[vietle-bh]

NOTE: Depends on

Issues addressed by this PR

This pull request introduces significant improvements to the CI workflows for linked C# pull requests and PR checks, focusing on modularity, security, and clarity. The main changes include splitting the linked C# PR workflow into three distinct workflows (linked, close, and sweep), introducing two new reusable composite actions (bhom-assemblies and linked-pr-context), and enhancing test coverage to reflect these structural updates. Permissions and token usage are now more granular and secure, and the alignment check is now a dedicated job with clearer reporting.

Workflow restructuring and modularization:

• The linked C# PR workflow is split into three separate workflows: linked-csharp-pr.yml (for open PRs), linked-csharp-pr-close.yml (for closed PRs), and linked-csharp-pr-sweep.yml (for scheduled sweeps). This ensures that only relevant jobs appear on the pull request page and that triggers are precise and non-overlapping.
• The alignment check is now its own job (alignment) in pr-checks.yml, with a descriptive name and clear failure summaries. The main checks job no longer runs the alignment step directly.

Reusable composite actions:

• Added .github/actions/bhom-assemblies/action.yml, a composite action to cache, restore, build, and save BHoM assemblies efficiently, preventing unnecessary rebuilds and ensuring cache freshness.
• Added .github/actions/linked-pr-context/action.yml, a composite action to gather context about the Python PR, determine eligibility, and enumerate affected C# repositories, ensuring correct gating and secure handling of secrets for fork PRs.

Security and permissions improvements:

• All workflows now start with minimal (read) permissions and raise them per job only as needed. The linked job and sweep job get statuses: write permission, while the close job does not. Tokens are created only for the repositories touched by the change, and only for steps that require them. [1] [2]
• Fork PRs are explicitly gated from accessing secrets or triggering C# PRs, enforced through the new composite action and workflow logic.

Test updates and coverage:

• The Python test suite is updated to reflect the new workflow structure, triggers, permissions, token scoping, and action usage. Tests now verify that jobs and triggers are correctly assigned, permissions are minimal, tokens are scoped, and cache/build logic is correct. [1] [2] [3] [4]

Other improvements:

• The PR checks workflow now uses the new shared assemblies action for caching and building, and ensures that the alignment check is clearly reported and explained in the job summary.

References: [1] [2] [3] [4] [5] [6]

Test files

Changelog

Additional comments

[github-actions]

Draft C# pull request: BHoM/CSharpSchema_Test#3