Skip to content

refactor(scripts): use shared SecurityHelpers and CIHelpers modules in security scripts#705

Merged
WilliamBerryiii merged 7 commits intomainfrom
refactor/security-shared-modules
Feb 20, 2026
Merged

refactor(scripts): use shared SecurityHelpers and CIHelpers modules in security scripts#705
WilliamBerryiii merged 7 commits intomainfrom
refactor/security-shared-modules

Conversation

@WilliamBerryiii
Copy link
Copy Markdown
Member

Description

Refactored security scripts to consume shared SecurityHelpers and CIHelpers modules, eliminating duplicated helper functions across Update-ActionSHAPinning.ps1 and Test-SHAStaleness.ps1. Stabilized YAML display key ordering in hve-core-all collection output. Removed the dt-method-09-deep Design Thinking instruction file and updated the github-backlog-manager agent tools declaration format.

  • refactor(scripts): replaced local Write-SecurityLog, Add-SecurityIssue, and Write-OutputResult in Update-ActionSHAPinning.ps1 with shared module imports from SecurityHelpers.psm1 and CIHelpers.psm1, renamed output function to Write-SecurityOutput, and switched $script:SecurityIssues from array to List[PSCustomObject] with New-SecurityIssue
  • refactor(scripts): converted $script:StaleDependencies in Test-SHAStaleness.ps1 from array concatenation (+=) to List[PSCustomObject] with .Add() and renamed Write-OutputResult to Write-SecurityOutput
  • test(scripts): removed duplicated test blocks for Write-SecurityLog, Add-SecurityIssue, and Write-OutputResult from both test files and updated mock references to match renamed functions (Write-SecurityOutput, New-SecurityIssue)
  • fix(scripts): stabilized display key order in hve-core-all YAML output by rebuilding the display section as an ordered hashtable before serialization
  • test(build): added Update-HveCoreAllCollection display key ordering tests covering featured-only, ordering-only, and combined-key scenarios
  • chore: removed dt-method-09-deep.instructions.md and associated collection manifest entries, plugin symlinks, and ADKAR spell-check dictionary term
  • chore: updated github-backlog-manager.agent.md tools declaration to explicit tool list format

Related Issue(s)

Type of Change

Select all that apply:

Code & Documentation:

  • Bug fix (non-breaking change fixing an issue)
  • New feature (non-breaking change adding functionality)
  • Breaking change (fix or feature causing existing functionality to change)
  • Documentation update

Infrastructure & Configuration:

  • GitHub Actions workflow
  • Linting configuration (markdown, PowerShell, etc.)
  • Security configuration
  • DevContainer configuration
  • Dependency update

AI Artifacts:

  • Reviewed contribution with prompt-builder agent and addressed all feedback
  • Copilot instructions (.github/instructions/*.instructions.md)
  • Copilot prompt (.github/prompts/*.prompt.md)
  • Copilot agent (.github/agents/*.agent.md)
  • Copilot skill (.github/skills/*/SKILL.md)

Note for AI Artifact Contributors:

  • Agents: Research, indexing/referencing other project (using standard VS Code GitHub Copilot/MCP tools), planning, and general implementation agents likely already exist. Review .github/agents/ before creating new ones.
  • Skills: Must include both bash and PowerShell scripts. See Skills.
  • Model Versions: Only contributions targeting the latest Anthropic and OpenAI models will be accepted. Older model versions (e.g., GPT-3.5, Claude 3) will be rejected.
  • See Agents Not Accepted and Model Version Requirements.

Other:

  • Script/automation (.ps1, .sh, .py)
  • Other (please describe):

Sample Prompts (for AI Artifact Contributions)

GHCP Artifact Maturity

Warning

This PR removes an experimental GHCP artifact.
.github/instructions/design-thinking/dt-method-09-deep.instructions.md was maturity experimental in the design-thinking collection.

File Type Maturity Notes
.github/agents/github/github-backlog-manager.agent.md Agent ✅ stable Tools format updated
.github/instructions/design-thinking/dt-method-09-deep.instructions.md Instructions ⚠️ experimental Removed in this PR

GHCP Maturity Acknowledgment

  • I acknowledge this PR includes non-stable GHCP artifacts
  • Non-stable artifacts are intentional for this change

Testing

Checklist

Required Checks

  • Documentation is updated (if applicable)
  • Files follow existing naming conventions
  • Changes are backwards compatible (if applicable)
  • Tests added for new functionality (if applicable)

AI Artifact Contributions

  • Used /prompt-analyze to review contribution
  • Addressed all feedback from prompt-builder review
  • Verified contribution follows common standards and type-specific requirements

Required Automated Checks

The following validation commands must pass before merging:

  • Markdown linting: npm run lint:md
  • Spell checking: npm run spell-check
  • Frontmatter validation: npm run lint:frontmatter
  • Skill structure validation: npm run validate:skills
  • Link validation: npm run lint:md-links
  • PowerShell analysis: npm run lint:ps

Security Considerations

  • This PR does not contain any sensitive or NDA information
  • Any new dependencies have been reviewed for security issues
  • Security-related scripts follow the principle of least privilege

Additional Notes

  • Write-OutputResult was renamed to Write-SecurityOutput in both security scripts to align with the shared module's export naming convention.
  • Removed test blocks for Write-SecurityLog, Add-SecurityIssue, and Write-OutputResult are now covered by SecurityHelpers.psm1 module-level tests.
  • The dt-method-09-deep.instructions.md removal also cleaned up the ADKAR acronym from .cspell/industry-acronyms.txt.

🔧 Generated by Copilot

- rebuild display section as ordered hashtable before YAML serialization
- ensures featured/ordering keys emit in consistent sequence across runs

🔧 - Generated by Copilot
- verify featured key precedes ordering key in YAML output
- cover display with only ordering, only featured, and both keys
- validate DryRun mode and return hashtable shape

🧪 - Generated by Copilot
…n security scripts

- replace local Write-SecurityLog, Add-SecurityIssue, Write-OutputResult with SecurityHelpers exports
- add Write-SecurityOutput wrapper for CI-specific output formats
- remove duplicate test blocks for functions now covered by module tests
- update mock references in Pester tests to match renamed functions

♻️ - Generated by Copilot
@WilliamBerryiii WilliamBerryiii requested a review from a team as a code owner February 20, 2026 20:43
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Feb 20, 2026

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

@WilliamBerryiii WilliamBerryiii merged commit 3a0baa7 into main Feb 20, 2026
19 checks passed
WilliamBerryiii pushed a commit that referenced this pull request Feb 20, 2026
🤖 I have created a release *beep* *boop*
---


##
[3.0.0](hve-core-v2.3.10...hve-core-v3.0.0)
(2026-02-20)


### ⚠ BREAKING CHANGES

* **skills:** migrate PR reference generation to self-contained skill
([#669](#669))
* restructure RPI collection to HVE Core naming convention
([#668](#668))

### ✨ Features

* **agents:** add agile-coach agent
([#562](#562))
([de8d86c](de8d86c))
* **agents:** add DT coach agent with tiered instruction loading
([#656](#656))
([206d3a7](206d3a7))
* **agents:** add product manager advisor and UX/UI designer agents
([#627](#627))
([539eb8a](539eb8a))
* **agents:** add system architecture reviewer for design trade-offs and
ADR creation ([#626](#626))
([de5cfd6](de5cfd6))
* **build:** pin devcontainer image and align tool parity
([#704](#704))
([6258b1c](6258b1c))
* **design-thinking:** add manufacturing industry context template
([#682](#682))
([ce864bf](ce864bf))
* **instructions:** add DT coaching state protocol for session
persistence ([#654](#654))
([5a5be4e](5a5be4e))
* **instructions:** add dt-coaching-identity ambient instruction
([#642](#642))
([6209a0d](6209a0d))
* **instructions:** add dt-method-01-deep for advanced scope
conversation techniques
([#673](#673))
([cc92ef9](cc92ef9))
* **instructions:** add dt-method-03-deep for advanced input synthesis
techniques ([#676](#676))
([0079a4f](0079a4f))
* **instructions:** add dt-method-09-deep instructions for Method 9
advanced coaching
([#703](#703))
([150b2a6](150b2a6))
* **instructions:** add dt-method-sequencing ambient instruction
([#650](#650))
([e465b2f](e465b2f))
* **instructions:** add dt-quality-constraints and design-thinking
collection ([#645](#645))
([17002bd](17002bd))
* **instructions:** add DT-to-RPI handoff contract specification
([#679](#679))
([87f9962](87f9962))
* **instructions:** add energy industry context template
([#687](#687))
([41088d8](41088d8))
* **instructions:** add healthcare industry context template
([#686](#686))
([b2d5281](b2d5281))
* **instructions:** add Method 1 Scope Conversations coaching knowledge
([#651](#651))
([93e2d48](93e2d48))
* **instructions:** add Method 2 Design Research coaching knowledge
([#652](#652))
([30f7f3b](30f7f3b))
* **instructions:** add Method 3 Input Synthesis coaching knowledge
([#653](#653))
([1efdb7d](1efdb7d))
* **instructions:** add Method 7 High-Fidelity Prototypes coaching
instruction ([#666](#666))
([9233eab](9233eab))
* **instructions:** add pull request instructions for PR generation
workflow ([#706](#706))
([73d23eb](73d23eb))
* **instructions:** create DT curriculum content (9 modules)
([#690](#690))
([9f7378f](9f7378f)),
closes [#617](#617)
* **instructions:** create dt-method-02-deep.instructions.md
([#700](#700))
([4d4d0ca](4d4d0ca))
* **instructions:** create dt-method-06-lofi-prototypes.instructions.md
([#684](#684))
([4d5f757](4d5f757))
* **instructions:** create dt-method-07-deep.instructions.md
([#678](#678))
([d3ec70d](d3ec70d))
* **instructions:** Create dt-method-08-deep.instructions.md
([#683](#683))
([d9e1115](d9e1115))
* **instructions:** create dt-method-08-testing.instructions.md
([#681](#681))
([3008ad8](3008ad8))
* **instructions:** create dt-method-09-iteration.instructions.md
([#685](#685))
([9d7f4f5](9d7f4f5))
* **instructions:** create dt-rpi-research-context.instructions.md
([#689](#689))
([34c7b89](34c7b89))
* **instructions:** create manufacturing reference learning scenario
([#692](#692))
([1bd3994](1bd3994))
* **instructions:** Design Thinking Method 4 brainstorming instruction
file ([#664](#664))
([06f90b0](06f90b0))
* **prompts:** add DT start-project prompt for coaching initialization
([#657](#657))
([ce583d5](ce583d5))
* **prompts:** add dt-resume-coaching prompt for session recovery
([#665](#665))
([11b93cb](11b93cb))
* **prompts:** create dt-handoff-problem-space.prompt.md
([#688](#688))
([277963d](277963d))
* **scripts:** add collection-level maturity field with validation,
gating, and notices
([#697](#697))
([7b1c8e8](7b1c8e8))
* **scripts:** add per-violation CI annotations and colorized console
output ([#637](#637))
([bd7d512](bd7d512))
* **skills:** edit SKILL frontmatter schema, add CI validation, and
documentation ([#625](#625))
([0138a78](0138a78))
* **skills:** mandate unit testing and document language support
([#636](#636))
([9263617](9263617))
* **skills:** migrate PR reference generation to self-contained skill
([#669](#669))
([cf8805f](cf8805f))


### 🐛 Bug Fixes

* **collections:** migrate artifacts into collection-based
subdirectories
([#658](#658))
([dfa5261](dfa5261))
* **instructions:** optimize Phase 1 DT token budgets and close
[#564](https://github.com/microsoft/hve-core/issues/564)/[#565](https://github.com/microsoft/hve-core/issues/565)
gaps ([#675](#675))
([4f42f00](4f42f00))
* **scripts:** add CI annotations and step summary to copyright header
check ([#638](#638))
([5fa6328](5fa6328))
* **scripts:** add grouped link-lang console diagnostics and failure
summary ([#661](#661))
([4d6871f](4d6871f))
* **scripts:** add per-violation Write-Host and Write-CIAnnotation
output to Test-DependencyPinning
([#640](#640))
([9d3b71d](9d3b71d))
* **scripts:** align agent frontmatter schema with VS Code spec
([#469](#469))
([254d445](254d445))
* **scripts:** optimize PSScriptAnalyzer linting performance in WSL2
([#667](#667))
([f120b93](f120b93))
* **scripts:** stabilize YAML display key ordering in collection
manifest ([#701](#701))
([73c0d2c](73c0d2c))
* **scripts:** use text stubs for plugin links when symlinks unavailable
([#695](#695))
([d7650a3](d7650a3))
* **skills:** fix powershell test coverage in pr-reference skill
([#699](#699))
([408e6b7](408e6b7))


### 📚 Documentation

* **dt:** add Method 5 Concepts and Method 6 Lo-Fi Prototypes
instructions ([#693](#693))
([cfdcf11](cfdcf11))
* **hve-guide:** add role-based guides and project lifecycle
documentation ([#663](#663))
([17a85da](17a85da))


### ♻️ Refactoring

* restructure RPI collection to HVE Core naming convention
([#668](#668))
([120dde0](120dde0))
* **scripts:** consolidate duplicate logging into shared SecurityHelpers
module ([#655](#655))
([627a877](627a877))
* **scripts:** use shared SecurityHelpers and CIHelpers modules in
security scripts
([#705](#705))
([3a0baa7](3a0baa7))


### 🔧 Maintenance

* **deps-dev:** bump markdownlint-cli2 from 0.20.0 to 0.21.0 in the
npm-dependencies group
([#609](#609))
([1486dd7](1486dd7))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: hve-core-release-please[bot] <254602402+hve-core-release-please[bot]@users.noreply.github.com>
@codecov-commenter
Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 24.13793% with 22 lines in your changes missing coverage. Please review.
✅ Project coverage is 85.79%. Comparing base (6258b1c) to head (c856945).
⚠️ Report is 4 commits behind head on main.

Files with missing lines Patch % Lines
scripts/security/Update-ActionSHAPinning.ps1 17.39% 19 Missing ⚠️
scripts/security/Test-SHAStaleness.ps1 50.00% 3 Missing ⚠️
Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##             main     #705      +/-   ##
==========================================
- Coverage   86.53%   85.79%   -0.75%     
==========================================
  Files          23       23              
  Lines        4836     4801      -35     
==========================================
- Hits         4185     4119      -66     
- Misses        651      682      +31     
Flag Coverage Δ
pester 85.79% <24.13%> (-0.75%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines Coverage Δ
scripts/security/Test-SHAStaleness.ps1 64.88% <50.00%> (-3.06%) ⬇️
scripts/security/Update-ActionSHAPinning.ps1 73.53% <17.39%> (-6.12%) ⬇️
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

AhmedMustafa249 added a commit to AhmedMustafa249/hve-core that referenced this pull request Feb 23, 2026
- Fixed two linting references caused by unsupported emojis in UTF-8 file and overlook em dash
- Replaced 'Write-OutputResult' with 'Write-SecurityOutput' due to refactoring done by PR microsoft#705
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants