experiment: pass all secrets and variables into module tests

Replaces the two hardcoded TestData fixtures with toJSON(secrets)/toJSON(vars) to dump every secret and variable, and rewrites the environment test to iterate and print every environment variable the job can see. Purpose: observe whether Import-TestData can enumerate a full dump (and how Actions masks secrets).

Author: MariusStorhaug

.github/workflows/Process-PSModule.yml

@@ -30,8 +30,10 @@ jobs:
     uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@d4020f3c9c3621cebae5d8bf4ffaf10f55c1784a # v6.1.2
     secrets:
       APIKey: ${{ secrets.APIKey }}
-      # E2E: push a secret (masked in logs) and a variable (not masked) into the module test jobs.
-      # Import-TestData exposes each entry as $env:<name>; asserted in tests/Environment.Tests.ps1.
+      # E2E EXPERIMENT: push ALL secrets and ALL variables into the module test jobs to see whether
+      # Import-TestData can enumerate them. toJSON(secrets) serializes every secret and always
+      # includes the auto-injected github_token; toJSON(vars) serializes every repo/org variable.
+      # The tests iterate every environment variable and print it so the job log shows what is
+      # visible (Actions redacts registered secret values to ***).
       TestData: >-
-        { "secrets": { "TEST_SECRET": "${{ secrets.TEST_SECRET }}" },
-        "variables": { "TEST_VARIABLE": ${{ toJSON(vars.TEST_VARIABLE) }} } }
+        { "secrets": ${{ toJSON(secrets) }}, "variables": ${{ toJSON(vars) }} }

tests/Environment.Tests.ps1

@@ -13,30 +13,28 @@
 [CmdletBinding()]
 param()
 
-Describe 'TestData is pushed into the module tests' {
-    # TEST_SECRET (from the "secrets" map, masked) and TEST_VARIABLE (from the "variables" map, not
-    # masked) are public non-secret fixtures that exist only to prove the calling workflow can push
-    # secrets and variables into the module test jobs. The calling workflow passes them through a
-    # single TestData object and Import-TestData (from Install-PSModuleHelpers) exposes them as
-    # environment variables; these tests confirm they arrive with the expected values.
+Describe 'TestData exposes all secrets and variables' {
+    # EXPERIMENT: the calling workflow now passes every secret and every variable through the single
+    # TestData object via toJSON(secrets)/toJSON(vars). Import-TestData (from Install-PSModuleHelpers)
+    # exposes each entry as an environment variable. These tests iterate every environment variable
+    # visible to the job and print it, so the job log shows exactly what reached the module tests.
+    # GitHub Actions redacts any registered secret value to *** in the log; plain variables print
+    # verbatim. Inspect the job log to see which names arrived and how they are rendered.
 
-    It 'Exposes the secret from the "secrets" map' {
-        $actual = [System.Environment]::GetEnvironmentVariable('TEST_SECRET')
-        $actual | Should -Not -BeNullOrEmpty
-        $actual | Should -BeExactly 'mariustestmodule-secret-fixture-value'
+    It 'Iterates every environment variable and prints what the job can see' {
+        $all = Get-ChildItem env: | Sort-Object Name
+        Write-Host "===== BEGIN environment dump ($($all.Count) variables) ====="
+        foreach ($entry in $all) {
+            Write-Host ("{0} = {1}" -f $entry.Name, $entry.Value)
+        }
+        Write-Host '===== END environment dump ====='
+        $all.Count | Should -BeGreaterThan 0
     }
 
-    It 'Exposes the variable from the "variables" map' {
-        $actual = [System.Environment]::GetEnvironmentVariable('TEST_VARIABLE')
-        $actual | Should -Not -BeNullOrEmpty
-        $actual | Should -BeExactly 'mariustestmodule-variable-fixture-value'
-    }
-
-    It 'Masks the secret in the log even when a test prints it in plain text' {
-        # Deliberately try to leak both values to the log with Write-Host. Because Import-TestData
-        # registered the secret via ::add-mask::, GitHub Actions redacts it to *** in the log, while
-        # the variable (not masked) is printed verbatim. Inspect the job log to see the difference.
-        Write-Host "Secret in plain text:   $env:TEST_SECRET"
-        Write-Host "Variable in plain text: $env:TEST_VARIABLE"
+    It 'Reports the fixture secret and variable arrived' {
+        # These two fixtures are part of the full dump (a repo secret and a repo variable). If the
+        # full enumeration worked, both are present; the secret prints as *** because it is masked.
+        Write-Host "TEST_SECRET   = $env:TEST_SECRET"
+        Write-Host "TEST_VARIABLE = $env:TEST_VARIABLE"
     }
 }