ci: strengthen pull-request test coverage

Author: autocarl

.github/workflows/ci.yml

@@ -33,7 +33,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest]
+        # Windows is a first-class target for a CLI/REPL framework, and its absence let a
+        # CRLF-only test failure ship green (see the TrimEntries fix in Given_Completions).
+        os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -194,7 +196,15 @@ jobs:
             --coverage-output-format cobertura
 
       - name: Test report
-        if: always()
+        # Creating a check run needs `checks: write`, but GitHub caps GITHUB_TOKEN
+        # to read-only for `pull_request` events raised from a fork — the
+        # workflow-level `permissions:` block cannot lift that ceiling. The action
+        # then fails with "Resource not accessible by integration", which cascades
+        # into skipping Pack and the package validation steps below. Fork PRs still
+        # gate on the Test step and publish the .trx via the test-results artifact.
+        # The `github.event_name` clause keeps the report alive on push builds,
+        # where `github.event.pull_request` is null.
+        if: always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
         uses: dorny/test-reporter@31a54ee7ebcacc03a09ea97a7e5465a47b84aea5 # v1.9.1
         with:
           name: Test Results