TestWorkflow.yml

on:
  workflow_call:
    inputs:
      runs-on:
        description: The operating system to run the tests on
        required: true
        type: string
      Prerelease:
        description: Run the prerelease version of the action
        required: false
        type: boolean
        default: false
      Owner:
        description: The owner of the repository
        required: false
        type: string
        default: PSModule
    secrets:
      TEST_USER_PAT:
        description: Personal Access Token for the test user
        required: true
      TEST_USER_USER_FG_PAT:
        description: Personal Access Token for the test user with full gists scope
        required: true
      TEST_USER_ORG_FG_PAT:
        description: Personal Access Token for the test user with full gists scope
        required: true
      TEST_APP_ENT_CLIENT_ID:
        description: Client ID for the test GitHub App for the enterprise
        required: true
      TEST_APP_ENT_PRIVATE_KEY:
        description: Private Key for the test GitHub App for the enterprise
        required: true
      TEST_APP_ORG_CLIENT_ID:
        description: Client ID for the test GitHub App for the organization
        required: true
      TEST_APP_ORG_PRIVATE_KEY:
        description: Private Key for the test GitHub App for the organization
        required: true
      KEYVAULT_KEY_REFERENCE:
        description: Azure KeyVault key reference URL for GitHub App authentication
        required: true

permissions:
  contents: read
  pull-requests: read
  id-token: write

jobs:
  ActionTestBasic:
    name: Basic
    runs-on: ${{ inputs.runs-on }}
    steps:
      # Need to check out as part of the test, as its a local action
      - name: Checkout repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Action-Test
        uses: ./
        with:
          Prerelease: ${{ inputs.Prerelease }}
          Debug: true
          Verbose: true

      - name: Action-Test [ShowInit]
        uses: ./
        with:
          Prerelease: ${{ inputs.Prerelease }}
          Debug: true
          Verbose: true
          ShowInit: true

  ActionTestWithScript:
    name: WithScript
    runs-on: ${{ inputs.runs-on }}
    steps:
      # Need to check out as part of the test, as its a local action
      - name: Checkout repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      # # Not a supported way of running the action
      # # This syntax is specifically for using a function in a specific module
      # # i.e.: moduleName\functionName
      # - name: Action-Test [tests\info.ps1]
      #   if: success() || failure()
      #   uses: ./
      #   with:
      #     Script: tests\info.ps1

      - name: Action-Test [tests/info.ps1]
        if: success() || failure()
        uses: ./
        with:
          Script: tests/info.ps1
          Prerelease: ${{ inputs.Prerelease }}

      - name: Action-Test [.\tests\info.ps1]
        if: success() || failure()
        uses: ./
        with:
          Script: .\tests\info.ps1
          Prerelease: ${{ inputs.Prerelease }}

      - name: Action-Test [./tests/info.ps1]
        if: success() || failure()
        uses: ./
        with:
          Script: ./tests/info.ps1
          Prerelease: ${{ inputs.Prerelease }}

      - name: Action-Test [. .\tests\info.ps1]
        if: success() || failure()
        uses: ./
        with:
          Script: . .\tests\info.ps1
          Prerelease: ${{ inputs.Prerelease }}

      - name: Action-Test [. ./tests/info.ps1]
        if: success() || failure()
        uses: ./
        with:
          Script: . ./tests/info.ps1
          Prerelease: ${{ inputs.Prerelease }}

      - name: Action-Test [. '.\tests\info.ps1']
        if: success() || failure()
        uses: ./
        with:
          Script: . '.\tests\info.ps1'
          Prerelease: ${{ inputs.Prerelease }}

      - name: Action-Test [. './tests/info.ps1']
        if: success() || failure()
        uses: ./
        with:
          Script: . './tests/info.ps1'
          Prerelease: ${{ inputs.Prerelease }}

  ActionTestCommands:
    name: Commands + Outputs
    runs-on: ${{ inputs.runs-on }}
    outputs:
      MatrixTest: ${{ fromJson(steps.test.outputs.result).MatrixTest }}
    steps:
      # Need to check out as part of the test, as its a local action
      - name: Checkout repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Action-Test
        uses: ./
        id: test
        with:
          Name: Action-Test
          Debug: true
          Verbose: true
          Prerelease: ${{ inputs.Prerelease }}
          ShowInit: true
          ShowOutput: true
          Script: |
            LogGroup 'Get-GitHubZen' {
              $cat = Get-GitHubOctocat
              $zen = Get-GitHubZen
              Set-GitHubEnvironmentVariable -Name 'OCTOCAT' -Value $cat
            }

            LogGroup 'Write to GitHub Actions' {
              Write-GitHubNotice -Message $zen -Title 'GitHub Zen'
              Write-GitHubWarning -Message 'This is a warning message'
              Write-GitHubError -Message 'This is an error message'
              Write-GitHubDebug -Message 'This is a debug message'
              Write-GitHubLog -Message 'This is a log message' -ForegroundColor Green -BackgroundColor Yellow
            }

            LogGroup 'Set outputs - WISECAT' {
              Set-GitHubOutput -Name 'WISECAT' -Value $cat
            }

            LogGroup 'Set outputs - Zen' {
              Set-GitHubOutput -Name 'Zen' -Value $zen
            }

            LogGroup 'Set outputs - Context' {
              Set-GitHubOutput -Name 'Context' -Value (Get-GitHubContext)
            }

            LogGroup 'Set outputs - GitConfig' {
              Set-GitHubOutput -Name 'GitConfig' -Value (Get-GitHubGitConfig -Scope system)
            }

            LogGroup 'Set outputs - Zen2' {
              Set-GitHubOutput -Name 'Zen2' -Value $zen
            }

            LogGroup 'Set array outputs' {
              $complexArray = @(
                [pscustomobject]@{
                  Name = 'Test'
                  Value = 'Value'
                  Cars = @(
                    @{
                      Make = 'Toyota'
                      Model = 'Corolla'
                    },
                    @{
                      Make = 'Ford'
                      Model = 'Fiesta'
                    }
                  )
                },
                [pscustomobject]@{
                  Name = 'Test2'
                  Value = 'Value2'
                  Cars = @(
                    @{
                      Make = 'Toyota'
                      Model = 'Corolla'
                    },
                    @{
                      Make = 'Ford'
                      Model = 'Fiesta'
                    }
                  )
                }
              )
              Set-GitHubOutput -Name 'ComplexArray' -Value $complexArray
            }

            LogGroup 'Set array outputs - JSON' {
              $compexJson = $complexArray | ConvertTo-Json -Depth 10
              Set-GitHubOutput -Name 'ComplexArrayJson' -Value $compexJson
            }

            LogGroup 'Set summary' {
                Get-Content $env:GITHUB_OUTPUT -Raw | Set-GitHubStepSummary
            }

            LogGroup "ErrorView should be 'NormalView' - [$ErrorView]" {
                if ($ErrorView -ne 'NormalView') {
                    throw 'ErrorView is not NormalView'
                }
            }

      - name: Run-test
        shell: pwsh
        env:
          result: ${{ steps.test.outputs.result }}
          WISECAT: ${{ fromJson(steps.test.outputs.result).WISECAT }}
          Zen: ${{ fromJson(steps.test.outputs.result).Zen }}
          Zen2: ${{ fromJson(steps.test.outputs.result).Zen2 }}
          Context: ${{ fromJson(steps.test.outputs.result).Context }}
          GitConfig: ${{ fromJson(steps.test.outputs.result).GitConfig }}
          ComplexArray: ${{ fromJson(steps.test.outputs.result).ComplexArray }}
          ComplexArrayJson: ${{ fromJson(steps.test.outputs.result).ComplexArrayJson }}
        run: |
          $result = $env:result | ConvertFrom-Json
          $PSStyle.OutputRendering = 'Ansi'

          LogGroup 'Result - Json' {
            $env:result | Format-List | Out-String
          }

          LogGroup 'Result - Object' {
            $result | Format-List | Out-String
          }

          LogGroup "WISECAT" {
            Write-Host $env:WISECAT
          }

          LogGroup "Zen" {
            Write-Host $env:Zen
          }

          LogGroup "Context" {
            $env:Context | Format-List | Out-String
          }

          LogGroup "GitConfig" {
            $env:GitConfig | Format-List | Out-String
          }

          LogGroup "Zen2" {
            Write-Host $env:Zen2
          }

          LogGroup "ComplexArray" {
            $env:ComplexArray
            if (-not (Test-Json -Json $env:ComplexArray)) {
                Write-Host "Item is not a JSON object"
                exit 1
            }
          }

          LogGroup "ComplexArrayJson" {
            $env:ComplexArrayJson
            if (-not (Test-Json -Json $env:ComplexArrayJson)) {
                Write-Host "Item is not a JSON object"
                exit 1
            }
          }

          LogGroup "Other" {
              Set-GitHubStepSummary -Summary $env:WISECAT
              Write-GitHubNotice -Message $result.Zen -Title 'GitHub Zen'
              Write-Host ($result.Zen2)
              $result.Context | Format-List | Out-String
              $result.Context.GetType().Name
              if ($result.GitConfig -isnot [String]) {
                  throw "GitConfig is not a PSCustomObject"
              }

              $result.GitConfig | Format-List | Out-String
              $result.GitConfig.GetType().Name
              if ($result.GitConfig -isnot [String]) {
                  throw "GitConfig is a PSCustomObject"
              }
          }

  MatrixCreator:
    name: Matrix Creator
    runs-on: ubuntu-latest
    outputs:
      MatrixTest: ${{ fromJson(steps.test.outputs.result).MatrixTest }}
    steps:
      # Need to check out as part of the test, as its a local action
      - name: Checkout repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Action-Test
        uses: ./
        id: test
        with:
          Debug: true
          Verbose: true
          Prerelease: true
          ShowInit: true
          ShowOutput: true
          Script: |
            LogGroup 'MatrixTest' {
                $matrixTest = @{
                    Path   = @('tests/srcTestRepo', 'tests/srcWithManifestTestRepo')
                    RunsOn = @('ubuntu-latest', 'windows-latest', 'macos-latest')
                }
                Set-GitHubOutput -Name 'MatrixTest' -Value $matrixTest
            }

  MatrixTest:
    needs: MatrixCreator
    strategy:
      matrix: ${{ fromJson(needs.MatrixCreator.outputs.MatrixTest) }}
    name: Matrix Test [${{ matrix.RunsOn }}]
    runs-on: ${{ matrix.RunsOn }}
    steps:
      - name: Matrix Test
        shell: pwsh
        id: test
        env:
          Path: ${{ matrix.Path }}
        run: |
          Install-PSResource -Name GitHub -TrustRepository -Prerelease
          if ($PSMODULE_GITHUB_SCRIPT) {
              throw "Is not running in GitHub-Script action! Failing"
          }
          $item = [pscustomobject]@{
              Path = $env:Path
              Exists = Test-Path -Path $env:Path
          }
          Set-GithubOutput -Name 'Item' -Value $item

      - name: Matrix Test [Show]
        shell: pwsh
        env:
          Item: ${{ steps.test.outputs.item }}
        run: |
          $PSStyle.OutputRendering = 'Ansi'
          $env:Item | Format-Table | Out-String
          $env:Item | ConvertFrom-Json

          if (-not (Test-Json -Json $env:Item)) {
              throw "Item is not a JSON object"
          }

  ActionTestWithoutToken:
    name: WithoutToken
    runs-on: ${{ inputs.runs-on }}
    steps:
      # Need to check out as part of the test, as its a local action
      - name: Checkout repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Action-Test
        uses: ./
        with:
          Token: ''
          Prerelease: ${{ inputs.Prerelease }}
          Script: |
            LogGroup 'My group' {
              'This is a group'
            }

  ActionTestWithPAT:
    name: WithPAT
    runs-on: ${{ inputs.runs-on }}
    steps:
      # Need to check out as part of the test, as its a local action
      - name: Checkout repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Action-Test
        uses: ./
        with:
          Token: ${{ secrets.TEST_USER_PAT }}
          Prerelease: ${{ inputs.Prerelease }}
          Script: |
            LogGroup 'Get-GitHubUser' {
              Get-GitHubUser -Debug | Format-Table -AutoSize | Out-String
            }

            LogGroup 'Get-GitHubOrganization' {
                Get-GitHubOrganization | Out-String
            }

            LogGroup 'Get-GitHubRepository' {
                Get-GitHubRepository -Owner '${{ inputs.Owner }}' | Out-String
            }

  ActionTestWithUSERFGPAT:
    name: WithUserFGPAT
    runs-on: ${{ inputs.runs-on }}
    steps:
      # Need to check out as part of the test, as its a local action
      - name: Checkout repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Action-Test
        uses: ./
        with:
          Token: ${{ secrets.TEST_USER_USER_FG_PAT }}
          Prerelease: ${{ inputs.Prerelease }}
          Script: |
            LogGroup 'Get-GitHubUser' {
              Get-GitHubUser | Format-Table -AutoSize | Out-String
            }

            LogGroup 'Get-GitHubOrganization' {
                Get-GitHubOrganization | Out-String
            }

            LogGroup 'Get-GitHubRepository' {
                Get-GitHubRepository -Owner '${{ inputs.Owner }}' | Out-String
            }

  ActionTestWithORGFGPAT:
    name: WithOrgFGPAT
    runs-on: ${{ inputs.runs-on }}
    steps:
      # Need to check out as part of the test, as its a local action
      - name: Checkout repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Action-Test
        uses: ./
        with:
          Token: ${{ secrets.TEST_USER_ORG_FG_PAT }}
          Prerelease: ${{ inputs.Prerelease }}
          Script: |
            LogGroup 'Get-GitHubUser' {
              Get-GitHubUser | Format-Table -AutoSize | Out-String
            }

            LogGroup 'Get-GitHubOrganization' {
                Get-GitHubOrganization | Out-String
            }

            LogGroup 'Get-GitHubRepository' {
                Get-GitHubRepository -Owner '${{ inputs.Owner }}' | Out-String
            }

  ActionTestWithGitHubAppEnt:
    name: GitHubAppEnt
    runs-on: ${{ inputs.runs-on }}
    steps:
      # Need to check out as part of the test, as its a local action
      - name: Checkout repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Action-Test
        uses: ./
        with:
          ClientID: ${{ secrets.TEST_APP_ENT_CLIENT_ID }}
          PrivateKey: ${{ secrets.TEST_APP_ENT_PRIVATE_KEY }}
          Prerelease: ${{ inputs.Prerelease }}
          Script: |
            LogGroup 'Get-GitHubApp' {
              Get-GitHubApp | Format-List | Out-String
            }

            LogGroup 'Get-GitHubAppInstallation' {
              Get-GitHubAppInstallation | Format-Table -AutoSize | Out-String
            }

            LogGroup 'Connect to all installations of the app' {
                Connect-GitHubApp
            }

            LogGroup 'Contexts' {
                Get-GitHubContext -ListAvailable | Format-Table -AutoSize | Out-String
            }

            LogGroup 'GitHubConfig' {
                Get-GitHubConfig | Format-List | Out-String
            }

  ActionTestWithGitHubAppOrg:
    name: GitHubAppOrg + quoted inputs
    runs-on: ${{ inputs.runs-on }}
    steps:
      # Need to check out as part of the test, as its a local action
      - name: Checkout repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Action-Test
        uses: ./
        with:
          ClientID: '${{ secrets.TEST_APP_ORG_CLIENT_ID }}'      # Test with quotes on input
          PrivateKey: '${{ secrets.TEST_APP_ORG_PRIVATE_KEY }}'  # Test with quotes on input
          Prerelease: ${{ inputs.Prerelease }}
          Script: |
            LogGroup 'Get-GitHubApp' {
              Get-GitHubApp | Format-List | Out-String
            }

            LogGroup 'Get-GitHubAppInstallation' {
              Get-GitHubAppInstallation | Format-Table -AutoSize | Out-String
            }

            LogGroup 'Connect to all installations of the app' {
                Connect-GitHubApp
            }

            LogGroup 'Contexts' {
                Get-GitHubContext -ListAvailable | Format-Table -AutoSize | Out-String
            }

            LogGroup 'GitHubConfig' {
                Get-GitHubConfig | Format-List | Out-String
            }

  ActionTestWithKeyVaultKeyReference:
    name: WithKeyVaultKeyReference
    environment: azure
    runs-on: ${{ inputs.runs-on }}
    steps:
      # Need to check out as part of the test, as its a local action
      - name: Checkout repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      # Login to Azure to enable KeyVault access
      - name: Login to Azure
        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
        with:
          client-id: ${{ vars.AZURE_CLIENT_ID }}
          tenant-id: ${{ vars.AZURE_TENANT_ID }}
          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
          allow-no-subscriptions: true

      - name: Action-Test
        uses: ./
        with:
          ClientID: ${{ secrets.TEST_APP_ORG_CLIENT_ID }}
          KeyVaultKeyReference: 'https://psmodule-test-vault.vault.azure.net/keys/psmodule-org-app/569ae34250e64adca6a2b2d159d454a5'
          Prerelease: ${{ inputs.Prerelease }}
          Script: |
            LogGroup 'Context details' {
                Get-GitHubContext | Select-Object * | Out-String
            }

            LogGroup 'Get-GitHubApp' {
              Get-GitHubApp | Format-List | Out-String
            }

            LogGroup 'Get-GitHubAppInstallation' {
              Get-GitHubAppInstallation | Format-Table -AutoSize | Out-String
            }

            LogGroup 'Connect to all installations of the app' {
                Connect-GitHubApp
            }

            LogGroup 'Contexts' {
                Get-GitHubContext -ListAvailable | Format-Table -AutoSize | Out-String
            }

            LogGroup 'GitHubConfig' {
                Get-GitHubConfig | Format-List | Out-String
            }

  ActionTestWithKeyVaultKeyReferenceLatest:
    name: WithKeyVaultKeyReferenceLatest
    environment: azure
    runs-on: ${{ inputs.runs-on }}
    steps:
      # Need to check out as part of the test, as its a local action
      - name: Checkout repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      # Login to Azure to enable KeyVault access
      - name: Login to Azure
        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
        with:
          client-id: ${{ vars.AZURE_CLIENT_ID }}
          tenant-id: ${{ vars.AZURE_TENANT_ID }}
          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
          allow-no-subscriptions: true

      - name: Action-Test
        uses: ./
        with:
          ClientID: ${{ secrets.TEST_APP_ORG_CLIENT_ID }}
          KeyVaultKeyReference: 'https://psmodule-test-vault.vault.azure.net/keys/psmodule-org-app/'
          Prerelease: ${{ inputs.Prerelease }}
          Script: |
            LogGroup 'Context details' {
                Get-GitHubContext | Select-Object * | Out-String
            }

            LogGroup 'Get-GitHubApp' {
              Get-GitHubApp | Format-List | Out-String
            }

            LogGroup 'Get-GitHubAppInstallation' {
              Get-GitHubAppInstallation | Format-Table -AutoSize | Out-String
            }

            LogGroup 'Connect to all installations of the app' {
                Connect-GitHubApp
            }

            LogGroup 'Contexts' {
                Get-GitHubContext -ListAvailable | Format-Table -AutoSize | Out-String
            }

            LogGroup 'GitHubConfig' {
                Get-GitHubConfig | Format-List | Out-String
            }

  ActionTestPreserveCredentialsFalse:
    name: PreserveCredentials False
    runs-on: ${{ inputs.runs-on }}
    steps:
      # Need to check out as part of the test, as its a local action
      - name: Checkout repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Action-Test with PreserveCredentials false
        uses: ./
        with:
          Token: ${{ secrets.TEST_USER_PAT }}
          PreserveCredentials: false
          Prerelease: ${{ inputs.Prerelease }}
          Script: |
            LogGroup 'Get-GitHubUser with credentials that will be cleaned up' {
              Get-GitHubUser | Format-Table -AutoSize | Out-String
            }

      - name: Verify credentials are cleaned up
        shell: pwsh
        run: |
          try {
            # Import GitHub module to check contexts
            Import-Module -Name GitHub -ErrorAction SilentlyContinue

            # Check if Get-GitHubContext command is available
            if (Get-Command Get-GitHubContext -ErrorAction SilentlyContinue) {
              # Get available contexts
              $contexts = Get-GitHubContext -ListAvailable

              Write-Host "Available GitHub contexts: $($contexts | ConvertTo-Json -Depth 3)"

              # Verify that no contexts are available (should be null or empty)
              if ($null -eq $contexts -or $contexts.Count -eq 0) {
                Write-Host "✅ SUCCESS: No GitHub contexts found after cleanup"
              } else {
                Write-Host "❌ FAILURE: Found $($contexts.Count) GitHub context(s) after cleanup"
                $contexts | Format-Table -AutoSize | Out-String | Write-Host
                exit 1
              }
            } else {
              Write-Host "⚠️  WARNING: Get-GitHubContext command not available"
            }
          } catch {
            Write-Host "❌ FAILURE: Error checking GitHub contexts: $($_.Exception.Message)"
            exit 1
          }