Add coverage gate, CycloneDX SBOM, and release attestations

[masarray]

Purpose

Continue the post-audit hardening with measurable test evidence, application-only dependency inventory, and stronger release provenance.

Quality gates

• Add pinned coverlet.msbuild 6.0.4 instrumentation to the test project.
• Add scripts/test-with-coverage.ps1 with TRX, complete test log, and normalized Cobertura evidence.
• Explicitly instrument production engine source currently linked into ARSVIN.Tests while excluding test/generated files.
• Enforce a verified 50% line-coverage regression floor.
• Treat compiler warnings as errors in CI, release validation, local validated builds, test compilation, and CodeQL.
• Upload test/coverage evidence even when the coverage gate fails.

Verified baseline:

• 26 tests passed
• 1,535 production lines instrumented
• 888 production lines covered
• 57.85% line coverage
• 33.17% branch coverage
• 60.71% method coverage

CycloneDX SBOM

• Add scripts/generate-sbom.ps1.
• Resolve Publisher and Subscriber dependency graphs separately.
• Deduplicate direct and transitive managed application packages.
• Record which application uses each dependency.
• Exclude and actively reject test-only packages such as xUnit, Coverlet, and Microsoft.NET.Test.Sdk.
• Stabilize component ordering, source commit, and metadata timestamp from the build commit.
• Add ARSVIN-SBOM.cdx.json to workflow artifacts, release files, and SHA-256 checksums.

Validated SBOM:

• CycloneDX 1.5
• 6 application dependency components
• sorted component order
• no test-only packages
• Publisher and Subscriber recorded as included applications

Installer toolchain

• Pin automated installer compilation to the exact Chocolatey package innosetup|6.7.1.
• Fail if the installed package version differs.
• Record the resolved ISCC.exe path and file/product metadata as build evidence.
• Preserve the complete installer compilation and silent install/uninstall smoke test.

Release provenance

• Add official actions/attest v4 pinned to immutable commit a1948c3f048ba23858d222213b7c278aabede763.
• Generate signed build provenance for tagged release assets.
• Generate a signed SBOM attestation connecting release binaries/ZIP to the CycloneDX document.
• Keep attestations tag-only; pull requests produce private validation artifacts and never publish a release.

Validation completed

CI

• Public-site validation: success
• Publisher warning-free build: success
• Subscriber warning-free build: success
• 26 tests: success
• 50% coverage gate: success at 57.85%
• Publisher/Subscriber vulnerability reports: success
• Test evidence artifact uploaded

CodeQL

• Full solution restore: success
• Warning-free full solution build: success
• C# analysis: success

Windows release validation

• Portable Publisher: success
• Portable Subscriber: success
• Inno Setup 6.7.1 installation and verification: success
• Suite installer compilation: success
• Application-only CycloneDX SBOM generation and validation: success
• Silent install/uninstall smoke test: success
• Five SHA-256 checksums generated and independently matched
• Private workflow artifact uploaded
• Public release job correctly skipped on this pull request

Validated workflow artifact:

• ARSVIN-0.0.0-pr.28-windows-x64
• Size: 409,102,814 bytes
• Workflow artifact digest: sha256:9394994b602a098d4ce568b5a1ffb3024b49df2fbfe86d4639414be35037e347

The attestation steps require a semantic-version tag and will be exercised by the next public release after this PR is merged.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.