AfterAll-ModuleLocal.yml

name: AfterAll-ModuleLocal

on:
  workflow_call:
    secrets:
      TestData:
        description: |
          Optional single-line JSON object with 'secrets' and 'variables' maps. Each entry is exposed
          as an environment variable available to the AfterAll teardown script; 'secrets' values are
          masked in the logs, 'variables' values are not.
        required: false
    inputs:
      Settings:
        type: string
        description: The complete settings object including test suites.
        required: true

permissions:
  contents: read # to checkout the repo

jobs:
  AfterAll-ModuleLocal:
    name: AfterAll-ModuleLocal
    runs-on: ubuntu-latest
    env:
      SETTINGS: ${{ inputs.Settings }}
    steps:
      - name: Checkout Code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Expose caller-provided test data
        shell: pwsh
        env:
          PSMODULE_TEST_DATA: ${{ secrets.TestData }}
        run: |
          if ([string]::IsNullOrWhiteSpace($env:PSMODULE_TEST_DATA)) {
              Write-Host 'No test data was provided by the calling workflow.'
              return
          }
          try {
              $data = $env:PSMODULE_TEST_DATA | ConvertFrom-Json -ErrorAction Stop
          } catch {
              throw "The 'TestData' secret must be valid JSON with 'secrets' and/or 'variables' maps."
          }
          if ($null -eq $data -or $data -isnot [pscustomobject]) {
              throw "The 'TestData' secret must be a JSON object with 'secrets' and/or 'variables' maps."
          }
          $allowedTopLevelKeys = @('secrets', 'variables')
          foreach ($propertyName in $data.PSObject.Properties.Name) {
              if ($allowedTopLevelKeys -notcontains $propertyName) {
                  throw "The 'TestData' secret only supports 'secrets' and 'variables' maps."
              }
          }
          $reservedNames = @('CI', 'HOME', 'PATH', 'PWD', 'SHELL', 'PSMODULE_TEST_DATA')
          $reservedPrefixes = @('GITHUB_', 'RUNNER_', 'ACTIONS_')
          function Assert-EnvironmentName {
              param([string] $Name)
              if ($Name -notmatch '^[A-Za-z_][A-Za-z0-9_]*$') {
                  throw "TestData keys must be valid environment variable names."
              }
              $normalized = $Name.ToUpperInvariant()
              if ($reservedNames -contains $normalized) {
                  throw "TestData keys must not override reserved environment variables."
              }
              foreach ($prefix in $reservedPrefixes) {
                  if ($normalized.StartsWith($prefix)) {
                      throw "TestData keys must not override reserved environment variables."
                  }
              }
          }
          function Assert-Map {
              param(
                  [object] $Map,
                  [string] $Name
              )
              if ($null -eq $Map) { return }
              if ($Map -isnot [pscustomobject]) {
                  throw "The 'TestData.$Name' value must be a JSON object."
              }
          }
          function Get-EnvironmentValue {
              param(
                  [object] $Value,
                  [string] $Name
              )
              if ($null -eq $Value) { return '' }
              if ($Value -is [pscustomobject] -or ($Value -is [System.Collections.IEnumerable] -and $Value -isnot [string])) {
                  throw "Values in 'TestData.$Name' must be scalar values."
              }
              return [string]$Value
          }
          function Add-EnvFromMap {
              param(
                  [object] $Map,
                  [string] $Name,
                  [switch] $Mask
              )
              Assert-Map -Map $Map -Name $Name
              if ($null -eq $Map) { return }
              $count = 0
              foreach ($item in $Map.PSObject.Properties) {
                  $name = $item.Name
                  Assert-EnvironmentName -Name $name
                  $value = Get-EnvironmentValue -Value $item.Value -Name $Name
                  if ($Mask) {
                      foreach ($line in ($value -split "`n")) {
                          $line = $line.TrimEnd("`r")
                          if ($line.Length -gt 0) {
                              Write-Host "::add-mask::$line"
                          }
                      }
                  }
                  do {
                      $delimiter = "GHENV_$([guid]::NewGuid().ToString('N'))"
                  } while ($value.Contains($delimiter))
                  Add-Content -Path $env:GITHUB_ENV -Value "$name<<$delimiter"
                  Add-Content -Path $env:GITHUB_ENV -Value $value
                  Add-Content -Path $env:GITHUB_ENV -Value $delimiter
                  $count++
              }
              if ($count -gt 0) {
                  if ($Mask) {
                      Write-Host "Exposed $count secret value(s) as environment variables."
                  } else {
                      Write-Host "Exposed $count variable value(s) as environment variables."
                  }
              }
          }

          Add-EnvFromMap -Map $data.secrets -Name 'secrets' -Mask
          Add-EnvFromMap -Map $data.variables -Name 'variables'

      - name: Run AfterAll Teardown Scripts
        if: always()
        uses: PSModule/GitHub-Script@1ee97bbc652d19c38ae12f6e1e47e9d9fbd12d0a # v1.8.0
        with:
          Name: AfterAll-ModuleLocal
          ShowInfo: false
          ShowOutput: true
          Debug: ${{ fromJson(inputs.Settings).Debug }}
          Prerelease: ${{ fromJson(inputs.Settings).Prerelease }}
          Verbose: ${{ fromJson(inputs.Settings).Verbose }}
          Version: ${{ fromJson(inputs.Settings).Version }}
          WorkingDirectory: ${{ fromJson(inputs.Settings).WorkingDirectory }}
          Script: |
            LogGroup "Running AfterAll Teardown Scripts" {
                $afterAllScript = 'tests/AfterAll.ps1'

                if (-not (Test-Path $afterAllScript)) {
                    Write-Host "No AfterAll.ps1 script found at [$afterAllScript] - exiting successfully"
                    exit 0
                }

                Write-Host "Running AfterAll teardown script: $afterAllScript"
                try {
                    & $afterAllScript
                    Write-Host "AfterAll script completed successfully: $afterAllScript"
                } catch {
                    Write-Warning "AfterAll script failed: $afterAllScript - $_"
                    # Don't throw for teardown scripts to ensure other cleanup scripts can run
                }
            }