Skip to content

Commit 9f23e48

Browse files
♻️ [Maintenance]: Pass a single TestData secret to Process-PSModule (CodeQL-clean)
Adopt the combined TestData secret from Process-PSModule: one object with "secrets" (masked) and "variables" (not masked) instead of separate TestSecrets and TestVariables. Reference the token with the direct "${{ secrets.X }}" form to resolve the CodeQL "excessive secrets exposure" alert, and keep the blob on one folded line so GitHub registers a single mask. Repin to the framework branch head.
1 parent 4fcca56 commit 9f23e48

1 file changed

Lines changed: 12 additions & 16 deletions

File tree

.github/workflows/Process-PSModule.yml

Lines changed: 12 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -27,24 +27,20 @@ permissions:
2727

2828
jobs:
2929
Process-PSModule:
30-
# Pinned to the TestSecrets/TestVariables feature branch of Process-PSModule (PR #365).
30+
# Pinned to the TestData feature branch of Process-PSModule (PR #365).
3131
# Repin to the released tag once that change ships.
32-
uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@5ae2f4cfec688512e4889c014493dd581bfe7c38 # feat/52-test-secrets
32+
uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@ea019351821a74ae1528a4472198c84c91dd3059 # feat/52-test-secrets
3333
secrets:
3434
# PowerShell Gallery API key used to publish the module.
3535
APIKey: ${{ secrets.APIKey }}
36-
# Secrets the module's tests need, exposed as environment variables (masked). Only what the
37-
# tests require is passed - secrets: inherit is intentionally not used. The integration tests
38-
# are skipped when CONFLUENCE_API_TOKEN is not available (forks / PRs without access).
39-
TestSecrets: >-
40-
{
41-
"CONFLUENCE_API_TOKEN": ${{ toJSON(secrets.CONFLUENCE_API_TOKEN) }}
42-
}
43-
with:
44-
# Non-secret configuration the module's tests need, exposed as environment variables (not masked).
45-
TestVariables: >-
46-
{
47-
"CONFLUENCE_SITE": ${{ toJSON(vars.CONFLUENCE_SITE) }},
36+
# All data the module's tests need, in one object: a "secrets" map (masked) and a "variables"
37+
# map (not masked), each entry exposed as an environment variable. Only what the tests require
38+
# is passed - secrets: inherit is intentionally not used. Integration tests skip when
39+
# CONFLUENCE_API_TOKEN is unavailable (forks / PRs without access). Secrets use the direct
40+
# "${{ secrets.X }}" form (CodeQL-clean) and the whole blob is one folded line so GitHub
41+
# registers a single mask.
42+
TestData: >-
43+
{ "secrets": { "CONFLUENCE_API_TOKEN": "${{ secrets.CONFLUENCE_API_TOKEN }}" },
44+
"variables": { "CONFLUENCE_SITE": ${{ toJSON(vars.CONFLUENCE_SITE) }},
4845
"CONFLUENCE_USERNAME": ${{ toJSON(vars.CONFLUENCE_USERNAME) }},
49-
"CONFLUENCE_SPACE_KEY": ${{ toJSON(vars.CONFLUENCE_SPACE_KEY) }}
50-
}
46+
"CONFLUENCE_SPACE_KEY": ${{ toJSON(vars.CONFLUENCE_SPACE_KEY) }} } }

0 commit comments

Comments
 (0)