From e22aec32c010fd0fa351a22954ce92b5a2dc6729 Mon Sep 17 00:00:00 2001
From: Vincent Biret <vibiret@microsoft.com>
Date: Fri, 28 Aug 2026 13:24:25 -0400
Subject: [PATCH 01/11] ci: upload coverage reports to github

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: eef1a37c-bad6-40d4-a626-d611f3aa65dc
---
 .github/workflows/dotnet-build-and-test.yml | 10 ++++++++++
 .github/workflows/python-test-coverage.yml  | 12 ++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/.github/workflows/dotnet-build-and-test.yml b/.github/workflows/dotnet-build-and-test.yml
index 6a8b4c427b6..04ba6546cb5 100644
--- a/.github/workflows/dotnet-build-and-test.yml
+++ b/.github/workflows/dotnet-build-and-test.yml
@@ -26,7 +26,9 @@ concurrency:
 
 permissions:
   contents: read
+  code-quality: write
   id-token: "write"
+  pull-requests: read
 
 jobs:
   paths-filter:
@@ -360,6 +362,14 @@ jobs:
           name: CoverageReport-${{ matrix.os }}-${{ matrix.targetFramework }}-${{ matrix.configuration }} # Artifact name
           path: ./TestResults/Reports # Directory containing files to upload
 
+      - name: Upload coverage report to GitHub
+        if: matrix.targetFramework == env.COVERAGE_FRAMEWORK && github.event_name != 'merge_group' && ((github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]') || (github.event_name != 'pull_request' && github.ref_name == github.event.repository.default_branch))
+        uses: actions/upload-code-coverage@d8e329117199404bba6fc81efe8093dc7c015e34 # v1.4.2
+        with:
+          file: ./TestResults/Reports/Cobertura.xml
+          language: CSharp
+          label: code-coverage/dotnet
+
       - name: Check coverage
         if: matrix.targetFramework == env.COVERAGE_FRAMEWORK
         shell: pwsh
diff --git a/.github/workflows/python-test-coverage.yml b/.github/workflows/python-test-coverage.yml
index ea9b4efaec4..5592b7e860c 100644
--- a/.github/workflows/python-test-coverage.yml
+++ b/.github/workflows/python-test-coverage.yml
@@ -15,6 +15,11 @@ env:
   # Coverage threshold percentage for enforced modules
   COVERAGE_THRESHOLD: 85
 
+permissions:
+  contents: read
+  code-quality: write
+  pull-requests: read
+
 jobs:
   python-tests-coverage:
     runs-on: ubuntu-latest
@@ -44,6 +49,13 @@ jobs:
         run: uv run poe test -A -C --cov-report=xml:python-coverage.xml -q --junitxml=pytest.xml
       - name: Check coverage threshold
         run: python ${{ github.workspace }}/.github/scripts/python_check_coverage.py python-coverage.xml ${{ env.COVERAGE_THRESHOLD }}
+      - name: Upload coverage report to GitHub
+        if: github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]'
+        uses: actions/upload-code-coverage@d8e329117199404bba6fc81efe8093dc7c015e34 # v1.4.2
+        with:
+          file: python/python-coverage.xml
+          language: Python
+          label: code-coverage/python
       - name: Upload coverage report
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:

From b901269d33daecdaa948242fb0604b8d7204926a Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 28 Aug 2026 17:33:39 +0000
Subject: [PATCH 02/11] Generate Cobertura coverage report

Co-authored-by: baywet <7905502+baywet@users.noreply.github.com>
---
 .github/workflows/dotnet-build-and-test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dotnet-build-and-test.yml b/.github/workflows/dotnet-build-and-test.yml
index 04ba6546cb5..cab5d27f511 100644
--- a/.github/workflows/dotnet-build-and-test.yml
+++ b/.github/workflows/dotnet-build-and-test.yml
@@ -353,7 +353,7 @@ jobs:
         with:
           reports: "./TestResults/Coverage/**/*.cobertura.xml"
           targetdir: "./TestResults/Reports"
-          reporttypes: "HtmlInline;JsonSummary"
+          reporttypes: "HtmlInline;JsonSummary;Cobertura"
 
       - name: Upload coverage report artifact
         if: matrix.targetFramework == env.COVERAGE_FRAMEWORK

From d9799694e15047acca21e0af98bf2714d3ece2ce Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 28 Aug 2026 17:36:56 +0000
Subject: [PATCH 03/11] Fix Python coverage default branch upload

Co-authored-by: baywet <7905502+baywet@users.noreply.github.com>
---
 .github/workflows/python-test-coverage.yml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/python-test-coverage.yml b/.github/workflows/python-test-coverage.yml
index 5592b7e860c..d4af8d44170 100644
--- a/.github/workflows/python-test-coverage.yml
+++ b/.github/workflows/python-test-coverage.yml
@@ -9,6 +9,14 @@ on:
       - "python/scripts/workspace_poe_tasks.py"
       - ".github/scripts/python_check_coverage.py"
       - ".github/workflows/python-test-coverage.yml"
+  push:
+    branches: ["main"]
+    paths:
+      - "python/packages/**"
+      - "python/tests/unit/**"
+      - "python/scripts/workspace_poe_tasks.py"
+      - ".github/scripts/python_check_coverage.py"
+      - ".github/workflows/python-test-coverage.yml"
 env:
   # Configure a constant location for the uv cache
   UV_CACHE_DIR: /tmp/.uv-cache
@@ -50,7 +58,7 @@ jobs:
       - name: Check coverage threshold
         run: python ${{ github.workspace }}/.github/scripts/python_check_coverage.py python-coverage.xml ${{ env.COVERAGE_THRESHOLD }}
       - name: Upload coverage report to GitHub
-        if: github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]'
+        if: github.actor != 'dependabot[bot]' && ((github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) || (github.event_name == 'push' && github.ref_name == github.event.repository.default_branch))
         uses: actions/upload-code-coverage@d8e329117199404bba6fc81efe8093dc7c015e34 # v1.4.2
         with:
           file: python/python-coverage.xml

From 7c728e0fe0c2ff7bffbd9d68d30534522ec99ba6 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 28 Aug 2026 17:44:24 +0000
Subject: [PATCH 04/11] Isolate coverage upload permissions

Co-authored-by: baywet <7905502+baywet@users.noreply.github.com>
---
 .github/workflows/dotnet-build-and-test.yml | 40 +++++++++++++++------
 .github/workflows/python-test-coverage.yml  | 33 ++++++++++++-----
 2 files changed, 53 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/dotnet-build-and-test.yml b/.github/workflows/dotnet-build-and-test.yml
index cab5d27f511..2370509ef3a 100644
--- a/.github/workflows/dotnet-build-and-test.yml
+++ b/.github/workflows/dotnet-build-and-test.yml
@@ -26,9 +26,6 @@ concurrency:
 
 permissions:
   contents: read
-  code-quality: write
-  id-token: "write"
-  pull-requests: read
 
 jobs:
   paths-filter:
@@ -177,6 +174,9 @@ jobs:
   dotnet-test:
     needs: paths-filter
     if: needs.paths-filter.outputs.dotnetChanges == 'true'
+    permissions:
+      contents: read
+      id-token: "write"
     strategy:
       fail-fast: false
       matrix:
@@ -362,14 +362,6 @@ jobs:
           name: CoverageReport-${{ matrix.os }}-${{ matrix.targetFramework }}-${{ matrix.configuration }} # Artifact name
           path: ./TestResults/Reports # Directory containing files to upload
 
-      - name: Upload coverage report to GitHub
-        if: matrix.targetFramework == env.COVERAGE_FRAMEWORK && github.event_name != 'merge_group' && ((github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]') || (github.event_name != 'pull_request' && github.ref_name == github.event.repository.default_branch))
-        uses: actions/upload-code-coverage@d8e329117199404bba6fc81efe8093dc7c015e34 # v1.4.2
-        with:
-          file: ./TestResults/Reports/Cobertura.xml
-          language: CSharp
-          label: code-coverage/dotnet
-
       - name: Check coverage
         if: matrix.targetFramework == env.COVERAGE_FRAMEWORK
         shell: pwsh
@@ -383,6 +375,29 @@ jobs:
           path: IntegrationTestResults/**/*.junit
           if-no-files-found: ignore
 
+  dotnet-upload-coverage:
+    needs: [paths-filter, dotnet-test]
+    if: needs.paths-filter.outputs.dotnetChanges == 'true' && github.event_name != 'merge_group' && ((github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]') || (github.event_name != 'pull_request' && github.ref_name == github.event.repository.default_branch))
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      code-quality: write
+      pull-requests: read
+    steps:
+      - name: Download coverage report artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: CoverageReport-ubuntu-latest-${{ env.COVERAGE_FRAMEWORK }}-Release
+          path: ./TestResults/Reports
+      - name: Upload coverage report to GitHub
+        uses: actions/upload-code-coverage@d8e329117199404bba6fc81efe8093dc7c015e34 # v1.4.2
+        with:
+          file: ./TestResults/Reports/Cobertura.xml
+          language: CSharp
+          label: code-coverage/dotnet
+          fail-on-error: false
+
   # The Foundry hosted-agent IT is costly (it builds a container, pushes to ACR, and provisions
   # live agents on a separate Foundry project). Running it in its own job keeps the overall
   # workflow time roughly flat: it executes in parallel to dotnet-build and dotnet-test and is
@@ -390,6 +405,9 @@ jobs:
   dotnet-foundry-hosted-it:
     needs: paths-filter
     if: github.event_name != 'pull_request' && needs.paths-filter.outputs.foundryHostingChanges == 'true'
+    permissions:
+      contents: read
+      id-token: "write"
     runs-on: ubuntu-latest
     environment: integration
     env:
diff --git a/.github/workflows/python-test-coverage.yml b/.github/workflows/python-test-coverage.yml
index d4af8d44170..06f32a98b7d 100644
--- a/.github/workflows/python-test-coverage.yml
+++ b/.github/workflows/python-test-coverage.yml
@@ -25,8 +25,6 @@ env:
 
 permissions:
   contents: read
-  code-quality: write
-  pull-requests: read
 
 jobs:
   python-tests-coverage:
@@ -57,16 +55,10 @@ jobs:
         run: uv run poe test -A -C --cov-report=xml:python-coverage.xml -q --junitxml=pytest.xml
       - name: Check coverage threshold
         run: python ${{ github.workspace }}/.github/scripts/python_check_coverage.py python-coverage.xml ${{ env.COVERAGE_THRESHOLD }}
-      - name: Upload coverage report to GitHub
-        if: github.actor != 'dependabot[bot]' && ((github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) || (github.event_name == 'push' && github.ref_name == github.event.repository.default_branch))
-        uses: actions/upload-code-coverage@d8e329117199404bba6fc81efe8093dc7c015e34 # v1.4.2
-        with:
-          file: python/python-coverage.xml
-          language: Python
-          label: code-coverage/python
       - name: Upload coverage report
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
+          name: python-coverage-report
           path: |
             python/python-coverage.xml
             python/pytest.xml
@@ -74,3 +66,26 @@ jobs:
           overwrite: true
           retention-days: 1
           if-no-files-found: error
+
+  python-upload-coverage:
+    needs: python-tests-coverage
+    if: github.actor != 'dependabot[bot]' && ((github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) || (github.event_name == 'push' && github.ref_name == github.event.repository.default_branch))
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      code-quality: write
+      pull-requests: read
+    steps:
+      - name: Download coverage report
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: python-coverage-report
+          path: python
+      - name: Upload coverage report to GitHub
+        uses: actions/upload-code-coverage@d8e329117199404bba6fc81efe8093dc7c015e34 # v1.4.2
+        with:
+          file: python/python-coverage.xml
+          language: Python
+          label: code-coverage/python
+          fail-on-error: false

From 757f2a83c3b29fd3c3d27c29b84c883f669308d9 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 28 Aug 2026 17:53:26 +0000
Subject: [PATCH 05/11] Gate Python coverage report to PR runs

Co-authored-by: baywet <7905502+baywet@users.noreply.github.com>
---
 .github/workflows/python-test-coverage-report.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/python-test-coverage-report.yml b/.github/workflows/python-test-coverage-report.yml
index 770537001fc..68a44c61c61 100644
--- a/.github/workflows/python-test-coverage-report.yml
+++ b/.github/workflows/python-test-coverage-report.yml
@@ -14,7 +14,7 @@ permissions:
 jobs:
   python-test-coverage-report:
     runs-on: ubuntu-latest
-    if: github.event.workflow_run.conclusion == 'success'
+    if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request'
     continue-on-error: false
     defaults:
       run:

From aa01b7eec467115ecaaeb879b62b6c35b3219f01 Mon Sep 17 00:00:00 2001
From: Vincent Biret <vibiret@microsoft.com>
Date: Fri, 28 Aug 2026 14:41:29 -0400
Subject: [PATCH 06/11] ci: remove python coverage comment workflow

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: eef1a37c-bad6-40d4-a626-d611f3aa65dc
---
 .../workflows/python-test-coverage-report.yml | 70 -------------------
 .github/workflows/python-test-coverage.yml    |  9 +--
 2 files changed, 1 insertion(+), 78 deletions(-)
 delete mode 100644 .github/workflows/python-test-coverage-report.yml

diff --git a/.github/workflows/python-test-coverage-report.yml b/.github/workflows/python-test-coverage-report.yml
deleted file mode 100644
index 68a44c61c61..00000000000
--- a/.github/workflows/python-test-coverage-report.yml
+++ /dev/null
@@ -1,70 +0,0 @@
-name: Python - Test Coverage Report
-
-on:
-  workflow_run:
-    workflows: ["Python - Test Coverage"]
-    types:
-      - completed
-
-permissions:
-  contents: read
-  actions: read
-  pull-requests: write
-
-jobs:
-  python-test-coverage-report:
-    runs-on: ubuntu-latest
-    if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request'
-    continue-on-error: false
-    defaults:
-      run:
-        working-directory: python
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Download coverage report
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          github-token: ${{ github.token }}
-          run-id: ${{ github.event.workflow_run.id }}
-          path: ./python
-          merge-multiple: true
-      - name: Display structure of downloaded files
-        run: ls
-      - name: Read and validate PR number
-        # Keep the artifact handoff aligned with the workflow run that produced it.
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPO: ${{ github.repository }}
-          RUN_HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
-        run: |
-          if [ ! -s pr_number ]; then
-            echo "PR number file 'pr_number' is missing or empty"
-            exit 1
-          fi
-
-          ARTIFACT_PR_NUMBER=$(cat pr_number)
-          if ! [[ "$ARTIFACT_PR_NUMBER" =~ ^[0-9]+$ ]]; then
-            echo "::error::PR number file contains invalid content"
-            exit 1
-          fi
-
-          PR_HEAD_SHA=$(gh pr view "$ARTIFACT_PR_NUMBER" --repo "$REPO" --json headRefOid --jq '.headRefOid')
-          if [ "$PR_HEAD_SHA" != "$RUN_HEAD_SHA" ]; then
-            echo "::error::PR head SHA does not match the triggering workflow run"
-            exit 1
-          fi
-
-          echo "PR_NUMBER=$ARTIFACT_PR_NUMBER" >> "$GITHUB_ENV"
-      - name: Pytest coverage comment
-        id: coverageComment
-        uses: MishaKav/pytest-coverage-comment@dd5b80bde6d16941f336518e92929e89069d8451 # v1.7.2
-        with:
-          github-token: ${{ github.token }}
-          issue-number: ${{ env.PR_NUMBER }}
-          pytest-xml-coverage-path: python/python-coverage.xml
-          title: "Python Test Coverage Report"
-          badge-title: "Python Test Coverage"
-          junitxml-title: "Python Unit Test Overview"
-          junitxml-path: python/pytest.xml
-          default-branch: "main"
-          report-only-changed-files: true
diff --git a/.github/workflows/python-test-coverage.yml b/.github/workflows/python-test-coverage.yml
index 06f32a98b7d..e41b075221b 100644
--- a/.github/workflows/python-test-coverage.yml
+++ b/.github/workflows/python-test-coverage.yml
@@ -37,11 +37,6 @@ jobs:
       UV_PYTHON: "3.11"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      # Save the PR number to a file since the workflow_run event
-      # in the coverage report workflow does not have access to it
-      - name: Save PR number
-        run: |
-          echo ${{ github.event.number }} > ./pr_number
       - name: Set up python and install the project
         id: python-setup
         uses: ./.github/actions/python-setup
@@ -52,7 +47,7 @@ jobs:
           # Configure a constant location for the uv cache
           UV_CACHE_DIR: /tmp/.uv-cache
       - name: Run aggregate tests with coverage report
-        run: uv run poe test -A -C --cov-report=xml:python-coverage.xml -q --junitxml=pytest.xml
+        run: uv run poe test -A -C --cov-report=xml:python-coverage.xml -q
       - name: Check coverage threshold
         run: python ${{ github.workspace }}/.github/scripts/python_check_coverage.py python-coverage.xml ${{ env.COVERAGE_THRESHOLD }}
       - name: Upload coverage report
@@ -61,8 +56,6 @@ jobs:
           name: python-coverage-report
           path: |
             python/python-coverage.xml
-            python/pytest.xml
-            python/pr_number
           overwrite: true
           retention-days: 1
           if-no-files-found: error

From 3ae28bf9510ea0f0dd10e37c8eab5a4ea339037f Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 28 Aug 2026 18:56:56 +0000
Subject: [PATCH 07/11] ci: restore python coverage PR report

Co-authored-by: baywet <7905502+baywet@users.noreply.github.com>
---
 .../workflows/python-test-coverage-report.yml | 70 +++++++++++++++++++
 .github/workflows/python-test-coverage.yml    |  9 ++-
 2 files changed, 78 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/python-test-coverage-report.yml

diff --git a/.github/workflows/python-test-coverage-report.yml b/.github/workflows/python-test-coverage-report.yml
new file mode 100644
index 00000000000..68a44c61c61
--- /dev/null
+++ b/.github/workflows/python-test-coverage-report.yml
@@ -0,0 +1,70 @@
+name: Python - Test Coverage Report
+
+on:
+  workflow_run:
+    workflows: ["Python - Test Coverage"]
+    types:
+      - completed
+
+permissions:
+  contents: read
+  actions: read
+  pull-requests: write
+
+jobs:
+  python-test-coverage-report:
+    runs-on: ubuntu-latest
+    if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request'
+    continue-on-error: false
+    defaults:
+      run:
+        working-directory: python
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Download coverage report
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          github-token: ${{ github.token }}
+          run-id: ${{ github.event.workflow_run.id }}
+          path: ./python
+          merge-multiple: true
+      - name: Display structure of downloaded files
+        run: ls
+      - name: Read and validate PR number
+        # Keep the artifact handoff aligned with the workflow run that produced it.
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          RUN_HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+        run: |
+          if [ ! -s pr_number ]; then
+            echo "PR number file 'pr_number' is missing or empty"
+            exit 1
+          fi
+
+          ARTIFACT_PR_NUMBER=$(cat pr_number)
+          if ! [[ "$ARTIFACT_PR_NUMBER" =~ ^[0-9]+$ ]]; then
+            echo "::error::PR number file contains invalid content"
+            exit 1
+          fi
+
+          PR_HEAD_SHA=$(gh pr view "$ARTIFACT_PR_NUMBER" --repo "$REPO" --json headRefOid --jq '.headRefOid')
+          if [ "$PR_HEAD_SHA" != "$RUN_HEAD_SHA" ]; then
+            echo "::error::PR head SHA does not match the triggering workflow run"
+            exit 1
+          fi
+
+          echo "PR_NUMBER=$ARTIFACT_PR_NUMBER" >> "$GITHUB_ENV"
+      - name: Pytest coverage comment
+        id: coverageComment
+        uses: MishaKav/pytest-coverage-comment@dd5b80bde6d16941f336518e92929e89069d8451 # v1.7.2
+        with:
+          github-token: ${{ github.token }}
+          issue-number: ${{ env.PR_NUMBER }}
+          pytest-xml-coverage-path: python/python-coverage.xml
+          title: "Python Test Coverage Report"
+          badge-title: "Python Test Coverage"
+          junitxml-title: "Python Unit Test Overview"
+          junitxml-path: python/pytest.xml
+          default-branch: "main"
+          report-only-changed-files: true
diff --git a/.github/workflows/python-test-coverage.yml b/.github/workflows/python-test-coverage.yml
index e41b075221b..06f32a98b7d 100644
--- a/.github/workflows/python-test-coverage.yml
+++ b/.github/workflows/python-test-coverage.yml
@@ -37,6 +37,11 @@ jobs:
       UV_PYTHON: "3.11"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      # Save the PR number to a file since the workflow_run event
+      # in the coverage report workflow does not have access to it
+      - name: Save PR number
+        run: |
+          echo ${{ github.event.number }} > ./pr_number
       - name: Set up python and install the project
         id: python-setup
         uses: ./.github/actions/python-setup
@@ -47,7 +52,7 @@ jobs:
           # Configure a constant location for the uv cache
           UV_CACHE_DIR: /tmp/.uv-cache
       - name: Run aggregate tests with coverage report
-        run: uv run poe test -A -C --cov-report=xml:python-coverage.xml -q
+        run: uv run poe test -A -C --cov-report=xml:python-coverage.xml -q --junitxml=pytest.xml
       - name: Check coverage threshold
         run: python ${{ github.workspace }}/.github/scripts/python_check_coverage.py python-coverage.xml ${{ env.COVERAGE_THRESHOLD }}
       - name: Upload coverage report
@@ -56,6 +61,8 @@ jobs:
           name: python-coverage-report
           path: |
             python/python-coverage.xml
+            python/pytest.xml
+            python/pr_number
           overwrite: true
           retention-days: 1
           if-no-files-found: error

From f9817497ed0d98c5ddca239e683b4324d51ad01f Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 28 Aug 2026 19:03:21 +0000
Subject: [PATCH 08/11] ci: point coverage users to GitHub report

Co-authored-by: baywet <7905502+baywet@users.noreply.github.com>
---
 .github/workflows/dotnet-build-and-test.yml   |  2 +
 .../workflows/python-test-coverage-report.yml | 70 -------------------
 .github/workflows/python-test-coverage.yml    | 11 +--
 3 files changed, 5 insertions(+), 78 deletions(-)
 delete mode 100644 .github/workflows/python-test-coverage-report.yml

diff --git a/.github/workflows/dotnet-build-and-test.yml b/.github/workflows/dotnet-build-and-test.yml
index 2370509ef3a..e9da557644e 100644
--- a/.github/workflows/dotnet-build-and-test.yml
+++ b/.github/workflows/dotnet-build-and-test.yml
@@ -397,6 +397,8 @@ jobs:
           language: CSharp
           label: code-coverage/dotnet
           fail-on-error: false
+      - name: Summarize GitHub coverage report
+        run: echo ".NET coverage is uploaded to GitHub's integrated coverage report with label \`code-coverage/dotnet\`." >> "$GITHUB_STEP_SUMMARY"
 
   # The Foundry hosted-agent IT is costly (it builds a container, pushes to ACR, and provisions
   # live agents on a separate Foundry project). Running it in its own job keeps the overall
diff --git a/.github/workflows/python-test-coverage-report.yml b/.github/workflows/python-test-coverage-report.yml
deleted file mode 100644
index 68a44c61c61..00000000000
--- a/.github/workflows/python-test-coverage-report.yml
+++ /dev/null
@@ -1,70 +0,0 @@
-name: Python - Test Coverage Report
-
-on:
-  workflow_run:
-    workflows: ["Python - Test Coverage"]
-    types:
-      - completed
-
-permissions:
-  contents: read
-  actions: read
-  pull-requests: write
-
-jobs:
-  python-test-coverage-report:
-    runs-on: ubuntu-latest
-    if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request'
-    continue-on-error: false
-    defaults:
-      run:
-        working-directory: python
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Download coverage report
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          github-token: ${{ github.token }}
-          run-id: ${{ github.event.workflow_run.id }}
-          path: ./python
-          merge-multiple: true
-      - name: Display structure of downloaded files
-        run: ls
-      - name: Read and validate PR number
-        # Keep the artifact handoff aligned with the workflow run that produced it.
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPO: ${{ github.repository }}
-          RUN_HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
-        run: |
-          if [ ! -s pr_number ]; then
-            echo "PR number file 'pr_number' is missing or empty"
-            exit 1
-          fi
-
-          ARTIFACT_PR_NUMBER=$(cat pr_number)
-          if ! [[ "$ARTIFACT_PR_NUMBER" =~ ^[0-9]+$ ]]; then
-            echo "::error::PR number file contains invalid content"
-            exit 1
-          fi
-
-          PR_HEAD_SHA=$(gh pr view "$ARTIFACT_PR_NUMBER" --repo "$REPO" --json headRefOid --jq '.headRefOid')
-          if [ "$PR_HEAD_SHA" != "$RUN_HEAD_SHA" ]; then
-            echo "::error::PR head SHA does not match the triggering workflow run"
-            exit 1
-          fi
-
-          echo "PR_NUMBER=$ARTIFACT_PR_NUMBER" >> "$GITHUB_ENV"
-      - name: Pytest coverage comment
-        id: coverageComment
-        uses: MishaKav/pytest-coverage-comment@dd5b80bde6d16941f336518e92929e89069d8451 # v1.7.2
-        with:
-          github-token: ${{ github.token }}
-          issue-number: ${{ env.PR_NUMBER }}
-          pytest-xml-coverage-path: python/python-coverage.xml
-          title: "Python Test Coverage Report"
-          badge-title: "Python Test Coverage"
-          junitxml-title: "Python Unit Test Overview"
-          junitxml-path: python/pytest.xml
-          default-branch: "main"
-          report-only-changed-files: true
diff --git a/.github/workflows/python-test-coverage.yml b/.github/workflows/python-test-coverage.yml
index 06f32a98b7d..7f046933de3 100644
--- a/.github/workflows/python-test-coverage.yml
+++ b/.github/workflows/python-test-coverage.yml
@@ -37,11 +37,6 @@ jobs:
       UV_PYTHON: "3.11"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      # Save the PR number to a file since the workflow_run event
-      # in the coverage report workflow does not have access to it
-      - name: Save PR number
-        run: |
-          echo ${{ github.event.number }} > ./pr_number
       - name: Set up python and install the project
         id: python-setup
         uses: ./.github/actions/python-setup
@@ -52,7 +47,7 @@ jobs:
           # Configure a constant location for the uv cache
           UV_CACHE_DIR: /tmp/.uv-cache
       - name: Run aggregate tests with coverage report
-        run: uv run poe test -A -C --cov-report=xml:python-coverage.xml -q --junitxml=pytest.xml
+        run: uv run poe test -A -C --cov-report=xml:python-coverage.xml -q
       - name: Check coverage threshold
         run: python ${{ github.workspace }}/.github/scripts/python_check_coverage.py python-coverage.xml ${{ env.COVERAGE_THRESHOLD }}
       - name: Upload coverage report
@@ -61,8 +56,6 @@ jobs:
           name: python-coverage-report
           path: |
             python/python-coverage.xml
-            python/pytest.xml
-            python/pr_number
           overwrite: true
           retention-days: 1
           if-no-files-found: error
@@ -89,3 +82,5 @@ jobs:
           language: Python
           label: code-coverage/python
           fail-on-error: false
+      - name: Summarize GitHub coverage report
+        run: echo "Python coverage is uploaded to GitHub's integrated coverage report with label \`code-coverage/python\`." >> "$GITHUB_STEP_SUMMARY"

From 09b0a8f70310cb39084504d7a66cd701d18b8b27 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 28 Aug 2026 19:07:23 +0000
Subject: [PATCH 09/11] ci: move python coverage upload to report workflow

Co-authored-by: baywet <7905502+baywet@users.noreply.github.com>
---
 .../workflows/python-test-coverage-report.yml | 35 +++++++++++++++++++
 .github/workflows/python-test-coverage.yml    | 27 ++------------
 2 files changed, 37 insertions(+), 25 deletions(-)
 create mode 100644 .github/workflows/python-test-coverage-report.yml

diff --git a/.github/workflows/python-test-coverage-report.yml b/.github/workflows/python-test-coverage-report.yml
new file mode 100644
index 00000000000..f832bb127f7
--- /dev/null
+++ b/.github/workflows/python-test-coverage-report.yml
@@ -0,0 +1,35 @@
+name: Python - Test Coverage Report
+
+on:
+  workflow_run:
+    workflows: ["Python - Test Coverage"]
+    types:
+      - completed
+
+permissions:
+  contents: read
+  actions: read
+  code-quality: write
+  pull-requests: read
+
+jobs:
+  python-test-coverage-report:
+    runs-on: ubuntu-latest
+    if: github.event.workflow_run.conclusion == 'success'
+    steps:
+      - name: Download coverage report
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          github-token: ${{ github.token }}
+          run-id: ${{ github.event.workflow_run.id }}
+          name: python-coverage-report
+          path: python
+      - name: Upload coverage report to GitHub
+        uses: actions/upload-code-coverage@d8e329117199404bba6fc81efe8093dc7c015e34 # v1.4.2
+        with:
+          file: python/python-coverage.xml
+          language: Python
+          label: code-coverage/python
+          fail-on-error: false
+      - name: Summarize GitHub coverage report
+        run: echo "Python coverage is uploaded to GitHub's integrated coverage report with label \`code-coverage/python\`." >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/python-test-coverage.yml b/.github/workflows/python-test-coverage.yml
index 7f046933de3..7b59996a7e4 100644
--- a/.github/workflows/python-test-coverage.yml
+++ b/.github/workflows/python-test-coverage.yml
@@ -9,6 +9,7 @@ on:
       - "python/scripts/workspace_poe_tasks.py"
       - ".github/scripts/python_check_coverage.py"
       - ".github/workflows/python-test-coverage.yml"
+      - ".github/workflows/python-test-coverage-report.yml"
   push:
     branches: ["main"]
     paths:
@@ -17,6 +18,7 @@ on:
       - "python/scripts/workspace_poe_tasks.py"
       - ".github/scripts/python_check_coverage.py"
       - ".github/workflows/python-test-coverage.yml"
+      - ".github/workflows/python-test-coverage-report.yml"
 env:
   # Configure a constant location for the uv cache
   UV_CACHE_DIR: /tmp/.uv-cache
@@ -59,28 +61,3 @@ jobs:
           overwrite: true
           retention-days: 1
           if-no-files-found: error
-
-  python-upload-coverage:
-    needs: python-tests-coverage
-    if: github.actor != 'dependabot[bot]' && ((github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) || (github.event_name == 'push' && github.ref_name == github.event.repository.default_branch))
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      code-quality: write
-      pull-requests: read
-    steps:
-      - name: Download coverage report
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: python-coverage-report
-          path: python
-      - name: Upload coverage report to GitHub
-        uses: actions/upload-code-coverage@d8e329117199404bba6fc81efe8093dc7c015e34 # v1.4.2
-        with:
-          file: python/python-coverage.xml
-          language: Python
-          label: code-coverage/python
-          fail-on-error: false
-      - name: Summarize GitHub coverage report
-        run: echo "Python coverage is uploaded to GitHub's integrated coverage report with label \`code-coverage/python\`." >> "$GITHUB_STEP_SUMMARY"

From 02b4c3e66b01f870fd2ef2dcac4b0c64082da888 Mon Sep 17 00:00:00 2001
From: Vincent Biret <vibiret@microsoft.com>
Date: Fri, 28 Aug 2026 15:11:14 -0400
Subject: [PATCH 10/11] chore: removes model hallucinations

---
 .github/workflows/python-test-coverage-report.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/workflows/python-test-coverage-report.yml b/.github/workflows/python-test-coverage-report.yml
index f832bb127f7..6e3dfc00327 100644
--- a/.github/workflows/python-test-coverage-report.yml
+++ b/.github/workflows/python-test-coverage-report.yml
@@ -31,5 +31,3 @@ jobs:
           language: Python
           label: code-coverage/python
           fail-on-error: false
-      - name: Summarize GitHub coverage report
-        run: echo "Python coverage is uploaded to GitHub's integrated coverage report with label \`code-coverage/python\`." >> "$GITHUB_STEP_SUMMARY"

From 93d2d6aa38d8887eb8e2a7e60f4180e56f319545 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 28 Aug 2026 19:19:20 +0000
Subject: [PATCH 11/11] ci: move python coverage upload back to test workflow

Co-authored-by: baywet <7905502+baywet@users.noreply.github.com>
---
 .../workflows/python-test-coverage-report.yml | 33 -------------------
 .github/workflows/python-test-coverage.yml    | 25 ++++++++++++--
 2 files changed, 23 insertions(+), 35 deletions(-)
 delete mode 100644 .github/workflows/python-test-coverage-report.yml

diff --git a/.github/workflows/python-test-coverage-report.yml b/.github/workflows/python-test-coverage-report.yml
deleted file mode 100644
index 6e3dfc00327..00000000000
--- a/.github/workflows/python-test-coverage-report.yml
+++ /dev/null
@@ -1,33 +0,0 @@
-name: Python - Test Coverage Report
-
-on:
-  workflow_run:
-    workflows: ["Python - Test Coverage"]
-    types:
-      - completed
-
-permissions:
-  contents: read
-  actions: read
-  code-quality: write
-  pull-requests: read
-
-jobs:
-  python-test-coverage-report:
-    runs-on: ubuntu-latest
-    if: github.event.workflow_run.conclusion == 'success'
-    steps:
-      - name: Download coverage report
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          github-token: ${{ github.token }}
-          run-id: ${{ github.event.workflow_run.id }}
-          name: python-coverage-report
-          path: python
-      - name: Upload coverage report to GitHub
-        uses: actions/upload-code-coverage@d8e329117199404bba6fc81efe8093dc7c015e34 # v1.4.2
-        with:
-          file: python/python-coverage.xml
-          language: Python
-          label: code-coverage/python
-          fail-on-error: false
diff --git a/.github/workflows/python-test-coverage.yml b/.github/workflows/python-test-coverage.yml
index 7b59996a7e4..e1c38fabb1e 100644
--- a/.github/workflows/python-test-coverage.yml
+++ b/.github/workflows/python-test-coverage.yml
@@ -9,7 +9,6 @@ on:
       - "python/scripts/workspace_poe_tasks.py"
       - ".github/scripts/python_check_coverage.py"
       - ".github/workflows/python-test-coverage.yml"
-      - ".github/workflows/python-test-coverage-report.yml"
   push:
     branches: ["main"]
     paths:
@@ -18,7 +17,6 @@ on:
       - "python/scripts/workspace_poe_tasks.py"
       - ".github/scripts/python_check_coverage.py"
       - ".github/workflows/python-test-coverage.yml"
-      - ".github/workflows/python-test-coverage-report.yml"
 env:
   # Configure a constant location for the uv cache
   UV_CACHE_DIR: /tmp/.uv-cache
@@ -61,3 +59,26 @@ jobs:
           overwrite: true
           retention-days: 1
           if-no-files-found: error
+
+  python-upload-coverage:
+    needs: python-tests-coverage
+    if: github.event_name != 'merge_group' && ((github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]') || (github.event_name != 'pull_request' && github.ref_name == github.event.repository.default_branch))
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      code-quality: write
+      pull-requests: read
+    steps:
+      - name: Download coverage report
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: python-coverage-report
+          path: python
+      - name: Upload coverage report to GitHub
+        uses: actions/upload-code-coverage@d8e329117199404bba6fc81efe8093dc7c015e34 # v1.4.2
+        with:
+          file: python/python-coverage.xml
+          language: Python
+          label: code-coverage/python
+          fail-on-error: false