Skip to content

Make the PSScriptAnalyzer pin hold, and catch syntax errors - #18

Merged
Sekers merged 2 commits into
developfrom
feature/script-analyzer-pin
Sep 23, 2026
Merged

Sekers merged 2 commits into
developfrom
feature/script-analyzer-pin

Conversation

@Sekers

@Sekers Sekers commented Sep 23, 2026

Copy link
Copy Markdown
Owner

Summary

Nothing changes for someone using the module; this is test, CI, and contributor documentation only.

  • The PSScriptAnalyzer pin now holds. The Tests workflow installed 1.25.0, but nothing made the test use that copy. The windows-latest image installs its own (whatever is newest when the image is built), and Windows PowerShell 5.1 cannot see the copy the workflow installs for PowerShell 7, so the 5.1 run always used the image's version. The workflow now sets PSSCRIPTANALYZER_VERSION once and installs that version. The test imports exactly that version and runs under PowerShell 7 only. In CI it fails, rather than skips, when the pinned version is missing.
  • Syntax errors are caught. The test asks for -Severity Error, ParseError. A syntax error has its own ParseError severity, so filtering on Error alone reported nothing.
  • Research_Notes/File-Encoding-And-Line-Endings.md section 1 now measures a module manifest as well as a script, which is what AGENTS.md cites for saving a non-ASCII manifest with a BOM.
  • The new Research_Notes/Test-Tooling-Behavior.md records the measurements behind the test, and what to repeat when PSSCRIPTANALYZER_VERSION changes.

Under Windows PowerShell 5.1 the analyzer test now reports as skipped, with its reason. Nothing is lost: 1.25.0 has the same rules in both editions, and syntax only PowerShell 7 accepts already fails the 5.1 run when the module imports.

Release classification

  • Major: breaks the public contract (an existing script or configuration file can stop working)
  • Minor: adds backward-compatible functionality
  • Patch: a backward-compatible fix
  • None: no user-visible change (tests, CI, or contributor documentation only)

Checklist

  • Targets develop, or main for a hotfix
  • CHANGELOG.md has an entry in the right section under [Unreleased] (added if missing), or the change is not user-visible
  • .\Tests\Invoke-Tests.ps1 passes
  • Contains no real tenant names, email domains, secrets, or configuration files
  • Any live Microsoft Graph testing was done in a test tenant and is described above (none was needed)

The Tests workflow installed PSScriptAnalyzer 1.25.0 so that a new
rule could not fail a build that passed before, but nothing made the
test use that copy. The windows-latest image installs its own, the
newest when the image is built (1.25.0 in 20260907.229.1), and
Windows PowerShell 5.1 cannot see the copy pwsh installs, so the 5.1
run always used the image's version. An image update would have
changed the rules without any change here.

- Tests.yml sets the version once, in PSSCRIPTANALYZER_VERSION, and
  installs that version.
- The test imports exactly that version when the variable is set, and
  the newest installed copy otherwise. PowerShell itself would load the
  copy in the first PSModulePath folder that has one, whatever its
  version. With CI=true, a missing analyzer or pinned version fails the
  test instead of skipping it.
- The test runs under PowerShell 7 only, and names the reason when it
  skips. 1.25.0 has the same 75 rules in both editions, and syntax only
  PowerShell 7 accepts already fails every 5.1 test file that imports
  the module.
- Analyze with -Severity Error, ParseError. A syntax error has its own
  ParseError severity, so filtering on Error alone reported nothing for
  a planted missing parenthesis.
- Research_Notes/File-Encoding-And-Line-Endings.md section 1 now
  measures a module manifest as well as a script, which is what the
  AGENTS.md rule for saving a non-ASCII manifest with a BOM cites.

Checked: with a fake newer PSScriptAnalyzer first on PSModulePath, the
pinned run loads 1.25.0 and passes; a pinned version that is not
installed skips locally and fails with CI=true; a planted syntax error
fails the test naming the file, line and rule.
The analyzer test and the Tests workflow rest on tool behavior that
was measured but only written down in a commit message, and several
of those facts change with the analyzer version or the runner image.

Add Research_Notes/Test-Tooling-Behavior.md: syntax errors appear
only under the ParseError severity; the analyzer's rules match across
editions but its parsing does not; PowerShell loads the first copy of
a module on PSModulePath, not the newest, and a 5.1 process started
from pwsh cannot see pwsh's folders; and the runner image installs
whatever analyzer version is newest when it is built. The note says
what to repeat when PSSCRIPTANALYZER_VERSION changes, and the test and
the workflow point at it.
@Sekers
Sekers merged commit 6ed387b into develop Sep 23, 2026
4 checks passed
@Sekers
Sekers deleted the feature/script-analyzer-pin branch September 24, 2026 01:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant