Cover the API layer, close three gates that could not fail, and fix a feed bug that 500s /internal/refresh

[bgard68]

Coverage

The API layer had no tests at all — Program.cs, LotteryEndpoints.cs, DrawRefreshService.cs and DatabaseHealthCheck.cs were exercised only by the post-build smoke test. Coverage was also not measurable: no test project referenced a collector.

Layer	Before	After
Lottery.Api	0% (no project)	100% (167/167)
Lottery.Application	98.1%	100% (87/87)
Lottery.Infrastructure	63.1%	100% (177/177)
Lottery.Domain	92.6%	98.8% (164/166)

109 tests → 316. The two uncovered Domain lines are DrawSchedule's "unreachable" throws: the loop scans eight consecutive days and both games draw on two or more, so reaching them would mean bending production code to suit a test.

coverlet.runsettings excludes the OpenAPI source generator's output — several thousand generated lines in Lottery.Api that nothing we write can cover, and which alone cost that layer ~40 points.

New tests/Lottery.Api.Tests boots the real host over a throwaway SQLite file (real migrations, real snapshot seed, real routing and middleware); only the live feeds and the timer loop are faked, so runs are offline and need no clock.

Three gates could report success while proving nothing

This is the failure mode gate-probes.yml exists to prevent, and two of its neighbours had it.

• era-check's live-feed validation had no set -e. With the API unreachable, RESPONSE was empty, jq produced nothing, and [ "" -gt 0 ] returned 2 — making the if false, so the step exited 0. Reproduced: exit 0 before, exit 7 after. This is the only monitor for an undocumented lottery rule change, so it has been silently green whenever it could not see anything.
• gate-probes' third probe did not guard its dotnet new setup and had no inconclusive check, unlike probes 1 and 2. A failed scaffold fell through to the success echo.
• The "Start API" wait loops exit 0 whether or not the API came up, because the trailing sleep succeeds.

Workflow permissions and hardening

• cleanup-runs.yml granted actions: write workflow-wide, so any job added later would inherit the ability to delete runs. Now scoped to the one job that needs it (GHA002).
• codeql.yml's security-events: write was also flagged by GHA002 — that one is a false positive. Code scanning has no read-only ingest path, so it is the floor for uploading SARIF, and it was already job-scoped with the workflow default read-only. Documented rather than "fixed" into a broken upload.
• deploy-api.yml's id-token: write moved to the job that calls azure/login; API_BASE_URL now goes through env: instead of being interpolated into a run: line.
• dependency-review's comment-summary-in-pr needed pull-requests: write and had none, so it silently never posted.
• cleanup-runs.yml validates its workflow_dispatch inputs before they reach $(( )), which evaluates array subscripts and so can execute a command substitution.
• Concurrency groups added to the four PR-triggered workflows.
• .gitleaks.toml no longer allowlists package-lock.json wholesale — npm lock files can carry inline registry credentials in resolved URLs. Only the integrity hashes are excluded now.

A real bug: feed parse failures 500 /internal/refresh

MegaMillionsJackpotFeed's own summary promises "any shape change degrades to null rather than throwing", and both sibling jackpot feeds guard HttpRequestException and JsonException. This one guarded nothing — XDocument.Parse throws XmlException, Deserialize throws JsonException.

Neither type matches RefreshGame's catch filter, and CompositeJackpotFeed passes them straight through, so they escape RefreshGame.ExecuteAsync. /internal/refresh — the endpoint the keep-alive workflow calls — has no try/catch, so the request 500s and any game after the failing one is skipped.

The trigger is the one this repo has already been bitten by: a bot-challenge HTML page served with a 200, which is what retired powerball.com's API.

SocrataWinningNumbersFeed had the same escape by a different route. It still refuses a bad batch — a silently short batch would let gap-repair skip real draws — but now as InvalidOperationException with the cause kept, the type the caller already handles.

Dependabot

#116, #111 and #109 each bump a package a peer constraint caps, so they fail before their tests run and are re-proposed weekly. Added semver-major ignores with the condition for lifting each, and commented the PRs. Also added the missing nuget entry for the frontend branch — that branch carries src/Lottery.Api and its CI builds it, but the existing entry has no target-branch, so those packages were never bumped or scanned.

Architecture — reviewed, unchanged

Domain has zero dependencies, Application owns the ports, Infrastructure implements them, only DependencyInjection.cs constructs concrete types, and all eight IDrawRepository methods have real consumers. Clean/Onion/DIP/SRP all hold, so nothing was changed — manufacturing findings would have been box-checking.

Verification

Against a clean worktree of the pushed HEAD: dotnet restore --locked-mode clean, dotnet build -warnaserror with zero warnings, 316/316 tests, all 13 endpoints returning expected status codes, all five security headers present and Server absent. main was merged in after #113 and the new project's lock file regenerated with --force-evaluate.

🤖 Generated with Claude Code