Migrate CI tests to GitHub Actions with full coverage on every run

[Aditya Patwardhan (adityapatwardhan)]

PR Summary

Migrate the build and functional tests from .ci/ci.yml and .ci/test.yml to GitHub Actions.

• Build the Release/net472 module and publish the module and nupkg as workflow artifacts.
• Use the same five-job test matrix for every PR, master push, and manual run: the full existing CI suite on Windows pwsh, Windows PowerShell, Ubuntu, and macOS, plus the ACR AzAuth suite on Windows.
• Remove the reduced public suite and branch/event-based test gating. Do not automatically cancel or supersede runs.
• Configure Azure OIDC authentication, runner-local SecretStore, Azure Artifacts Credential Provider, Pester 4.10.1, and architecture-aware DSC installation.
• Fail jobs on failed/missing Pester results, retain NUnit XML reports, and clean up only the generated ACR repositories recorded by the current job.
• Remove an environment dump from the GitHub Packages test and document all required credentials and environment settings in README.md.

PR Context

The ci-integration environment must allow PR merge refs and manually selected branches, with required reviewers, prevention of self-review, and administrator bypass disabled. Review the exact source/workflow revision before approval because authenticated test jobs execute repository code with test credentials.

GitHub withholds credentials from fork/Dependabot PR workflows. Such runs do not fall back to partial coverage: maintainers must review and mirror the changes to a branch in this repository to execute the authenticated suite. This change does not use pull_request_target.

The existing Azure DevOps definitions remain available for transition and release consumers. The external PowerShell/compliance stage is not migrated; preserve that coverage until a replacement is approved. GitHub/Azure environment settings have not been provisioned by this PR, and hosted authenticated execution still requires that setup.

Validation

• 16 CI helper/regression tests passed under PowerShell 7 and Windows PowerShell 5.1.
• GitHub workflows passed actionlint; PowerShell scripts passed syntax checks.
• Release/net472 build and 12 credential-info smoke tests passed during migration development.
• Full hosted, cross-platform authenticated tests have not been run locally.

PR Checklist

• PR has a meaningful title.
• Summarized changes and context.
• New PowerShell files have copyright headers.
• Added regression tests for workflow coverage, credential requirements, test failure propagation, and ACR cleanup.
• Documented credential setup, trust boundaries, and CI cutover.
• No product/API breaking changes.
• Configure the GitHub environment and service permissions, then verify hosted execution before retiring Azure DevOps test checks.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟡 Changes recommended

The reusable test workflow uses Windows-only backslash paths, causing Ubuntu and macOS jobs to fail before running tests.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Migrates CI build and authenticated functional testing from Azure DevOps to GitHub Actions, adding cross-platform coverage, credential setup, artifact retention, and ACR cleanup.

Changes:

• Added GitHub Actions build and five-job test matrix.
• Added CI helper scripts and regression tests.
• Documented environment, credential, and migration requirements.

File summaries

File	Description
.github/workflows/ci.yml	Builds and publishes module artifacts.
.github/workflows/ci-tests.yml	Runs cross-platform authenticated tests.
.github/scripts/Initialize-CI.ps1	Installs test dependencies and DSC.
.github/scripts/Invoke-CITests.ps1	Selects and executes CI suites.
.github/scripts/Remove-CITestRepositories.ps1	Cleans generated ACR repositories.
.github/scripts/tests/CI.Tests.ps1	Tests workflow and helper behavior.
README.md	Documents GitHub Actions configuration.
test/FindPSResourceTests/FindPSResourceGithubPackages.Tests.ps1	Removes environment diagnostic output.

Review details

Suppressed comments (4)

.github/workflows/ci-tests.yml:73

• The Ubuntu and macOS jobs reach this step with pwsh, where . followed by backslash does not identify the repository path; the module import therefore fails on those two matrix entries. Use a forward-slash path or Join-Path for this invocation.

          Import-Module .\buildtools.psd1 -Force

.github/workflows/ci-tests.yml:79

• This helper-test path is also Windows-specific even though the default shell is pwsh for the Ubuntu and macOS matrix jobs, so those jobs cannot run the regression tests. Use a cross-platform path separator.

          $result = Invoke-Pester .\.github\scripts\tests -PassThru

.github/workflows/ci-tests.yml:120

• Cleanup is run with pwsh on the non-Windows matrix entries too, but this backslash-separated path is not portable to Unix PowerShell. The cleanup step will be unable to start there; use a forward-slash path or Join-Path.

        run: .\.github\scripts\Remove-CITestRepositories.ps1

.github/workflows/ci-tests.yml:106

• The functional-test script is invoked with backslash separators on every matrix entry; on Ubuntu and macOS this path is not resolved by PowerShell, so the full/AzAuth suite step fails without running tests. Use a cross-platform path here.

        run: .\.github\scripts\Invoke-CITests.ps1 -Suite $env:CI_SUITE

• Files reviewed: 8/8 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.