Process-PSModule.yml

name: Process-PSModule

on:
  workflow_dispatch:
  schedule:
    - cron: '0 0 * * *'
  pull_request:
    branches:
      - main
    types:
      - closed
      - opened
      - reopened
      - synchronize
      - labeled

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: write
  pull-requests: write
  statuses: write
  pages: write
  id-token: write

jobs:
  Process-PSModule:
    uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@d4020f3c9c3621cebae5d8bf4ffaf10f55c1784a # v6.1.2
    secrets:
      APIKey: ${{ secrets.APIKey }}
      # EXPERIMENT conclusion: SECRETS cannot be bulk-dumped. toJSON(secrets) always carries
      # github_token, which Import-TestData rejects (reserved GITHUB_ prefix); and pre-filtering it
      # in a prep job is blocked by GitHub's "skip output may contain secret" guard on job outputs.
      # So secrets must be named explicitly. VARIABLES, however, bulk-pass fine via toJSON(vars):
      # no github_token, not secret, and passed inline (not through a job output).
      TestData: >-
        { "secrets": { "TEST_SECRET": "${{ secrets.TEST_SECRET }}" },
        "variables": ${{ toJSON(vars) }} }