@@ -45,10 +45,8 @@ jobs:
       - name: Build the samples (a library or sample that does not compile fails the run)
         run: dotnet build docsite/samples/Samples.csproj -c Release -p:GeneratePackageOnBuild=false
 
-      - name: Run the samples (a failure is reported, not blocking)
-        id: samples
-        continue-on-error: true
-        run: dotnet docsite/samples/bin/Release/net10.0/Samples.dll
+      - name: Run the samples (a failing sample fails the run)
+        run: dotnet run --project docsite/samples/Samples.csproj -c Release --no-build
 
       - name: Build the site
         run: |
@@ -72,11 +70,6 @@ jobs:
           $lines = @()
           $lines += '## Docs build'
           $lines += ''
-          if ('${{ steps.samples.outcome }}' -eq 'failure') {
-            $lines += '> **The samples ran but reported a failure.** The docs may describe behavior that changed. See the "Run the samples" step.'
-            $lines += ''
-            Write-Host '::warning title=Docs samples::The samples ran but reported a failure.'
-          }
           if (Test-Path docfx-log.json) {
             # Plain text parsing on purpose: a log line that is not valid JSON must not break the summary.
             $warnings = @(Get-Content docfx-log.json | Where-Object { $_ -match '"severity":"warning"' } | ForEach-Object {
 
@@ -0,0 +1,122 @@
+name: Tests
+
+# Runs the Core test suite on every pull request and every push to master, and checks the packages for known vulnerabilities.
+# The suite runs on net10.0 and net11.0 in Release, and on net11.0 in Debug (Debug.Assert is live there).
+# SQL Server LocalDB is part of the runner image. ODX_REQUIRE_SQL=1 makes the tests that need it fail, instead of skip, when it is missing.
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# One group per ref: a pull request's ref (refs/pull/N/merge) never equals master's, so a pull request run can never cancel a master run.
+# A newer push to a pull request cancels the older run; master and manual runs queue and are never cancelled.
+concurrency:
+  group: tests-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+env:
+  DOTNET_NOLOGO: true
+  DOTNET_CLI_TELEMETRY_OPTOUT: true
+  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
+
+jobs:
+  test:
+    name: Test ${{ matrix.name }}
+    runs-on: windows-latest
+    timeout-minutes: 30
+    defaults:
+      run:
+        shell: pwsh
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: net10.0-Release
+            tfm: net10.0
+            configuration: Release
+          - name: net11.0-Release
+            tfm: net11.0
+            configuration: Release
+          - name: net11.0-Debug
+            tfm: net11.0
+            configuration: Debug
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-dotnet@v6
+        with:
+          dotnet-version: |
+            10.0.x
+            11.0.x
+
+      # The tests that need a real SQL Server connect to (localdb)\MSSQLLocalDB. The runner image carries the LocalDB runtime,
+      # but the automatic instance is created on its first start, which can outlast a connection timeout. Start it here,
+      # so the first test does not pay for it, and fail now, with a clear message, if the image has no LocalDB.
+      - name: Start SQL Server LocalDB
+        run: |
+          $exe = (Get-Command SqlLocalDB.exe -ErrorAction SilentlyContinue)?.Source
+          if (-not $exe) {
+            $exe = Get-ChildItem "$env:ProgramFiles\Microsoft SQL Server\*\Tools\Binn\SqlLocalDB.exe" -ErrorAction SilentlyContinue |
+              Sort-Object FullName | Select-Object -Last 1 -ExpandProperty FullName
+          }
+          if (-not $exe) { throw 'SqlLocalDB.exe was not found on this runner image, so the SQL Server tests cannot run.' }
+          & $exe start MSSQLLocalDB
+          if ($LASTEXITCODE -ne 0) { throw "SqlLocalDB start MSSQLLocalDB failed with exit code $LASTEXITCODE" }
+          & $exe info MSSQLLocalDB
+
+      - name: Run the tests (${{ matrix.name }})
+        env:
+          ODX_REQUIRE_SQL: 1
+        run: dotnet test Tests/Open.Database.Extensions.Core.Tests -c ${{ matrix.configuration }} -f ${{ matrix.tfm }} --logger "trx;LogFileName=${{ matrix.name }}.trx" --results-directory TestResults/${{ matrix.name }}
+
+      - name: Upload the TRX files
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: trx-${{ matrix.name }}
+          path: TestResults/${{ matrix.name }}/*.trx
+
+  vulnerable-packages:
+    name: Vulnerable packages
+    runs-on: windows-latest
+    timeout-minutes: 15
+    defaults:
+      run:
+        shell: pwsh
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-dotnet@v6
+        with:
+          dotnet-version: 11.0.x
+
+      # `dotnet list package --vulnerable` exits 0 even when it finds something, so read what it prints.
+      # Each library project, plus the test project, is listed with its transitive packages.
+      - name: List vulnerable packages (any finding fails the run)
+        run: |
+          $projects = @(Get-ChildItem Source -Recurse -Filter *.csproj) + @(Get-Item Tests/Open.Database.Extensions.Core.Tests/*.csproj)
+          $failures = @()
+          foreach ($project in $projects) {
+            $output = (dotnet list $project.FullName package --vulnerable --include-transitive 2>&1 | Out-String)
+            $exitCode = $LASTEXITCODE
+            Write-Host $output
+            if ($exitCode -ne 0) {
+              $failures += "$($project.Name): dotnet list exited with code $exitCode"
+            }
+            elseif ($output -match 'has the following vulnerable packages') {
+              $failures += "$($project.Name): vulnerable packages found (listed above)"
+            }
+            elseif ($output -match 'NU1900') {
+              $failures += "$($project.Name): the vulnerability data could not be read, so the check proved nothing"
+            }
+          }
+          if ($failures.Count -gt 0) {
+            foreach ($failure in $failures) { Write-Host "::error title=Vulnerable packages::$failure" }
+            exit 1
+          }
+          "No vulnerable packages in $($projects.Count) project(s)."
@@ -7,10 +7,12 @@ namespace Open.Database.Extensions.Tests;
 /// <summary>
 /// SQL Server LocalDB for the few tests that need a real server (the SQL Server package's typed <c>SqlCommand</c> and <c>SqlTransaction</c> extensions, which fakes cannot stand in for).
 /// Call <see cref="SkipUnlessAvailable"/> first in such a test: it reports the test as skipped, not as passed or failed, when LocalDB cannot be reached, so the suite stays green on a machine or build agent without it.
+/// Where a skip would hide a gap (continuous integration), set the environment variable named by <see cref="RequireVariable"/>: the same tests then fail, with the reason, instead of being skipped.
 /// </summary>
 /// <remarks>
 /// The reachability check runs once per test run. It is the same connection every test uses, so a machine without LocalDB fails fast (the instance does not exist) instead of waiting for a timeout in every test.
 /// Setting the environment variable named by <see cref="ForceSkipVariable"/> skips every server test without looking for LocalDB, which is how to see the suite as a machine without LocalDB sees it.
+/// <see cref="RequireVariable"/> wins over <see cref="ForceSkipVariable"/>: with both set the server tests fail, so forcing a skip can never turn a required run into a green one.
 /// Everything the tests create lives in <c>tempdb</c> under a name made unique by a new <see cref="Guid"/>, and is dropped when its <see cref="Scratch"/> is disposed.
 /// </remarks>
 [ExcludeFromCodeCoverage]
@@ -19,6 +21,9 @@ internal static class LocalDbFixture
 	/// <summary>The environment variable that, when it has any value, skips every test that needs LocalDB.</summary>
 	public const string ForceSkipVariable = "ODE_TEST_NO_LOCALDB";
 
+	/// <summary>The environment variable that, when it has any value, makes every test that needs LocalDB fail instead of skip when LocalDB cannot be reached (or when <see cref="ForceSkipVariable"/> is set).</summary>
+	public const string RequireVariable = "ODX_REQUIRE_SQL";
+
 	/// <summary>The default instance every Visual Studio and SQL Server Express LocalDB install creates, working in <c>tempdb</c>.</summary>
 	public const string ConnectionString = @"Server=(localdb)\MSSQLLocalDB;Database=tempdb;Integrated Security=true;Encrypt=False;Connect Timeout=20";
 
@@ -42,10 +47,15 @@ internal static class LocalDbFixture
 		}
 	}
 
-	/// <summary>Skips the calling test (it is reported as skipped) when LocalDB cannot be reached.</summary>
+	/// <summary>Skips the calling test (it is reported as skipped) when LocalDB cannot be reached, or fails it instead when <see cref="RequireVariable"/> is set.</summary>
 	public static void SkipUnlessAvailable()
 	{
-		if (Unavailable.Value is { } reason) Assert.Skip(reason);
+		if (Unavailable.Value is not { } reason) return;
+
+		if (!string.IsNullOrEmpty(Environment.GetEnvironmentVariable(RequireVariable)))
+			Assert.Fail($"{RequireVariable} is set, so a missing SQL Server is a failure, not a skip: {reason}");
+
+		Assert.Skip(reason);
 	}
 
 	/// <summary>A new, closed connection to LocalDB's <c>tempdb</c>. The caller disposes it.</summary>