Release pipeline runs Process-PSModule v8 and tests run on Pester 6

[Marius Storhaug (MariusStorhaug)]

Every release of this module flows through the Process-PSModule v8 pipeline, which publishes a stable release from a push to main and authenticates repository writes with a GitHub App installation token instead of broad github.token permissions. The module's Pester suite runs on Pester 6.1.x and uses the Pester 6 Should-* assertion family, matching the range the pipeline resolves for its own runs.

A contributor needs Pester 6.1.x available locally to run tests/Fonts.Tests.ps1, and the caller workflow supplies PSGALLERY_API_KEY, GitHubAppClientId, and GitHubAppPrivateKey explicitly from PSModule organization secrets. Anyone installing and using the Fonts module is unaffected: the module's functions, parameters, and behaviour are untouched.

Breaking: Pester 6.1.x requirement for the test suite

The assertion syntax a test file uses determines which Pester majors can execute it, and a suite that mixes syntaxes across a version boundary fails in ways that look like product defects.

tests/Fonts.Tests.ps1 declares its Pester requirement at the top of the file and asserts with Should-NotBeNull and Should-BeNull, so the suite runs on Pester 6.1.x up to but excluding 7.0.0. Pester 6 offers no Should-NotThrow, so the tests invoke Install-Font and Uninstall-Font directly and let an unhandled exception fail the test, which surfaces the real error at its own line.

#Requires -Modules @{ ModuleName = 'Pester'; ModuleVersion = '6.1.0'; MaximumVersion = '6.*' }

Changed: Release pipeline on Process-PSModule v8

The caller workflow governs which events reach the shared pipeline, which permissions a run holds, and which credentials it receives, and a v8 pipeline evaluates a stable release from a default-branch push rather than from a merged pull request.

.github/workflows/Process-PSModule.yml tracks the v8 major tag, so the repository follows the major automatically. It triggers on a push to main for stable releases and keeps the pull_request trigger for CI, prereleases, and prerelease cleanup. Its concurrency key separates a pull request from a default-branch push and queues rather than cancels, because a release-capable run mutates the PowerShell Gallery, GitHub Releases, and tags. github.token holds only contents: read, pages: write, and id-token: write, since the GitHub App installation token performs repository writes.

jobs:
  Process-PSModule:
    uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@v8
    secrets:
      PSGALLERY_API_KEY: ${{ secrets.PSGALLERY_API_KEY }}
      GitHubAppClientId: ${{ secrets.SHELLY_CLIENT_ID }}
      GitHubAppPrivateKey: ${{ secrets.SHELLY_PRIVATE_KEY }}

Secret	Value	Effect	Default
PSGALLERY_API_KEY	PowerShell Gallery API key	Publishes the module to the PowerShell Gallery.	Required to publish
GitHubAppClientId	GitHub App client ID	Authenticates the installation token that performs repository writes.	Required
GitHubAppPrivateKey	GitHub App private key	Signs the installation-token request for the same App.	Required
TestData	JSON object with secrets and variables maps	Exposes caller-defined values to the module's test phases.	Unset; the suite needs none

The calling the workflow guide covers the full caller contract, and writing module tests covers the Pester requirement and test discovery.

Technical details

The caller workflow body is verbatim from the v8.0.3 docs, checked against the v8.0.3 ref rather than reconstructed from the release notes. v7.0.0 moved repository writes onto a GitHub App installation token, which is what allows the narrowed permission set; v8.0.0 moved stable-release evaluation onto the default-branch push, which is what makes the push: trigger mandatory rather than optional. secrets: inherit is dropped because the v8 guide states explicit mapping is the contract and inheritance is not a substitute. All three secrets already exist at PSModule organization level.

The pipeline pins its Invoke-Pester runs to [6.1.0,7.0.0), so the file's #Requires guard mirrors the range the runner resolves. Should-NotBeNull and Should-BeNull were verified against Pester 6.1.0 to treat an empty collection as null, which makes them faithful replacements for the BeNullOrEmpty checks the suite relied on — an empty Get-Font result still satisfies Should-BeNull. Replacing the { ... } | Should -Not -Throw wrappers also repaired the $fonts assignments, which were scoped to the throwaway scriptblocks and never observable.

Validation: the file parses clean, Pester 6.1.0 discovers all 10 tests, and a full run against the module source on macOS passes 10 of 10 with the installed test font cleaned up afterwards. Invoke-ScriptAnalyzer with .github/linters/.powershell-psscriptanalyzer.psd1 reports no findings. Test names, structure, and coverage are identical, so the suite change is syntax only.

Out of scope and deliberately untouched: .github/dependabot.yml and Dependabot secrets, and everything under src/, where a separate effort addresses an Install-Font -Force defect.

[psmodule-s-shelly]

No Significant Changes Detected

This PR does not contain changes to files that would trigger a new release:

Pattern	Description
^src/	Matches files where path matches this pattern
^README\.md$	Matches files where path matches this pattern

Build, test, and publish stages will be skipped for this PR.

If you believe this is incorrect, please verify that your changes are in the correct locations.

[psmodule-s-shelly]

No Significant Changes Detected

This PR does not contain changes to files that would trigger a new release:

Pattern	Description
^src/	Matches files where path matches this pattern
^README\.md$	Matches files where path matches this pattern

Build, test, and publish stages will be skipped for this PR.

If you believe this is incorrect, please verify that your changes are in the correct locations.

[psmodule-s-shelly]

No Significant Changes Detected

This PR does not contain changes to files that would trigger a new release:

Pattern	Description
^src/	Matches files where path matches this pattern
^README\.md$	Matches files where path matches this pattern

Build, test, and publish stages will be skipped for this PR.

If you believe this is incorrect, please verify that your changes are in the correct locations.