yml, particularly the ordering of the exit statement relative to the figure-emitting statements.
3. scripts/vscode/Invoke-VSBuild.ps1 and Invoke-Restore.ps1 — the largest production diffs, but mechanical extraction; guard order and messages are unchanged.
4. Test files — largest by line count and the noisiest part of the diff.
5. The evidence tree, if you want the measured basis for any figure quoted above.

Follow-ups

• The live check-run context name is not yet captured, because no run exists against the head SHA until this pull request opens. One acceptance criterion remains unchecked for that reason, and the evidence artifact records the exact query to re-run.
• A pre-existing analyzer reference skew was found while building this branch and is not addressed here, because every affected file is a .csproj and therefore outside this change's declared write set. Fifteen project files carry an unconditional analyzer item naming Meziantou.Analyzer.3.0.203 while the restore manifests pin 3.0.235, so a clean clone fails to build. CI does not currently surface this, because the NuGet cache step uses a prefix fallback key that carries the older package forward. It warrants its own issue.

GitHub Auto-close

• None. GitHub validation was unavailable when this body was generated, and the context bundle recorded no verified closing issue, so no auto-close bullet is emitted. Issues CI collects coverage but enforces no threshold: _mstest-coverage.yml never converts to Cobertura or compares a floor #561, No Pester job in CI: production PowerShell under scripts/vscode has zero CI coverage #562 and Bug: ci-coverage-threshold-and-pester-gates #869 are the tracking items for this work and should be resolved manually after merge, once the remaining acceptance criterion is confirmed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Mok2zkoP23ArYqAjHvRqd1