Skip to content

feat(scripts): add SecurityHelpers and CIHelpers modules#354

Merged
WilliamBerryiii merged 8 commits intomainfrom
refactor/securityhelpers-module
Jan 30, 2026
Merged

feat(scripts): add SecurityHelpers and CIHelpers modules#354
WilliamBerryiii merged 8 commits intomainfrom
refactor/securityhelpers-module

Conversation

@WilliamBerryiii
Copy link
Copy Markdown
Member

Description

This PR introduces two new PowerShell modules with shared utilities for hve-core scripts:

SecurityHelpers.psm1 - Security utility functions for security scanning scripts:

  • Write-SecurityLog - Timestamped logging with severity levels and optional file output
  • New-SecurityIssue - Structured security issue object creation
  • Write-SecurityReport - Multi-format output (JSON, console, markdown)
  • Test-GitHubToken - GitHub token validation with rate limit info
  • Invoke-GitHubAPIWithRetry - GitHub API calls with exponential backoff retry

CIHelpers.psm1 - CI platform abstraction for GitHub Actions and Azure DevOps:

  • Get-CIPlatform / Test-CIEnvironment - Platform detection
  • Set-CIOutput - Cross-platform output variables
  • Write-CIStepSummary - Step summary output
  • Write-CIAnnotation - Warnings, errors, and notices
  • Set-CITaskResult / Publish-CIArtifact - Task management

Both modules include comprehensive Pester tests with 90%+ coverage.

Related Issue(s)

N/A - Internal refactoring to reduce code duplication in security scripts.

Type of Change

  • Bug fix (non-breaking change that fixes an issue)
  • New feature (non-breaking change that adds functionality)
  • Breaking change (fix or feature that causes existing functionality to change)
  • Documentation (changes to documentation only)
  • GitHub Actions (changes to workflow files)
  • Linting (changes to linting configuration)
  • Security (changes to security configurations)
  • DevContainer (changes to DevContainer configuration)
  • Dependency (dependency updates)
  • AI Artifacts (changes to prompts, instructions, or agents)
  • Script/automation (changes to scripts or tooling)

Testing

  • Pester unit tests added for SecurityHelpers.psm1 (62 tests passing)
  • Pester unit tests added for CIHelpers.psm1 (47 tests passing)
  • PSScriptAnalyzer clean (all 38 files pass)
  • All existing tests continue to pass

Test commands:

# Run SecurityHelpers tests
Invoke-Pester -Path ./scripts/tests/security/SecurityHelpers.Tests.ps1 -Output Detailed

# Run CIHelpers tests
Invoke-Pester -Path ./scripts/tests/lib/CIHelpers.Tests.ps1 -Output Detailed

# Run PSScriptAnalyzer
npm run lint:ps

Checklist

  • My code follows the style guidelines of this project
  • I have performed a self-review of my code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes

Security Considerations

  • No secrets or credentials in code
  • GitHub token handling uses secure patterns (Bearer auth, rate limit awareness)
  • API retry logic prevents token leakage in error messages
  • Module follows PowerShell security best practices

Additional Notes

Files Changed

File Change Description
scripts/security/Modules/SecurityHelpers.psm1 Added Shared security utilities module
scripts/lib/Modules/CIHelpers.psm1 Added CI platform abstraction module
scripts/tests/security/SecurityHelpers.Tests.ps1 Added Unit tests (62 tests)
scripts/tests/lib/CIHelpers.Tests.ps1 Added Unit tests (47 tests)
scripts/tests/Mocks/GitMocks.psm1 Modified Added Azure DevOps env var support

Commits

  1. feat(scripts): add CIHelpers.psm1 module for CI platform abstraction
  2. fix(scripts): address PR review feedback and add copyright headers
  3. feat(security): add SecurityHelpers module with shared utilities

- add Get-CIPlatform and Test-CIEnvironment for platform detection
- add Set-CIOutput and Write-CIStepSummary for output handling
- add Write-CIAnnotation for warnings, errors, and notices
- add Set-CITaskResult and Publish-CIArtifact for task management
- add Pester tests with 95% coverage

🔧 - Generated by Copilot
- Add ADO env vars to Save/Restore-GitHubEnvironment functions
- Change UTF8 to utf8 for encoding consistency
- Add #Requires -Modules Pester directive to test file
- Remove temporal markers from code files
- Add Microsoft copyright headers to CIHelpers module files

🔧 - Generated by Copilot
Copilot AI review requested due to automatic review settings January 30, 2026 03:21
@WilliamBerryiii WilliamBerryiii requested a review from a team as a code owner January 30, 2026 03:21
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Jan 30, 2026

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR introduces two new PowerShell utility modules to reduce code duplication in hve-core scripts:

Purpose: Add shared utility modules for security scanning scripts (SecurityHelpers.psm1) and CI platform abstraction (CIHelpers.psm1), along with comprehensive Pester test suites.

Changes:

  • Added SecurityHelpers.psm1 with logging, issue tracking, reporting, and GitHub API utilities
  • Added CIHelpers.psm1 with cross-platform CI detection and output functions for GitHub Actions and Azure DevOps
  • Added comprehensive test suites with 62 tests for SecurityHelpers and 47 tests for CIHelpers
  • Updated GitMocks.psm1 to support Azure DevOps environment variables for testing

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
scripts/security/Modules/SecurityHelpers.psm1 New module providing security utilities including timestamped logging, structured issue objects, multi-format reporting, GitHub token validation, and API retry logic with exponential backoff
scripts/tests/security/SecurityHelpers.Tests.ps1 Comprehensive test suite with 62 unit tests covering all SecurityHelpers functions with 90%+ coverage including edge cases and error handling
scripts/lib/Modules/CIHelpers.psm1 New module providing CI platform abstraction with functions for platform detection, output variables, step summaries, annotations, task results, and artifact publishing across GitHub Actions, Azure DevOps, and local environments
scripts/tests/lib/CIHelpers.Tests.ps1 Comprehensive test suite with 47 unit tests covering all CIHelpers functions with proper environment mocking and scenario coverage
scripts/tests/Mocks/GitMocks.psm1 Updated existing mock helpers to support Azure DevOps environment variables (TF_BUILD, AZURE_PIPELINES, etc.) and improved documentation to reflect CI platform abstraction

@WilliamBerryiii WilliamBerryiii force-pushed the refactor/securityhelpers-module branch 2 times, most recently from 0cbaf76 to 6988a81 Compare January 30, 2026 04:47
Copilot AI review requested due to automatic review settings January 30, 2026 04:47
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

- add Write-SecurityLog, New-SecurityIssue, Write-SecurityReport functions

- add Test-GitHubToken, Invoke-GitHubAPIWithRetry for GitHub API support

- add comprehensive unit tests with 62 passing tests

🔒 - Generated by Copilot
@WilliamBerryiii WilliamBerryiii force-pushed the refactor/securityhelpers-module branch from 6988a81 to 005d5ed Compare January 30, 2026 04:58
@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Jan 30, 2026

Codecov Report

❌ Patch coverage is 95.63107% with 9 lines in your changes missing coverage. Please review.
✅ Project coverage is 52.46%. Comparing base (23e7a7e) to head (059cad9).

Files with missing lines Patch % Lines
scripts/security/Modules/SecurityHelpers.psm1 95.80% 7 Missing ⚠️
scripts/lib/Modules/CIHelpers.psm1 94.87% 2 Missing ⚠️
Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##             main     #354      +/-   ##
==========================================
+ Coverage   49.51%   52.46%   +2.94%     
==========================================
  Files          16       17       +1     
  Lines        2886     3084     +198     
==========================================
+ Hits         1429     1618     +189     
- Misses       1457     1466       +9     
Flag Coverage Δ
pester 52.46% <95.63%> (+2.94%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines Coverage Δ
scripts/lib/Modules/CIHelpers.psm1 94.39% <94.87%> (-0.35%) ⬇️
scripts/security/Modules/SecurityHelpers.psm1 95.80% <95.80%> (ø)

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

- Add 12 tests for cross-platform status code fallback
- Cover all message-to-code mappings (401, 403, 404, 429, 500-504)
- Verify retry behavior based on extracted status codes
- Test case-insensitive message matching

🧪 - Generated by Copilot
Copilot AI review requested due to automatic review settings January 30, 2026 05:26
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

…ttacks

- Escape :: patterns in GitHub Actions messages to neutralize command sequences
- Escape [ and ] in Azure DevOps messages to prevent ##vso[ command injection
- Preserves single colons for valid paths like C:\

🔒 - Generated by Copilot
…Helpers

- Add tests for GitHub Actions newline/CR/percent escaping in Write-CIAnnotation
- Add tests for Azure DevOps newline/bracket/semicolon escaping
- Add tests for Set-CIOutput injection prevention

🧪 - Generated by Copilot
Copilot AI review requested due to automatic review settings January 30, 2026 06:21
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

…ers-module

# Conflicts:
#	scripts/lib/Modules/CIHelpers.psm1
#	scripts/tests/lib/CIHelpers.Tests.ps1
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

@WilliamBerryiii WilliamBerryiii merged commit b93d990 into main Jan 30, 2026
16 checks passed
@WilliamBerryiii WilliamBerryiii deleted the refactor/securityhelpers-module branch January 30, 2026 23:13
WilliamBerryiii added a commit that referenced this pull request Feb 4, 2026
🤖 I have created a release *beep* *boop*
---


##
[2.1.0](hve-core-v2.0.1...hve-core-v2.1.0)
(2026-02-04)


### ✨ Features

* add PowerShell script to validate copyright headers
([#370](#370))
([92fce72](92fce72))
* **docs:** Replace deprecated chat.modeFilesLocations with
chat.agentFilesLocations
([#413](#413))
([67fb2ab](67fb2ab))
* **scripts:** add CIHelpers module for CI platform abstraction
([#348](#348))
([23e7a7e](23e7a7e))
* **scripts:** add SecurityHelpers and CIHelpers modules
([#354](#354))
([b93d990](b93d990))
* **workflow:** add copilot-setup-steps.yml for Coding Agent environment
([#398](#398))
([085a38b](085a38b))


### 🐛 Bug Fixes

* **build:** increase release-please search depths to prevent 250-commit
window issue ([#342](#342))
([4bb857d](4bb857d))
* **build:** patch @isaacs/brace-expansion critical vulnerability
([#404](#404))
([292ef51](292ef51))
* **ci:** disable errexit during spell check exit code capture
([#356](#356))
([ed6ed46](ed6ed46))
* **ci:** exclude extension/README.md from frontmatter validation
([#362](#362))
([e0d7378](e0d7378))
* exclude test fixtures from markdown link checker
([#345](#345))
([58147f9](58147f9))
* **extension:** resolve path resolution issues in Windows/WSL
environments ([#407](#407))
([8529725](8529725))
* **linting:** use Write-Error instead of Write-Host for error output
([#377](#377))
([2ca766b](2ca766b))
* **scripts:** apply CI output escaping to infrastructure scripts
([#369](#369))
([251021e](251021e))
* **scripts:** apply CI output escaping to linting scripts
([#367](#367))
([fdd75ed](fdd75ed))
* **scripts:** apply CI output escaping to security scripts
([#368](#368))
([1237c9a](1237c9a))
* **scripts:** ensure reliable array count operations in linting and
security scripts
([#395](#395))
([de43e73](de43e73))
* **scripts:** standardize PowerShell requirements header block
([#385](#385))
([6e26282](6e26282))


### 📚 Documentation

* add doc-ops agent to CUSTOM-AGENTS reference
([#358](#358))
([15f7185](15f7185))
* add memory agent to CUSTOM-AGENTS.md
([#359](#359))
([d92c4e1](d92c4e1))
* add missing agents to extension README
([#357](#357))
([d58541c](d58541c))
* add task-reviewer agent to CUSTOM-AGENTS.md
([#363](#363))
([0efb722](0efb722))
* **contributing:** add copyright header guidelines
([#382](#382))
([881a567](881a567))
* **scripts:** update README.md with missing directory sections
([#355](#355))
([ac2966f](ac2966f))


### ♻️ Refactoring

* **scripts:** align linting and tests with CIHelpers
([#401](#401))
([3587e6a](3587e6a))
* **scripts:** extract Invoke-PackageExtension for testability
([#343](#343))
([858a1be](858a1be))
* **scripts:** extract orchestration function for Prepare-Extension
testability ([#344](#344))
([9fd4bd1](9fd4bd1))
* **scripts:** replace raw GITHUB_OUTPUT with Set-CIOutput in
Package-Extension
([#391](#391))
([74a30bb](74a30bb))
* **security:** move DependencyViolation and ComplianceReport to shared
module ([#378](#378))
([1dd31ad](1dd31ad))


### 🔧 Maintenance

* add copyright headers to PowerShell scripts
([#381](#381))
([d19c9b3](d19c9b3))
* add copyright headers to shell scripts
([#380](#380))
([284b456](284b456))
* **deps-dev:** bump cspell from 9.6.1 to 9.6.2 in the npm-dependencies
group ([#387](#387))
([23c2b9f](23c2b9f))
* **workflows:** simplify Copilot setup steps workflow triggers
([#414](#414))
([492a7b1](492a7b1))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

---------

Co-authored-by: hve-core-release-please[bot] <254602402+hve-core-release-please[bot]@users.noreply.github.com>
Co-authored-by: Bill Berry <wberry@microsoft.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants