Skip to content

Commit 2138374

Browse files
bolensbolens
authored
fix(security): harden workflows and stabilize Pester CI
Close Dependabot/CodeQL workflow findings, shard and timeout Pester, and harden TestSupport/bootstrap so Ubuntu and Windows CI stay green.
1 parent 2f6c0a1 commit 2138374

409 files changed

Lines changed: 13568 additions & 5249 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.editorconfig‎

Lines changed: 61 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,80 @@
1+
# https://editorconfig.org
2+
# Keep in sync with .gitattributes (LF), run-format.ps1 (UTF-8 / LF),
3+
# PSScriptAnalyzerSettings.psd1 (no BOM required), .vscode/settings.json,
4+
# and .markdownlint.json (MD013 line_length 200).
5+
16
root = true
27

38
[*]
49
charset = utf-8
5-
end_of_line = crlf
10+
end_of_line = lf
611
insert_final_newline = true
712
trim_trailing_whitespace = true
8-
9-
[*.ps1]
1013
indent_style = space
1114
indent_size = 4
1215

13-
[*.psd1]
16+
# PowerShell — 4-space indent (VS Code editor.tabSize + Invoke-Formatter)
17+
[*.{ps1,psm1,psd1,ps1xml,pssc,psrc}]
1418
indent_style = space
1519
indent_size = 4
1620

21+
# YAML / Taskfile / GitHub Actions — 2-space indent
22+
[*.{yml,yaml}]
23+
indent_style = space
24+
indent_size = 2
25+
26+
[{Taskfile.yml,Taskfile.yaml,.github/workflows/**}]
27+
indent_style = space
28+
indent_size = 2
29+
30+
# JSON (package.json, cspell, VS Code) — 2-space indent
31+
[*.json]
32+
indent_style = space
33+
indent_size = 2
34+
35+
[{.vscode/**,.markdownlint.json,cspell.json,cspell*.json}]
36+
indent_style = space
37+
indent_size = 2
38+
39+
# Markdown — MD013 line_length 200; keep trailing spaces (hard line breaks)
1740
[*.md]
41+
indent_style = space
42+
indent_size = 2
1843
trim_trailing_whitespace = false
44+
max_line_length = 200
1945

20-
[*.yml]
46+
# Just recipes use 4-space bodies (see justfile)
47+
[{justfile,Justfile,*.just}]
48+
indent_style = space
49+
indent_size = 4
50+
51+
# Makefiles require tabs
52+
[{Makefile,makefile,*.mk}]
53+
indent_style = tab
54+
55+
# TOML / INI-style configs
56+
[*.{toml,ini}]
2157
indent_style = space
2258
indent_size = 2
2359

24-
[*.yaml]
60+
# Shell helpers shipped beside PowerShell tooling
61+
[*.{sh,bash}]
2562
indent_style = space
26-
indent_size = 2
63+
indent_size = 2
64+
end_of_line = lf
65+
66+
# Lockfiles and generated blobs — do not reformat on save
67+
[{pnpm-lock.yaml,package-lock.json,yarn.lock,**/docs/api/**,**/docs/test-verification-reports/**}]
68+
indent_style = unset
69+
indent_size = unset
70+
trim_trailing_whitespace = unset
71+
insert_final_newline = unset
72+
max_line_length = unset
73+
74+
[*.{svg,png,jpg,jpeg,gif,webp,ico,woff,woff2,ttf,eot}]
75+
charset = unset
76+
end_of_line = unset
77+
insert_final_newline = unset
78+
trim_trailing_whitespace = unset
79+
indent_style = unset
80+
indent_size = unset

‎.gitattributes‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,3 +13,9 @@
1313
*.yaml text eol=lf
1414
*.toml text eol=lf
1515
*.psrc text eol=lf
16+
*.jsonc text eol=lf
17+
.editorconfig text eol=lf
18+
justfile text eol=lf
19+
Justfile text eol=lf
20+
Makefile text eol=lf
21+
*.mk text eol=lf

‎.github/workflows/check-readmes.yml‎

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
name: Check comment-based help consistency
22

3+
concurrency:
4+
group: ${{ github.workflow }}-${{ github.ref }}
5+
cancel-in-progress: true
6+
37
on:
48
push:
59
branches: [ main ]
10+
paths:
11+
- '**/*.ps1'
12+
- '**/*.psm1'
13+
- 'profile.d/**'
14+
- 'scripts/checks/check-comment-help.ps1'
15+
- 'Microsoft.PowerShell_profile.ps1'
16+
- '.github/workflows/check-readmes.yml'
617
pull_request:
718
branches: [ main ]
19+
paths:
20+
- '**/*.ps1'
21+
- '**/*.psm1'
22+
- 'profile.d/**'
23+
- 'scripts/checks/check-comment-help.ps1'
24+
- 'Microsoft.PowerShell_profile.ps1'
25+
- '.github/workflows/check-readmes.yml'
826

927
env:
1028
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
1129

30+
permissions:
31+
contents: read
32+
1233
jobs:
1334
validate-comment-help:
1435
runs-on: windows-latest
1536
steps:
16-
- uses: actions/checkout@v6
37+
- uses: actions/checkout@v7
1738
- name: Run comment-based help check
1839
run: pwsh -NoProfile -File .\scripts\checks\check-comment-help.ps1
1940
shell: pwsh

‎.github/workflows/ci-powershell.yml‎

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,37 @@
11
name: CI - PowerShell (matrix)
22

3+
concurrency:
4+
group: ${{ github.workflow }}-${{ github.ref }}
5+
cancel-in-progress: true
6+
37
on:
48
push:
59
branches: [ main ]
10+
paths:
11+
- 'Microsoft.PowerShell_profile.ps1'
12+
- 'profile.d/**'
13+
- 'Modules/**'
14+
- 'scripts/checks/**'
15+
- 'scripts/lib/**'
16+
- 'PSScriptAnalyzerSettings.psd1'
17+
- '.github/workflows/ci-powershell.yml'
618
pull_request:
719
branches: [ main ]
20+
paths:
21+
- 'Microsoft.PowerShell_profile.ps1'
22+
- 'profile.d/**'
23+
- 'Modules/**'
24+
- 'scripts/checks/**'
25+
- 'scripts/lib/**'
26+
- 'PSScriptAnalyzerSettings.psd1'
27+
- '.github/workflows/ci-powershell.yml'
828

929
env:
1030
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
1131

32+
permissions:
33+
contents: read
34+
1235
jobs:
1336
validate:
1437
name: Validate on ${{ matrix.os }} / PowerShell ${{ matrix.pwsh }}
@@ -18,7 +41,7 @@ jobs:
1841
pwsh: [7.2, 7.4]
1942
runs-on: ${{ matrix.os }}
2043
steps:
21-
- uses: actions/checkout@v6
44+
- uses: actions/checkout@v7
2245
- name: Install PSScriptAnalyzer
2346
run: pwsh -NoProfile -Command "Install-Module -Name PSScriptAnalyzer -Scope CurrentUser -Force"
2447
- name: Validate profile (lint + idempotency)

‎.github/workflows/codeql.yml‎

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,32 @@
11
name: Security - CodeQL Analysis
22

3+
concurrency:
4+
group: ${{ github.workflow }}-${{ github.ref }}
5+
cancel-in-progress: true
6+
37
on:
48
push:
59
branches: [ main ]
10+
paths:
11+
- '.github/workflows/**'
12+
- '**/*.js'
13+
- '**/*.ts'
14+
- '**/*.mjs'
15+
- '**/*.cjs'
16+
- 'package.json'
17+
- 'pnpm-lock.yaml'
18+
- '.github/workflows/codeql.yml'
619
pull_request:
720
branches: [ main ]
21+
paths:
22+
- '.github/workflows/**'
23+
- '**/*.js'
24+
- '**/*.ts'
25+
- '**/*.mjs'
26+
- '**/*.cjs'
27+
- 'package.json'
28+
- 'pnpm-lock.yaml'
29+
- '.github/workflows/codeql.yml'
830
schedule:
931
# Run weekly on Mondays at 2 AM UTC
1032
- cron: '0 2 * * 1'
@@ -16,6 +38,7 @@ jobs:
1638
permissions:
1739
actions: read
1840
contents: read
41+
issues: write
1942
security-events: write
2043
pull-requests: write
2144

@@ -26,7 +49,7 @@ jobs:
2649

2750
steps:
2851
- name: Checkout repository
29-
uses: actions/checkout@v6
52+
uses: actions/checkout@v7
3053

3154
- name: Initialize CodeQL
3255
uses: github/codeql-action/init@v4

‎.github/workflows/commit-message-check.yml‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,25 @@
11
name: Validate commit messages
22

3+
concurrency:
4+
group: ${{ github.workflow }}-${{ github.ref }}
5+
cancel-in-progress: true
6+
37
on:
48
pull_request:
59
types: [opened, synchronize, reopened]
610

711
env:
812
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
913

14+
permissions:
15+
contents: read
16+
pull-requests: write
17+
1018
jobs:
1119
commit-message-check:
1220
runs-on: ubuntu-latest
1321
steps:
14-
- uses: actions/checkout@v6
22+
- uses: actions/checkout@v7
1523

1624
- name: Run commit message validation
1725
id: validate
@@ -30,15 +38,15 @@ jobs:
3038
3139
- name: Upsert bot comment (on failure)
3240
if: ${{ steps.validate.outputs.status != '0' }}
33-
uses: peter-evans/create-or-update-comment@v5
41+
uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5
3442
with:
3543
token: ${{ secrets.GITHUB_TOKEN }}
3644
issue-number: ${{ github.event.pull_request.number }}
3745
body-file: comment-body.md
3846

3947
- name: Add label (on failure)
4048
if: ${{ steps.validate.outputs.status != '0' }}
41-
uses: actions-ecosystem/action-add-labels@v1
49+
uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # v1
4250
with:
4351
github_token: ${{ secrets.GITHUB_TOKEN }}
4452
labels: commit-message-invalid

‎.github/workflows/dependency-validation.yml‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,47 @@
11
name: Dependencies - Validation
22

3+
concurrency:
4+
group: ${{ github.workflow }}-${{ github.ref }}
5+
cancel-in-progress: true
6+
37
on:
48
pull_request:
59
branches: [ main ]
10+
paths:
11+
- 'Modules/**'
12+
- 'package.json'
13+
- 'pnpm-lock.yaml'
14+
- 'pnpm-workspace.yaml'
15+
- 'scripts/utils/dependencies/**'
16+
- 'scripts/lib/**'
17+
- '.github/workflows/dependency-validation.yml'
618
push:
719
branches: [ main ]
20+
paths:
21+
- 'Modules/**'
22+
- 'package.json'
23+
- 'pnpm-lock.yaml'
24+
- 'pnpm-workspace.yaml'
25+
- 'scripts/utils/dependencies/**'
26+
- 'scripts/lib/**'
27+
- '.github/workflows/dependency-validation.yml'
828
workflow_dispatch:
929

1030
env:
1131
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
1232

33+
permissions:
34+
contents: read
35+
issues: write
36+
pull-requests: write
37+
1338
jobs:
1439
validate-dependencies:
1540
name: Validate Dependencies
1641
runs-on: windows-latest
1742
steps:
1843
- name: Checkout repository
19-
uses: actions/checkout@v6
44+
uses: actions/checkout@v7
2045

2146

2247
- name: Validate Dependencies

‎.github/workflows/dependency-vulnerability-scan.yml‎

Lines changed: 29 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,30 @@
11
name: Security - Dependency Update & Vulnerability Scan
22

3+
concurrency:
4+
group: ${{ github.workflow }}-${{ github.ref }}
5+
cancel-in-progress: true
6+
37
on:
48
pull_request:
59
branches: [ main ]
10+
paths:
11+
- 'Modules/**'
12+
- 'package.json'
13+
- 'pnpm-lock.yaml'
14+
- 'pnpm-workspace.yaml'
15+
- 'scripts/utils/security/**'
16+
- 'scripts/utils/dependencies/**'
17+
- '.github/workflows/dependency-vulnerability-scan.yml'
618
push:
719
branches: [ main ]
20+
paths:
21+
- 'Modules/**'
22+
- 'package.json'
23+
- 'pnpm-lock.yaml'
24+
- 'pnpm-workspace.yaml'
25+
- 'scripts/utils/security/**'
26+
- 'scripts/utils/dependencies/**'
27+
- '.github/workflows/dependency-vulnerability-scan.yml'
828
schedule:
929
# Run weekly on Mondays at 3 AM UTC
1030
- cron: '0 3 * * 1'
@@ -17,9 +37,13 @@ jobs:
1737
scan-powershell-modules:
1838
name: Scan PowerShell Modules
1939
runs-on: windows-latest
40+
permissions:
41+
contents: read
42+
issues: write
43+
pull-requests: write
2044
steps:
2145
- name: Checkout repository
22-
uses: actions/checkout@v6
46+
uses: actions/checkout@v7
2347

2448

2549
- name: Check for Module Updates
@@ -83,12 +107,14 @@ jobs:
83107
scan-npm-dependencies:
84108
name: Scan NPM Dependencies
85109
runs-on: ubuntu-latest
110+
permissions:
111+
contents: read
86112
steps:
87113
- name: Checkout repository
88-
uses: actions/checkout@v6
114+
uses: actions/checkout@v7
89115

90116
- name: Setup pnpm
91-
uses: pnpm/action-setup@v6
117+
uses: pnpm/action-setup@b0f76dfb45f55f8421693e4803ac7bb65143bd34 # v6
92118
with:
93119
version: 11.5.3
94120

0 commit comments

Comments
 (0)