test: print the secret and variable in plain text to show masking

Adds an It block that Write-Hosts both values. GitHub Actions masks TEST_SECRET (registered via ::add-mask:: by Import-TestData) to *** in the log, while TEST_VARIABLE is printed verbatim - demonstrating that only the secrets map is masked.

Author: Marius Storhaug

tests/Environment.Tests.ps1

@@ -6,6 +6,10 @@
     'PSUseDeclaredVarsMoreThanAssignments', '',
     Justification = 'Required for Pester tests'
 )]
+[Diagnostics.CodeAnalysis.SuppressMessageAttribute(
+    'PSAvoidUsingWriteHost', '',
+    Justification = 'Deliberately prints the values to the log to demonstrate GitHub Actions masking'
+)]
 [CmdletBinding()]
 param()
 
@@ -27,4 +31,12 @@ Describe 'TestData is pushed into the module tests' {
         $actual | Should -Not -BeNullOrEmpty
         $actual | Should -BeExactly 'mariustestmodule-variable-fixture-value'
     }
+
+    It 'Masks the secret in the log even when a test prints it in plain text' {
+        # Deliberately try to leak both values to the log with Write-Host. Because Import-TestData
+        # registered the secret via ::add-mask::, GitHub Actions redacts it to *** in the log, while
+        # the variable (not masked) is printed verbatim. Inspect the job log to see the difference.
+        Write-Host "Secret in plain text:   $env:TEST_SECRET"
+        Write-Host "Variable in plain text: $env:TEST_VARIABLE"
+    }
 }