feat(build): add code coverage reporting to Pester workflow by WilliamBerryiii · Pull Request #230 · microsoft/hve-core

WilliamBerryiii · 2026-01-21T20:58:23Z

Description

Add code coverage reporting to the Pester test workflow with Codecov integration. The implementation enables optional coverage collection during PR validation, uploads results to Codecov using OIDC authentication, and provides an informational threshold check with an 18% baseline.

Add code-coverage input parameter to pester-tests.yml reusable workflow
Enable OIDC authentication via conditional id-token: write permission for Codecov v5.5.2
Upload coverage artifacts and integrate with Codecov using SHA-pinned action (0561704f0f02c16a585d4c7555e57fa2e44cf909)
Add informational coverage threshold check that reports but does not block CI
Fix coverage path resolution in pester.config.ps1 using explicit Get-ChildItem instead of glob patterns
Apply duck typing fix in Test-DependencyPinning.ps1 to resolve PowerShell class type collision during coverage instrumentation

Related Issue(s)

Fixes #201

Type of Change

Select all that apply:

Code & Documentation:

Bug fix (non-breaking change fixing an issue)
New feature (non-breaking change adding functionality)
Breaking change (fix or feature causing existing functionality to change)
Documentation update

Infrastructure & Configuration:

AI Artifacts:

Reviewed contribution with prompt-builder agent and addressed all feedback
Copilot instructions (.github/instructions/*.instructions.md)
Copilot prompt (.github/prompts/*.prompt.md)
Copilot agent (.github/agents/*.agent.md)

Note for AI Artifact Contributors:

Agents: Research, indexing/referencing other project (using standard VS Code GitHub Copilot/MCP tools), planning, and general implementation agents likely already exist. Review .github/agents/ before creating new ones.

Model Versions: Only contributions targeting the latest Anthropic and OpenAI models will be accepted. Older model versions (e.g., GPT-3.5, Claude 3) will be rejected.

See Agents Not Accepted and Model Version Requirements.

Other:

Script/automation (.ps1, .sh, .py)
Other (please describe):

Testing

Ran full Pester test suite locally with code coverage enabled: 253 tests passed
Verified coverage report generation at logs/coverage.xml in JaCoCo format
Confirmed duck typing fix resolves class type collision with Pester coverage instrumentation
Validated coverage path resolution correctly discovers all target scripts

Checklist

Required Checks

Documentation is updated (if applicable)
Files follow existing naming conventions
Changes are backwards compatible (if applicable)

Required Automated Checks

The following validation commands must pass before merging:

Markdown linting: npm run lint:md
Spell checking: npm run spell-check
Frontmatter validation: npm run lint:frontmatter
Link validation: npm run lint:md-links
PowerShell analysis: npm run lint:ps

Security Considerations

This PR does not contain any sensitive or NDA information
Any new dependencies have been reviewed for security issues
Security-related scripts follow the principle of least privilege

Additional Notes

The coverage threshold is set to 18% as an informational baseline; the check reports results but never blocks CI
Codecov integration uses OIDC authentication (tokenless) per v5.5.2 best practices
The duck typing fix in Export-ComplianceReport avoids Pester's coverage instrumentation redefining PowerShell classes, which caused type identity conflicts

📊 - Generated by Copilot

- add code-coverage input and Codecov upload to pester-tests.yml - enable OIDC auth with id-token permission for Codecov v5.5.2 - fix coverage path resolution in pester.config.ps1 - apply duck typing fix for PowerShell class type collision 📊 - Generated by Copilot

github-actions · 2026-01-21T20:59:03Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package

Version

Score

Details

actions/codecov/codecov-action

0561704f0f02c16a585d4c7555e57fa2e44cf909

🟢 7

Details

Check	Score	Reason
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	🟢 10	all changesets reviewed
Maintained	⚠️ 2	3 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2
Pinned-Dependencies	⚠️ 2	dependency not pinned by hash detected -- score normalized to 2
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Signed-Releases	⚠️ -1	no releases found
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
SAST	🟢 9	SAST tool detected but not run on all commits
CI-Tests	🟢 9	29 out of 30 merged PRs checked by a CI test -- score normalized to 9
Contributors	🟢 10	project has 13 contributing companies or organizations

Scanned Files

.github/workflows/pester-tests.yml

Copilot

Pull request overview

This PR adds comprehensive code coverage reporting to the Pester test workflow using Codecov integration. The implementation introduces a configurable code-coverage input parameter, enables OIDC authentication for secure upload, and provides informational threshold checking. Key changes include fixing coverage path resolution in the Pester configuration and applying a duck typing workaround to resolve PowerShell class instrumentation conflicts.

Changes:

Add code coverage collection with Codecov OIDC integration to Pester workflow
Fix coverage path resolution using explicit Get-ChildItem instead of glob patterns
Apply duck typing fix to prevent class type collision during Pester instrumentation

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

File	Description
.github/workflows/pester-tests.yml	Adds code-coverage input, OIDC permissions, Codecov upload step, and threshold check logic
.github/workflows/pr-validation.yml	Enables code coverage and id-token permission for PR validation, runs all tests instead of changed-files-only
scripts/tests/pester.config.ps1	Replaces glob patterns with Get-ChildItem for explicit coverage path resolution
scripts/security/Test-DependencyPinning.ps1	Removes ComplianceReport type annotation to avoid Pester coverage instrumentation issues

scripts/tests/pester.config.ps1

.github/workflows/pester-tests.yml

scripts/tests/pester.config.ps1

- remove invalid inputs context from workflow-level permissions - add id-token: write to job-level permissions for OIDC - simplify coverage threshold check to use Pester output - add -File parameter to Get-ChildItem in pester.config.ps1 🐛 - Generated by Copilot

codecov-commenter · 2026-01-21T21:24:16Z

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

Thanks for integrating Codecov - We've got you covered ☂️

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

.github/workflows/pester-tests.yml

.github/workflows/pr-validation.yml

scripts/security/Test-DependencyPinning.ps1

.github/workflows/pester-tests.yml

- improve id-token permission comment to reference enable-code-coverage input - add null guard to coverage threshold check preventing cast errors - add property validation to Export-ComplianceReport duck-typed parameter - add actionlint 1.7.10 to tool-checksums.json - update gitleaks from 8.18.2 to 8.30.0 🔧 - Generated by Copilot

🔧 - Generated by Copilot

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Copilot · 2026-01-22T20:09:53Z

scripts/security/Test-DependencyPinning.ps1

+    # Validate required properties on duck-typed $Report parameter (ComplianceReport schema)
+    $requiredProperties = @('ComplianceScore', 'Violations', 'TotalDependencies', 'UnpinnedDependencies', 'Metadata')
+    foreach ($prop in $requiredProperties) {
+        if ($null -eq $Report.PSObject.Properties[$prop]) {
+            throw "Report object missing required property: $prop"
+        }
+    }


The new duck-typed $Report validation only checks a subset of properties, but the function later uses additional fields (e.g., Timestamp, ScanPath, ScannedFiles, PinnedDependencies, Summary). As written, an invalid report object can pass validation and then fail later with less clear errors. Expand the required property list (or validate per $Format) to cover all properties the function accesses.

🤖 I have created a release *beep* *boop* --- ## [2.0.0](hve-core-v1.1.0...hve-core-v2.0.0) (2026-01-28) ### ⚠ BREAKING CHANGES * **agents:** add Task Reviewer and expand RPI to 4-phase workflow ([#277](#277)) ### ✨ Features * **agents:** add hve-core-installer agent to extension package ([#297](#297)) ([c0e48c6](c0e48c6)) * **agents:** add Task Reviewer and expand RPI to 4-phase workflow ([#277](#277)) ([ae76cab](ae76cab)) * **build:** add code coverage reporting to Pester workflow ([#230](#230)) ([a34822a](a34822a)) * **docs:** add GOVERNANCE.md for OSSF Silver Badge compliance ([#235](#235)) ([b0e752c](b0e752c)) * **docs:** add ROADMAP.md for OSSF Silver badge compliance ([#238](#238)) ([4a41c16](4a41c16)) * **mcp:** add MCP server configuration guidance and installer enhancements ([#225](#225)) ([0bce418](0bce418)) * **scripts:** add YAML linting with actionlint ([#234](#234)) ([d9301f9](d9301f9)) * **security:** add OpenSSF Scorecard workflow and badge ([#271](#271)) ([7c6d788](7c6d788)) * **skills:** add video-to-gif conversion skill with FFmpeg two-pass optimization ([#247](#247)) ([8d65c42](8d65c42)) * **tests:** add Pester tests for LintingHelpers and Validate-MarkdownFrontmatter ([#197](#197), [#198](#198)) ([#205](#205)) ([51ae563](51ae563)) ### 🐛 Bug Fixes * **build:** detect table formatting changes via git diff ([#261](#261)) ([985eee0](985eee0)) * **build:** disable MD024 lint rule in CHANGELOG for release-please ([#220](#220)) ([971df94](971df94)) * **build:** quote shell variables and group redirects in workflow files ([#299](#299)) ([3372509](3372509)) * **build:** resolve scorecard badge and workflow security issues ([#301](#301)) ([aeaed13](aeaed13)) * **extension:** remove frontmatter from README and exclude from markdown linting ([#223](#223)) ([4272529](4272529)) * **instructions:** quote applyTo glob pattern for YAML compatibility ([#216](#216)) ([085199c](085199c)) * **scripts:** add FooterExcludePaths parameter to frontmatter validation ([#334](#334)) ([64db98d](64db98d)) * **scripts:** add GHSA word and logs/ exclusion to cspell config ([#214](#214)) ([5c99b3f](5c99b3f)) * **scripts:** correct type assertions in Invoke-YamlLint.Tests.ps1 ([#332](#332)) ([af7050d](af7050d)) * **scripts:** eliminate false positives in dependency pinning npm pattern ([#273](#273)) ([ccbdfa3](ccbdfa3)) * **security:** add artifact attestation for signed releases ([#257](#257)) ([c52d6e2](c52d6e2)) * standardize markdown footers and complete frontmatter ([#217](#217)) ([b4e7556](b4e7556)) ### 📚 Documentation * add OpenSSF Best Practices Passing badge to README ([#239](#239)) ([91bc529](91bc529)) * **architecture:** add architecture documentation and value proposition ([#252](#252)) ([0e4b02f](0e4b02f)) * **contributing:** add testing requirements for OSSF compliance ([#254](#254)) ([4db1a18](4db1a18)) * **docs:** add enterprise status badges to README header ([#270](#270)) ([ccb68a4](ccb68a4)) * **security:** add security assurance case and threat model for OSSF Silver ([#259](#259)) ([a390e26](a390e26)) ### ♻️ Refactoring * **application:** wrap execution with try blocks, ensure proper … ([#296](#296)) ([35c4417](35c4417)) * **scripts:** extract frontmatter validation to testable module ([#293](#293)) ([4e8707e](4e8707e)) * **scripts:** extract pure functions for Pester testability ([#221](#221)) ([d40e742](d40e742)) ### 🔧 Maintenance * **deps-dev:** bump cspell from 9.4.0 to 9.6.0 in the npm-dependencies group ([#208](#208)) ([855914b](855914b)) * **deps-dev:** bump cspell from 9.6.0 to 9.6.1 in the npm-dependencies group ([#294](#294)) ([1e45ad6](1e45ad6)) * **deps:** bump actions/setup-node from 6.1.0 to 6.2.0 in the github-actions group ([#209](#209)) ([c4c69e2](c4c69e2)) * **deps:** bump the github-actions group with 4 updates ([#295](#295)) ([d8337b8](d8337b8)) * remove step-security/harden-runner from workflows ([#246](#246)) ([c5708d8](c5708d8)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: hve-core-release-please[bot] <254602402+hve-core-release-please[bot]@users.noreply.github.com>

Copilot AI review requested due to automatic review settings January 21, 2026 20:58

WilliamBerryiii requested a review from a team as a code owner January 21, 2026 20:58

Copilot started reviewing on behalf of WilliamBerryiii January 21, 2026 20:59 View session

Copilot AI reviewed Jan 21, 2026

View reviewed changes

WilliamBerryiii mentioned this pull request Jan 21, 2026

[Issue]: Add unit tests for linting scripts to improve code coverage #231

Closed

5 tasks

WilliamBerryiii requested review from agreaves-ms, auyidi1, katriendg and kgmwang1 January 21, 2026 21:29

katriendg approved these changes Jan 22, 2026

View reviewed changes

Merge branch 'main' into feat/add-pester-code-coverage

4ebe32b

Copilot AI review requested due to automatic review settings January 22, 2026 18:43

Copilot started reviewing on behalf of WilliamBerryiii January 22, 2026 18:43 View session

Copilot AI reviewed Jan 22, 2026

View reviewed changes

.github/workflows/pester-tests.yml Outdated Show resolved Hide resolved

.github/workflows/pr-validation.yml Show resolved Hide resolved

scripts/security/Test-DependencyPinning.ps1 Show resolved Hide resolved

.github/workflows/pester-tests.yml Show resolved Hide resolved

WilliamBerryiii added 2 commits January 22, 2026 11:58

fix(build): correct property validation for ComplianceReport schema

b11d0fb

🔧 - Generated by Copilot

Copilot AI review requested due to automatic review settings January 22, 2026 20:04

Copilot started reviewing on behalf of WilliamBerryiii January 22, 2026 20:04 View session

WilliamBerryiii merged commit a34822a into main Jan 22, 2026
20 checks passed

WilliamBerryiii deleted the feat/add-pester-code-coverage branch January 22, 2026 20:06

hve-core-release-please bot mentioned this pull request Jan 22, 2026

chore(main): release hve-core 2.0.0 #212

Merged

Copilot AI reviewed Jan 22, 2026

View reviewed changes

This was referenced Jan 28, 2026

chore(main): release hve-core 3.0.0 #341

Closed

chore(main): release hve-core 3.0.0 #417

Closed

hve-core-release-please bot mentioned this pull request Feb 6, 2026

chore(main): release hve-core 3.0.0 #441

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(build): add code coverage reporting to Pester workflow#230

feat(build): add code coverage reporting to Pester workflow#230
WilliamBerryiii merged 5 commits intomainfrom
feat/add-pester-code-coverage

WilliamBerryiii commented Jan 21, 2026

Uh oh!

github-actions bot commented Jan 21, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov-commenter commented Jan 21, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jan 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

WilliamBerryiii commented Jan 21, 2026

Description

Related Issue(s)

Type of Change

Testing

Checklist

Required Checks

Required Automated Checks

Security Considerations

Additional Notes

Uh oh!

github-actions bot commented Jan 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov-commenter commented Jan 21, 2026

Welcome to Codecov 🎉

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions bot commented Jan 21, 2026 •

edited

Loading