⚙️ [Maintenance]: Pinned PowerShell Gallery module updates are proposed automatically - #156
Closed
Marius Storhaug (MariusStorhaug) wants to merge 8 commits into
Closed
⚙️ [Maintenance]: Pinned PowerShell Gallery module updates are proposed automatically#156Marius Storhaug (MariusStorhaug) wants to merge 8 commits into
Marius Storhaug (MariusStorhaug) wants to merge 8 commits into
Conversation
Dependabot has no PowerShell Gallery ecosystem, so nothing on the platform moves a pin like the Pester one in Invoke-PesterSuite.ps1. The script reads the pinned version through a caller-supplied pattern, asks the Gallery which versions exist, and rewrites the pin to the newest one inside the allowed range. The pattern must match exactly once and an unreachable Gallery is an error, so a broken lookup can never be mistaken for 'already up to date'. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Marius Storhaug (MariusStorhaug)
added
the
Maintenance
…et otherwise The Gallery is served from an in-process HttpListener on a loopback port, so both outcomes are demonstrated without waiting for Pester to release and without network access. Also fixes a bug the suite found: a feed reporting exactly one version unrolled to a bare [version], which has no Count under Set-StrictMode, so a single-version module would have crashed the check. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Runs on a schedule, on demand, and on every push to main. The push trigger is there because GitHub silently disables a scheduled workflow after 60 days of inactivity in a public repository: it does not cover the quiet window, but it guarantees the first push after one re-checks the pin. The pull request is labelled and left for a human, because identity-plus-exact pins are the one track the Dependencies standard says is never auto-merged. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Records that the gap is Dependabot having no PowerShell Gallery ecosystem rather than a choice made here, so if the platform ever ships one the right response is to delete this and add a package-ecosystem entry. Names the risk that a scheduled workflow is disabled silently after 60 days of inactivity in a public repository, and what distinguishes that from a run that found nothing to do. Also settles the analyzer findings on the new files and stops the new tests depending on member enumeration, which broke them under the full suite. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…t check Reverted in the next commit. 5.7.1 is outside the range the suites' #Requires lines declare, which is what a bad bump would look like. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Reverts the temporary 5.7.1 pin now that run 31266574992 has shown a breaking bump fails the Test check. The updater's checkout no longer persists the token into .git/config, which zizmor's artipacked audit flagged. The one push that needs credentials supplies them itself, so no later step in the job can read them. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Marius Storhaug (MariusStorhaug)
marked this pull request as ready for review
August 8, 2026 16:26
7 tasks
The existing-pull-request guard looked only at open ones, so a version a reviewer had closed to decline would be proposed again on the next run, every week, once the branch was gone. Checking every state means closing is how you say no, and the bot listens. The guard stays per version because the branch name carries it: declining 6.1.0 says nothing about 6.1.1. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Marius Storhaug (MariusStorhaug)
changed the title
Marius Storhaug (MariusStorhaug)
deleted the
maintenance-136-gallery-pin-updates
branch
August 9, 2026 19:22
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
MSX maintainers can now receive a reviewable pull request when this repository's pinned Pester version has a newer compatible PowerShell Gallery release. The exact version-and-GUID pin remains unchanged in posture; only its maintenance becomes automated.
New: Automated Pester pin proposals
A weekly, manually runnable, and
main-push-triggered workflow checks the PowerShell Gallery and opens a labelled pull request for the newest compatible stable Pester release. The proposed update must pass the repository's existing test gate before it can merge, and the workflow never auto-merges it.The update check fails explicitly when it cannot identify the pin or reach the Gallery, so an unavailable check cannot be mistaken for an up-to-date dependency. Closed update pull requests are treated as a decision not to propose that exact version again.
Changed: PowerShell Gallery coverage is documented
The Dependency Updates design now identifies PowerShell Gallery as unsupported by Dependabot and records the local workflow pattern, including the 60-day scheduled-workflow lapse and the evidence used to distinguish a lapsed schedule from a successful no-op run.
Technical details
Update-GalleryModulePin.ps1, a parameterised updater that preserves the target file's encoding, line endings, and Pester module GUID while changing only the version capture.Update-ModulePin.ymland Pester coverage for version selection, ceilings, prereleases, feed paging, idempotency, workflow outputs, and hard failures..github/scripts/**(PowerShell).github/workflows/**tests/**src/docs/**Relevant issues (or links)