🌟 [Major]: Reusable workflows now use GitHub App orchestration and explicit publish credentials

[Marius Storhaug (MariusStorhaug)]

Process-PSModule now performs repository inspection, versioning, release management, and pull-request feedback through a configured GitHub App. Publishing uses the explicit PSGALLERY_API_KEY credential consistently from the reusable workflow through the publishing action.

Breaking Changes

Caller workflows must now pass GitHub App credentials and the PowerShell Gallery credential through the reusable workflow contract. Workflows that omit these required secrets fail before their dependent stages run.

secrets:
  PSGALLERY_API_KEY: ${{ secrets.PSGALLERY_API_KEY }}
  GitHubAppClientId: ${{ secrets.GITHUB_APP_CLIENT_ID }}
  GitHubAppPrivateKey: ${{ secrets.GITHUB_APP_PRIVATE_KEY }}

The caller can retain any local GitHub App secret names; only the reusable-workflow boundary names are fixed. PSGALLERY_API_KEY is also the input name of the publishing action.

Changed: Scoped GitHub automation

Every GitHub-dependent stage now mints a short-lived token for the triggering repository and requests only the access it needs. Version planning reads repository and pull-request data, builds read repository metadata, and publishing creates releases, uploads assets, cleans prereleases, and posts pull-request comments through the configured App.

The GitHub App installation needs Contents: write and Pull requests: write. Metadata: read is granted automatically. Permissions such as Actions, Statuses, Pages, and ID tokens remain part of the caller workflow's default github.token path and are not App permissions.

Technical Details

• Plan, Build-Module, and Publish-Module mint repository-scoped installation tokens with pinned actions/create-github-app-token.
• GitHub-facing actions receive the token only through step-scoped GH_TOKEN; the GitHub App path has no github.token fallback.
• The release path, version resolution, repository metadata reads, settings, comments, and prerelease cleanup all use the App token.
• The reusable workflow, publishing action input, action environment variable, and Process-PSModule documentation use PSGALLERY_API_KEY.
• Canonical caller templates and Process-PSModule documentation include the App credential contract, PowerShell Gallery credential, permission matrix, and Dependabot configuration requirement.
• The GitHub-Script named-token-input hardening follow-up remains tracked separately.

Related issues

• Fixes Orchestrate reusable workflow GitHub operations through a GitHub App #510
• Fixes Use PSGALLERY_API_KEY for PowerShell Gallery publishing #343
• Fixes Security: installation token passed via named 'Token' input may leak in debug logs GitHub-Script#103

[github-actions]

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
CSS	Pass ✅
CSS_PRETTIER	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
HTML	Pass ✅
JAVASCRIPT_ES	Pass ✅
JAVASCRIPT_PRETTIER	Pass ✅
MARKDOWN	Pass ✅
NATURAL_LANGUAGE	Pass ✅
POWERSHELL	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter