🚀 [Feature]: Add TestVariables input for non-secret test configuration

Adds a TestVariables workflow input (symmetric to TestSecrets) that exposes caller-selected NON-SECRET values as environment variables in the module test jobs, without masking. The expose step is refactored into a shared helper that masks secrets but not variables. Self-tests prove it via a dedicated PSMODULE_TEST_VARIABLE repo variable (asserted value + length). README documents both.

Author: MariusStorhaug

.github/workflows/AfterAll-ModuleLocal.yml

@@ -13,6 +13,13 @@ on:
         type: string
         description: The complete settings object including test suites.
         required: true
+      TestVariables:
+        type: string
+        description: |
+          Optional JSON object mapping environment variable names to NON-SECRET values, exposed as
+          environment variables (not masked) to the AfterAll teardown script. Built from toJSON(vars.<name>).
+        required: false
+        default: ''
 
 permissions:
   contents: read # to checkout the repo
@@ -30,34 +37,48 @@ jobs:
           persist-credentials: false
           fetch-depth: 0
 
-      - name: Expose caller-provided test secrets
+      - name: Expose caller-provided test secrets and variables
         shell: pwsh
         env:
           PSMODULE_TEST_SECRETS: ${{ secrets.TestSecrets }}
+          PSMODULE_TEST_VARIABLES: ${{ inputs.TestVariables }}
         run: |
-          if ([string]::IsNullOrWhiteSpace($env:PSMODULE_TEST_SECRETS)) {
-              Write-Host 'No test secrets were provided by the calling workflow.'
-              return
-          }
-          try {
-              $secrets = $env:PSMODULE_TEST_SECRETS | ConvertFrom-Json -ErrorAction Stop
-          } catch {
-              throw "The 'TestSecrets' secret must be a JSON object mapping names to values. $_"
-          }
-          foreach ($secret in $secrets.PSObject.Properties) {
-              $name = $secret.Name
-              $value = [string]$secret.Value
-              foreach ($line in ($value -split "`n")) {
-                  $line = $line.TrimEnd("`r")
-                  if ($line.Length -gt 0) {
-                      Write-Host "::add-mask::$line"
+          function Add-EnvFromJson {
+              param(
+                  [string] $Json,
+                  [string] $Source,
+                  [switch] $Mask
+              )
+              if ([string]::IsNullOrWhiteSpace($Json)) { return }
+              try {
+                  $items = $Json | ConvertFrom-Json -ErrorAction Stop
+              } catch {
+                  throw "The '$Source' value must be a JSON object mapping names to values. $_"
+              }
+              foreach ($item in $items.PSObject.Properties) {
+                  $name = $item.Name
+                  $value = [string]$item.Value
+                  if ($Mask) {
+                      foreach ($line in ($value -split "`n")) {
+                          $line = $line.TrimEnd("`r")
+                          if ($line.Length -gt 0) {
+                              Write-Host "::add-mask::$line"
+                          }
+                      }
                   }
+                  $delimiter = "GHENV_$([guid]::NewGuid().ToString('N'))"
+                  Add-Content -Path $env:GITHUB_ENV -Value "$name<<$delimiter"
+                  Add-Content -Path $env:GITHUB_ENV -Value $value
+                  Add-Content -Path $env:GITHUB_ENV -Value $delimiter
+                  Write-Host "Exposed [$name] as an environment variable."
               }
-              $delimiter = "GHENV_$([guid]::NewGuid().ToString('N'))"
-              Add-Content -Path $env:GITHUB_ENV -Value "$name<<$delimiter"
-              Add-Content -Path $env:GITHUB_ENV -Value $value
-              Add-Content -Path $env:GITHUB_ENV -Value $delimiter
-              Write-Host "Exposed [$name] as an environment variable."
+          }
+
+          Add-EnvFromJson -Json $env:PSMODULE_TEST_SECRETS -Source 'TestSecrets' -Mask
+          Add-EnvFromJson -Json $env:PSMODULE_TEST_VARIABLES -Source 'TestVariables'
+
+          if ([string]::IsNullOrWhiteSpace($env:PSMODULE_TEST_SECRETS) -and [string]::IsNullOrWhiteSpace($env:PSMODULE_TEST_VARIABLES)) {
+              Write-Host 'No test secrets or variables were provided by the calling workflow.'
           }
 
       - name: Run AfterAll Teardown Scripts

.github/workflows/BeforeAll-ModuleLocal.yml

@@ -13,6 +13,13 @@ on:
         type: string
         description: The complete settings object including test suites.
         required: true
+      TestVariables:
+        type: string
+        description: |
+          Optional JSON object mapping environment variable names to NON-SECRET values, exposed as
+          environment variables (not masked) to the BeforeAll setup script. Built from toJSON(vars.<name>).
+        required: false
+        default: ''
 
 permissions:
   contents: read # to checkout the repo
@@ -30,34 +37,48 @@ jobs:
           persist-credentials: false
           fetch-depth: 0
 
-      - name: Expose caller-provided test secrets
+      - name: Expose caller-provided test secrets and variables
         shell: pwsh
         env:
           PSMODULE_TEST_SECRETS: ${{ secrets.TestSecrets }}
+          PSMODULE_TEST_VARIABLES: ${{ inputs.TestVariables }}
         run: |
-          if ([string]::IsNullOrWhiteSpace($env:PSMODULE_TEST_SECRETS)) {
-              Write-Host 'No test secrets were provided by the calling workflow.'
-              return
-          }
-          try {
-              $secrets = $env:PSMODULE_TEST_SECRETS | ConvertFrom-Json -ErrorAction Stop
-          } catch {
-              throw "The 'TestSecrets' secret must be a JSON object mapping names to values. $_"
-          }
-          foreach ($secret in $secrets.PSObject.Properties) {
-              $name = $secret.Name
-              $value = [string]$secret.Value
-              foreach ($line in ($value -split "`n")) {
-                  $line = $line.TrimEnd("`r")
-                  if ($line.Length -gt 0) {
-                      Write-Host "::add-mask::$line"
+          function Add-EnvFromJson {
+              param(
+                  [string] $Json,
+                  [string] $Source,
+                  [switch] $Mask
+              )
+              if ([string]::IsNullOrWhiteSpace($Json)) { return }
+              try {
+                  $items = $Json | ConvertFrom-Json -ErrorAction Stop
+              } catch {
+                  throw "The '$Source' value must be a JSON object mapping names to values. $_"
+              }
+              foreach ($item in $items.PSObject.Properties) {
+                  $name = $item.Name
+                  $value = [string]$item.Value
+                  if ($Mask) {
+                      foreach ($line in ($value -split "`n")) {
+                          $line = $line.TrimEnd("`r")
+                          if ($line.Length -gt 0) {
+                              Write-Host "::add-mask::$line"
+                          }
+                      }
                   }
+                  $delimiter = "GHENV_$([guid]::NewGuid().ToString('N'))"
+                  Add-Content -Path $env:GITHUB_ENV -Value "$name<<$delimiter"
+                  Add-Content -Path $env:GITHUB_ENV -Value $value
+                  Add-Content -Path $env:GITHUB_ENV -Value $delimiter
+                  Write-Host "Exposed [$name] as an environment variable."
               }
-              $delimiter = "GHENV_$([guid]::NewGuid().ToString('N'))"
-              Add-Content -Path $env:GITHUB_ENV -Value "$name<<$delimiter"
-              Add-Content -Path $env:GITHUB_ENV -Value $value
-              Add-Content -Path $env:GITHUB_ENV -Value $delimiter
-              Write-Host "Exposed [$name] as an environment variable."
+          }
+
+          Add-EnvFromJson -Json $env:PSMODULE_TEST_SECRETS -Source 'TestSecrets' -Mask
+          Add-EnvFromJson -Json $env:PSMODULE_TEST_VARIABLES -Source 'TestVariables'
+
+          if ([string]::IsNullOrWhiteSpace($env:PSMODULE_TEST_SECRETS) -and [string]::IsNullOrWhiteSpace($env:PSMODULE_TEST_VARIABLES)) {
+              Write-Host 'No test secrets or variables were provided by the calling workflow.'
           }
 
       - name: Run BeforeAll Setup Scripts

.github/workflows/Test-ModuleLocal.yml

@@ -13,6 +13,13 @@ on:
         type: string
         description: The settings object as a JSON string.
         required: true
+      TestVariables:
+        type: string
+        description: |
+          Optional JSON object mapping environment variable names to NON-SECRET values, exposed as
+          environment variables (not masked). The caller builds it from toJSON(vars.<name>).
+        required: false
+        default: ''
 
 permissions:
   contents: read # to checkout the repo and create releases on the repo
@@ -35,34 +42,48 @@ jobs:
           persist-credentials: false
           fetch-depth: 0
 
-      - name: Expose caller-provided test secrets
+      - name: Expose caller-provided test secrets and variables
         shell: pwsh
         env:
           PSMODULE_TEST_SECRETS: ${{ secrets.TestSecrets }}
+          PSMODULE_TEST_VARIABLES: ${{ inputs.TestVariables }}
         run: |
-          if ([string]::IsNullOrWhiteSpace($env:PSMODULE_TEST_SECRETS)) {
-              Write-Host 'No test secrets were provided by the calling workflow.'
-              return
-          }
-          try {
-              $secrets = $env:PSMODULE_TEST_SECRETS | ConvertFrom-Json -ErrorAction Stop
-          } catch {
-              throw "The 'TestSecrets' secret must be a JSON object mapping names to values. $_"
-          }
-          foreach ($secret in $secrets.PSObject.Properties) {
-              $name = $secret.Name
-              $value = [string]$secret.Value
-              foreach ($line in ($value -split "`n")) {
-                  $line = $line.TrimEnd("`r")
-                  if ($line.Length -gt 0) {
-                      Write-Host "::add-mask::$line"
+          function Add-EnvFromJson {
+              param(
+                  [string] $Json,
+                  [string] $Source,
+                  [switch] $Mask
+              )
+              if ([string]::IsNullOrWhiteSpace($Json)) { return }
+              try {
+                  $items = $Json | ConvertFrom-Json -ErrorAction Stop
+              } catch {
+                  throw "The '$Source' value must be a JSON object mapping names to values. $_"
+              }
+              foreach ($item in $items.PSObject.Properties) {
+                  $name = $item.Name
+                  $value = [string]$item.Value
+                  if ($Mask) {
+                      foreach ($line in ($value -split "`n")) {
+                          $line = $line.TrimEnd("`r")
+                          if ($line.Length -gt 0) {
+                              Write-Host "::add-mask::$line"
+                          }
+                      }
                   }
+                  $delimiter = "GHENV_$([guid]::NewGuid().ToString('N'))"
+                  Add-Content -Path $env:GITHUB_ENV -Value "$name<<$delimiter"
+                  Add-Content -Path $env:GITHUB_ENV -Value $value
+                  Add-Content -Path $env:GITHUB_ENV -Value $delimiter
+                  Write-Host "Exposed [$name] as an environment variable."
               }
-              $delimiter = "GHENV_$([guid]::NewGuid().ToString('N'))"
-              Add-Content -Path $env:GITHUB_ENV -Value "$name<<$delimiter"
-              Add-Content -Path $env:GITHUB_ENV -Value $value
-              Add-Content -Path $env:GITHUB_ENV -Value $delimiter
-              Write-Host "Exposed [$name] as an environment variable."
+          }
+
+          Add-EnvFromJson -Json $env:PSMODULE_TEST_SECRETS -Source 'TestSecrets' -Mask
+          Add-EnvFromJson -Json $env:PSMODULE_TEST_VARIABLES -Source 'TestVariables'
+
+          if ([string]::IsNullOrWhiteSpace($env:PSMODULE_TEST_SECRETS) -and [string]::IsNullOrWhiteSpace($env:PSMODULE_TEST_VARIABLES)) {
+              Write-Host 'No test secrets or variables were provided by the calling workflow.'
           }
 
       - name: Download module artifact

.github/workflows/Workflow-Test-Default.yml

@@ -41,6 +41,9 @@ jobs:
         }
     with:
       WorkingDirectory: tests/srcTestRepo
+      # Non-secret configuration flows via TestVariables (built from repo/org variables, not masked).
+      TestVariables: >-
+        { "PSMODULE_TEST_VARIABLE": ${{ toJSON(vars.PSMODULE_TEST_VARIABLE) }} }
       ImportantFilePatterns: |
         ^src/
         ^README\.md$

.github/workflows/Workflow-Test-WithManifest.yml

@@ -41,6 +41,9 @@ jobs:
         }
     with:
       WorkingDirectory: tests/srcWithManifestTestRepo
+      # Non-secret configuration flows via TestVariables (built from repo/org variables, not masked).
+      TestVariables: >-
+        { "PSMODULE_TEST_VARIABLE": ${{ toJSON(vars.PSMODULE_TEST_VARIABLE) }} }
       ImportantFilePatterns: |
         ^src/
         ^README\.md$

.github/workflows/workflow.yml

@@ -59,6 +59,16 @@ on:
         default: |
           ^src/
           ^README\.md$
+      TestVariables:
+        type: string
+        description: |
+          Optional JSON object mapping environment variable names to NON-SECRET values that are exposed
+          to the module test jobs (BeforeAll-ModuleLocal, Test-ModuleLocal, AfterAll-ModuleLocal).
+          The calling workflow builds it from repository/organization variables using
+          toJSON(vars.<name>). Unlike TestSecrets, these values are NOT masked. Omit it when the module
+          needs no non-secret test configuration. See the README for a complete example.
+        required: false
+        default: ''
 
 permissions:
   contents: write      # to checkout the repo and create releases on the repo
@@ -165,6 +175,7 @@ jobs:
       - Get-Settings
     with:
       Settings: ${{ needs.Get-Settings.outputs.Settings }}
+      TestVariables: ${{ inputs.TestVariables }}
 
   # Runs on:
   # - ✅ Open/Updated PR - Tests module in local environment
@@ -182,6 +193,7 @@ jobs:
       TestSecrets: ${{ secrets.TestSecrets }}
     with:
       Settings: ${{ needs.Get-Settings.outputs.Settings }}
+      TestVariables: ${{ inputs.TestVariables }}
 
   # Runs on:
   # - ✅ Open/Updated PR - Runs teardown scripts after local module tests
@@ -198,6 +210,7 @@ jobs:
       - Test-ModuleLocal
     with:
       Settings: ${{ needs.Get-Settings.outputs.Settings }}
+      TestVariables: ${{ inputs.TestVariables }}
 
   # Runs on:
   # - ✅ Open/Updated PR - Collects and reports test results

README.md

@@ -394,6 +394,7 @@ jobs:
 | `Prerelease` | `boolean` | Whether to use a prerelease version of the 'GitHub' module. | `false` | `false` |
 | `WorkingDirectory` | `string` | The path to the root of the repo. | `false` | `'.'` |
 | `ImportantFilePatterns` | `string` | Newline-separated list of regular expression patterns that identify important files. Changes matching these patterns trigger build, test, and publish stages. When set, fully replaces the defaults. | `false` | `^src/\n^README\.md$` |
+| `TestVariables` | `string` | A JSON object mapping environment variable names to non-secret values, exposed (unmasked) as environment variables to the module test jobs. Built by the caller from `toJSON(vars.<name>)`. | `false` | `''` |
 
 ### Secrets
 
@@ -405,13 +406,16 @@ credentials that are exposed. `secrets: inherit` is intentionally not required.
 | `APIKey` | GitHub secrets | The API key for the PowerShell Gallery, used to publish the module. | Yes |
 | `TestSecrets` | GitHub secrets | A JSON object mapping environment variable names to secret values, exposed to the module test jobs. | No |
 
-#### Passing secrets to the tests
+#### Passing secrets and variables to the tests
 
-`TestSecrets` lets a module expose any number of caller-defined secrets to its test jobs
-(`BeforeAll-ModuleLocal`, `Test-ModuleLocal` and `AfterAll-ModuleLocal`) without changing the shared
-workflow. The calling workflow decides exactly which secrets are passed by building a single-line JSON object.
-Use `toJSON(secrets.<name>)` so that quoting and multi-line values (such as private keys) are encoded
-correctly. A folded `>-` block keeps the source readable while producing a single-line value:
+`TestSecrets` (a secret) and `TestVariables` (a regular input) let a module expose any number of
+caller-defined values to its test jobs (`BeforeAll-ModuleLocal`, `Test-ModuleLocal` and
+`AfterAll-ModuleLocal`) without changing the shared workflow. Use `TestSecrets` for sensitive values
+(masked in the logs) and `TestVariables` for non-secret configuration such as URLs, usernames and
+identifiers (not masked). The calling workflow decides exactly what is passed by building single-line
+JSON objects. Use `toJSON(secrets.<name>)` / `toJSON(vars.<name>)` so that quoting and multi-line
+values (such as private keys) are encoded correctly. A folded `>-` block keeps the source readable
+while producing a single-line value:
 
 ```yaml
 jobs:
@@ -421,30 +425,36 @@ jobs:
       APIKey: ${{ secrets.APIKEY }}
       TestSecrets: >-
         {
-        "TEST_USER_PAT": ${{ toJSON(secrets.TEST_USER_PAT) }},
-        "CONFLUENCE_API_KEY": ${{ toJSON(secrets.CONFLUENCE_API_KEY) }}
+        "CONFLUENCE_API_TOKEN": ${{ toJSON(secrets.CONFLUENCE_API_TOKEN) }}
+        }
+    with:
+      TestVariables: >-
+        {
+        "CONFLUENCE_API_BASE_URI": ${{ toJSON(vars.CONFLUENCE_API_BASE_URI) }},
+        "CONFLUENCE_USERNAME": ${{ toJSON(vars.CONFLUENCE_USERNAME) }},
+        "CONFLUENCE_SPACE_KEY": ${{ toJSON(vars.CONFLUENCE_SPACE_KEY) }}
         }
 ```
 
 Each entry becomes an environment variable in the test jobs, so the module's Pester tests read the
 values directly:
 
 ```powershell
-$env:TEST_USER_PAT
-$env:CONFLUENCE_API_KEY
+$env:CONFLUENCE_API_TOKEN     # from TestSecrets (masked in logs)
+$env:CONFLUENCE_API_BASE_URI  # from TestVariables (not masked)
 ```
 
 Notes:
 
-- The names are entirely caller-defined; no secret names are hard-coded in the shared workflow.
-- Every value is masked in the logs (`::add-mask::`).
-- Provide the object as a single-line value (the folded `>-` block above does this). Avoid a literal
+- The names are entirely caller-defined; no secret or variable names are hard-coded in the shared workflow.
+- `TestSecrets` values are masked in the logs (`::add-mask::`); `TestVariables` values are not masked.
+- Provide each object as a single-line value (the folded `>-` block above does this). Avoid a literal
   `|` block: GitHub registers every line of a multi-line secret as its own mask, which over-masks
   unrelated log output.
-- Omit `TestSecrets` entirely when the module needs no secrets.
-- Because `secrets: inherit` is not used, only the secrets you list are ever exposed.
-- Organization and repository secrets are supported. Secrets stored in a GitHub *Environment* are not
-  exposed by this mechanism.
+- Omit `TestSecrets` / `TestVariables` entirely when the module needs no secrets / no non-secret config.
+- Because `secrets: inherit` is not used, only the values you list are ever exposed.
+- Organization and repository secrets and variables are supported. Secrets stored in a GitHub
+  *Environment* are not exposed by this mechanism.
 
 ### Permissions