Workflow-Test-Default.yml

name: Workflow-Test [Default]

run-name: 'Workflow-Test [Default] - [${{ github.event.pull_request.title }} #${{ github.event.pull_request.number }}] by @${{ github.actor }}'

on:
  workflow_dispatch:
  pull_request:
    paths:
      - '.github/workflows/**'
      - '!.github/workflows/Release.yml'
      - '!.github/workflows/Linter.yml'
  schedule:
    - cron: '0 0 * * *'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: write
  pull-requests: write
  statuses: write
  pages: write
  id-token: write

jobs:
  WorkflowTestDefault:
    uses: ./.github/workflows/workflow.yml
    secrets:
      APIKey: ${{ secrets.APIKey }}
      # Self-test only: two dedicated, NON-SENSITIVE repository secrets (PSMODULE_TEST_*_SECRET) exist
      # purely to prove the TestSecrets plumbing end to end - a real GitHub secret is masked, passed
      # through, and exposed as $env:<name>. Their known values are asserted (value + length) in
      # tests/.../Environment.Tests.ps1.
      # The folded '>-' block keeps the JSON on a SINGLE line so GitHub registers one mask for the
      # blob; a multi-line blob makes every line (incl. braces) its own mask and over-masks the logs.
      TestSecrets: >-
        {
        "PSMODULE_TEST_SINGLELINE_SECRET": ${{ toJSON(secrets.PSMODULE_TEST_SINGLELINE_SECRET) }},
        "PSMODULE_TEST_MULTILINE_SECRET": ${{ toJSON(secrets.PSMODULE_TEST_MULTILINE_SECRET) }}
        }
    with:
      WorkingDirectory: tests/srcTestRepo
      # Non-secret configuration flows via TestVariables (built from repo/org variables, not masked).
      TestVariables: >-
        { "PSMODULE_TEST_VARIABLE": ${{ toJSON(vars.PSMODULE_TEST_VARIABLE) }} }
      ImportantFilePatterns: |
        ^src/
        ^README\.md$
        ^\.github/workflows/(?!Release\.yml$|Linter\.yml$)