Bump actions/deploy-pages from 5.0.0 to 5.0.1 in the github-actions g…

…roup (#538)

Bumps the github-actions group with 1 update:
[actions/deploy-pages](https://github.com/actions/deploy-pages).

Updates `actions/deploy-pages` from 5.0.0 to 5.0.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/deploy-pages/releases">actions/deploy-pages's
releases</a>.</em></p>
<blockquote>
<h2>v5.0.1</h2>
<h1>Changelog</h1>
<ul>
<li>Add backoff and jitter to deployment polling <a
href="https://github.com/yoannchaudet"><code>@​yoannchaudet</code></a>
(<a
href="https://redirect.github.com/actions/deploy-pages/issues/444">#444</a>)</li>
<li>Improve deployment request test coverage <a
href="https://github.com/adwitiyagoyal"><code>@​adwitiyagoyal</code></a>
(<a
href="https://redirect.github.com/actions/deploy-pages/issues/440">#440</a>)</li>
</ul>
<hr />
<p>See details of <a
href="https://github.com/actions/deploy-pages/compare/v5.0.0...v5.0.1">all
code changes</a> since previous release.</p>
<p>:warning: For use with products other than GitHub.com, such as GitHub
Enterprise Server, please consult the <a
href="https://github.com/actions/deploy-pages/#compatibility">compatibility
table</a>.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/deploy-pages/commit/368f82528645a54fb793d4d04e342629a3f51346"><code>368f825</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/deploy-pages/issues/444">#444</a>
from actions/yoannchaudet-deployment-polling-backoff</li>
<li><a
href="https://github.com/actions/deploy-pages/commit/7e97763d1f8271fc88f351a0c275f37de7f32094"><code>7e97763</code></a>
Validate deployment polling intervals</li>
<li><a
href="https://github.com/actions/deploy-pages/commit/0143e11abb4ace1f6858cb44b2ab99eae8a40b45"><code>0143e11</code></a>
Add backoff and jitter to deployment polling</li>
<li><a
href="https://github.com/actions/deploy-pages/commit/5e98f10ce206463e411e82ac66ef0f2df79c5499"><code>5e98f10</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/deploy-pages/issues/440">#440</a>
from actions/user/adwitiya</li>
<li><a
href="https://github.com/actions/deploy-pages/commit/8b0625abb54462fce279dc6ce57ef7ce0fb8b8fc"><code>8b0625a</code></a>
Improve deployment request test coverage</li>
<li>See full diff in <a
href="https://github.com/actions/deploy-pages/compare/cd2ce8fcbc39b97be8ca5fce6e763baed58fa128...368f82528645a54fb793d4d04e342629a3f51346">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/deploy-pages&package-manager=github_actions&previous-version=5.0.0&new-version=5.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Marius Storhaug <marstor@hotmail.com>

🩹 [Patch]: Framework artifacts stay under .PSModule (#540)

Framework-generated artifacts now stay under the consumer repository's
`.PSModule` directory instead of root-level `outputs`, `_site`,
`TestResult`, and `CodeCoverage` paths. Invoke-Pester keeps its internal
`.temp` state at `[System.IO.Path]::GetTempPath()/Invoke-Pester`,
outside the consumer worktree.

## Changed: Framework artifact directory

- Built modules use `.PSModule/module`.
- Generated documentation uses `.PSModule/docs`.
- Zensical workspace and GitHub Pages payload use `.PSModule/site`, with
generated HTML at `.PSModule/site/_site`.
- Framework tests write reports to
`<WorkingDirectory>/.PSModule/TestResult/<suite>-TestResult-Report.xml`
and
`<WorkingDirectory>/.PSModule/CodeCoverage/<suite>-CodeCoverage-Report.xml`
through Invoke-Pester's existing report-path inputs.
- Build, test, lint, publish, release, artifact download/upload, Pages,
action defaults, implementation tests, fixtures, and references use the
new locations.
- Aggregation-runner-only `CodeCoverage/`, `CodeCoverage-MissedPaths/`,
`TestResults/`, and `super-linter-output/` locations are unchanged.

## Adopting this release

No consumer configuration, code, or invocation changes are required.
`workflow.yml` is the supported consumer contract; component actions,
nested reusable workflows, and their intermediate artifact paths are
internal implementation details.

## Release impact

- Effective decision: `release:patch`.
- Semantic effect: Patch release; the supported `workflow.yml` contract
is unchanged.

## Invoke-Pester compatibility

This change uses Invoke-Pester v5.1.1, pinned to its immutable release
commit `c5494aba3c07d7bfd81bdbbc9f301e8fa4a729fb`. The release includes
PSModule/Invoke-Pester#78, which honors the existing
`TestResult_OutputPath` and `CodeCoverage_OutputPath` action inputs used
for the `.PSModule` report paths.

## Technical details

- Fixture assertions require generated documentation under
`.PSModule/docs`.
- Focused Pester tests cover publish and release paths.
- A focused site experiment verifies `.PSModule/site/_site` is produced
without legacy root artifact directories.
- Changed workflow YAML files parse successfully.

Bump actions/deploy-pages from 5.0.0 to 5.0.1 in the github-actions g…

…roup (#538)

Bumps the github-actions group with 1 update:
[actions/deploy-pages](https://github.com/actions/deploy-pages).

Updates `actions/deploy-pages` from 5.0.0 to 5.0.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/deploy-pages/releases">actions/deploy-pages's
releases</a>.</em></p>
<blockquote>
<h2>v5.0.1</h2>
<h1>Changelog</h1>
<ul>
<li>Add backoff and jitter to deployment polling <a
href="https://github.com/yoannchaudet"><code>@​yoannchaudet</code></a>
(<a
href="https://redirect.github.com/actions/deploy-pages/issues/444">#444</a>)</li>
<li>Improve deployment request test coverage <a
href="https://github.com/adwitiyagoyal"><code>@​adwitiyagoyal</code></a>
(<a
href="https://redirect.github.com/actions/deploy-pages/issues/440">#440</a>)</li>
</ul>
<hr />
<p>See details of <a
href="https://github.com/actions/deploy-pages/compare/v5.0.0...v5.0.1">all
code changes</a> since previous release.</p>
<p>:warning: For use with products other than GitHub.com, such as GitHub
Enterprise Server, please consult the <a
href="https://github.com/actions/deploy-pages/#compatibility">compatibility
table</a>.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/deploy-pages/commit/368f82528645a54fb793d4d04e342629a3f51346"><code>368f825</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/deploy-pages/issues/444">#444</a>
from actions/yoannchaudet-deployment-polling-backoff</li>
<li><a
href="https://github.com/actions/deploy-pages/commit/7e97763d1f8271fc88f351a0c275f37de7f32094"><code>7e97763</code></a>
Validate deployment polling intervals</li>
<li><a
href="https://github.com/actions/deploy-pages/commit/0143e11abb4ace1f6858cb44b2ab99eae8a40b45"><code>0143e11</code></a>
Add backoff and jitter to deployment polling</li>
<li><a
href="https://github.com/actions/deploy-pages/commit/5e98f10ce206463e411e82ac66ef0f2df79c5499"><code>5e98f10</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/deploy-pages/issues/440">#440</a>
from actions/user/adwitiya</li>
<li><a
href="https://github.com/actions/deploy-pages/commit/8b0625abb54462fce279dc6ce57ef7ce0fb8b8fc"><code>8b0625a</code></a>
Improve deployment request test coverage</li>
<li>See full diff in <a
href="https://github.com/actions/deploy-pages/compare/cd2ce8fcbc39b97be8ca5fce6e763baed58fa128...368f82528645a54fb793d4d04e342629a3f51346">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/deploy-pages&package-manager=github_actions&previous-version=5.0.0&new-version=5.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Marius Storhaug <marstor@hotmail.com>

Bump actions/deploy-pages from 5.0.0 to 5.0.1 in the github-actions g…

…roup (#538)

Bumps the github-actions group with 1 update:
[actions/deploy-pages](https://github.com/actions/deploy-pages).

Updates `actions/deploy-pages` from 5.0.0 to 5.0.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/deploy-pages/releases">actions/deploy-pages's
releases</a>.</em></p>
<blockquote>
<h2>v5.0.1</h2>
<h1>Changelog</h1>
<ul>
<li>Add backoff and jitter to deployment polling <a
href="https://github.com/yoannchaudet"><code>@​yoannchaudet</code></a>
(<a
href="https://redirect.github.com/actions/deploy-pages/issues/444">#444</a>)</li>
<li>Improve deployment request test coverage <a
href="https://github.com/adwitiyagoyal"><code>@​adwitiyagoyal</code></a>
(<a
href="https://redirect.github.com/actions/deploy-pages/issues/440">#440</a>)</li>
</ul>
<hr />
<p>See details of <a
href="https://github.com/actions/deploy-pages/compare/v5.0.0...v5.0.1">all
code changes</a> since previous release.</p>
<p>:warning: For use with products other than GitHub.com, such as GitHub
Enterprise Server, please consult the <a
href="https://github.com/actions/deploy-pages/#compatibility">compatibility
table</a>.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/deploy-pages/commit/368f82528645a54fb793d4d04e342629a3f51346"><code>368f825</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/deploy-pages/issues/444">#444</a>
from actions/yoannchaudet-deployment-polling-backoff</li>
<li><a
href="https://github.com/actions/deploy-pages/commit/7e97763d1f8271fc88f351a0c275f37de7f32094"><code>7e97763</code></a>
Validate deployment polling intervals</li>
<li><a
href="https://github.com/actions/deploy-pages/commit/0143e11abb4ace1f6858cb44b2ab99eae8a40b45"><code>0143e11</code></a>
Add backoff and jitter to deployment polling</li>
<li><a
href="https://github.com/actions/deploy-pages/commit/5e98f10ce206463e411e82ac66ef0f2df79c5499"><code>5e98f10</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/deploy-pages/issues/440">#440</a>
from actions/user/adwitiya</li>
<li><a
href="https://github.com/actions/deploy-pages/commit/8b0625abb54462fce279dc6ce57ef7ce0fb8b8fc"><code>8b0625a</code></a>
Improve deployment request test coverage</li>
<li>See full diff in <a
href="https://github.com/actions/deploy-pages/compare/cd2ce8fcbc39b97be8ca5fce6e763baed58fa128...368f82528645a54fb793d4d04e342629a3f51346">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/deploy-pages&package-manager=github_actions&previous-version=5.0.0&new-version=5.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Marius Storhaug <marstor@hotmail.com>

⚙️ [Maintenance]: Public help-link checks now support any HTTPS host (#…

…532)

Public command help-link validation now works with any HTTPS
documentation host while preserving the required module and function
path structure. Repositories can publish their command reference outside
the PSModule documentation site without weakening the canonical URL
contract.

## Changed: Public help-link validation

Every public function must provide a first `.LINK` entry. The test fails
immediately when no `.LINK` section is found. When a link is present, it
must be an absolute HTTPS URL with a host and the canonical
`/Module/Functions/<relative-command>/` path; query strings and
fragments are rejected.

The PowerShell module standard, framework-test reference, pre-review
validation checklist, module-structuring guide, and skip-test guide now
document this requirement using a configurable HTTPS documentation host.

---
<details>
<summary>Technical details</summary>

- Changed
`.github/actions/Test-PSModule/src/tests/SourceCode/PSModule/PSModule.Tests.ps1`
to require a link, then parse the first `.LINK` URI and validate its
scheme, host, path, query, and fragment instead of comparing against a
hardcoded `psmodule.io` origin.
- Updated one grouped command fixture in each test repository to use
`https://docs.example.com`, proving the test does not depend on the
PSModule host.
- Documented `PublicHelpLink` in
`docs/content/reference/powershell-module-standard.md` and
`docs/content/reference/framework-test-ids.md`.
- Added the requirement to
`docs/content/guides/validating-before-review.md` and replaced
fixed-host examples in the structuring and skip-test guides with
`<DocumentationHost>`.
- Validation: the targeted Pester 6.1.0 source-code suite passed 13
tests for both `tests/srcTestRepo` and `tests/srcWithManifestTestRepo`;
`zensical build --strict` and `git diff --check` passed.

| Changed surface | Standards checked | Framework docs checked | Result
|
| --- | --- | --- | --- |
| `.github/actions/Test-PSModule/**` (PowerShell) | MSX PowerShell
standard | Public command help-link contract | Aligned |
| `tests/**` (PowerShell fixtures) | MSX PowerShell standard |
Source-code test fixtures | Aligned |
| `docs/content/reference/**` and `docs/content/guides/**` (Markdown) |
MSX Documentation Model, Markdown | Module layout and framework-test
guidance | Aligned |

Issue convergence sweep: scoped to reusable public help-link validation
and its contributor guidance. This change does not generate missing
links during scaffolding or build, so the broader follow-up remains
open.

</details>

<details>
<summary>Relevant issues (or links)</summary>

### Related work

- References #445
- References #453

</details>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

🪲 [Fix]: New module versions publish to the PowerShell Gallery (#529)

A module version that has never been published to the PowerShell Gallery
can now be published. Any first release, and every subsequent new
version, previously failed the Publish-Module stage before the upload
was attempted.

## Fixed: New module versions publish to the PowerShell Gallery

Publishing a version that is not yet on the PowerShell Gallery now
succeeds. The stage checks whether the version already exists so an
interrupted run can resume, and treats an absent version as the expected
result for a new release rather than an error.

Before this change the Publish-Module job failed with the following, and
no module was ever uploaded:

```text
Find-PSResource: Package with name 'MyModule', version '1.3.1' could not be found in repository 'PSGallery'.
Error: Process completed with exit code 1.
```

No repository configuration changes are needed. A workflow run that
previously failed at this point succeeds on re-run.

Resuming an interrupted publication is unchanged: when the version is
already on the Gallery, the run skips the upload and continues to GitHub
release creation.

---
<details>
<summary>Technical details</summary>

- `.github/actions/Publish-PSModule/src/publish.ps1` — the Gallery
existence probe in the `Publish to PSGallery` region ran
`Find-PSResource` with `-ErrorAction Stop`.
`Microsoft.PowerShell.PSResourceGet` raises
`PackageNotFound,Microsoft.PowerShell.PSResourceGet.Cmdlets.FindPSResource`
when the requested version does not exist, which `-ErrorAction Stop`
turns into a throw, so the probe made a missing version fatal instead of
returning `$null`. The probe now keeps `-ErrorAction Stop` and catches
only `PackageNotFound`, treating that one error as 'not yet published'
and letting the `if ($publishedPackage)` branch decide the outcome.
Every other error stays fatal, so a transient Gallery failure cannot be
misread as 'version absent' and cause a re-upload of a version that
already exists.
- The probe was introduced in #512 to make
Gallery publication idempotent for the default-branch push release path.
That path replaced a `try`/`catch` around `Publish-PSResource`, which is
why the regression reached `main` without an existing test catching it.
-
`.github/actions/Publish-PSModule/tests/Publish-PSModule.Recovery.Tests.ps1`
— the harness could not observe whether publication happened, so its
assertions were vacuous: `Publish-PSResource` was shimmed to set
`$script:publishInvoked`, but `publish.ps1` runs in its own scope via
`&`, so the flag never propagated and stayed `$false` regardless.
Replaced with a hashtable captured by `GetNewClosure()`, which is shared
by reference. A second variant wrote a marker file under
`$env:GITHUB_WORKSPACE`; that is process-wide and races between parallel
Pester runspaces, so the marker could land in another test file's
`TestDrive`. The not-found shim also used
`$PSCmdlet.ThrowTerminatingError(...)`, which ignores `-ErrorAction` and
therefore threw under both `Stop` and `SilentlyContinue` — unable to
distinguish the fix from the defect. It now uses `Write-Error` with the
real `PackageNotFound` error ID, matching how the cmdlet actually
behaves. Added a case asserting a non-`PackageNotFound` lookup failure
stays fatal and does not publish. Each test was verified to fail against
the specific defect it guards.
-
`.github/actions/Release-PSModule/tests/Release-PSModule.WhatIf.Tests.ps1`
and `Publish-PSModule.Recovery.Tests.ps1` — shim teardown used
`Remove-Item -Path function:global:X`. `Set-Item` accepts that path and
creates `X` in the global scope, but `Remove-Item` and `Get-Item` do not
resolve it back, and fail silently rather than erroring, so the cleanup
was a no-op. The shims survived `AfterAll` and shadowed the real
commands for later test files, which is what made `Test-Actions` fail
with `A parameter cannot be found that matches parameter name
'Prerelease'` in `Get-NextPrereleaseNumber`. Teardown now removes by
name.
- Validated end to end in `MariusStorhaug/MariusTestModule` ([PR
#63](MariusStorhaug/MariusTestModule#63)) with
the caller pointed at this branch. A new version published successfully
([run
33597824748](https://github.com/MariusStorhaug/MariusTestModule/actions/runs/33597824748/job/100145585604)),
and re-running the same job with the version present skipped the upload
via the resume path
([re-run](https://github.com/MariusStorhaug/MariusTestModule/actions/runs/33597824748/job/100146802704)).
Both branches of the probe are confirmed against the live Gallery.
- Out of scope, found while reproducing: a `workflow_dispatch` on the
default branch resolves no associated pull request, because pull request
association in `.github/actions/Get-PSModuleSettings/src/main.ps1` is
gated on `$isPush`. A manual recovery run therefore discards the merged
pull request's version label and silently resolves a Patch bump. This is
a separate defect in version resolution and is recorded in the analysis
on #528; it is not addressed here.
- Also out of scope: `.github/workflows/Test-Actions.yml` builds a
Pester configuration with `Run.Parallel` and `Run.Shuffle`, asserts the
options applied, then discards it and creates a fresh
`New-PesterConfiguration` for the actual run. Parallel and shuffle are
validated but never used, which is why the `GITHUB_WORKSPACE` race above
could not surface in CI. The suite now passes both sequentially and
under the intended parallel configuration, so enabling it should be
safe.

| Changed surface | Standards checked | Framework docs checked | Result
|
| --- | --- | --- | --- |
| `.github/actions/Publish-PSModule/src/**` (PowerShell) | Coding
standards, error handling | Publish stage contract | Aligned |
| `.github/actions/Publish-PSModule/tests/**` (Pester) | Pester test
standards | Action test layout | Aligned |
| `.github/actions/Release-PSModule/tests/**` (Pester) | Pester test
standards | Action test layout | Aligned |

</details>

<details>
<summary>Relevant issues (or links)</summary>

- Resolves #528

### Related work

- References #512

</details>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: MariusStorhaug <17722253+MariusStorhaug@users.noreply.github.com>
Co-authored-by: Marius Storhaug <Marius.Storhaug@dnb.no>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Upgrade Process-PSModule to Pester 6.1 (#519)

## Implemented in Process-PSModule

- Enforce the Pester `[6.1.0,7.0.0)` range in reusable framework test
runs.
- Align module-local workflow inputs with the current Invoke-Pester
contract: `Version`/`Prerelease` select Pester, while
`GitHubVersion`/`GitHubPrerelease` select the GitHub module. Pester
prerelease remains at the action default.
- Keep the six Test-PSModule container/test files inside the action
implementation at `.github/actions/Test-PSModule/src/tests`, because
they are context-dependent framework suites executed against the
compiled module or source tree. Discovery remains
`$PSScriptRoot/tests/$settings`.
- Add a framework CI contract test that validates Pester 6.1
configuration properties:
  - `Run.Shuffle`
  - `Run.ShuffleSeed`
  - `Run.Parallel`
  - `Run.ParallelThrottleLimit`
  - `Debug.ShowStartMarkers`
- Align coverage input documentation with Pester 6.1: supported formats
are JaCoCo and Cobertura, and profiler-based tracing is documented
correctly.
- Update Pester 6.1 authoring and coverage-report guidance.

## Pester 6.1 runtime audit

A local Pester 6.1 probe generated a passing test result and coverage
report, and the Get-PesterCodeCoverage action processed that JSON
successfully. The coverage result shape remains compatible:
`CoveragePercent`, `CoveragePercentTarget`, `CommandsMissed`,
`CommandsExecuted`, `FilesAnalyzed`, and all count properties are
present and consumed correctly.

The Pester result still exposes `Containers`; each container retains
`Data`, `Blocks`, and aggregate result/count properties. The existing
container files therefore remain compatible with the
compiled-module/source-tree execution model.

## Contract findings and required upstream follow-up

The current `PSModule/Invoke-Pester` v5.1.0 action does not expose these
Pester configuration properties as action inputs, so this repository
deliberately does not add incompatible passthrough mappings:

- `Run_Shuffle`
- `Run_ShuffleSeed`
- `Run_Parallel`
- `Run_ParallelThrottleLimit`
- `Debug_ShowStartMarkers`

The coordinated `PSModule/Invoke-Pester` follow-up must add each input
to `action.yml`, forward each `PSMODULE_INVOKE_PESTER_INPUT_*`
environment variable, map them into the generated `PesterConfiguration`,
and publish a version/tag that Process-PSModule can pin.
Process-PSModule can then expose the corresponding reusable-action
inputs and pass them through.

## Test and fixture boundaries confirmed

- Module-local tests assume the built module is already loaded:
`Test-ModuleLocal.yml` imports the artifact in its prescript before
invoking Pester.
- Framework module tests import the module explicitly in their own test
scopes; no implicit preload was introduced.
- PSD1 files in the repository test fixture (`src/data/Config.psd1` and
`src/data/Settings.psd1`) are not implicitly loaded and are currently
unused. Any future PSD1 dataset test must call
`Import-PowerShellDataFile` explicitly or load it from supported setup.
- `Expose-TestData` passes only explicit caller-provided fixtures as
environment variables to setup, teardown, and tests.
- Module linting remains a separate `Invoke-ScriptAnalyzer` job and
artifact path; it is not folded into Pester execution.

## Validation

- Pester 6.1 configuration contract validated locally.
- Pester 6.1 result/container and coverage shapes inspected locally.
- Get-PesterCodeCoverage executed against a generated Pester 6.1
coverage JSON fixture and passed.
- Restored Test-PSModule scripts parsed successfully.
- Test-PSModule path resolution validated from a consumer repository
root.
- Changed PowerShell parsed successfully.
- `git diff --check` passed.

Commits: `337533c`, `ad2961e`, `8c3366f`, `0423d6a`

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

🪲 [Fix]: Obsolete GitHub token write permissions removed (#521)

Repositories that use the GitHub App permission model can run
Process-PSModule without granting unneeded repository, pull-request, or
status write access. GitHub Pages deployments continue to use the
caller's `github.token` with `contents: read`, `pages: write`, and
`id-token: write`.

## Fixed: Reusable workflow permission escalation

The reusable workflow no longer requests permissions that GitHub App
installation tokens already provide for release and pull-request
operations. Update caller workflows to use the narrowed permission block
documented for `v8`.

```yaml
permissions:
  contents: read
  pages: write
  id-token: write
```

---
<details>
<summary>Technical details</summary>

- Removed legacy `github.token` write requests from the reusable
workflow and nested jobs; scoped GitHub App tokens retain repository and
pull-request write access.
- Updated repository workflow tests and caller documentation to use the
`v8` permission contract.

| Changed surface | Standards checked | Framework docs checked | Result
|
| --- | --- | --- | --- |
| `.github/workflows/**` | GitHub Actions | Reusable workflow contract |
Fixed in this PR |
| `docs/content/**` | Markdown, Natural Language | Workflow setup guides
| Fixed in this PR |

</details>

<details>
<summary>Relevant issues (or links)</summary>

### Related work

- References #510

</details>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Bump the github-actions group with 2 updates (#511)

Bumps the github-actions group with 2 updates:
[actions/checkout](https://github.com/actions/checkout) and
[actions/setup-python](https://github.com/actions/setup-python).

Updates `actions/checkout` from 7.0.0 to 7.0.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/releases">actions/checkout's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>skip running unsafe pr check if input is default by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li>
<li>trim only ascii whitespace for branch by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li>
<li>escape values passed to --unset by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li>
<li>Various dependency updates</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v7...v7.0.1">https://github.com/actions/checkout/compare/v7...v7.0.1</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v7.0.1</h2>
<ul>
<li>Skip running unsafe pr check if input is default by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li>
<li>Trim only ascii whitespace for branch by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li>
<li>Escape values passed to --unset by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v7.0.0</h2>
<ul>
<li>Block checking out fork PR for pull_request_target and workflow_run
by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v6.0.3</h2>
<ul>
<li>Fix checkout init for SHA-256 repositories by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<h2>v6.0.2</h2>
<ul>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li>
</ul>
<h2>v6.0.1</h2>
<ul>
<li>Add worktree support for persist-credentials includeIf by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li>
</ul>
<h2>v6.0.0</h2>
<ul>
<li>Persist creds to a separate file by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
<li>Update README to include Node.js 24 support details and requirements
by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
</ul>
<h2>v5.0.1</h2>
<ul>
<li>Port v6 cleanup to v5 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
</ul>
<h2>v5.0.0</h2>
<ul>
<li>Update actions checkout to use node 24 by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
</ul>
<h2>v4.3.1</h2>
<ul>
<li>Port v6 cleanup to v4 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
</ul>
<h2>v4.3.0</h2>
<ul>
<li>docs: update README.md by <a
href="https://github.com/motss"><code>@​motss</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a
href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a
href="https://github.com/benwells"><code>@​benwells</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a
href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
<li>Update README.md by <a
href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a
href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
<li>Update package dependencies by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
</ul>
<h2>v4.2.2</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment
variables by <a href="https://github.com/jww3"><code>@​jww3</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a
href="https://github.com/jww3"><code>@​jww3</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
</ul>
<h2>v4.2.1</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a
href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/actions/checkout/compare/v7...3d3c42e5aac5ba805825da76410c181273ba90b1">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/setup-python` from 6.3.0 to 7.0.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-python/releases">actions/setup-python's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.0</h2>
<h2>What's Changed</h2>
<h3>Enhancements</h3>
<ul>
<li>Migrate to ESM and upgrade dependencies by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1330">actions/setup-python#1330</a></li>
<li>Pin SHA commits and update docs with latest versions by <a
href="https://github.com/HarithaVattikuti"><code>@​HarithaVattikuti</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1338">actions/setup-python#1338</a></li>
<li>Remove the pip-install input by <a
href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a> in
<a
href="https://redirect.github.com/actions/setup-python/pull/1336">actions/setup-python#1336</a></li>
</ul>
<h3>Bug Fix</h3>
<ul>
<li>Fix to Classify stderr warning messages as warnings instead of
errors in annotations by <a
href="https://github.com/lmvysakh"><code>@​lmvysakh</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1335">actions/setup-python#1335</a></li>
<li>Validate and retry manifest fetch to prevent silent failures by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1332">actions/setup-python#1332</a></li>
</ul>
<h3>Dependency Upgrade</h3>
<ul>
<li>Bump certifi from 2020.6.20 to 2024.7.4 in
/<strong>tests</strong>/data by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1328">actions/setup-python#1328</a></li>
<li>Remove EOL Python versions and Bumps numpy text fixture by <a
href="https://github.com/priya-kinthali"><code>@​priya-kinthali</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1333">actions/setup-python#1333</a></li>
<li>Upgrade <code>@​actions/cache</code> to 6.2.0 by <a
href="https://github.com/philip-gai"><code>@​philip-gai</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1337">actions/setup-python#1337</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/lmvysakh"><code>@​lmvysakh</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/1335">actions/setup-python#1335</a></li>
<li><a
href="https://github.com/philip-gai"><code>@​philip-gai</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/1337">actions/setup-python#1337</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-python/compare/v6...v7.0.0">https://github.com/actions/setup-python/compare/v6...v7.0.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/setup-python/commit/5fda3b95a4ea91299a34e894583c3862153e4b97"><code>5fda3b9</code></a>
Pin SHA commits and update docs with latest versions (<a
href="https://redirect.github.com/actions/setup-python/issues/1338">#1338</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/4ab7e95f05e168b4356aebde89dd84f59c283d8e"><code>4ab7e95</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/setup-python/issues/1337">#1337</a>
from actions/philip-gai/bump-actions-cache-6-2-0</li>
<li><a
href="https://github.com/actions/setup-python/commit/0f3a009f475dbea83c0371cd85d099690fee8c5c"><code>0f3a009</code></a>
Remove the pip-install input (<a
href="https://redirect.github.com/actions/setup-python/issues/1336">#1336</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/f8cf4291c8b8e273ddd26e569454615c7315d932"><code>f8cf429</code></a>
Migrate to ESM and upgrade dependencies (<a
href="https://redirect.github.com/actions/setup-python/issues/1330">#1330</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/54baeea5b34417d10a7479663a23cca53ea209b5"><code>54baeea</code></a>
Validate and retry manifest fetch to prevent silent failures (<a
href="https://redirect.github.com/actions/setup-python/issues/1332">#1332</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/c7092773a316760f4ecfe498e4af668a4dafeac5"><code>c709277</code></a>
Annotation code fix (<a
href="https://redirect.github.com/actions/setup-python/issues/1335">#1335</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/6849080452e69b330395e8a6d23cf90f56d76a1a"><code>6849080</code></a>
remove EOL Python versions and Bumps numpy text fixture (<a
href="https://redirect.github.com/actions/setup-python/issues/1333">#1333</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/0903b469fbf4441aadfe4f4b249dc5b1fba3a73e"><code>0903b46</code></a>
Bump certifi from 2020.6.20 to 2024.7.4 in /<strong>tests</strong>/data
(<a
href="https://redirect.github.com/actions/setup-python/issues/1328">#1328</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/setup-python/compare/ece7cb06caefa5fff74198d8649806c4678c61a1...5fda3b95a4ea91299a34e894583c3862153e4b97">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Marius Storhaug <marstor@hotmail.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

🌟 [Major]: Publish stable releases from default-branch pushes (#512)

Process-PSModule now authorizes stable module publication from an
important push to the default branch rather than from a merged
`pull_request` event. An associated merged pull request supplies labels
and release notes only when its merge commit exactly matches the pushed
SHA; direct pushes and default-branch manual dispatches release a Patch
version with commit-based notes.

## Breaking Changes

Caller workflows must add a `push` trigger for their default branch to
receive stable releases. The canonical caller templates now use
non-cancelling per-pull-request-or-ref concurrency so pull-request
cleanup and the resulting default-branch release remain independent
while all release mutations queue safely. The consumer-repository
rollout remains tracked in #438.

## Changed: Stable release lifecycle

- Open labelled pull requests can publish prereleases; closed pull
requests run prerelease cleanup only.
- Important default-branch pushes run the full pipeline and publish a
stable release only after PowerShell Gallery publication succeeds.
- GitHub releases and tags target the exact tested pushed commit.
- Direct default-branch pushes and manual dispatches default to Patch
regardless of `AutoPatching`; pull-request prereleases retain their
configured `AutoPatching` behavior.
- First pushes are evaluated from the complete Git tree, and truncated
trees fail explicitly rather than producing an unsafe release decision.
- Only a real `pull_request.closed` event can enter cleanup; a label
change on an already closed PR runs no build, prerelease, or cleanup
path.
- Release workflow concurrency uses `cancel-in-progress: false` to
preserve serialized artifact and tag mutation.

## Dogfood and documentation

- The default and manifest dogfood callers now receive the complete PR
event contract, including label changes and closure, and do not cancel
release-capable runs.
- Fixture roots are important, fixture sites build, and
`Publish.Site.Skip` prevents deployment to the Process-PSModule Pages
environment.
- Caller, first-release, scenario, stage, settings, specification, and
module-standard documentation now define default-branch push authority,
cleanup-only closed PRs, direct-push behavior, and non-cancelling
concurrency.

## Scope boundary

`Release-GHRepository@v2.0.3`, which releases Process-PSModule itself,
only supports pull-request event payloads. This PR therefore does not
install a push trigger that would succeed without producing that
repository release. Push-capable repository releases and moving
workflow-consumer tags are tracked separately in
PSModule/Release-GHRepository#108.

## Technical Details

- The Plan settings action normalizes PR, push, and manual-dispatch
state into a shared context.
- Push-to-PR association uses `GET
/repos/{owner}/{repo}/commits/{sha}/pulls` and requires an exact merged
commit match on the default branch.
- Version-label conflicts remain blocking for release decisions but
cannot block closed-PR cleanup.
- Publishing, GitHub release creation, and cleanup receive the
normalized PR context explicitly, so direct releases never attempt PR
comments.
- `Publish.Site.Skip` separates site build from deployment; dogfood
callers mark their fixture roots as important, build site artifacts, and
skip real Pages publication.

<details>
<summary>Related issues</summary>

- Fixes #390
- Related: #438
- Dependency: PSModule/Release-GHRepository#108

</details>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>