🪲 [Fix]: Test data reaches module tests in every consumer repository (#377)

Module test workflows now receive the caller-provided test data (secrets
and variables) in every repository that consumes Process-PSModule, and
version resolution once again honors the bump label on pull requests.
Previously the BeforeAll, Test, and AfterAll module jobs failed at the
"Expose caller-provided test data" step because they ran a script that
shipped only inside Process-PSModule's own repository, so no consumer
could actually use the `TestData` secret introduced in v6.0.0.

- Fixes #378

## Fixed: Test data now reaches module tests in consumer repositories

The `TestData` secret (a single-line JSON object of `secrets` and
`variables`) is now exposed to the BeforeAll, Test, and AfterAll module
test jobs in any repository that consumes Process-PSModule. Each job
installs the shared helpers and runs the `Import-TestData` command,
which reads the payload, masks the secrets, and publishes every entry as
an environment variable for the tests.

The consumer interface is unchanged — callers already pass `TestData` to
`workflow.yml` (added in v6.0.0), so no migration is required:

```yaml
secrets:
  TestData: >-
    { "secrets": { "TEST_SECRET": "${{ secrets.TEST_SECRET }}" },
      "variables": { "TEST_VARIABLE": ${{ toJSON(vars.TEST_VARIABLE) }} } }
```

Secrets arrive masked in the logs; variables arrive verbatim.

## Fixed: Bump labels are honored during version resolution on pull
requests

Version resolution now always evaluates the Major/Minor/Patch bump
label, so a pull request labeled `Minor` previews the correct next minor
version instead of defaulting to a patch prerelease. This is picked up
by adopting `Resolve-PSModuleVersion` v1.1.4.

## Technical Details

- Removed `.github/scripts/Expose-TestData.ps1` (138 lines); the
exposure logic moved into the shared `PSModule/Install-PSModuleHelpers`
module as the `Import-TestData` command, so it no longer has to be
checked out from the caller's repository.
- `BeforeAll-ModuleLocal.yml`, `Test-ModuleLocal.yml`, and
`AfterAll-ModuleLocal.yml` each now install
`PSModule/Install-PSModuleHelpers@v1.0.9` and run `Import-TestData` (env
`PSMODULE_TEST_DATA: ${{ secrets.TestData }}`) in place of the deleted
script.
- `Plan.yml`: `PSModule/Resolve-PSModuleVersion` pinned to v1.1.4, which
contains the always-evaluate-labels fix.
- `Build-Site.yml`: `Install-PSModuleHelpers` bumped v1.0.8 → v1.0.9 so
the action resolves to a single version across the repo.
- `README.md` documents that test data is exposed through
`Install-PSModuleHelpers` / `Import-TestData`.
- All action references are pinned to release commit SHAs (IPH v1.0.9 =
`8bfb84d557755c67d9b5643efe573bdcae4c1a4a`, Resolve v1.1.4 =
`8d1dac7f326a45ba08060c1e24a5dd6f6f00b3ab`); actionlint is clean.
- Validated end-to-end on a consumer module: all module test matrix jobs
(Linux/Windows/macOS) pass, with a masked secret and a verbatim variable
observed in the tests.

Author: MariusStorhaug

.github/scripts/Expose-TestData.ps1

@@ -31,12 +31,15 @@ jobs:
           persist-credentials: false
           fetch-depth: 0
 
+      - name: Install-PSModuleHelpers
+        uses: PSModule/Install-PSModuleHelpers@8bfb84d557755c67d9b5643efe573bdcae4c1a4a # v1.0.9
+
       - name: Expose caller-provided test data
         shell: pwsh
         env:
           PSMODULE_TEST_DATA: ${{ secrets.TestData }}
         run: |
-          ./.github/scripts/Expose-TestData.ps1
+          Import-TestData
 
       - name: Run AfterAll Teardown Scripts
         if: always()

.github/workflows/AfterAll-ModuleLocal.yml

@@ -31,12 +31,15 @@ jobs:
           persist-credentials: false
           fetch-depth: 0
 
+      - name: Install-PSModuleHelpers
+        uses: PSModule/Install-PSModuleHelpers@8bfb84d557755c67d9b5643efe573bdcae4c1a4a # v1.0.9
+
       - name: Expose caller-provided test data
         shell: pwsh
         env:
           PSMODULE_TEST_DATA: ${{ secrets.TestData }}
         run: |
-          ./.github/scripts/Expose-TestData.ps1
+          Import-TestData
 
       - name: Run BeforeAll Setup Scripts
         uses: PSModule/GitHub-Script@8083ec1f733f00357ee4d0db0c6056686e483bc0 # v1.9.0

.github/workflows/BeforeAll-ModuleLocal.yml

@@ -23,7 +23,7 @@ jobs:
           fetch-depth: 0
 
       - name: Install-PSModuleHelpers
-        uses: PSModule/Install-PSModuleHelpers@68e8ca76be679bfcb7099aed8cffa911c4ab72af # v1.0.8
+        uses: PSModule/Install-PSModuleHelpers@8bfb84d557755c67d9b5643efe573bdcae4c1a4a # v1.0.9
 
       - name: Download docs artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1

.github/workflows/Build-Site.yml

@@ -85,7 +85,7 @@ jobs:
           ImportantFilePatterns: ${{ inputs.ImportantFilePatterns }}
 
       - name: Resolve-Version
-        uses: PSModule/Resolve-PSModuleVersion@d53326c7687d20a7949d457fccd71223856b1890 # v1.1.0
+        uses: PSModule/Resolve-PSModuleVersion@8d1dac7f326a45ba08060c1e24a5dd6f6f00b3ab # v1.1.4
         id: Resolve-Version
         env:
           GH_TOKEN: ${{ github.token }}

.github/workflows/Plan.yml

@@ -36,21 +36,21 @@ jobs:
           persist-credentials: false
           fetch-depth: 0
 
-      - name: Expose caller-provided test data
-        shell: pwsh
-        env:
-          PSMODULE_TEST_DATA: ${{ secrets.TestData }}
-        run: |
-          ./.github/scripts/Expose-TestData.ps1
-
       - name: Download module artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: module
           path: ${{ fromJson(inputs.Settings).WorkingDirectory }}/outputs/module
 
       - name: Install-PSModuleHelpers
-        uses: PSModule/Install-PSModuleHelpers@68e8ca76be679bfcb7099aed8cffa911c4ab72af # v1.0.8
+        uses: PSModule/Install-PSModuleHelpers@8bfb84d557755c67d9b5643efe573bdcae4c1a4a # v1.0.9
+
+      - name: Expose caller-provided test data
+        shell: pwsh
+        env:
+          PSMODULE_TEST_DATA: ${{ secrets.TestData }}
+        run: |
+          Import-TestData
 
       - name: Import-Module
         id: import-module

.github/workflows/Test-ModuleLocal.yml

@@ -489,7 +489,8 @@ Notes:
   Names must match `^[A-Za-z_][A-Za-z0-9_]*$` and must not override reserved variables such as `PATH`,
   `CI`, `GITHUB_*`, `RUNNER_*` or `ACTIONS_*`.
 - The `TestData` validation, masking and environment export logic is shared by the ModuleLocal workflows
-  through `.github/scripts/Expose-TestData.ps1`.
+  through the [`PSModule/Install-PSModuleHelpers`](https://github.com/PSModule/Install-PSModuleHelpers)
+  action, which installs the `Import-TestData` command each workflow runs to expose the values.
 - Reference secrets as `"${{ secrets.<name> }}"` (quoted, directly) rather than
   `toJSON(secrets.<name>)`. The direct form keeps CodeQL's *excessive secrets exposure* check happy and
   works for single-line secret values. It cannot carry values that contain `"`, `\` or newlines, so