feat(rulesets): require the shared .NET tests on dotnet-template

.github/workflows/ci.yaml

@@ -5898,6 +5898,9 @@ jobs:
       - name: 🧪 Test Go template validation ruleset
         run: bash tests/go-template-validation-ruleset.sh
 
+      - name: 🧪 Test .NET template tests ruleset
+        run: bash tests/dotnet-template-tests-ruleset.sh
+
       - name: 🧪 Test trusted deploy/ guards ruleset
         run: bash tests/deploy-guards-ruleset.sh
 

deploy/README.md

@@ -41,9 +41,9 @@ out-of-band changes made in the GitHub UI.
 - `organization-rulesets/` — one `OrganizationRuleset` per file (org-wide branch/tag
   protection). 9 existing org rulesets remain **Observe-only**; the existing signing
   rule is retained disabled with only Observe/Update and its full observed fields.
-  Five net-new rulesets are managed: `v*` tag protection, World at Ruin's trusted-regression
+  Six net-new rulesets are managed: `v*` tag protection, World at Ruin's trusted-regression
   workflow, monorepo's independent CI aggregate check, this repository's `deploy/` guards
-  run from its reviewed `main`, and go-template's Go validation workflow. Unadopted org rulesets remain outside managed updates;
+  run from its reviewed `main`, go-template's Go validation workflow, and dotnet-template's .NET tests workflow. Unadopted org rulesets remain outside managed updates;
   schema-supported adoption work is distinct from remaining provider gaps — see
   [`organization-rulesets/README.md`](organization-rulesets/README.md) for the full
   importability matrix and the push/tag/Actions-policy analysis.

deploy/organization-rulesets/README.md

@@ -44,6 +44,7 @@ verb — e.g. `require-pull-request.yaml`). Repo-scoped rulesets live next door
 | `require-monorepo-ci-aggregate-contract.yaml` | **Require workflow - Monorepo CI aggregate contract** (net-new) | Managed (Create) — target only monorepo and require the aggregate-execution control from its reviewed `main` |
 | `require-dotgithub-deploy-guards.yaml` | **Require workflow - .github deploy guards** (net-new) | Managed (Create) — target only this repository and run the `deploy/` release-contract and deletion validators from its reviewed `main` |
 | `require-go-template-validation.yaml` | **Require workflow - Go template validation** (net-new) | Managed (Create) — target only go-template and require the canonical Go validation workflow from this repository's reviewed `main`, restoring the gate the property-conditioned UI ruleset stopped applying there |
+| `require-dotnet-template-tests.yaml` | **Require workflow - .NET template tests** (net-new) | Managed (Create) — target only dotnet-template and require the canonical .NET tests workflow from this repository's reviewed `main`, supplying the build and test gate the UI ruleset does not apply there |
 | (in `../repository-rulesets/`) `require-merge-queue-on-platform.yaml` | `platform` "Require merge queue" | Observe + Update (managed import, full ruleset backfilled) |
 
 The 10 imported org rulesets: Block force pushes · Require a pull request before

deploy/organization-rulesets/kustomization.yaml

@@ -1,6 +1,6 @@
 # `OrganizationRuleset` resources — one per file, named after the rule (an active verb).
 # Nine imported org rulesets remain Observe-only; the retained signing rule is disabled
-# with only Observe/Update. Five net-new rulesets are managed (Create).
+# with only Observe/Update. Six net-new rulesets are managed (Create).
 # The 10 org rulesets the provider cannot express remain UI-managed —
 # see ./README.md for the importability matrix and the push/tag/Actions-policy analysis.
 # Repo-scoped rulesets live in ../repository-rulesets/. Included by ../kustomization.yaml.
@@ -24,3 +24,4 @@ resources:
   - require-monorepo-ci-aggregate-contract.yaml
   - require-dotgithub-deploy-guards.yaml
   - require-go-template-validation.yaml
+  - require-dotnet-template-tests.yaml

deploy/organization-rulesets/require-dotnet-template-tests.yaml

@@ -0,0 +1,36 @@
+# Give dotnet-template the .NET build and test gate its AGENTS.md describes
+# (devantler-tech/dotnet-template#424). The UI-managed "Require workflows … for
+# .NET" ruleset does not target the template, so its pull requests have had no
+# cross-platform build or test check. That ruleset stays UI-managed and
+# untouched: this rule targets only dotnet-template, by id, and requires the
+# canonical workflow from this repository's reviewed main branch, so a candidate
+# cannot edit or remove the gate it is judged by.
+# No bypass or Delete policy is declared.
+apiVersion: enterprise.github.m.upbound.io/v1alpha1
+kind: OrganizationRuleset
+metadata:
+  name: require-dotnet-template-tests
+spec:
+  managementPolicies:
+    - Observe
+    - Create
+    - Update
+    - LateInitialize
+  forProvider:
+    name: Require workflow - .NET template tests
+    target: branch
+    enforcement: active
+    conditions:
+      - refName:
+          - include: ["~DEFAULT_BRANCH"]
+            exclude: []
+        repositoryId: [825979604]
+    rules:
+      - requiredWorkflows:
+          - requiredWorkflow:
+              - repositoryId: 948529001
+                path: .github/workflows/run-dotnet-tests.yaml
+                ref: refs/heads/main
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

tests/dotnet-template-tests-ruleset.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+set -euo pipefail
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+render="$(mktemp)"
+trap 'rm -f "$render"' EXIT
+fail() { echo "dotnet-template-tests-ruleset test: $*" >&2; exit 1; }
+kubectl kustomize "$root/deploy" >"$render"
+selector='select(.kind == "OrganizationRuleset" and .metadata.name == "require-dotnet-template-tests")'
+count="$(yq -N "$selector | .metadata.name" "$render" | grep -c . || true)"
+[[ "$count" == 1 ]] || fail "expected one .NET template tests ruleset"
+assert_json() {
+  local expected="$1" expression="$2" actual
+  actual="$(yq -o=json -I=0 "$selector | $expression" "$render")"
+  [[ "$actual" == "$expected" ]] || fail "$expression: expected $expected, got $actual"
+}
+assert_json '["Observe","Create","Update","LateInitialize"]' '.spec.managementPolicies'
+assert_json '"branch"' '.spec.forProvider.target'
+assert_json '"active"' '.spec.forProvider.enforcement'
+assert_json '[825979604]' '.spec.forProvider.conditions[0].repositoryId'
+assert_json '["~DEFAULT_BRANCH"]' '.spec.forProvider.conditions[0].refName[0].include'
+assert_json '[]' '.spec.forProvider.conditions[0].refName[0].exclude'
+assert_json '[]' '(.spec.forProvider.bypassActors // [])'
+assert_json '[{"requiredWorkflows":[{"requiredWorkflow":[{"path":".github/workflows/run-dotnet-tests.yaml","ref":"refs/heads/main","repositoryId":948529001}]}]}]' '.spec.forProvider.rules'
+echo "dotnet-template-tests-ruleset: OK"

tests/world-at-ruin-regression-ruleset.sh

@@ -63,11 +63,11 @@ grep -Fq 'The 10 imported org rulesets' "${inventory}" ||
 # The backticks are literal Markdown table cell delimiters, not command substitution.
 # shellcheck disable=SC2016
 managed_rows="$(grep -c '^| `[a-z-]*\.yaml` | .*(net-new) | Managed (Create)' "${inventory}" || true)"
-[[ "${managed_rows}" == "5" ]] ||
-  fail "organization ruleset inventory must list 5 managed rulesets, got ${managed_rows}"
+[[ "${managed_rows}" == "6" ]] ||
+  fail "organization ruleset inventory must list 6 managed rulesets, got ${managed_rows}"
 managed_rendered="$(yq -N 'select(.kind == "OrganizationRuleset" and (.spec.managementPolicies | contains(["Create"]))) | .metadata.name' "${render}" | grep -c . || true)"
-[[ "${managed_rendered}" == "5" ]] ||
-  fail "expected 5 rendered managed (Create) organization rulesets, got ${managed_rendered}"
+[[ "${managed_rendered}" == "6" ]] ||
+  fail "expected 6 rendered managed (Create) organization rulesets, got ${managed_rendered}"
 # Schema inspection is not a live census. Keep rendered ownership checks above,
 # and require the capability inventory to preserve that evidence boundary.
 if ! grep -Fq 'Schema support determines what can be declared; it does not prove adoption,' "${inventory}" ||