Fix stdin inherited by child processes when no input provided

When invoke_command is called with input = None, the child process
previously inherited the parent's stdin handle. In CI environments
where the parent has a redirected pipe for stdin, this caused PowerShell
child processes to block indefinitely on `$Input` (reading from the
inherited pipe that never closes).

The fix sets stdin to Stdio::null() when no input is provided, ensuring
the child process sees an immediate EOF rather than inheriting whatever
stdin handle the parent holds.

Root cause: commit 1af2c8b changed the PowerShell adapter from
"config": "full" to "config": "single", which routes export through a
code path that calls invoke_command with no input. Previously, the
full-config path always provided input so stdin was always piped.

Also adds:
- Integration test that detects this regression in all environments
  (terminal and CI) without leaving hanging threads
- A -RustTestFilter parameter to build.ps1 / Test-RustProject to
  allow running a specific Rust test by name via the build script

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: 2 people

build.ps1

@@ -89,6 +89,7 @@ param(
     [switch]$Test,
     [string[]]$Project,
     [switch]$ExcludeRustTests,
+    [string]$RustTestFilter,
     [switch]$ExcludePesterTests,
     [ValidateSet("dsc", "adapters", "extensions", "grammars", "resources")]
     [string[]]$PesterTestGroup,
@@ -266,6 +267,9 @@ process {
                 Architecture = $Architecture
                 Release      = $Release
             }
+            if (-not [string]::IsNullOrEmpty($RustTestFilter)) {
+                $rustTestParams.TestFilter = $RustTestFilter
+            }
             Write-BuildProgress @progressParams -Status "Testing Rust projects"
             Test-RustProject @rustTestParams @VerboseParam
         }

helpers.build.psm1

@@ -1798,7 +1798,8 @@ function Test-RustProject {
         [ValidateSet('current','aarch64-pc-windows-msvc','x86_64-pc-windows-msvc','aarch64-apple-darwin','x86_64-apple-darwin','aarch64-unknown-linux-gnu','aarch64-unknown-linux-musl','x86_64-unknown-linux-gnu','x86_64-unknown-linux-musl')]
         $Architecture = 'current',
         [switch]$Release,
-        [switch]$Docs
+        [switch]$Docs,
+        [string]$TestFilter
     )
 
     begin {
@@ -1828,7 +1829,11 @@ function Test-RustProject {
         } else {
             Write-Verbose -Verbose "Testing rust projects: [$members]"
         }
-        cargo test @flags
+        if (-not [string]::IsNullOrEmpty($TestFilter)) {
+            cargo test @flags -- $TestFilter
+        } else {
+            cargo test @flags
+        }
 
         if ($null -ne $LASTEXITCODE -and $LASTEXITCODE -ne 0) {
             Write-Error "Last exit code is $LASTEXITCODE, rust tests failed"

lib/dsc-lib/src/dscresources/command_resource.rs

@@ -767,6 +767,8 @@ async fn run_process_async(executable: &str, args: Option<Vec<String>>, input: O
     let mut command = Command::new(executable);
     if input.is_some() {
         command.stdin(Stdio::piped());
+    } else {
+        command.stdin(Stdio::null());
     }
     command.stdout(Stdio::piped());
     command.stderr(Stdio::piped());

lib/dsc-lib/tests/integration/command_resource.rs

@@ -0,0 +1,64 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+#[cfg(test)]
+mod invoke_command {
+    use dsc_lib::{dscresources::command_resource::invoke_command, types::ExitCodesMap};
+
+    /// Verifies that when `invoke_command` is called with `input = None`, the child process
+    /// receives an immediate EOF on stdin (i.e., stdin is set to null) rather than inheriting
+    /// the parent's stdin handle.
+    ///
+    /// This is a regression test for the hang introduced in DSC 3.2.0 when the PowerShell
+    /// adapter changed from `"config": "full"` to `"config": "single"`. In single mode, the
+    /// adapter's export operation is called with no input, leaving stdin unset in the previous
+    /// code. Child processes that read from stdin would then block indefinitely when the parent
+    /// process itself had an open stdin handle — either a TTY in a terminal or a pipe in CI.
+    ///
+    /// The test uses a timed async read rather than a blocking read so that the child process
+    /// always exits within a bounded time. If stdin is null (the fix), `ReadAsync` completes
+    /// immediately returning 0 bytes (EOF), which maps to -1. If stdin is inherited (the bug),
+    /// `ReadAsync` blocks until the timeout fires and the test receives -2, which fails the
+    /// assertion.
+    #[test]
+    fn no_input_does_not_block_on_stdin() {
+        let exit_codes = ExitCodesMap::default();
+
+        // Use PowerShell's own async timeout so the child process always exits within ~5s,
+        // regardless of fix status. We never leave a hanging thread:
+        //   byte:-1  → ReadAsync got EOF immediately  → stdin was null  → PASS
+        //   byte:-2  → ReadAsync timed out (5 s)      → stdin was NOT null → FAIL
+        let ps_command = concat!(
+            "$reader = [Console]::OpenStandardInput();",
+            "$buf = [byte[]]::new(1);",
+            "$task = $reader.ReadAsync($buf, 0, 1);",
+            "$completed = $task.Wait(5000);",
+            "$b = if ($completed) { if ($task.Result -eq 0) { -1 } else { $buf[0] } } else { -2 };",
+            "Write-Output \"byte:$b\""
+        );
+
+        let result = invoke_command(
+            "pwsh",
+            Some(vec![
+                "-NonInteractive".to_string(),
+                "-NoProfile".to_string(),
+                "-Command".to_string(),
+                ps_command.to_string(),
+            ]),
+            None,  // no input — the scenario that caused the hang
+            None,
+            None,
+            &exit_codes,
+        ).expect("invoke_command should succeed");
+
+        let (exit_code, stdout, _stderr) = result;
+        assert_eq!(exit_code, 0, "Command should exit 0");
+        // -1 means ReadAsync got EOF immediately, confirming stdin was set to null.
+        // -2 means stdin was open (inherited) and the read timed out after 5s.
+        assert!(
+            stdout.contains("byte:-1"),
+            "Expected EOF (byte:-1) from null stdin, got: {stdout:?}\n\
+             'byte:-2' means stdin was inherited from the parent rather than set to null."
+        );
+    }
+}

lib/dsc-lib/tests/integration/main.rs

@@ -13,5 +13,6 @@
 //! minimize compilation times. If we defined the tests one level higher in the `tests` folder,
 //! Rust would generate numerous binaries to execute our tests.
 
+#[cfg(test)] mod command_resource;
 #[cfg(test)] mod schemas;
 #[cfg(test)] mod types;