🔒 security(module): harden repository and PowerShell safety

[SamErde]

Summary

• tighten CI/dependency automation and consolidate Scorecards scanning
• remove generated build/test/help artifacts from source control and ignore regenerated outputs
• restore PSShouldProcess enforcement with -WhatIf/-Confirm coverage for state-changing commands
• harden installer/update paths, add telemetry opt-out documentation, and raise the coverage gate to 30%

Validation

• Invoke-Build TestLocal -File .\src\PSPreworkout.build.ps1 passed with 225 tests passed, 0 failed, 3 skipped
• coverage gate passed at 30.24% / 30%
• PowerShell parse check passed
• module source PSScriptAnalyzer returned no findings

Notes

• Repository ruleset/branch protection enforcement remains a maintainer/admin settings action.
• Codacy MCP tools were unavailable in this session, so Codacy analysis could not be run locally.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

• .github/workflows/Supply Chain Security Scorecards.yml
• docs/requirements.txt

[github-advanced-security]

Remark-lint (reported by Codacy) found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	✅ 0 (≤ 100 complexity)
Duplication	✅ 0 (≤ 1 duplication)

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[Copilot]

Pull request overview

This PR focuses on hardening the PSPreworkout module and repository automation by re-enabling ShouldProcess semantics for state-changing commands, improving installer/update safety, tightening GitHub Actions permissions, and documenting/adding telemetry opt-out behavior.

Changes:

• Restores SupportsShouldProcess / -WhatIf / -Confirm coverage for multiple state-changing public commands and adds Pester safety tests.
• Adds telemetry opt-out support via PSPREWORKOUT_DISABLE_TELEMETRY, reduces telemetry network timeout, and documents telemetry behavior.
• Tightens CI/dependency automation (least-privilege workflow permissions, Dependabot limits, consolidated Scorecards workflow) and improves docs formatting/alias sections.

Reviewed changes

Copilot reviewed 58 out of 62 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/Tests/Unit/Write-PSPreworkoutTelemetry.Tests.ps1	Adds unit tests for telemetry disablement, timeout, and failure behavior.
src/Tests/Unit/StateChangingCommandSafety.Tests.ps1	Adds unit tests ensuring -WhatIf/-Confirm are exposed and honored for key state-changing commands.
src/Tests/Unit/Set-EnvironmentVariable.Tests.ps1	Adds unit tests confirming Set-EnvironmentVariable honors ShouldProcess.
src/PSScriptAnalyzerSettings.psd1	Re-enables PSShouldProcess rule enforcement by removing the exclusion.
src/PSPreworkout/Public/Update-AllTheThings.ps1	Wraps state-changing actions (module/script/help/package updates) in ShouldProcess.
src/PSPreworkout/Public/Set-EnvironmentVariable.ps1	Adds SupportsShouldProcess and gates environment updates behind ShouldProcess.
src/PSPreworkout/Public/Set-DefaultTerminal.ps1	Adds Windows-only enforcement and gates registry mutations behind ShouldProcess.
src/PSPreworkout/Public/Set-ConsoleFont.ps1	Adds SupportsShouldProcess and gates registry edits behind ShouldProcess.
src/PSPreworkout/Public/New-ScriptFromTemplate.ps1	Adds SupportsShouldProcess and gates file creation behind ShouldProcess.
src/PSPreworkout/Public/Install-WinGet.ps1	Adds SupportsShouldProcess, Windows-only enforcement, and gates download/install steps behind ShouldProcess.
src/PSPreworkout/Public/Install-PowerShellISE.ps1	Adds SupportsShouldProcess, Windows-only enforcement, and gates registry/service/capability changes behind ShouldProcess.
src/PSPreworkout/Public/Install-OhMyPosh.ps1	Adds SupportsShouldProcess, hardens “direct” install to download-to-file then execute (no Invoke-Expression).
src/PSPreworkout/Public/Install-CommandNotFoundUtility.ps1	Adds SupportsShouldProcess and gates install/feature enabling behind ShouldProcess.
src/PSPreworkout/Public/Initialize-PSEnvironmentConfiguration.ps1	Adds SupportsShouldProcess and gates git/module/package/registry/session-setting changes behind ShouldProcess.
src/PSPreworkout/Private/Write-PSPreworkoutTelemetry.ps1	Adds telemetry opt-out env var support and reduces REST timeout.
src/PSPreworkout.build.ps1	Raises coverage threshold and makes manifest updates conditional to avoid rewriting unchanged content.
Scripts/Update-AllTheThings.ps1	Corrects Chocolatey spelling in script metadata/docs.
Scripts/Update-AllTheThings_ScriptInfo.ps1	Corrects Chocolatey spelling in script metadata.
README.md	Adds telemetry documentation and corrects a grammar issue.
docs/index.md	Adds telemetry documentation and corrects a grammar issue.
docs/requirements.txt	Pins MkDocs-related Python dependencies to exact versions.
docs/Update-AllTheThings.md	Updates generated cmdlet docs (aliases section and Chocolatey spelling).
docs/Test-IsElevated.md	Updates generated cmdlet docs (aliases section).
docs/Show-WithoutEmptyProperty.md	Updates generated cmdlet docs (aliases section / formatting).
docs/Show-LoadedAssembly.md	Updates generated cmdlet docs (aliases section).
docs/Set-EnvironmentVariable.md	Updates generated cmdlet docs to reflect -WhatIf/-Confirm and alias list.
docs/Set-DefaultTerminal.md	Updates generated cmdlet docs (aliases section / formatting).
docs/Set-ConsoleFont.md	Updates generated cmdlet docs to reflect -WhatIf/-Confirm and alias list.
docs/Out-JsonFile.md	Updates generated cmdlet docs (aliases section / formatting).
docs/Install-WinGet.md	Updates generated cmdlet docs to reflect -WhatIf/-Confirm and alias list.
docs/Install-PowerShellISE.md	Updates generated cmdlet docs to reflect -WhatIf/-Confirm and alias list.
docs/Install-OhMyPosh.md	Updates generated cmdlet docs to reflect -WhatIf/-Confirm and alias list.
docs/Install-CommandNotFoundUtility.md	Updates generated cmdlet docs to reflect -WhatIf/-Confirm and alias list.
docs/Initialize-PSEnvironmentConfiguration.md	Updates generated cmdlet docs to reflect -WhatIf/-Confirm and alias list.
docs/Get-TypeAccelerator.md	Updates generated cmdlet docs (aliases section).
docs/Get-PowerShellPortable.md	Updates generated cmdlet docs (aliases section).
docs/Get-ModulesWithUpdate.md	Updates generated cmdlet docs (aliases section).
docs/Get-LoadedAssembly.md	Updates generated cmdlet docs (aliases section).
docs/Get-HashtableValueType.md	Updates generated cmdlet docs (aliases section).
docs/Get-EnvironmentVariable.md	Updates generated cmdlet docs (aliases section).
docs/Get-CommandHistory.md	Updates generated cmdlet docs (aliases section).
docs/Edit-WinGetSettingsFile.md	Updates generated cmdlet docs (aliases section).
docs/Edit-PSReadLineHistoryFile.md	Updates generated cmdlet docs (aliases section).
docs/en-US/PSPreworkout_378339de-a0df-4d44-873b-4fd32c388e06_HelpInfo.xml	Removes generated external help artifact from source control.
.readthedocs.yaml	Updates ReadTheDocs MkDocs config path to mkdocs.yml at repo root.
.gitignore	Starts ignoring build/help artifacts and docs external-help outputs.
.github/workflows/Validate Module Manifest.yml	Applies least-privilege permissions and avoids needless manifest rewrites.
.github/workflows/Update MkDocs Navigation.yml	Applies least-privilege permissions (job-scoped write).
.github/workflows/scorecard.yml	Consolidates/standardizes Scorecards workflow (schedule, perms, naming).
.github/workflows/Format Markdown.yml	Applies least-privilege permissions (job-scoped write).
.github/workflows/Build Module.yml	Tightens triggers/paths and removes auto-commit behavior; read-only permissions.
.github/workflows/Supply Chain Security Scorecards.yml	Removes older redundant Scorecards workflow.
.github/dependabot.yml	Simplifies Dependabot config and caps open PRs.
.github/CONTRIBUTING.md	Fixes typos and documents manifest automation expectations.
.editorconfig	Fixes PowerShell capitalization in comment.
.cspell.json	Updates dictionary words/ignores for Chocolatey spelling cleanup.

[SamErde]

@copilot apply changes based on the comments in this thread

[Copilot]

@copilot apply changes based on the comments in this thread

Applied both fixes in f96ee8f:

• Install-WinGet.ps1: post-run message now uses $Path (always populated, whether or not -DownloadPath was passed) and "Xaml packages" to match $XamlPackage.
• Set-EnvironmentVariable.ps1: removed the variable value from the error string so secrets/tokens are never written to logs or CI output.