Harden stable push routing

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: MariusStorhaug

.github/actions/Get-PSModuleSettings/src/Get-PSModuleSettings.Helpers.psm1

@@ -75,6 +75,7 @@ function Resolve-WorkflowEventRouting {
             $HasImportantChanges
         )
         ShouldCleanupEvent              = $isClosedPR
+        ShouldRunCleanup                = $isClosedPR -or $shouldRelease
     }
 }
 
@@ -128,3 +129,23 @@ function Get-FilesFromGitTree {
         Where-Object { $_.type -eq 'blob' } |
         Select-Object -ExpandProperty path
 }
+
+function Get-FilesFromGitHubComparison {
+    <#
+        .SYNOPSIS
+        Returns files from a complete GitHub compare response.
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [Parameter(Mandatory)]
+        [PSCustomObject] $Comparison
+    )
+
+    $files = @($Comparison.files | Where-Object { $null -ne $_ })
+    if ($files.Count -ge 300) {
+        throw 'Cannot determine changed files because the GitHub compare response reached its 300-file limit.'
+    }
+
+    $files | Select-Object -ExpandProperty filename
+}

.github/actions/Get-PSModuleSettings/src/main.ps1

@@ -325,7 +325,7 @@ LogGroup 'Calculate Job Run Conditions:' {
     # Check if important files have changed in the PR
     # Important files are determined by the configured ImportantFilePatterns setting
     $hasImportantChanges = $false
-    if ($pullRequestContext.Number) {
+    if ($eventName -eq 'pull_request' -and $pullRequestContext.Number) {
         LogGroup 'Check for Important File Changes' {
             $owner = $env:GITHUB_REPOSITORY_OWNER
             $repo = $env:GITHUB_REPOSITORY_NAME
@@ -416,10 +416,8 @@ If you believe this is incorrect, please verify that your changes are in the cor
                 $changedFiles = Get-FilesFromGitTree -Tree $tree
             } else {
                 Write-Host "Fetching changed files between [$beforeCommitSha] and [$commitSha]..."
-                $changedFiles = Invoke-GitHubAPI -ApiEndpoint "/repos/$owner/$repo/compare/$beforeCommitSha...$commitSha" -Method GET |
-                    Select-Object -ExpandProperty Response |
-                    Select-Object -ExpandProperty files |
-                    Select-Object -ExpandProperty filename
+                $comparison = (Invoke-GitHubAPI -ApiEndpoint "/repos/$owner/$repo/compare/$beforeCommitSha...$commitSha" -Method GET).Response
+                $changedFiles = Get-FilesFromGitHubComparison -Comparison $comparison
             }
 
             Write-Host "Changed files ($($changedFiles.Count)):"
@@ -633,7 +631,7 @@ $settings.Test.Module | Add-Member -MemberType NoteProperty -Name Suites -Value
 
 # Calculate job-specific conditions and add to settings
 LogGroup 'Calculate Job Run Conditions:' {
-    $shouldAutoCleanup = $routing.ShouldCleanupEvent -and ($settings.Publish.Module.AutoCleanup -eq $true)
+    $shouldAutoCleanup = $routing.ShouldRunCleanup -and ($settings.Publish.Module.AutoCleanup -eq $true)
 
     # Update Publish.Module with computed release values
     $settings.Publish.Module | Add-Member -MemberType NoteProperty -Name ReleaseType -Value $releaseType -Force

.github/actions/Get-PSModuleSettings/tests/Get-PSModuleSettings.Helpers.Tests.ps1

@@ -12,6 +12,7 @@ Describe 'Resolve-WorkflowEventRouting' {
         $result.ReleaseType | Should -Be 'Release'
         $result.ShouldRunBuildTest | Should -BeTrue
         $result.ShouldCleanupEvent | Should -BeFalse
+        $result.ShouldRunCleanup | Should -BeTrue
     }
 
     It 'routes a direct push to the default branch to a stable release' {
@@ -62,6 +63,7 @@ Describe 'Resolve-WorkflowEventRouting' {
         $result.ReleaseType | Should -Be 'None'
         $result.ShouldRunBuildTest | Should -BeFalse
         $result.ShouldCleanupEvent | Should -BeTrue
+        $result.ShouldRunCleanup | Should -BeTrue
     }
 
     It 'does not run a label event for a closed PR' {
@@ -76,6 +78,7 @@ Describe 'Resolve-WorkflowEventRouting' {
         $result.IsOpenOrUpdatedPR | Should -BeFalse
         $result.ShouldRunBuildTest | Should -BeFalse
         $result.ShouldCleanupEvent | Should -BeFalse
+        $result.ShouldRunCleanup | Should -BeFalse
     }
 }
 
@@ -148,3 +151,29 @@ Describe 'Get-FilesFromGitTree' {
         { Get-FilesFromGitTree -Tree $tree } | Should -Throw '*tree response was truncated*'
     }
 }
+
+Describe 'Get-FilesFromGitHubComparison' {
+    It 'returns filenames from a compare response below the file limit' {
+        $comparison = [pscustomobject]@{
+            files = @(
+                [pscustomobject]@{ filename = 'src/Module.psm1' }
+                [pscustomobject]@{ filename = 'README.md' }
+            )
+        }
+
+        $result = Get-FilesFromGitHubComparison -Comparison $comparison
+
+        $result | Should -Be @('src/Module.psm1', 'README.md')
+    }
+
+    It 'rejects a compare response that reaches the file limit' {
+        $comparison = [pscustomobject]@{
+            files = @(1..300 | ForEach-Object {
+                    [pscustomobject]@{ filename = "src/File$_.ps1" }
+                })
+        }
+
+        { Get-FilesFromGitHubComparison -Comparison $comparison } |
+            Should -Throw '*compare response reached its 300-file limit*'
+    }
+}

docs/content/reference/scenario-matrix.md

@@ -24,7 +24,7 @@ execution; other pages link here rather than repeating it.
 | **Get-TestResults**       | ✅ Yes          | ✅ Yes              | ❌ No     | ✅ Yes                    |
 | **Get-CodeCoverage**      | ✅ Yes          | ✅ Yes              | ❌ No     | ✅ Yes                    |
 | **Publish-Site**          | ❌ No           | ✅ Yes*             | ❌ No     | ✅ Yes*                   |
-| **Publish-Module**        | ✅ Prerelease†  | ✅ Stable†          | ✅ Cleanup‡ | ✅ Stable†              |
+| **Publish-Module**        | ✅ Prerelease†  | ✅ Stable†§         | ✅ Cleanup‡ | ✅ Stable†§             |
 
 - \* Only when `Publish.Site.Skip` is `false`.
 - † Requires an important change and all required build, test, and coverage gates to succeed. An open PR also requires
@@ -33,6 +33,7 @@ execution; other pages link here rather than repeating it.
   release with commit-based notes.
 - ‡ Cleans up prerelease versions and tags for the closed pull request when `Publish.Module.AutoCleanup` is enabled;
   it does not publish a stable release.
+- § A successful stable release also retries prerelease cleanup when `Publish.Module.AutoCleanup` is enabled.
 
 A job that is enabled by this matrix can still be skipped by a setting (for example `Test.Skip`) or because an open PR
 or default-branch push changed no