Accept SHA-pinned action refs in update-mslearn-dates workflow tests - #2252
Merged
Roland Krummenacher (RolandKrummenacher) merged 2 commits intoAug 13, 2026
Conversation
…ests Two assertions in Action.UpdateMsLearnDates.Tests.ps1 required a floating @vn tag: $workflowContent | Should -Match 'uses:\s*actions/checkout@v\d+' $workflowContent | Should -Match 'uses:\s*tj-actions/changed-files@v\d+' Pinning the workflows to full-length commit SHAs replaced those refs with 40-character SHAs plus a trailing version comment, so both assertions now fail. This turns the Pester job red on dev and therefore on every open PR. The assertions accept either form now, so the suite passes whether an action is SHA-pinned or tag-referenced. The intent of the tests -- that the workflow checks out the PR branch and uses changed-files -- is preserved. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Roland Krummenacher (RolandKrummenacher)
requested a review
from Michael Flanakin (flanakin)
as a code owner
August 13, 2026 04:31
Roland Krummenacher (RolandKrummenacher)
requested a review
from Brett Wilson (MSBrett)
as a code owner
August 13, 2026 04:31
microsoft-github-policy-service
Bot
requested review from
Anthony Romano (aromano2) and
Hélder Pinto (helderpinto)
August 13, 2026 04:32
microsoft-github-policy-service
Bot
added
the
Needs: Review 👀
microsoft-github-policy-service
Bot
added
the
Tool: PowerShell
Copilot started reviewing on behalf of
Roland Krummenacher (RolandKrummenacher)
August 13, 2026 04:32
View session
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the Pester unit tests for the update-mslearn-dates workflow to tolerate hardened GitHub Action references that are pinned to full commit SHAs, while still accepting the prior @vN tag format. This keeps the test suite aligned with the repository’s workflow security posture (SHA-pinned actions) without weakening the intent of the assertions.
Changes:
- Broadened the
uses:match patterns foractions/checkoutandtj-actions/changed-filesto accept either a 40-character SHA pin or avNtag. - Added clarifying commentary explaining why SHA pins are accepted.
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
actions/checkout is GitHub-maintained rather than third-party, so the comment covering both it and tj-actions/changed-files should not call them third-party. Addresses review feedback on #2252. No assertion or behavior change. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Aug 13, 2026
Michael Flanakin (flanakin)
approved these changes
Aug 13, 2026
Roland Krummenacher (RolandKrummenacher)
merged commit Aug 13, 2026
ab629c1
into
dev
5 checks passed
Roland Krummenacher (RolandKrummenacher)
deleted the
RolandKrummenacher/fix-workflow-pin-assertions
branch
August 13, 2026 07:34
Roland Krummenacher (RolandKrummenacher)
deployed
to
ftk-pr
August 13, 2026 07:34 — with 
GitHub Actions
Active
GitHub Actions
Active
microsoft-github-policy-service
Bot
requested a review
from Michael Flanakin (flanakin)
August 13, 2026 07:36
|
All Contributors (@all-contributors) please add Roland Krummenacher (@RolandKrummenacher) for code |
Contributor
|
@microsoft-github-policy-service[bot] Roland Krummenacher (@RolandKrummenacher) already contributed before to code |
Roland Krummenacher (RolandKrummenacher)
pushed a commit
that referenced
this pull request
Aug 13, 2026
Resolves the conflict introduced by #2244, which bumped actions/checkout in .github/workflows/opendata-commitment-eligibility.yml while this branch was editing the `ref:` line directly beneath it. The two changes are additive, not contradictory: the resolution keeps #2244's new pin (3d3c42e5... v7.0.1, up from 11d5960a... v4.4.0) and this branch's `ref: ${{ github.event.inputs.ref || 'dev' }}` plus the workflow_dispatch inputs. Also brings in #2252, which fixes the two update-mslearn-dates assertions that had been failing this branch's Pester run through no fault of its own. Verified after resolution: no conflict markers remain, the workflow YAML parses, both `ref` and `dry_run` inputs are present, the checkout step carries dev's new SHA, the familycounts rename is intact, and 51 unit tests pass across both the previously failing Action.UpdateMsLearnDates suite and this branch's own. Note the dispatch run that validated this branch used checkout v4.4.0; the scheduled job will now run v7.0.1. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🐛 Problem
The Pester job is failing on
dev, and therefore on every open PR.Two assertions in
src/powershell/Tests/Unit/Action.UpdateMsLearnDates.Tests.ps1require a floating@vNtag:Pinning the workflows to full-length commit SHAs rewrote those refs in
.github/workflows/update-mslearn-dates.yml:Neither matches
@v\d+, so both assertions fail:🔧 Solution
Widen both patterns to accept either a 40-character SHA pin or a version tag:
The tests' intent — that the workflow checks out the PR branch and uses
changed-files— is preserved, and the suite now passes whether an action is SHA-pinned or tag-referenced, so re-pinning in future won't break it again.These are the only two version-tag assertions of this kind in the test suite; I grepped for others and found none.
🧪 Validation
Action.UpdateMsLearnDates.Tests.ps1+Action.UpdateMsLearnDates.AwkParity.Tests.ps1: 34 pass, 0 fail (was 2 failing).devworktree before the change, so this is adevbreakage rather than a PR-specific one.dev(the one pre-existingPSUseDeclaredVarsMoreThanAssignmentson line 7 is untouched).Test-only change; no workflow or product code is modified.
🤖 Generated with Claude Code