The Changes job fails open, misses renames, and does not list tools/Shared or .config/dotnet-tools.json #70

Decided in decision 113, part of #118. The selection moves into tools/CiLanes. It runs git diff --name-only --no-renames -z and assigns each path the first class whose pattern matches. A path no class names selects every lane, so an unknown path selects the pack rather than skipping it. tools/Shared/**, tools/Directory.Build.* and the smoke test select every lane. .config/dotnet-tools.json is unlisted, so it does too. The CI gate (#71) fails when Changes did not succeed, which closes the fail-open. CiLaneTests (conventions) runs classify over every file MSBuild evaluates for each shipping project and the smoke test, items and imports both, and fails one that does not select the pack. Seeds: a rename out of src/ (SelectionTests, shown failing without --no-renames), a failed diff (exit 1, no answer written), and a failed Changes (GateTests).

Problem

The changes job in dotnet.yml (added in 44b3ef0) decides whether a PR runs Pack and Consumer smoke test, two required checks. It can answer "nothing to pack" when the PR does change a package, and nothing reports that. There are three ways.

1. It fails open. The workflow comment says a failed git diff "fails the job rather than answering false, so a broken diff can never skip the pack". The opposite happens:

• Changes is not a required check.
• When it fails, Pack and Consumer are skipped because a job they need failed.
• GitHub reports a skipped job as Success on a required check ("A job that is skipped will report its status as "Success". It will not prevent a pull request from merging, even if it is a required check").

So Test (ubuntu-latest) and Labels and issue link decide the merge alone. This follows from GitHub's documented rule; it has not been reproduced on a live PR.

2. It cannot see a rename's source. git diff --name-only without --no-renames lists only the new path of a renamed file. Moving a file from src/ to spikes/ or docs/ reports just the new path, so the job answers product=false. Checked locally with git 2.54: git mv src/A.cs docs/A.cs lists docs/A.cs alone, while --no-renames lists both paths.

3. Two inputs are missing from its list.

• tools/Shared/*.cs is compiled into the smoke test tool through tools/Directory.Build.props (<Compile Include="$(MSBuildThisFileDirectory)Shared/*.cs" />), but only tools/ConsumerSmokeTest/* is listed.
• .config/dotnet-tools.json pins the CycloneDX that Pack's SBOM step runs, and it is not listed either.

A change to either skips Pack and Consumer on the PR. The first run of the changed code is the push to the release branch.

Change

• git diff --name-only --no-renames -z.
• The deciding list comes from the project graph: the smoke tool's and the shipping projects' MSBuild inputs, including linked and imported files, plus .config/dotnet-tools.json. Any path the list does not recognise selects the pack, rather than skipping it.
• A job that always runs requires Changes to have succeeded (CI: a gate job over every job, and which legs it requires #71). Until then, make Changes a required check.
• Seeds, each shown to fail:
  • a rename out of src/
  • an edit to tools/Shared/SharedFile.cs
  • an edit to .config/dotnet-tools.json
  • Changes exiting 1 on a PR

Done when

All four seeds fail the PR's required checks, rather than skipping Pack and Consumer.