In the current GitHub CI definition, the test and collateral jobs share a bit of logic (checkout, setup python, install system dependencies), but it's easy to forget that both of these essentially need the same behavior, especially because diffcov runs the tests. For example, in this run, I added a workaround to test but not to collateral, so the tests failed when run in diffcov.

Gemini has some ideas on how to model this shared behavior.