@plainconceptsplatform/workflows 0.28.12 → 0.28.14

package/loops/templates/ci/app-ci-dotnet-next.yml

@@ -1,330 +1,330 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/templates/ci/app-ci-dotnet-next.yml. Update with `workflows update --force`; consumer edits may be overwritten.
-name: "App: CI"
-
-on:
-  pull_request:
-  schedule:
-    - cron: "0 6 * * 1"
-  workflow_dispatch:
-  workflow_call:
-    secrets:
-      NPM_REGISTRY_TOKEN:
-        required: false
-
-env:
-  DOTNET_VERSION: "10.0.x"
-  NODE_VERSION: "22"
-  PNPM_VERSION: "10"
-  API_WORKING_DIRECTORY: apps/api
-  DOTNET_SOLUTION: App.slnx
-  UNIT_TEST_PROJECT: tests/App.UnitTests/App.UnitTests.csproj
-  PARITY_TEST_PROJECT: tests/App.ParityTests/App.ParityTests.csproj
-  INTEGRATION_TEST_PROJECT: tests/App.IntegrationTests/App.IntegrationTests.csproj
-  # Per-PR mutation gate. Stryker mutates only files changed since the PR base (--since),
-  # so a green unit suite that never actually pins behaviour fails here instead of shipping.
-  # dotnet-stryker is pinned in the api tools manifest (.config/dotnet-tools.json / dotnet-tools.json).
-  MUTATION_TARGET_PROJECT: src/App.Domain/App.Domain.csproj
-  MUTATION_TEST_PROJECT: tests/App.UnitTests/App.UnitTests.csproj
-  MUTATION_THRESHOLD: "60"
-  COVERAGE_SETTINGS: coverage.runsettings
-  COVERAGE_CHECK_COMMAND: node ../../scripts/check-coverage.mjs TestResults/merged/Cobertura.xml
-  MIGRATION_PROJECT: src/App.Infrastructure/App.Infrastructure.csproj
-  MIGRATION_STARTUP_PROJECT: src/App.Api/App.Api.csproj
-  SEED_PROJECT: src/App.Seed
-  PRIMARY_DATABASE: app
-  DATA_LAYER_DATABASE: numa_dl
-  # Derived per run rather than written down. The container is ephemeral, bound to a random
-  # host port and reachable only from this job, so the value protects nothing, but a literal
-  # password in a config file is a policy finding wherever it sits, and this file is public.
-  # It has to be a workflow-level expression: service containers receive their environment
-  # before any step runs, so a value generated in a step would arrive too late.
-  #
-  # The same expression is repeated inside the service's `options` above rather than read
-  # from here, because the `env` context is not available in `jobs.<id>.services` — only
-  # inside that service's own `env:`. Written as ${{ env.SQL_SA_PASSWORD }} there, the health
-  # check probes with an empty password and the service never reports healthy.
-  SQL_SA_PASSWORD: "Aa1!${{ github.run_id }}"
-  WEB_PACKAGE: "@app/web"
-  NPM_REGISTRY_URL: "//npm.pkg.github.com/"
-  TRUFFLEHOG_IMAGE: "trufflesecurity/trufflehog:latest"
-  SEMGREP_IMAGE: "semgrep/semgrep:1.168.0"
-  SBOM_ARTIFACT_NAME: app-sbom.cyclonedx.json
-  MIGRATION_CONTEXT: AppDbContext
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ci-${{ github.workflow }}-${{ github.head_ref || github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-jobs:
-  api:
-    name: API (.NET)
-    if: github.event_name != 'schedule'
-    runs-on: RunnerLandingZone
-    timeout-minutes: 30
-    services:
-      sqlserver:
-        image: mcr.microsoft.com/mssql/server:2022-latest
-        env:
-          ACCEPT_EULA: "Y"
-          MSSQL_SA_PASSWORD: ${{ env.SQL_SA_PASSWORD }}
-        ports:
-        # Ephemeral host port. Four runners share this machine, so a fixed 1433 means the
-        # second concurrent job fails at Initialize containers with "Docker start fail with
-        # exit code 1". Steps read the assigned port from the job.services context.
-          - 1433
-        options: >-
-          --health-cmd "/opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P 'Aa1!${{ github.run_id }}' -Q 'SELECT 1' -C || exit 1"
-          --health-interval 10s --health-timeout 5s --health-retries 12 --health-start-period 30s
-    defaults:
-      run:
-        working-directory: ${{ env.API_WORKING_DIRECTORY }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
-        with:
-          dotnet-version: ${{ env.DOTNET_VERSION }}
-      - name: Restore tools, solution, and build
-        run: |
-          dotnet tool restore
-          dotnet restore "$DOTNET_SOLUTION"
-          dotnet build "$DOTNET_SOLUTION" --no-restore -c Release
-      - name: Unit tests with coverage
-        run: dotnet test "$UNIT_TEST_PROJECT" --no-build -c Release --collect:"XPlat Code Coverage" --settings "$COVERAGE_SETTINGS" --results-directory TestResults
-      - name: Parity tests
-        run: dotnet test "$PARITY_TEST_PROJECT" --no-build -c Release
-      - name: Create test databases
-        run: |
-          for database in "$PRIMARY_DATABASE" "$DATA_LAYER_DATABASE"; do
-            docker exec ${{ job.services.sqlserver.id }} /opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P "$SQL_SA_PASSWORD" -C -Q "IF DB_ID('$database') IS NULL CREATE DATABASE [$database];"
-          done
-      - name: Apply migrations and seed test data
-        env:
-          ConnectionStrings__App: Server=localhost,${{ job.services.sqlserver.ports['1433'] }};Database=${{ env.PRIMARY_DATABASE }};User Id=sa;Password=${{ env.SQL_SA_PASSWORD }};TrustServerCertificate=true
-          DataLayer__ConnectionString: Server=localhost,${{ job.services.sqlserver.ports['1433'] }};Database=${{ env.DATA_LAYER_DATABASE }};User Id=sa;Password=${{ env.SQL_SA_PASSWORD }};TrustServerCertificate=true
-          DATALAYER_SEED: "true"
-        run: |
-          dotnet ef database update -p "$MIGRATION_PROJECT" -s "$MIGRATION_STARTUP_PROJECT" --context "$MIGRATION_CONTEXT"
-          dotnet run --project "$SEED_PROJECT" --no-build -c Release
-      - name: Integration tests with coverage
-        env:
-          ConnectionStrings__App: Server=localhost,${{ job.services.sqlserver.ports['1433'] }};Database=${{ env.PRIMARY_DATABASE }};User Id=sa;Password=${{ env.SQL_SA_PASSWORD }};TrustServerCertificate=true
-          DataLayer__ConnectionString: Server=localhost,${{ job.services.sqlserver.ports['1433'] }};Database=${{ env.DATA_LAYER_DATABASE }};User Id=sa;Password=${{ env.SQL_SA_PASSWORD }};TrustServerCertificate=true
-        run: dotnet test "$INTEGRATION_TEST_PROJECT" --no-build -c Release --collect:"XPlat Code Coverage" --settings "$COVERAGE_SETTINGS" --results-directory TestResults
-      - name: Enforce merged coverage floor
-        run: |
-          dotnet tool install --global dotnet-reportgenerator-globaltool
-          export PATH="$PATH:$HOME/.dotnet/tools"   # ephemeral ARC runners do not have dotnet tools on PATH
-          reportgenerator -reports:"TestResults/**/coverage.cobertura.xml" -targetdir:TestResults/merged -reporttypes:Cobertura
-          bash -c "$COVERAGE_CHECK_COMMAND"
-
-  mutation-api:
-    name: Mutation (.NET, diff)
-    if: github.event_name == 'pull_request'
-    runs-on: RunnerLandingZone
-    timeout-minutes: 25
-    defaults:
-      run:
-        working-directory: ${{ env.API_WORKING_DIRECTORY }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          # Stryker --since diffs against the PR base; it needs history, not a shallow tip.
-          fetch-depth: 0
-      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
-        with:
-          dotnet-version: ${{ env.DOTNET_VERSION }}
-      - name: Detect backend changes
-        id: scope
-        working-directory: ${{ github.workspace }}
-        run: |
-          git fetch origin "$GITHUB_BASE_REF" --depth=1
-          if git diff --name-only "origin/$GITHUB_BASE_REF" HEAD | grep -qE "^${API_WORKING_DIRECTORY}/"; then
-            echo "run=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "run=false" >> "$GITHUB_OUTPUT"
-            echo "No ${API_WORKING_DIRECTORY} changes in this PR; skipping .NET mutation."
-          fi
-      - name: Restore tools and build
-        if: steps.scope.outputs.run == 'true'
-        run: |
-          dotnet tool restore
-          dotnet build "$DOTNET_SOLUTION" -c Release
-      - name: Stryker.NET (changed files only)
-        if: steps.scope.outputs.run == 'true'
-        run: |
-          export PATH="$PATH:$HOME/.dotnet/tools"   # ephemeral ARC runners do not have dotnet tools on PATH
-          dotnet stryker \
-            --project "$MUTATION_TARGET_PROJECT" \
-            --test-projects "$MUTATION_TEST_PROJECT" \
-            --since:"origin/$GITHUB_BASE_REF" \
-            --concurrency 2 \
-            --threshold-high "$MUTATION_THRESHOLD" \
-            --threshold-low "$MUTATION_THRESHOLD" \
-            --break-at "$MUTATION_THRESHOLD" \
-            --reporter progress --reporter json
-
-  web:
-    name: Web (Next.js)
-    if: github.event_name != 'schedule'
-    runs-on: RunnerLandingZone
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
-        with:
-          version: ${{ env.PNPM_VERSION }}
-          run_install: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
-      - name: Configure optional private registry authentication
-        env:
-          NPM_REGISTRY_TOKEN: ${{ secrets.NPM_REGISTRY_TOKEN }}
-        run: |
-          if [ -n "$NPM_REGISTRY_TOKEN" ]; then
-            echo "${NPM_REGISTRY_URL}:_authToken=$NPM_REGISTRY_TOKEN" >> .npmrc
-          fi
-      - run: pnpm install --frozen-lockfile
-      - name: Lint, test, verify boundaries, and build
-        run: |
-          pnpm --filter "$WEB_PACKAGE" run lint
-          pnpm --filter "$WEB_PACKAGE" run test
-          pnpm --filter "$WEB_PACKAGE" run lint:fsd
-          pnpm --filter "$WEB_PACKAGE" run build
-
-  mutation-web:
-    name: Mutation (web, diff)
-    if: github.event_name == 'pull_request'
-    runs-on: RunnerLandingZone
-    timeout-minutes: 25
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0
-      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
-        with:
-          version: ${{ env.PNPM_VERSION }}
-          run_install: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
-      - name: Detect web changes
-        id: scope
-        run: |
-          git fetch origin "$GITHUB_BASE_REF" --depth=1
-          if git diff --name-only "origin/$GITHUB_BASE_REF" HEAD | grep -qE "^apps/web/"; then
-            echo "run=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "run=false" >> "$GITHUB_OUTPUT"
-            echo "No apps/web changes in this PR; skipping web mutation."
-          fi
-      - name: Configure optional private registry authentication
-        if: steps.scope.outputs.run == 'true'
-        env:
-          NPM_REGISTRY_TOKEN: ${{ secrets.NPM_REGISTRY_TOKEN }}
-        run: |
-          if [ -n "$NPM_REGISTRY_TOKEN" ]; then
-            echo "${NPM_REGISTRY_URL}:_authToken=$NPM_REGISTRY_TOKEN" >> .npmrc
-          fi
-      - name: Install and run StrykerJS (changed files only)
-        if: steps.scope.outputs.run == 'true'
-        run: |
-          pnpm install --frozen-lockfile
-          pnpm --filter "$WEB_PACKAGE" exec stryker run --since="origin/$GITHUB_BASE_REF"
-
-  secret-scan:
-    name: Secret scan (TruffleHog)
-    runs-on: RunnerLandingZone
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - run: docker run --rm -v "${{ github.workspace }}:/repo" "$TRUFFLEHOG_IMAGE" filesystem /repo --only-verified --fail --no-update
-
-  deps-and-iac-scan:
-    name: Dependencies and IaC (Trivy)
-    runs-on: RunnerLandingZone
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
-        with:
-          scan-type: fs
-          scanners: vuln,misconfig,secret
-          severity: CRITICAL,HIGH
-          ignore-unfixed: true
-          exit-code: "1"
-          format: table
-
-  sast-scan:
-    name: SAST (Semgrep)
-    runs-on: RunnerLandingZone
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - run: docker run --rm -v "${{ github.workspace }}:/src" -w /src "$SEMGREP_IMAGE" semgrep scan --error --metrics=off --oss-only --disable-version-check --config p/default --config p/security-audit --config p/secrets --config p/csharp --config p/typescript --config p/react --exclude-rule yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
-
-  sbom:
-    name: SBOM (CycloneDX)
-    runs-on: RunnerLandingZone
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
-        with:
-          format: cyclonedx-json
-          artifact-name: ${{ env.SBOM_ARTIFACT_NAME }}
-
-  # A bot pull request is opened with GITHUB_TOKEN, and GitHub delivers no workflow_run event
-  # for the CI runs that follow (the run's actor is the bot). The router's CI-completion route
-  # never sees them, so this job hands the verdict over from inside CI. workflow_dispatch is
-  # one of the two events GITHUB_TOKEN may raise, so no App token is needed here, and the
-  # router treats a dispatch as trusted. Human pull requests are left to the workflow_run
-  # route, which does fire for them. The reconcile belt remains the hourly fallback.
-  #
-  # If a deploy pipeline calls this workflow with `uses:`, that caller must also grant
-  # `actions: write`. A called workflow may not request a scope its caller withheld, and the
-  # whole run fails to start with zero jobs and no annotation when it does.
-  dispatch-merge-gate:
-    name: Dispatch merge gate
-    needs: [api, mutation-api, web, mutation-web]
-    if: >
-      always() &&
-      github.event_name == 'pull_request' &&
-      github.event.pull_request.head.repo.full_name == github.repository &&
-      github.event.pull_request.draft == false &&
-      github.event.pull_request.user.type == 'Bot'
-    runs-on: RunnerLandingZone
-    timeout-minutes: 5
-    permissions:
-      contents: read
-      actions: write
-    steps:
-      - name: Dispatch the merge gate with this run's verdict
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPO: ${{ github.repository }}
-          REF: ${{ github.event.repository.default_branch }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          RUN_ID: ${{ github.run_id }}
-          RESULTS: ${{ join(needs.*.result, ' ') }}
-        run: |
-          set -euo pipefail
-          conclusion=success
-          for result in $RESULTS; do
-            case "$result" in
-              failure) conclusion=failure; break ;;
-              cancelled | timed_out) conclusion=cancelled ;;
-            esac
-          done
-          # A cancelled run was superseded by a newer push, whose own run dispatches.
-          if [ "$conclusion" = cancelled ]; then
-            echo "CI was cancelled; not dispatching the merge gate."
-            exit 0
-          fi
-          echo "Dispatching the merge gate for PR #$PR_NUMBER with CI $conclusion (run $RUN_ID)."
-          gh workflow run work-router.yml --repo "$REPO" --ref "$REF" \
-            -f operation=merge-gate -f pr-number="$PR_NUMBER" \
-            -f ci-conclusion="$conclusion" -f ci-run-id="$RUN_ID"
+# Managed by @plainconceptsplatform/workflows. Source: loops/templates/ci/app-ci-dotnet-next.yml. Update with `workflows update --force`; consumer edits may be overwritten.
+name: "App: CI"
+
+on:
+  pull_request:
+  schedule:
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+  workflow_call:
+    secrets:
+      NPM_REGISTRY_TOKEN:
+        required: false
+
+env:
+  DOTNET_VERSION: "10.0.x"
+  NODE_VERSION: "22"
+  PNPM_VERSION: "10"
+  API_WORKING_DIRECTORY: apps/api
+  DOTNET_SOLUTION: App.slnx
+  UNIT_TEST_PROJECT: tests/App.UnitTests/App.UnitTests.csproj
+  PARITY_TEST_PROJECT: tests/App.ParityTests/App.ParityTests.csproj
+  INTEGRATION_TEST_PROJECT: tests/App.IntegrationTests/App.IntegrationTests.csproj
+  # Per-PR mutation gate. Stryker mutates only files changed since the PR base (--since),
+  # so a green unit suite that never actually pins behaviour fails here instead of shipping.
+  # dotnet-stryker is pinned in the api tools manifest (.config/dotnet-tools.json / dotnet-tools.json).
+  MUTATION_TARGET_PROJECT: src/App.Domain/App.Domain.csproj
+  MUTATION_TEST_PROJECT: tests/App.UnitTests/App.UnitTests.csproj
+  MUTATION_THRESHOLD: "60"
+  COVERAGE_SETTINGS: coverage.runsettings
+  COVERAGE_CHECK_COMMAND: node ../../scripts/check-coverage.mjs TestResults/merged/Cobertura.xml
+  MIGRATION_PROJECT: src/App.Infrastructure/App.Infrastructure.csproj
+  MIGRATION_STARTUP_PROJECT: src/App.Api/App.Api.csproj
+  SEED_PROJECT: src/App.Seed
+  PRIMARY_DATABASE: app
+  DATA_LAYER_DATABASE: numa_dl
+  # Derived per run rather than written down. The container is ephemeral, bound to a random
+  # host port and reachable only from this job, so the value protects nothing, but a literal
+  # password in a config file is a policy finding wherever it sits, and this file is public.
+  # It has to be a workflow-level expression: service containers receive their environment
+  # before any step runs, so a value generated in a step would arrive too late.
+  #
+  # The same expression is repeated inside the service's `options` above rather than read
+  # from here, because the `env` context is not available in `jobs.<id>.services` — only
+  # inside that service's own `env:`. Written as ${{ env.SQL_SA_PASSWORD }} there, the health
+  # check probes with an empty password and the service never reports healthy.
+  SQL_SA_PASSWORD: "Aa1!${{ github.run_id }}"
+  WEB_PACKAGE: "@app/web"
+  NPM_REGISTRY_URL: "//npm.pkg.github.com/"
+  TRUFFLEHOG_IMAGE: "trufflesecurity/trufflehog:latest"
+  SEMGREP_IMAGE: "semgrep/semgrep:1.168.0"
+  SBOM_ARTIFACT_NAME: app-sbom.cyclonedx.json
+  MIGRATION_CONTEXT: AppDbContext
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  api:
+    name: API (.NET)
+    if: github.event_name != 'schedule'
+    runs-on: RunnerLandingZone
+    timeout-minutes: 30
+    services:
+      sqlserver:
+        image: mcr.microsoft.com/mssql/server:2022-latest
+        env:
+          ACCEPT_EULA: "Y"
+          MSSQL_SA_PASSWORD: ${{ env.SQL_SA_PASSWORD }}
+        ports:
+        # Ephemeral host port. Four runners share this machine, so a fixed 1433 means the
+        # second concurrent job fails at Initialize containers with "Docker start fail with
+        # exit code 1". Steps read the assigned port from the job.services context.
+          - 1433
+        options: >-
+          --health-cmd "/opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P 'Aa1!${{ github.run_id }}' -Q 'SELECT 1' -C || exit 1"
+          --health-interval 10s --health-timeout 5s --health-retries 12 --health-start-period 30s
+    defaults:
+      run:
+        working-directory: ${{ env.API_WORKING_DIRECTORY }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+      - name: Restore tools, solution, and build
+        run: |
+          dotnet tool restore
+          dotnet restore "$DOTNET_SOLUTION"
+          dotnet build "$DOTNET_SOLUTION" --no-restore -c Release
+      - name: Unit tests with coverage
+        run: dotnet test "$UNIT_TEST_PROJECT" --no-build -c Release --collect:"XPlat Code Coverage" --settings "$COVERAGE_SETTINGS" --results-directory TestResults
+      - name: Parity tests
+        run: dotnet test "$PARITY_TEST_PROJECT" --no-build -c Release
+      - name: Create test databases
+        run: |
+          for database in "$PRIMARY_DATABASE" "$DATA_LAYER_DATABASE"; do
+            docker exec ${{ job.services.sqlserver.id }} /opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P "$SQL_SA_PASSWORD" -C -Q "IF DB_ID('$database') IS NULL CREATE DATABASE [$database];"
+          done
+      - name: Apply migrations and seed test data
+        env:
+          ConnectionStrings__App: Server=localhost,${{ job.services.sqlserver.ports['1433'] }};Database=${{ env.PRIMARY_DATABASE }};User Id=sa;Password=${{ env.SQL_SA_PASSWORD }};TrustServerCertificate=true
+          DataLayer__ConnectionString: Server=localhost,${{ job.services.sqlserver.ports['1433'] }};Database=${{ env.DATA_LAYER_DATABASE }};User Id=sa;Password=${{ env.SQL_SA_PASSWORD }};TrustServerCertificate=true
+          DATALAYER_SEED: "true"
+        run: |
+          dotnet ef database update -p "$MIGRATION_PROJECT" -s "$MIGRATION_STARTUP_PROJECT" --context "$MIGRATION_CONTEXT"
+          dotnet run --project "$SEED_PROJECT" --no-build -c Release
+      - name: Integration tests with coverage
+        env:
+          ConnectionStrings__App: Server=localhost,${{ job.services.sqlserver.ports['1433'] }};Database=${{ env.PRIMARY_DATABASE }};User Id=sa;Password=${{ env.SQL_SA_PASSWORD }};TrustServerCertificate=true
+          DataLayer__ConnectionString: Server=localhost,${{ job.services.sqlserver.ports['1433'] }};Database=${{ env.DATA_LAYER_DATABASE }};User Id=sa;Password=${{ env.SQL_SA_PASSWORD }};TrustServerCertificate=true
+        run: dotnet test "$INTEGRATION_TEST_PROJECT" --no-build -c Release --collect:"XPlat Code Coverage" --settings "$COVERAGE_SETTINGS" --results-directory TestResults
+      - name: Enforce merged coverage floor
+        run: |
+          dotnet tool install --global dotnet-reportgenerator-globaltool
+          export PATH="$PATH:$HOME/.dotnet/tools"   # ephemeral ARC runners do not have dotnet tools on PATH
+          reportgenerator -reports:"TestResults/**/coverage.cobertura.xml" -targetdir:TestResults/merged -reporttypes:Cobertura
+          bash -c "$COVERAGE_CHECK_COMMAND"
+
+  mutation-api:
+    name: Mutation (.NET, diff)
+    if: github.event_name == 'pull_request'
+    runs-on: RunnerLandingZone
+    timeout-minutes: 25
+    defaults:
+      run:
+        working-directory: ${{ env.API_WORKING_DIRECTORY }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # Stryker --since diffs against the PR base; it needs history, not a shallow tip.
+          fetch-depth: 0
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+      - name: Detect backend changes
+        id: scope
+        working-directory: ${{ github.workspace }}
+        run: |
+          git fetch origin "$GITHUB_BASE_REF" --depth=1
+          if git diff --name-only "origin/$GITHUB_BASE_REF" HEAD | grep -qE "^${API_WORKING_DIRECTORY}/"; then
+            echo "run=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "run=false" >> "$GITHUB_OUTPUT"
+            echo "No ${API_WORKING_DIRECTORY} changes in this PR; skipping .NET mutation."
+          fi
+      - name: Restore tools and build
+        if: steps.scope.outputs.run == 'true'
+        run: |
+          dotnet tool restore
+          dotnet build "$DOTNET_SOLUTION" -c Release
+      - name: Stryker.NET (changed files only)
+        if: steps.scope.outputs.run == 'true'
+        run: |
+          export PATH="$PATH:$HOME/.dotnet/tools"   # ephemeral ARC runners do not have dotnet tools on PATH
+          dotnet stryker \
+            --project "$MUTATION_TARGET_PROJECT" \
+            --test-projects "$MUTATION_TEST_PROJECT" \
+            --since:"origin/$GITHUB_BASE_REF" \
+            --concurrency 2 \
+            --threshold-high "$MUTATION_THRESHOLD" \
+            --threshold-low "$MUTATION_THRESHOLD" \
+            --break-at "$MUTATION_THRESHOLD" \
+            --reporter progress --reporter json
+
+  web:
+    name: Web (Next.js)
+    if: github.event_name != 'schedule'
+    runs-on: RunnerLandingZone
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+        with:
+          version: ${{ env.PNPM_VERSION }}
+          run_install: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+      - name: Configure optional private registry authentication
+        env:
+          NPM_REGISTRY_TOKEN: ${{ secrets.NPM_REGISTRY_TOKEN }}
+        run: |
+          if [ -n "$NPM_REGISTRY_TOKEN" ]; then
+            echo "${NPM_REGISTRY_URL}:_authToken=$NPM_REGISTRY_TOKEN" >> .npmrc
+          fi
+      - run: pnpm install --frozen-lockfile
+      - name: Lint, test, verify boundaries, and build
+        run: |
+          pnpm --filter "$WEB_PACKAGE" run lint
+          pnpm --filter "$WEB_PACKAGE" run test
+          pnpm --filter "$WEB_PACKAGE" run lint:fsd
+          pnpm --filter "$WEB_PACKAGE" run build
+
+  mutation-web:
+    name: Mutation (web, diff)
+    if: github.event_name == 'pull_request'
+    runs-on: RunnerLandingZone
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+        with:
+          version: ${{ env.PNPM_VERSION }}
+          run_install: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+      - name: Detect web changes
+        id: scope
+        run: |
+          git fetch origin "$GITHUB_BASE_REF" --depth=1
+          if git diff --name-only "origin/$GITHUB_BASE_REF" HEAD | grep -qE "^apps/web/"; then
+            echo "run=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "run=false" >> "$GITHUB_OUTPUT"
+            echo "No apps/web changes in this PR; skipping web mutation."
+          fi
+      - name: Configure optional private registry authentication
+        if: steps.scope.outputs.run == 'true'
+        env:
+          NPM_REGISTRY_TOKEN: ${{ secrets.NPM_REGISTRY_TOKEN }}
+        run: |
+          if [ -n "$NPM_REGISTRY_TOKEN" ]; then
+            echo "${NPM_REGISTRY_URL}:_authToken=$NPM_REGISTRY_TOKEN" >> .npmrc
+          fi
+      - name: Install and run StrykerJS (changed files only)
+        if: steps.scope.outputs.run == 'true'
+        run: |
+          pnpm install --frozen-lockfile
+          pnpm --filter "$WEB_PACKAGE" exec stryker run --since="origin/$GITHUB_BASE_REF"
+
+  secret-scan:
+    name: Secret scan (TruffleHog)
+    runs-on: RunnerLandingZone
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - run: docker run --rm -v "${{ github.workspace }}:/repo" "$TRUFFLEHOG_IMAGE" filesystem /repo --only-verified --fail --no-update
+
+  deps-and-iac-scan:
+    name: Dependencies and IaC (Trivy)
+    runs-on: RunnerLandingZone
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          scan-type: fs
+          scanners: vuln,misconfig,secret
+          severity: CRITICAL,HIGH
+          ignore-unfixed: true
+          exit-code: "1"
+          format: table
+
+  sast-scan:
+    name: SAST (Semgrep)
+    runs-on: RunnerLandingZone
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - run: docker run --rm -v "${{ github.workspace }}:/src" -w /src "$SEMGREP_IMAGE" semgrep scan --error --metrics=off --oss-only --disable-version-check --config p/default --config p/security-audit --config p/secrets --config p/csharp --config p/typescript --config p/react --exclude-rule yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
+
+  sbom:
+    name: SBOM (CycloneDX)
+    runs-on: RunnerLandingZone
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
+        with:
+          format: cyclonedx-json
+          artifact-name: ${{ env.SBOM_ARTIFACT_NAME }}
+
+  # A bot pull request is opened with GITHUB_TOKEN, and GitHub delivers no workflow_run event
+  # for the CI runs that follow (the run's actor is the bot). The router's CI-completion route
+  # never sees them, so this job hands the verdict over from inside CI. workflow_dispatch is
+  # one of the two events GITHUB_TOKEN may raise, so no App token is needed here, and the
+  # router treats a dispatch as trusted. Human pull requests are left to the workflow_run
+  # route, which does fire for them. The reconcile belt remains the hourly fallback.
+  #
+  # If a deploy pipeline calls this workflow with `uses:`, that caller must also grant
+  # `actions: write`. A called workflow may not request a scope its caller withheld, and the
+  # whole run fails to start with zero jobs and no annotation when it does.
+  dispatch-merge-gate:
+    name: Dispatch merge gate
+    needs: [api, mutation-api, web, mutation-web]
+    if: >
+      always() &&
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.draft == false &&
+      github.event.pull_request.user.type == 'Bot'
+    runs-on: RunnerLandingZone
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      actions: write
+    steps:
+      - name: Dispatch the merge gate with this run's verdict
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          REF: ${{ github.event.repository.default_branch }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          RUN_ID: ${{ github.run_id }}
+          RESULTS: ${{ join(needs.*.result, ' ') }}
+        run: |
+          set -euo pipefail
+          conclusion=success
+          for result in $RESULTS; do
+            case "$result" in
+              failure) conclusion=failure; break ;;
+              cancelled | timed_out) conclusion=cancelled ;;
+            esac
+          done
+          # A cancelled run was superseded by a newer push, whose own run dispatches.
+          if [ "$conclusion" = cancelled ]; then
+            echo "CI was cancelled; not dispatching the merge gate."
+            exit 0
+          fi
+          echo "Dispatching the merge gate for PR #$PR_NUMBER with CI $conclusion (run $RUN_ID)."
+          gh workflow run work-router.yml --repo "$REPO" --ref "$REF" \
+            -f operation=merge-gate -f pr-number="$PR_NUMBER" \
+            -f ci-conclusion="$conclusion" -f ci-run-id="$RUN_ID"