Tighten Salesforce PR workflow gating

Author: omniphx

.github/workflows/run-tests.yml

@@ -66,6 +66,7 @@ jobs:
 
   salesforce-integration:
     runs-on: ubuntu-latest
+    name: Salesforce Integration
     env:
       RUN_SALESFORCE_INTEGRATION_TESTS: true
       SF_CONSUMER_KEY: ${{ secrets.SF_CONSUMER_KEY }}
@@ -93,24 +94,36 @@ jobs:
             fi
           done
 
-      - name: Skip when Salesforce secrets are missing
+      - name: Resolve Salesforce test configuration
+        id: salesforce-config
         run: |
           missing=0
           for key in SF_CONSUMER_KEY SF_CONSUMER_SECRET SF_USERNAME SF_PASSWORD; do
             if [ -z "${!key}" ]; then
-              echo "Skipping Salesforce integration tests because $key is not configured."
+              echo "Missing Salesforce secret: $key"
               missing=1
             fi
           done
-          if [ "$missing" -ne 0 ]; then
-            exit 0
-          fi
+
           if [ -z "$SF_LOGIN_URL" ]; then
             echo "SF_LOGIN_URL=https://login.salesforce.com" >> "$GITHUB_ENV"
           fi
 
+          if [ "$missing" -ne 0 ]; then
+            echo "can_run=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "can_run=true" >> "$GITHUB_OUTPUT"
+
+      - name: Skip Salesforce integration test
+        if: steps.salesforce-config.outputs.can_run != 'true'
+        run: echo "Skipping Salesforce integration tests because the required GitHub secrets are not configured for this pull request."
+
       - name: Install dependencies
+        if: steps.salesforce-config.outputs.can_run == 'true'
         run: composer update --prefer-stable --prefer-dist --no-interaction --no-suggest
 
       - name: Execute Salesforce integration test
+        if: steps.salesforce-config.outputs.can_run == 'true'
         run: vendor/bin/phpunit --filter UserPasswordIntegrationTest