#157 fix: add CodeScene PR coverage gates (#158)

- add a reusable check-coverage action for cs-coverage check
 - run CodeScene coverage gates on pull requests in Tests.yml
 - keep the existing develop/manual CodeScene analysis flow
 - document the new PR gate behavior in the contributor docs and changelog

Author: stiwicourage

.github/actions/check-coverage/action.yml

@@ -0,0 +1,34 @@
+name: Check Coverage
+description: Run CodeScene coverage gates against uploaded coverage artifacts.
+
+inputs:
+  access-token:
+    description: CodeScene REST API access token.
+    required: true
+  project-url:
+    description: Full CodeScene project API URL, for example https://codescene.io/v2/projects/12345.
+    required: true
+  coverage-files:
+    description: Glob pattern matching coverage reports to check.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Download cs-coverage binary
+      shell: bash
+      run: |
+        set -euo pipefail
+        curl -fsSL -o "$(pwd)/cs-coverage.zip" https://downloads.codescene.io/enterprise/cli/cs-coverage-linux-amd64-latest.zip
+        unzip -oq "$(pwd)/cs-coverage.zip"
+        chmod +x "$(pwd)/cs-coverage"
+
+    - name: Run CodeScene coverage gate check
+      shell: bash
+      env:
+        CS_PROJECT_URL: ${{ inputs.project-url }}
+        CS_ACCESS_TOKEN: ${{ inputs.access-token }}
+      run: |
+        set -euo pipefail
+        find "$(pwd)" -name '*.cobertura.xml' -print
+        "$(pwd)/cs-coverage" check --verbose --coverage-files "${{ inputs.coverage-files }}"

.github/workflows/Tests.yml

@@ -92,6 +92,30 @@ jobs:
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
 
+  codescene-coverage-gates:
+    runs-on: ubuntu-latest
+    needs:
+      - test-and-coverage
+    if: ${{ needs.test-and-coverage.result == 'success' && github.event_name == 'pull_request' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Download CI artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: nova-ci-artifacts
+          path: coverage/
+
+      - name: Check coverage gates in CodeScene
+        uses: ./.github/actions/check-coverage
+        with:
+          access-token: ${{ secrets.CS_ACCESS_TOKEN }}
+          project-url: ${{ format('{0}/v2/projects/{1}', vars.CS_URL, vars.CS_PROJECT_ID) }}
+          coverage-files: '**/pester-coverage.cobertura.xml'
+
   codescene-analysis:
     runs-on: ubuntu-latest
     needs:

CONTRIBUTING.md

@@ -34,6 +34,8 @@ Before making larger changes, read the contributor docs in:
 GitHub now prefills pull requests with `.github/pull_request_template.md`.
 Use it to explain intent clearly, record what you validated, and call out any required documentation or changelog work.
 
+Pull requests against `main` and `develop` also run a CodeScene coverage-gate check when CI has produced the Cobertura coverage artifact, so PRs can be blocked when changed code falls below the configured coverage threshold.
+
 **Before opening a pull request, please run the local quality flow from the repository root:**
 
 ```powershell title="run.ps1"
@@ -55,6 +57,7 @@ If you are working on the CodeScene integration, the CI coverage helper writes t
 CodeScene upload step consumes:
 
 - generate coverage with `./scripts/build/ci/Invoke-NovaModuleToolsCI.ps1`
+- pull requests then download that uploaded artifact and run the CodeScene coverage-gate check through `.github/actions/check-coverage`
 - then upload/trigger with `./scripts/build/ci/Invoke-CodeSceneAnalysis.ps1 -UploadCoverage -TriggerAnalysis`
 - the upload helper auto-discovers a single `artifacts/*.cobertura.xml` file unless you pass `-CoveragePath`
 - if upload succeeds but `-TriggerAnalysis` fails with a project-owner OAuth error, re-authorize the repository in

README.md

@@ -423,9 +423,11 @@ workflow configuration, and emits CI-friendly reports such as:
 - `artifacts/pester-coverage.cobertura.xml`
 - `artifacts/coverage-low.txt`
 
-The `Tests.yml` workflow reuses that Cobertura artifact for both Codecov and CodeScene.
-The CodeScene step uploads coverage through `scripts/build/ci/Invoke-CodeSceneAnalysis.ps1` before it triggers a
-follow-up analysis run.
+The `Tests.yml` workflow reuses that Cobertura artifact for Codecov, for the pull-request CodeScene coverage-gate check,
+and for the develop/manual CodeScene upload-and-analysis flow.
+The CodeScene pull-request gate downloads the uploaded artifact and runs `cs-coverage check`, while the develop/manual
+CodeScene step uploads coverage through `scripts/build/ci/Invoke-CodeSceneAnalysis.ps1` before it triggers a follow-up
+analysis run.
 If coverage upload succeeds but the trigger fails with an OAuth/project-owner error, fix the repository authorization in
 CodeScene for the project owner. That trigger-side repository authorization is separate from `CS_ACCESS_TOKEN`.
 
@@ -572,6 +574,8 @@ When CodeScene coverage upload is needed, run
 `scripts/build/ci/Invoke-CodeSceneAnalysis.ps1 -UploadCoverage -TriggerAnalysis`.
 That script auto-discovers a single `*.cobertura.xml` file under `artifacts/` unless you pass `-CoveragePath`
 explicitly.
+The repository `Tests.yml` workflow now also downloads that same Cobertura artifact during pull requests and runs the
+CodeScene coverage-gate check before merge.
 If `-TriggerAnalysis` fails after a successful upload, review the CodeScene response body: repository OAuth problems for
 the project owner must be fixed in CodeScene itself and are not solved by rotating `CS_ACCESS_TOKEN` alone.
 
@@ -589,8 +593,7 @@ published module from the local install directory into the current PowerShell se
 step depends on the built-but-unpublished output instead.
 
 The CI helper flow also produces JUnit and Cobertura artifacts for external systems, including the coverage file that
-the
-CodeScene workflow upload step consumes.
+the CodeScene workflow gate and upload steps consume.
 
 ### Release automation