fix(ci): select integration test events explicitly

[Vincent Biret (baywet)]

Motivation and Context

Select integration-test jobs using pull-request repository identity while retaining build and unit-test checks for all pull requests and the merge queue.

Description

• Skip integration jobs for fork pull requests and Dependabot-triggered pull requests, while allowing other same-repository pull requests, merge groups, and manual runs on repository branches. The Dependabot exclusion applies only to pull-request events.
• Preserve the existing scheduled/manual split for the full Python integration suite.
• Separate .NET integration tests from build and unit-test jobs, and include the separate job in the final result check.
• Keep Python integration settings on test steps and integration setup permissions on the jobs that use them.

Validation from the isolated worktree:

• Temporary session-only checks using the Actions expression evaluator: the initial event-policy update passed all 19 cases after 9 intended assertion failures. For the Dependabot refinement, node '<session-files>\workflow-policy-check\check.mjs' 'D:\github\semantic-kernel-integration-event-selection' produced 3 intended Dependabot-PR assertion failures and 20 passes before the fix; afterward, all 23 cases passed. Coverage includes same-repository human PRs, Dependabot PRs, fork PRs, unavailable PR head repositories, merge groups and manual runs with a Dependabot actor, manual topic-branch runs, and the Python scheduled/manual split. No new CI unit tests or dependencies are retained in this PR.
• actionlint -shellcheck= -pyflakes= -ignore 'constant expression "false" in condition' .github\workflows\dotnet-build-and-test.yml .github\workflows\dotnet-integration-tests.yml .github\workflows\python-integration-tests.yml: passed. The exclusion covers three pre-existing constant-false conditions in disabled Python steps, confirmed against the base revision.
• git diff --check: passed.

Live integration tests and repository-wide .NET/Python builds were not run locally. The initial PR revision passed all applicable GitHub checks, including the three .NET build-and-test jobs; the updated revision requires a fresh CI run.

Contribution Checklist

• The code builds clean without any errors or warnings
• The PR follows the SK Contribution Guidelines and the pre-submission formatting script raises no violations
• All unit tests pass, and I have added new tests where possible
• I didn't break anyone 😄

[Copilot]

🟢 Approval recommended

The changes match the intended event restrictions and preserve required checks, with no blocking issues identified.

0 open findings

What changed in this PR

Makes integration-test event selection explicit while preserving pull-request and merge-queue build and unit-test checks.

Changes:

• Restricts integration jobs to main-branch manual runs and existing Python schedules.
• Separates .NET integration execution and scopes integration settings and permissions.
• Adds event-selection tests, CI wiring, and contributor instructions.

File	Description
CONTRIBUTING.md	Documents automation test commands.
.github/​workflows/​python-integration-tests.yml	Gates integration jobs and scopes settings and permissions.
.github/​workflows/​github-automation-tests.yml	Installs test dependencies and expands workflow path coverage.
.github/​workflows/​dotnet-integration-tests.yml	Restricts execution to main-branch manual runs.
.github/​workflows/​dotnet-build-and-test.yml	Separates integration tests and includes their result in the final check.
.github/​tests/​test_integration_events.js	Adds event-selection regression coverage.
.github/​tests/​package.json	Declares workflow-testing dependencies.
.github/​tests/​package-lock.json	Locks testing dependencies.

Files not reviewed (1)

• .github/tests/package-lock.json: Generated file

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

CI event gating and credential-scope changes need human confirmation after a fresh CI run on the updated revision.

0 open findings

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

Merge-gate and credential-scoping changes need fresh CI validation and human review before approval.

0 open findings

🧠 Review effort: Balanced

[Copilot]

🟢 Approval recommended

No blocking issues were identified in event selection, permission scoping, or result aggregation.

0 open findings

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

Dependabot PRs enter credential-dependent jobs despite lacking access to Actions secrets.

1 open finding

• Dependabot PR workflows require unavailable Actions secrets · New

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

Newly enabled credentialed PR jobs and the separated .NET integration job need fresh CI validation before approval.

0 open findings

1 resolved since last review

• Dependabot PR workflows require unavailable Actions secrets

🧠 Review effort: Balanced