[StepSecurity] Apply security best practices

.github/workflows/Build Module.yml

@@ -19,17 +19,27 @@ on:
 
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   test:
+    permissions:
+      contents: write  # for stefanzweifel/git-auto-commit-action to push code in repo
     name: 🧪 Run Tests
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
 
     steps:
 
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+      with:
+        egress-policy: audit
+
     - name: ✅ Checkout Repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
     # Uncomment below to explore what modules/variables/env variables are available in the build image
     - name: 📦 Modules and Variables Display
@@ -45,21 +55,21 @@ jobs:
       run: Invoke-Build -File .\src\TheCleaners.build.ps1
 
     - name: 🧪 Upload Pester Results
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: pester-results
         path: .\src\Artifacts\testOutput
         if-no-files-found: warn
 
     - name: 📦 Upload Build
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: zip-archive
         path: .\src\Archive
         if-no-files-found: warn
         # git-auto-commit-action only runs on Linux-based platforms.
 
     - name: 💾 Commit Changes
-      uses: stefanzweifel/git-auto-commit-action@v5
+      uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5.2.0
       with:
         commit_message: 'Commit Build'

.github/workflows/Deploy MkDocs.yml

@@ -14,6 +14,9 @@ on:
   # Allow manual triggering of the workflow.
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
 
   build:
@@ -27,11 +30,16 @@ jobs:
       cancel-in-progress: true
 
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        with:
+          egress-policy: audit
+
       - name: ✅ Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
       - name: 🐍 Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.x'  # specify the Python version
 

.github/workflows/Publish.yml

@@ -1,12 +1,20 @@
 name: Publish to PowerShell Gallery
 on:
   workflow_dispatch:
+permissions:
+  contents: read
+
 jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+      with:
+        egress-policy: audit
+
     - name: Clone Project Files
-      uses: actions/checkout@v4
+      uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
     - name: Publish PowerShell Module
       shell: pwsh
       run: |

src/Artifacts/Invoke-TheCleaners.ps1

@@ -4,17 +4,50 @@
 .GUID bec6a004-45da-4062-ab78-b8eae99f29be
 .AUTHOR Sam Erde
 .COPYRIGHT (c) 2025 Sam Erde. All rights reserved.
-.TAGS Update PowerShell Windows
+.TAGS PowerShell Windows Utility
 .LICENSEURI https://github.com/SamErde/TheCleaners/blob/main/LICENSE
 .PROJECTURI https://github.com/SamErde/TheCleaners/
 #>
+
 function Invoke-TheCleaners {
+    <#
+    .SYNOPSIS
+    Show a welcome message when the module is imported explicitly by the user.
+
+    .DESCRIPTION
+    This function shows a welcome message to help the user get started when they explicitly import the module. If the
+    module is automatically imported by invoking one of its exported functions, we assume the user already knows the
+    command that they want to run and do not show the welcome message.
+
+    .PARAMETER InvokingCommand
+    A parameter to receive the command line that called this function. This is used to determine if the module was
+    imported explicitly by the user or automatically by invoking one of its exported functions. This information must
+    come from outside the function in order to be able to determine what command invoked the script itself.
+
+    .EXAMPLE
+    Invoke-TheCleaners -InvokingCommand "$( ((Get-PSCallStack)[1]).InvocationInfo.MyCommand )"
+
+    .NOTES
+    Author: Sam Erde
+    Company: Sentinel Technologies, Inc
+    Date: 2025-03-11
+    Version: 1.0.0
+    #>
     [CmdletBinding()]
     [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingWriteHost', '')]
-    param()
-    Write-Host "Thank you for calling The Cleaners! 🧹`nRun " -ForegroundColor Green -NoNewline
-    Write-Host 'Start-Cleaning' -BackgroundColor Black -ForegroundColor White -NoNewline
-    Write-Host " to see the services we offer today.`n" -ForegroundColor Green
+    param (
+        # The command that called this function.
+        [Parameter(Mandatory)]
+        [string]
+        $InvokingCommand
+    )
+
+    if ($InvokingCommand -match 'ipmo|Import-Module') {
+        Write-Host "Thank you for calling The Cleaners! 🧹`nRun " -ForegroundColor Green -NoNewline
+        Write-Host 'Start-Cleaning' -BackgroundColor Black -ForegroundColor White -NoNewline
+        Write-Host " to see the services we offer today.`n" -ForegroundColor Green
+    }
+
 }
 
-Invoke-TheCleaners
+Invoke-TheCleaners -InvokingCommand "$( ((Get-PSCallStack)[1]).InvocationInfo.MyCommand )"