🩹 [Patch]: Integration tests no longer collide and Organizations enterprise flow is reliable

.github/instructions/tests.instructions.md

@@ -22,9 +22,17 @@ Secrets:
 
 ### APP_ENT — PSModule Enterprise App
 
-Homed in `MSX`. ClientID: `Iv23lieHcDQDwVV3alK1`.
+Homed in `MSX` (enterprise slug: `msx`). ClientID: `Iv23lieHcDQDwVV3alK1`.
 Installed on [psmodule-test-org3](https://github.com/orgs/psmodule-test-org3) (enterprise org) with all permissions and push events.
 
+Required enterprise-scoped permissions (configured on the app):
+
+- `enterprise_organization_installations: write` — required by `Install-GitHubApp` on enterprise-owned organizations
+  ([docs](https://docs.github.com/rest/enterprise-admin/organization-installations#install-a-github-app-on-an-enterprise-owned-organization)).
+  The Organizations test creates an enterprise organization and then installs the app on it; the
+  endpoint returns 404 (not 403) when this permission is missing, which makes a missing
+  permission look like a missing resource. See issue #596.
+
 Secrets: `TEST_APP_ENT_CLIENT_ID`, `TEST_APP_ENT_PRIVATE_KEY`
 
 ### APP_ORG — PSModule Organization App
@@ -75,11 +83,11 @@ Runs once before all parallel test files. For each auth case (except `GITHUB_TOK
 4. For `organization` owners only, provisions extra repositories (`-2`, `-3` suffix) for
    test files that need companion repos (e.g., Secrets/Variables `SelectedRepository` tests)
 
-`Set-GitHubRepository` is idempotent — if the repository already exists it updates it in place (issuing a
-PATCH), and if it does not exist it creates it. Because the same parameters are passed each time, the
-end-state is identical regardless of how many times the setup runs. The extra PATCH on the happy path is
-a deliberate trade-off for simplicity: one call handles both first-run and partial-rerun scenarios without
-branching logic.
+Global setup deliberately removes any matching deterministic repositories before provisioning them again.
+That gives workflow reruns a clean repository state for resources such as releases, tags, environments,
+secrets, and variables. Each individual test file still calls `Set-GitHubRepository` in its per-context
+`BeforeAll` as an idempotent safety net, so a single test file or auth context can be rerun independently
+even when the global setup step did not run first.
 
 ### `AfterAll.ps1` — global teardown
 

tests/Actions.Tests.ps1

@@ -54,7 +54,7 @@ Describe 'Actions' {
                     Write-Host ($context | Format-List | Out-String)
                 }
             }
-            $repoPrefix = "Test-$os-$TokenType"
+            $repoPrefix = "$testName-$os-$TokenType"
             $repoName = "$repoPrefix-$id"
 
             LogGroup "Using Repository - [$repoName]" {

tests/AfterAll.ps1

@@ -11,7 +11,6 @@ LogGroup 'AfterAll - Global Test Teardown' {
     if (-not $env:Settings) {
         throw 'Settings environment variable is not set. Process-PSModule must populate it with the test suite configuration.'
     }
-    $prefix = 'Test'
 
     # Derive the list of OS names from the Settings JSON provided by Process-PSModule.
     try {
@@ -30,6 +29,11 @@ LogGroup 'AfterAll - Global Test Teardown' {
     }
     Write-Host "Cleaning up test repositories for OSes: $($osNames -join ', ')"
 
+    # Source the single authoritative list of test-file repositories so setup and teardown
+    # always operate on the same set. See tests/Data/TestRepos.ps1.
+    $testRepos = . "$PSScriptRoot/Data/TestRepos.ps1"
+    $testNames = $testRepos.TestNames
+    $testNamesWithExtraRepos = $testRepos.TestNamesWithExtraRepos
     foreach ($authCase in $authCases) {
         $authCase.GetEnumerator() | ForEach-Object { Set-Variable -Name $_.Key -Value $_.Value }
 
@@ -46,25 +50,27 @@ LogGroup 'AfterAll - Global Test Teardown' {
             Write-Host ($context | Format-List | Out-String)
 
             foreach ($os in $osNames) {
-                $repoPrefix = "$prefix-$os-$TokenType"
-                $repoName = "$repoPrefix-$id"
+                foreach ($testName in $testNames) {
+                    $repoPrefix = "$testName-$os-$TokenType"
+                    $repoName = "$repoPrefix-$id"
 
-                LogGroup "Repository cleanup - $AuthType-$TokenType - $os" {
-                    # Use deterministic name lookups instead of listing all repos to reduce API calls.
-                    $cleanupRepoNames = @($repoName)
-                    if ($OwnerType -eq 'organization') {
-                        $cleanupRepoNames += "$repoName-2", "$repoName-3"
-                    }
+                    LogGroup "Repository cleanup - $AuthType-$TokenType - $os - $testName" {
+                        # Use deterministic name lookups instead of listing all repos to reduce API calls.
+                        $cleanupRepoNames = @($repoName)
+                        if ($OwnerType -eq 'organization' -and $testName -in $testNamesWithExtraRepos) {
+                            $cleanupRepoNames += "$repoName-2", "$repoName-3"
+                        }
 
-                    foreach ($cleanupRepoName in $cleanupRepoNames) {
-                        switch ($OwnerType) {
-                            'user' {
-                                Get-GitHubRepository -Name $cleanupRepoName -ErrorAction SilentlyContinue |
-                                    Remove-GitHubRepository -Confirm:$false
-                            }
-                            'organization' {
-                                Get-GitHubRepository -Owner $Owner -Name $cleanupRepoName -ErrorAction SilentlyContinue |
-                                    Remove-GitHubRepository -Confirm:$false
+                        foreach ($cleanupRepoName in $cleanupRepoNames) {
+                            switch ($OwnerType) {
+                                'user' {
+                                    Get-GitHubRepository -Name $cleanupRepoName -ErrorAction SilentlyContinue |
+                                        Remove-GitHubRepository -Confirm:$false
+                                }
+                                'organization' {
+                                    Get-GitHubRepository -Owner $Owner -Name $cleanupRepoName -ErrorAction SilentlyContinue |
+                                        Remove-GitHubRepository -Confirm:$false
+                                }
                             }
                         }
                     }

tests/BeforeAll.ps1

@@ -28,6 +28,12 @@ LogGroup 'BeforeAll - Global Test Setup' {
     }
     Write-Host "Creating test repositories for OSes: $($osNames -join ', ')"
 
+    # Source the single authoritative list of test-file repositories so setup and teardown
+    # always operate on the same set. See tests/Data/TestRepos.ps1.
+    $testRepos = . "$PSScriptRoot/Data/TestRepos.ps1"
+    $testNames = $testRepos.TestNames
+    $testNamesWithExtraRepos = $testRepos.TestNamesWithExtraRepos
+
     foreach ($authCase in $authCases) {
         $authCase.GetEnumerator() | ForEach-Object { Set-Variable -Name $_.Key -Value $_.Value }
 
@@ -43,47 +49,49 @@ LogGroup 'BeforeAll - Global Test Setup' {
         Write-Host ($context | Format-List | Out-String)
 
         foreach ($os in $osNames) {
-            $repoPrefix = "Test-$os-$TokenType"
-            $repoName = "$repoPrefix-$id"
+            foreach ($testName in $testNames) {
+                $repoPrefix = "$testName-$os-$TokenType"
+                $repoName = "$repoPrefix-$id"
 
-            LogGroup "Repository setup - $AuthType-$TokenType - $os" {
-                # Clean up repos from a previous attempt of the same run (re-runs).
-                # Use deterministic name lookups instead of listing all repos to reduce API calls.
-                $cleanupRepoNames = @($repoName)
-                if ($OwnerType -eq 'organization') {
-                    $cleanupRepoNames += "$repoName-2", "$repoName-3"
-                }
+                LogGroup "Repository setup - $AuthType-$TokenType - $os - $testName" {
+                    # Clean up repos from a previous attempt of the same run (re-runs).
+                    # Use deterministic name lookups instead of listing all repos to reduce API calls.
+                    $cleanupRepoNames = @($repoName)
+                    if ($OwnerType -eq 'organization' -and $testName -in $testNamesWithExtraRepos) {
+                        $cleanupRepoNames += "$repoName-2", "$repoName-3"
+                    }
 
-                foreach ($cleanupRepoName in $cleanupRepoNames) {
-                    switch ($OwnerType) {
-                        'user' {
-                            Get-GitHubRepository -Name $cleanupRepoName -ErrorAction SilentlyContinue |
-                                Remove-GitHubRepository -Confirm:$false
-                        }
-                        'organization' {
-                            Get-GitHubRepository -Owner $Owner -Name $cleanupRepoName -ErrorAction SilentlyContinue |
-                                Remove-GitHubRepository -Confirm:$false
+                    foreach ($cleanupRepoName in $cleanupRepoNames) {
+                        switch ($OwnerType) {
+                            'user' {
+                                Get-GitHubRepository -Name $cleanupRepoName -ErrorAction SilentlyContinue |
+                                    Remove-GitHubRepository -Confirm:$false
+                            }
+                            'organization' {
+                                Get-GitHubRepository -Owner $Owner -Name $cleanupRepoName -ErrorAction SilentlyContinue |
+                                    Remove-GitHubRepository -Confirm:$false
+                            }
                         }
                     }
-                }
 
-                # Provision the primary shared repository.
-                $repoParams = @{
-                    Name      = $repoName
-                    AddReadme = $true
-                    License   = 'mit'
-                    Gitignore = 'VisualStudio'
-                }
-                switch ($OwnerType) {
-                    'user' { Set-GitHubRepository @repoParams }
-                    'organization' { Set-GitHubRepository @repoParams -Organization $Owner }
-                }
+                    # Provision the primary per-test-file repository.
+                    $repoParams = @{
+                        Name      = $repoName
+                        AddReadme = $true
+                        License   = 'mit'
+                        Gitignore = 'VisualStudio'
+                    }
+                    switch ($OwnerType) {
+                        'user' { Set-GitHubRepository @repoParams }
+                        'organization' { Set-GitHubRepository @repoParams -Organization $Owner }
+                    }
 
-                # Provision extra repositories needed by Secrets/Variables SelectedRepository tests.
-                # Only organization owners need them — those tests are skipped for user owners.
-                if ($OwnerType -eq 'organization') {
-                    foreach ($suffix in 2, 3) {
-                        Set-GitHubRepository -Organization $Owner -Name "$repoName-$suffix"
+                    # Provision extra repositories needed by Secrets/Variables SelectedRepository tests.
+                    # Only organization owners need them — those tests are skipped for user owners.
+                    if ($OwnerType -eq 'organization' -and $testName -in $testNamesWithExtraRepos) {
+                        foreach ($suffix in 2, 3) {
+                            Set-GitHubRepository -Organization $Owner -Name "$repoName-$suffix"
+                        }
                     }
                 }
             }

tests/Data/TestRepos.ps1

@@ -0,0 +1,11 @@
+# Test files that require their own per-test-file repository.
+# Each test file's per-context BeforeAll also calls Set-GitHubRepository as a safety net,
+# so this list is an optimization rather than a hard dependency. BeforeAll.ps1 and
+# AfterAll.ps1 both source this file so setup and teardown always operate on the same set.
+@{
+    # Test files that each need a primary repository.
+    TestNames = @('Environments', 'Secrets', 'Variables', 'Releases', 'Actions')
+
+    # Subset that also need companion -2/-3 repositories for org-scoped SelectedRepository tests.
+    TestNamesWithExtraRepos = @('Secrets', 'Variables')
+}

tests/Environments.Tests.ps1

@@ -43,7 +43,7 @@ Describe 'Environments' {
                     Write-Host ($context | Format-List | Out-String)
                 }
             }
-            $repoPrefix = "Test-$os-$TokenType"
+            $repoPrefix = "$testName-$os-$TokenType"
             $repoName = "$repoPrefix-$id"
             $environmentName = "$testName-$os-$TokenType-$id"
 
@@ -64,6 +64,20 @@ Describe 'Environments' {
                 }
                 Write-Host ($repo | Select-Object * | Out-String)
             }
+
+            # Clean up stale environments from prior runs with the same GITHUB_RUN_ID.
+            # This keeps isolated reruns self-contained even when the global BeforeAll did not reset the repository.
+            if ($repo) {
+                LogGroup "Pre-test Cleanup - Existing Environments on [$repoName]" {
+                    $existingEnvironments = Get-GitHubEnvironment -Owner $owner -Repository $repoName -ErrorAction SilentlyContinue
+                    if ($existingEnvironments) {
+                        Write-Host ($existingEnvironments | Format-Table | Out-String)
+                        $existingEnvironments | Remove-GitHubEnvironment -Confirm:$false
+                    } else {
+                        Write-Host 'No existing environments to clean up.'
+                    }
+                }
+            }
         }
 
         AfterAll {