refactor(scripts): replace raw GITHUB_OUTPUT with Set-CIOutput in Package-Extension by WilliamBerryiii · Pull Request #391 · microsoft/hve-core

WilliamBerryiii · 2026-02-02T23:53:37Z

Pull Request

Description

Refactors Package-Extension.ps1 to use the existing CIHelpers module instead of raw GITHUB_OUTPUT file writes. This change:

Replaces 4-line conditional block with 3 Set-CIOutput calls
Provides consistent CI output handling across GitHub Actions and Azure DevOps
Adds automatic escaping for special characters via CIHelpers module
Removes platform-specific conditional logic from the script

The CIHelpers.psm1 module handles injection prevention by escaping %, \r, \n, ::, [, ], and ; characters in output values.

Related Issue(s)

Fixes #350

Type of Change

Select all that apply:

Code & Documentation:

Bug fix (non-breaking change fixing an issue)
New feature (non-breaking change adding functionality)
Breaking change (fix or feature causing existing functionality to change)
Documentation update

Infrastructure & Configuration:

AI Artifacts:

Reviewed contribution with prompt-builder agent and addressed all feedback
Copilot instructions (.github/instructions/*.instructions.md)
Copilot prompt (.github/prompts/*.prompt.md)
Copilot agent (.github/agents/*.agent.md)

Other:

Script/automation (.ps1, .sh, .py)
Other (please describe):

Testing

PSScriptAnalyzer: 38 files analyzed, all passed
Pester Tests: 42 tests passed (includes CIHelpers.Tests.ps1 injection prevention tests)
Manual Verification: Confirmed Set-CIOutput correctly outputs values for version, vsix-file, and pre-release

Checklist

Required Checks

Documentation is updated (if applicable)
Files follow existing naming conventions
Changes are backwards compatible (if applicable)
Tests added for new functionality (if applicable)

Required Automated Checks

The following validation commands must pass before merging:

Markdown linting: npm run lint:md
Spell checking: npm run spell-check
Frontmatter validation: npm run lint:frontmatter
Link validation: npm run lint:md-links
PowerShell analysis: npm run lint:ps

Security Considerations

This PR does not contain any sensitive or NDA information
Any new dependencies have been reviewed for security issues
Security-related scripts follow the principle of least privilege

Security Analysis:

The refactoring improves security by leveraging CIHelpers module's built-in escaping functions:

ConvertTo-GitHubActionsEscaped: Escapes %, \r, \n, :: to prevent workflow command injection
ConvertTo-AzureDevOpsEscaped: Escapes %, \r, \n, [, ], ; to prevent logging command injection

Test coverage for injection prevention exists in CIHelpers.Tests.ps1 (lines 192-209 for Azure DevOps, lines 340-400 for GitHub Actions).

Additional Notes

The $PreRelease.IsPresent boolean auto-converts to "True"/"False" string, matching original behavior
The CIHelpers module was already imported at line 73 of Package-Extension.ps1
Set-CIOutput is a no-op when not running in CI environments (both $env:GITHUB_OUTPUT and $env:TF_BUILD are absent)

github-actions · 2026-02-02T23:54:12Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

codecov-commenter · 2026-02-02T23:55:37Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 61.28%. Comparing base (085a38b) to head (fcb8240).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #391      +/-   ##
==========================================
- Coverage   61.49%   61.28%   -0.21%     
==========================================
  Files          17       17              
  Lines        3111     3110       -1     
==========================================
- Hits         1913     1906       -7     
- Misses       1198     1204       +6

Flag	Coverage Δ
pester	`61.28% <100.00%> (-0.21%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
scripts/extension/Package-Extension.ps1	`91.62% <100.00%> (+7.24%)`	⬆️

... and 2 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copilot

Pull request overview

This PR refactors Package-Extension.ps1 to replace inline GitHub Actions output file writes with the shared CIHelpers module's Set-CIOutput function, improving consistency and security through automatic escaping of special characters.

Changes:

Replaced conditional $env:GITHUB_OUTPUT file writes with three Set-CIOutput calls
Removed platform-specific conditional logic in favor of module-based abstraction
Leveraged existing CIHelpers module security features for injection prevention

scripts/extension/Package-Extension.ps1

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

scripts/tests/extension/Package-Extension.Tests.ps1

- add GitHub Actions environment context tests for Set-CIOutput validation - add tests for version, vsix-file, and pre-release output variables - add error handling test for vsce command failure - add local environment context test - refactor Local Context to use Clear-MockGitHubEnvironment for consistency 🧪 - Generated by Copilot

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

🤖 I have created a release *beep* *boop* --- ## [2.1.0](hve-core-v2.0.1...hve-core-v2.1.0) (2026-02-04) ### ✨ Features * add PowerShell script to validate copyright headers ([#370](#370)) ([92fce72](92fce72)) * **docs:** Replace deprecated chat.modeFilesLocations with chat.agentFilesLocations ([#413](#413)) ([67fb2ab](67fb2ab)) * **scripts:** add CIHelpers module for CI platform abstraction ([#348](#348)) ([23e7a7e](23e7a7e)) * **scripts:** add SecurityHelpers and CIHelpers modules ([#354](#354)) ([b93d990](b93d990)) * **workflow:** add copilot-setup-steps.yml for Coding Agent environment ([#398](#398)) ([085a38b](085a38b)) ### 🐛 Bug Fixes * **build:** increase release-please search depths to prevent 250-commit window issue ([#342](#342)) ([4bb857d](4bb857d)) * **build:** patch @isaacs/brace-expansion critical vulnerability ([#404](#404)) ([292ef51](292ef51)) * **ci:** disable errexit during spell check exit code capture ([#356](#356)) ([ed6ed46](ed6ed46)) * **ci:** exclude extension/README.md from frontmatter validation ([#362](#362)) ([e0d7378](e0d7378)) * exclude test fixtures from markdown link checker ([#345](#345)) ([58147f9](58147f9)) * **extension:** resolve path resolution issues in Windows/WSL environments ([#407](#407)) ([8529725](8529725)) * **linting:** use Write-Error instead of Write-Host for error output ([#377](#377)) ([2ca766b](2ca766b)) * **scripts:** apply CI output escaping to infrastructure scripts ([#369](#369)) ([251021e](251021e)) * **scripts:** apply CI output escaping to linting scripts ([#367](#367)) ([fdd75ed](fdd75ed)) * **scripts:** apply CI output escaping to security scripts ([#368](#368)) ([1237c9a](1237c9a)) * **scripts:** ensure reliable array count operations in linting and security scripts ([#395](#395)) ([de43e73](de43e73)) * **scripts:** standardize PowerShell requirements header block ([#385](#385)) ([6e26282](6e26282)) ### 📚 Documentation * add doc-ops agent to CUSTOM-AGENTS reference ([#358](#358)) ([15f7185](15f7185)) * add memory agent to CUSTOM-AGENTS.md ([#359](#359)) ([d92c4e1](d92c4e1)) * add missing agents to extension README ([#357](#357)) ([d58541c](d58541c)) * add task-reviewer agent to CUSTOM-AGENTS.md ([#363](#363)) ([0efb722](0efb722)) * **contributing:** add copyright header guidelines ([#382](#382)) ([881a567](881a567)) * **scripts:** update README.md with missing directory sections ([#355](#355)) ([ac2966f](ac2966f)) ### ♻️ Refactoring * **scripts:** align linting and tests with CIHelpers ([#401](#401)) ([3587e6a](3587e6a)) * **scripts:** extract Invoke-PackageExtension for testability ([#343](#343)) ([858a1be](858a1be)) * **scripts:** extract orchestration function for Prepare-Extension testability ([#344](#344)) ([9fd4bd1](9fd4bd1)) * **scripts:** replace raw GITHUB_OUTPUT with Set-CIOutput in Package-Extension ([#391](#391)) ([74a30bb](74a30bb)) * **security:** move DependencyViolation and ComplianceReport to shared module ([#378](#378)) ([1dd31ad](1dd31ad)) ### 🔧 Maintenance * add copyright headers to PowerShell scripts ([#381](#381)) ([d19c9b3](d19c9b3)) * add copyright headers to shell scripts ([#380](#380)) ([284b456](284b456)) * **deps-dev:** bump cspell from 9.6.1 to 9.6.2 in the npm-dependencies group ([#387](#387)) ([23c2b9f](23c2b9f)) * **workflows:** simplify Copilot setup steps workflow triggers ([#414](#414)) ([492a7b1](492a7b1)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: hve-core-release-please[bot] <254602402+hve-core-release-please[bot]@users.noreply.github.com> Co-authored-by: Bill Berry <wberry@microsoft.com>

WilliamBerryiii requested a review from a team as a code owner February 2, 2026 23:53

Copilot AI review requested due to automatic review settings February 2, 2026 23:53

Copilot started reviewing on behalf of WilliamBerryiii February 2, 2026 23:54 View session

Copilot AI reviewed Feb 2, 2026

View reviewed changes

scripts/extension/Package-Extension.ps1 Show resolved Hide resolved

WilliamBerryiii force-pushed the refactor/issue-350-cihelpers-extension-scripts branch from a5c42f9 to a413f57 Compare February 3, 2026 01:34

WilliamBerryiii requested a review from Copilot February 3, 2026 01:39

Copilot started reviewing on behalf of WilliamBerryiii February 3, 2026 01:39 View session

Copilot AI reviewed Feb 3, 2026

View reviewed changes

scripts/tests/extension/Package-Extension.Tests.ps1 Outdated Show resolved Hide resolved

WilliamBerryiii force-pushed the refactor/issue-350-cihelpers-extension-scripts branch from a413f57 to 435791a Compare February 3, 2026 02:01

katriendg approved these changes Feb 3, 2026

View reviewed changes

Merge branch 'main' into refactor/issue-350-cihelpers-extension-scripts

fcb8240

Copilot AI review requested due to automatic review settings February 3, 2026 18:58

Copilot started reviewing on behalf of WilliamBerryiii February 3, 2026 18:59 View session

WilliamBerryiii merged commit 74a30bb into main Feb 3, 2026
21 checks passed

WilliamBerryiii deleted the refactor/issue-350-cihelpers-extension-scripts branch February 3, 2026 19:02

Copilot AI reviewed Feb 3, 2026

View reviewed changes

hve-core-release-please bot mentioned this pull request Feb 3, 2026

chore(main): release hve-core 2.1.0 #347

Merged

This was referenced Feb 4, 2026

chore(main): release hve-core 3.0.0 #417

Closed

chore(main): release hve-core 3.0.0 #441

Closed

This was referenced Feb 14, 2026

chore(main): release hve-core 3.0.0 #556

Closed

chore(main): release hve-core 3.0.0 #558

Closed

chore(main): release hve-core 3.0.0 #641

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

refactor(scripts): replace raw GITHUB_OUTPUT with Set-CIOutput in Package-Extension#391

refactor(scripts): replace raw GITHUB_OUTPUT with Set-CIOutput in Package-Extension#391
WilliamBerryiii merged 2 commits intomainfrom
refactor/issue-350-cihelpers-extension-scripts

WilliamBerryiii commented Feb 2, 2026

Uh oh!

github-actions bot commented Feb 2, 2026 •

edited

Loading

Uh oh!

codecov-commenter commented Feb 2, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

WilliamBerryiii commented Feb 2, 2026

Pull Request

Description

Related Issue(s)

Type of Change

Testing

Checklist

Required Checks

Required Automated Checks

Security Considerations

Additional Notes

Uh oh!

github-actions bot commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

Scanned Files

Uh oh!

codecov-commenter commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions bot commented Feb 2, 2026 •

edited

Loading

codecov-commenter commented Feb 2, 2026 •

edited

Loading