Feature/157 feature add codescene code coverage gates for pull requests

.github/actions/check-coverage/action.yml

@@ -0,0 +1,34 @@
+name: Check Coverage
+description: Run CodeScene coverage gates against uploaded coverage artifacts.
+
+inputs:
+  access-token:
+    description: CodeScene REST API access token.
+    required: true
+  project-url:
+    description: Full CodeScene project API URL, for example https://codescene.io/v2/projects/12345.
+    required: true
+  coverage-files:
+    description: Glob pattern matching coverage reports to check.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Download cs-coverage binary
+      shell: bash
+      run: |
+        set -euo pipefail
+        curl -fsSL -o "$(pwd)/cs-coverage.zip" https://downloads.codescene.io/enterprise/cli/cs-coverage-linux-amd64-latest.zip
+        unzip -oq "$(pwd)/cs-coverage.zip"
+        chmod +x "$(pwd)/cs-coverage"
+
+    - name: Run CodeScene coverage gate check
+      shell: bash
+      env:
+        CS_PROJECT_URL: ${{ inputs.project-url }}
+        CS_ACCESS_TOKEN: ${{ inputs.access-token }}
+      run: |
+        set -euo pipefail
+        find "$(pwd)" -name '*.cobertura.xml' -print
+        "$(pwd)/cs-coverage" check --verbose --coverage-files "${{ inputs.coverage-files }}"

.github/prompts/pr-description.prompt.md

@@ -28,12 +28,22 @@ Analyze the provided input and:
 
 Be pragmatic: if information is missing, make reasonable assumptions but call them out briefly.
 
----
+Before generating the PR description, you MUST:
 
-## Output format
+- Read this prompt file from `.github/prompts/pr-description.prompt.md` directly, even if hidden folders were not
+  surfaced by an earlier search.
+- Read `.github/pull_request_template.md` directly and treat it as authoritative.
+- Resolve all relative paths from the repository root.
+- Treat `./pr-descriptions/` as a repository-root-relative output folder.
+- Never assume `.github/` content is missing just because a previous listing or glob search did not show hidden folders.
 
-You MUST return the PR description using this exact structure:
+---
 
-### Pull Request Template
+## Output format
 
-.github/pull_request_template.md
+You MUST return the PR description using this exact structure, you will find the template in
+`.github/pull_request_template.md`:
+You MUST fill in all sections, and you MUST NOT modify the template structure.
+You MUST create a *.md file in the `./pr-descriptions/` folder with the same name as the PR title, and write the
+generated description there.
+If the folder does not exist yet, you MUST create it under the repository root before writing the file.

.github/workflows/Tests.yml

@@ -33,6 +33,13 @@ jobs:
       - name: Run NovaModuleTools CI test and coverage workflow
         run: ./scripts/build/ci/Invoke-NovaModuleToolsCI.ps1 -OutputDirectory ./artifacts
 
+      - name: Validate repository changelog with Test-KeepAChangelogFile
+        run: |
+          $result = Test-KeepAChangelogFile -Path ./CHANGELOG.md
+          if (-not $result.IsValid) {
+            throw ($result.Errors -join [Environment]::NewLine)
+          }
+
       - name: Upload CI artifacts
         if: always()
         uses: actions/upload-artifact@v4
@@ -92,6 +99,30 @@ jobs:
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
 
+  codescene-coverage-gates:
+    runs-on: ubuntu-latest
+    needs:
+      - test-and-coverage
+    if: ${{ needs.test-and-coverage.result == 'success' && github.event_name == 'pull_request' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Download CI artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: nova-ci-artifacts
+          path: coverage/
+
+      - name: Check coverage gates in CodeScene
+        uses: ./.github/actions/check-coverage
+        with:
+          access-token: ${{ secrets.CS_ACCESS_TOKEN }}
+          project-url: ${{ format('{0}/v2/projects/{1}', vars.CS_URL, vars.CS_PROJECT_ID) }}
+          coverage-files: '**/pester-coverage.cobertura.xml'
+
   codescene-analysis:
     runs-on: ubuntu-latest
     needs:

CONTRIBUTING.md

@@ -34,6 +34,8 @@ Before making larger changes, read the contributor docs in:
 GitHub now prefills pull requests with `.github/pull_request_template.md`.
 Use it to explain intent clearly, record what you validated, and call out any required documentation or changelog work.
 
+Pull requests against `main` and `develop` also run a CodeScene coverage-gate check when CI has produced the Cobertura coverage artifact, so PRs can be blocked when changed code falls below the configured coverage threshold.
+
 **Before opening a pull request, please run the local quality flow from the repository root:**
 
 ```powershell title="run.ps1"
@@ -55,6 +57,7 @@ If you are working on the CodeScene integration, the CI coverage helper writes t
 CodeScene upload step consumes:
 
 - generate coverage with `./scripts/build/ci/Invoke-NovaModuleToolsCI.ps1`
+- pull requests then download that uploaded artifact and run the CodeScene coverage-gate check through `.github/actions/check-coverage`
 - then upload/trigger with `./scripts/build/ci/Invoke-CodeSceneAnalysis.ps1 -UploadCoverage -TriggerAnalysis`
 - the upload helper auto-discovers a single `artifacts/*.cobertura.xml` file unless you pass `-CoveragePath`
 - if upload succeeds but `-TriggerAnalysis` fails with a project-owner OAuth error, re-authorize the repository in

README.md

@@ -423,9 +423,11 @@ workflow configuration, and emits CI-friendly reports such as:
 - `artifacts/pester-coverage.cobertura.xml`
 - `artifacts/coverage-low.txt`
 
-The `Tests.yml` workflow reuses that Cobertura artifact for both Codecov and CodeScene.
-The CodeScene step uploads coverage through `scripts/build/ci/Invoke-CodeSceneAnalysis.ps1` before it triggers a
-follow-up analysis run.
+The `Tests.yml` workflow reuses that Cobertura artifact for Codecov, for the pull-request CodeScene coverage-gate check,
+and for the develop/manual CodeScene upload-and-analysis flow.
+The CodeScene pull-request gate downloads the uploaded artifact and runs `cs-coverage check`, while the develop/manual
+CodeScene step uploads coverage through `scripts/build/ci/Invoke-CodeSceneAnalysis.ps1` before it triggers a follow-up
+analysis run.
 If coverage upload succeeds but the trigger fails with an OAuth/project-owner error, fix the repository authorization in
 CodeScene for the project owner. That trigger-side repository authorization is separate from `CS_ACCESS_TOKEN`.
 
@@ -572,6 +574,8 @@ When CodeScene coverage upload is needed, run
 `scripts/build/ci/Invoke-CodeSceneAnalysis.ps1 -UploadCoverage -TriggerAnalysis`.
 That script auto-discovers a single `*.cobertura.xml` file under `artifacts/` unless you pass `-CoveragePath`
 explicitly.
+The repository `Tests.yml` workflow now also downloads that same Cobertura artifact during pull requests and runs the
+CodeScene coverage-gate check before merge.
 If `-TriggerAnalysis` fails after a successful upload, review the CodeScene response body: repository OAuth problems for
 the project owner must be fixed in CodeScene itself and are not solved by rotating `CS_ACCESS_TOKEN` alone.
 
@@ -589,8 +593,7 @@ published module from the local install directory into the current PowerShell se
 step depends on the built-but-unpublished output instead.
 
 The CI helper flow also produces JUnit and Cobertura artifacts for external systems, including the coverage file that
-the
-CodeScene workflow upload step consumes.
+the CodeScene workflow gate and upload steps consume.
 
 ### Release automation