♻️ [Maintenance]: Combine TestSecrets and TestVariables into a single TestData secret

Replace the separate TestSecrets secret and TestVariables input with one TestData
secret that carries a { "secrets": {...}, "variables": {...} } object, so callers
have a single overview of everything the module tests receive.

- workflow.yml + the three ModuleLocal workflows declare/pass TestData; the expose
  step parses both maps, masks only the "secrets" values, and leaves "variables"
  unmasked.
- Self-test callers build TestData with the CodeQL-clean direct "${{ secrets.X }}"
  form for secrets and toJSON(vars.X) for variables, kept single-line via a folded
  >- scalar so GitHub registers one mask.
- Drop the multi-line self-test secret (the direct form cannot carry newlines);
  README documents base64 for multi-line/special-character secrets.
- Update Environment.Tests.ps1 and the README accordingly.

Author: MariusStorhaug

.github/workflows/AfterAll-ModuleLocal.yml

@@ -3,23 +3,17 @@ name: AfterAll-ModuleLocal
 on:
   workflow_call:
     secrets:
-      TestSecrets:
+      TestData:
         description: |
-          Optional JSON object mapping environment variable names to secret values. Each entry is
-          exposed as an environment variable available to the AfterAll teardown script.
+          Optional single-line JSON object with 'secrets' and 'variables' maps. Each entry is exposed
+          as an environment variable available to the AfterAll teardown script; 'secrets' values are
+          masked in the logs, 'variables' values are not.
         required: false
     inputs:
       Settings:
         type: string
         description: The complete settings object including test suites.
         required: true
-      TestVariables:
-        type: string
-        description: |
-          Optional JSON object mapping environment variable names to NON-SECRET values, exposed as
-          environment variables (not masked) to the AfterAll teardown script. Built from toJSON(vars.<name>).
-        required: false
-        default: ''
 
 permissions:
   contents: read # to checkout the repo
@@ -37,25 +31,27 @@ jobs:
           persist-credentials: false
           fetch-depth: 0
 
-      - name: Expose caller-provided test secrets and variables
+      - name: Expose caller-provided test data
         shell: pwsh
         env:
-          PSMODULE_TEST_SECRETS: ${{ secrets.TestSecrets }}
-          PSMODULE_TEST_VARIABLES: ${{ inputs.TestVariables }}
+          PSMODULE_TEST_DATA: ${{ secrets.TestData }}
         run: |
-          function Add-EnvFromJson {
+          if ([string]::IsNullOrWhiteSpace($env:PSMODULE_TEST_DATA)) {
+              Write-Host 'No test data was provided by the calling workflow.'
+              return
+          }
+          try {
+              $data = $env:PSMODULE_TEST_DATA | ConvertFrom-Json -ErrorAction Stop
+          } catch {
+              throw "The 'TestData' secret must be a JSON object with 'secrets' and/or 'variables' maps. $_"
+          }
+          function Add-EnvFromMap {
               param(
-                  [string] $Json,
-                  [string] $Source,
+                  [object] $Map,
                   [switch] $Mask
               )
-              if ([string]::IsNullOrWhiteSpace($Json)) { return }
-              try {
-                  $items = $Json | ConvertFrom-Json -ErrorAction Stop
-              } catch {
-                  throw "The '$Source' value must be a JSON object mapping names to values. $_"
-              }
-              foreach ($item in $items.PSObject.Properties) {
+              if (-not $Map) { return }
+              foreach ($item in $Map.PSObject.Properties) {
                   $name = $item.Name
                   $value = [string]$item.Value
                   if ($Mask) {
@@ -74,12 +70,8 @@ jobs:
               }
           }
 
-          Add-EnvFromJson -Json $env:PSMODULE_TEST_SECRETS -Source 'TestSecrets' -Mask
-          Add-EnvFromJson -Json $env:PSMODULE_TEST_VARIABLES -Source 'TestVariables'
-
-          if ([string]::IsNullOrWhiteSpace($env:PSMODULE_TEST_SECRETS) -and [string]::IsNullOrWhiteSpace($env:PSMODULE_TEST_VARIABLES)) {
-              Write-Host 'No test secrets or variables were provided by the calling workflow.'
-          }
+          Add-EnvFromMap -Map $data.secrets -Mask
+          Add-EnvFromMap -Map $data.variables
 
       - name: Run AfterAll Teardown Scripts
         if: always()

.github/workflows/BeforeAll-ModuleLocal.yml

@@ -3,23 +3,17 @@ name: BeforeAll-ModuleLocal
 on:
   workflow_call:
     secrets:
-      TestSecrets:
+      TestData:
         description: |
-          Optional JSON object mapping environment variable names to secret values. Each entry is
-          exposed as an environment variable available to the BeforeAll setup script.
+          Optional single-line JSON object with 'secrets' and 'variables' maps. Each entry is exposed
+          as an environment variable available to the BeforeAll setup script; 'secrets' values are
+          masked in the logs, 'variables' values are not.
         required: false
     inputs:
       Settings:
         type: string
         description: The complete settings object including test suites.
         required: true
-      TestVariables:
-        type: string
-        description: |
-          Optional JSON object mapping environment variable names to NON-SECRET values, exposed as
-          environment variables (not masked) to the BeforeAll setup script. Built from toJSON(vars.<name>).
-        required: false
-        default: ''
 
 permissions:
   contents: read # to checkout the repo
@@ -37,25 +31,27 @@ jobs:
           persist-credentials: false
           fetch-depth: 0
 
-      - name: Expose caller-provided test secrets and variables
+      - name: Expose caller-provided test data
         shell: pwsh
         env:
-          PSMODULE_TEST_SECRETS: ${{ secrets.TestSecrets }}
-          PSMODULE_TEST_VARIABLES: ${{ inputs.TestVariables }}
+          PSMODULE_TEST_DATA: ${{ secrets.TestData }}
         run: |
-          function Add-EnvFromJson {
+          if ([string]::IsNullOrWhiteSpace($env:PSMODULE_TEST_DATA)) {
+              Write-Host 'No test data was provided by the calling workflow.'
+              return
+          }
+          try {
+              $data = $env:PSMODULE_TEST_DATA | ConvertFrom-Json -ErrorAction Stop
+          } catch {
+              throw "The 'TestData' secret must be a JSON object with 'secrets' and/or 'variables' maps. $_"
+          }
+          function Add-EnvFromMap {
               param(
-                  [string] $Json,
-                  [string] $Source,
+                  [object] $Map,
                   [switch] $Mask
               )
-              if ([string]::IsNullOrWhiteSpace($Json)) { return }
-              try {
-                  $items = $Json | ConvertFrom-Json -ErrorAction Stop
-              } catch {
-                  throw "The '$Source' value must be a JSON object mapping names to values. $_"
-              }
-              foreach ($item in $items.PSObject.Properties) {
+              if (-not $Map) { return }
+              foreach ($item in $Map.PSObject.Properties) {
                   $name = $item.Name
                   $value = [string]$item.Value
                   if ($Mask) {
@@ -74,12 +70,8 @@ jobs:
               }
           }
 
-          Add-EnvFromJson -Json $env:PSMODULE_TEST_SECRETS -Source 'TestSecrets' -Mask
-          Add-EnvFromJson -Json $env:PSMODULE_TEST_VARIABLES -Source 'TestVariables'
-
-          if ([string]::IsNullOrWhiteSpace($env:PSMODULE_TEST_SECRETS) -and [string]::IsNullOrWhiteSpace($env:PSMODULE_TEST_VARIABLES)) {
-              Write-Host 'No test secrets or variables were provided by the calling workflow.'
-          }
+          Add-EnvFromMap -Map $data.secrets -Mask
+          Add-EnvFromMap -Map $data.variables
 
       - name: Run BeforeAll Setup Scripts
         uses: PSModule/GitHub-Script@1ee97bbc652d19c38ae12f6e1e47e9d9fbd12d0a # v1.8.0

.github/workflows/Test-ModuleLocal.yml

@@ -3,23 +3,17 @@ name: Test-ModuleLocal
 on:
   workflow_call:
     secrets:
-      TestSecrets:
+      TestData:
         description: |
-          Optional JSON object mapping environment variable names to secret values. Each entry is
-          exposed as an environment variable that the module's Pester tests read via $env:<name>.
+          Optional single-line JSON object with 'secrets' and 'variables' maps. Each entry is exposed
+          as an environment variable the module's Pester tests read via $env:<name>; 'secrets' values
+          are masked in the logs, 'variables' values are not.
         required: false
     inputs:
       Settings:
         type: string
         description: The settings object as a JSON string.
         required: true
-      TestVariables:
-        type: string
-        description: |
-          Optional JSON object mapping environment variable names to NON-SECRET values, exposed as
-          environment variables (not masked). The caller builds it from toJSON(vars.<name>).
-        required: false
-        default: ''
 
 permissions:
   contents: read # to checkout the repo and create releases on the repo
@@ -42,25 +36,27 @@ jobs:
           persist-credentials: false
           fetch-depth: 0
 
-      - name: Expose caller-provided test secrets and variables
+      - name: Expose caller-provided test data
         shell: pwsh
         env:
-          PSMODULE_TEST_SECRETS: ${{ secrets.TestSecrets }}
-          PSMODULE_TEST_VARIABLES: ${{ inputs.TestVariables }}
+          PSMODULE_TEST_DATA: ${{ secrets.TestData }}
         run: |
-          function Add-EnvFromJson {
+          if ([string]::IsNullOrWhiteSpace($env:PSMODULE_TEST_DATA)) {
+              Write-Host 'No test data was provided by the calling workflow.'
+              return
+          }
+          try {
+              $data = $env:PSMODULE_TEST_DATA | ConvertFrom-Json -ErrorAction Stop
+          } catch {
+              throw "The 'TestData' secret must be a JSON object with 'secrets' and/or 'variables' maps. $_"
+          }
+          function Add-EnvFromMap {
               param(
-                  [string] $Json,
-                  [string] $Source,
+                  [object] $Map,
                   [switch] $Mask
               )
-              if ([string]::IsNullOrWhiteSpace($Json)) { return }
-              try {
-                  $items = $Json | ConvertFrom-Json -ErrorAction Stop
-              } catch {
-                  throw "The '$Source' value must be a JSON object mapping names to values. $_"
-              }
-              foreach ($item in $items.PSObject.Properties) {
+              if (-not $Map) { return }
+              foreach ($item in $Map.PSObject.Properties) {
                   $name = $item.Name
                   $value = [string]$item.Value
                   if ($Mask) {
@@ -79,12 +75,8 @@ jobs:
               }
           }
 
-          Add-EnvFromJson -Json $env:PSMODULE_TEST_SECRETS -Source 'TestSecrets' -Mask
-          Add-EnvFromJson -Json $env:PSMODULE_TEST_VARIABLES -Source 'TestVariables'
-
-          if ([string]::IsNullOrWhiteSpace($env:PSMODULE_TEST_SECRETS) -and [string]::IsNullOrWhiteSpace($env:PSMODULE_TEST_VARIABLES)) {
-              Write-Host 'No test secrets or variables were provided by the calling workflow.'
-          }
+          Add-EnvFromMap -Map $data.secrets -Mask
+          Add-EnvFromMap -Map $data.variables
 
       - name: Download module artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1

.github/workflows/Workflow-Test-Default.yml

@@ -28,22 +28,19 @@ jobs:
     uses: ./.github/workflows/workflow.yml
     secrets:
       APIKey: ${{ secrets.APIKey }}
-      # Self-test only: two dedicated, NON-SENSITIVE repository secrets (PSMODULE_TEST_*_SECRET) exist
-      # purely to prove the TestSecrets plumbing end to end - a real GitHub secret is masked, passed
-      # through, and exposed as $env:<name>. Their known values are asserted (value + length) in
+      # Self-test only: a dedicated, NON-SENSITIVE repository secret + variable exist purely to prove
+      # the TestData plumbing end to end - the "secrets" entry is masked and the "variables" entry is
+      # not, and both are exposed as $env:<name>. Their known values are asserted (value + length) in
       # tests/.../Environment.Tests.ps1.
-      # The folded '>-' block keeps the JSON on a SINGLE line so GitHub registers one mask for the
-      # blob; a multi-line blob makes every line (incl. braces) its own mask and over-masks the logs.
-      TestSecrets: >-
-        {
-        "PSMODULE_TEST_SINGLELINE_SECRET": ${{ toJSON(secrets.PSMODULE_TEST_SINGLELINE_SECRET) }},
-        "PSMODULE_TEST_MULTILINE_SECRET": ${{ toJSON(secrets.PSMODULE_TEST_MULTILINE_SECRET) }}
-        }
+      # Secrets use the direct "${{ secrets.X }}" form (CodeQL-clean; avoids toJSON(secrets.*)), which
+      # requires single-line secret values with no embedded quotes or backslashes; variables use
+      # toJSON(vars.X) so any characters are encoded safely. The folded '>-' scalar keeps the whole blob
+      # on ONE line so GitHub registers a single mask instead of one per line.
+      TestData: >-
+        { "secrets": { "PSMODULE_TEST_SINGLELINE_SECRET": "${{ secrets.PSMODULE_TEST_SINGLELINE_SECRET }}" },
+        "variables": { "PSMODULE_TEST_VARIABLE": ${{ toJSON(vars.PSMODULE_TEST_VARIABLE) }} } }
     with:
       WorkingDirectory: tests/srcTestRepo
-      # Non-secret configuration flows via TestVariables (built from repo/org variables, not masked).
-      TestVariables: >-
-        { "PSMODULE_TEST_VARIABLE": ${{ toJSON(vars.PSMODULE_TEST_VARIABLE) }} }
       ImportantFilePatterns: |
         ^src/
         ^README\.md$

.github/workflows/Workflow-Test-WithManifest.yml

@@ -28,22 +28,19 @@ jobs:
     uses: ./.github/workflows/workflow.yml
     secrets:
       APIKey: ${{ secrets.APIKey }}
-      # Self-test only: two dedicated, NON-SENSITIVE repository secrets (PSMODULE_TEST_*_SECRET) exist
-      # purely to prove the TestSecrets plumbing end to end - a real GitHub secret is masked, passed
-      # through, and exposed as $env:<name>. Their known values are asserted (value + length) in
+      # Self-test only: a dedicated, NON-SENSITIVE repository secret + variable exist purely to prove
+      # the TestData plumbing end to end - the "secrets" entry is masked and the "variables" entry is
+      # not, and both are exposed as $env:<name>. Their known values are asserted (value + length) in
       # tests/.../Environment.Tests.ps1.
-      # The folded '>-' block keeps the JSON on a SINGLE line so GitHub registers one mask for the
-      # blob; a multi-line blob makes every line (incl. braces) its own mask and over-masks the logs.
-      TestSecrets: >-
-        {
-        "PSMODULE_TEST_SINGLELINE_SECRET": ${{ toJSON(secrets.PSMODULE_TEST_SINGLELINE_SECRET) }},
-        "PSMODULE_TEST_MULTILINE_SECRET": ${{ toJSON(secrets.PSMODULE_TEST_MULTILINE_SECRET) }}
-        }
+      # Secrets use the direct "${{ secrets.X }}" form (CodeQL-clean; avoids toJSON(secrets.*)), which
+      # requires single-line secret values with no embedded quotes or backslashes; variables use
+      # toJSON(vars.X) so any characters are encoded safely. The folded '>-' scalar keeps the whole blob
+      # on ONE line so GitHub registers a single mask instead of one per line.
+      TestData: >-
+        { "secrets": { "PSMODULE_TEST_SINGLELINE_SECRET": "${{ secrets.PSMODULE_TEST_SINGLELINE_SECRET }}" },
+        "variables": { "PSMODULE_TEST_VARIABLE": ${{ toJSON(vars.PSMODULE_TEST_VARIABLE) }} } }
     with:
       WorkingDirectory: tests/srcWithManifestTestRepo
-      # Non-secret configuration flows via TestVariables (built from repo/org variables, not masked).
-      TestVariables: >-
-        { "PSMODULE_TEST_VARIABLE": ${{ toJSON(vars.PSMODULE_TEST_VARIABLE) }} }
       ImportantFilePatterns: |
         ^src/
         ^README\.md$