Bring all action repositories into compliance with the GitHub Actions standard

[MariusStorhaug]

An organization-wide audit of the PSModule action repositories against the GitHub Actions coding standard found every action repository's CI workflows deviate on two rules, and two repositories additionally deviate on entry-script placement. The workflows are seeded from Template-Action and are defined inline in each repository (no shared reusable workflow), so each repository is corrected individually.

This issue tracks the rollout. Repositories with issues enabled carry their own tracking issue (linked below). The ten repositories that have issues disabled are tracked here, in the framework repository, following the same pattern as other cross-repository rollouts.

Request

Bring every action repository into compliance with two rules of the standard, plus entry-script placement where it applies:

1. Pin the runner image. Replace ubuntu-latest with a specific image (ubuntu-24.04); pin matrix OS entries to specific versions (e.g. ubuntu-24.04, macos-15, windows-2025) rather than *-latest.
2. Queue release runs. Set cancel-in-progress: false on the release workflow (Release.yml / Auto-Release.yml) so a publish is never aborted mid-write. Test and lint workflows may keep cancel-in-progress: true.
3. Entry-script placement. Where the entry script lives at scripts/main.ps1, move it to src/main.ps1 (or main.ps1 at the action root) and update action.yml.

Acceptance criteria

• No action repository uses a -latest runner in any workflow.
• Every release workflow sets cancel-in-progress: false.
• Entry scripts follow the standard's placement (main.ps1 at the action root or under src/).
• Template-Action is corrected so regenerated repositories are compliant by default.

---

Technical decisions

Per-repository fixes. The action repositories do not consume a shared reusable workflow (0 of 19), so each repository's inline workflows are edited directly.

Runner image. ubuntu-latest -> ubuntu-24.04; matrix OS lists pinned to specific images.

Concurrency. cancel-in-progress: false on release/publish workflows only; test and lint keep true (cancelling superseded runs is desirable).

Scaffold. Template-Action is fixed in its own issue (PSModule/Template-Action#36) so the deviation stops propagating to new repositories.

Issue hosting. Ten repositories have issues disabled; their compliance work is tracked in this issue rather than in the repositories themselves.

Out of scope. Dependabot update grouping and semver update labels are intentionally not used (see MSXOrg/docs#19 and #359).

---

Implementation plan

Repositories tracked in their own issue

• Bring the action into compliance with the GitHub Actions standard Debug#29
• Bring the action into compliance with the GitHub Actions standard Download-CIArtifact#30
• Bring the action into compliance with the GitHub Actions standard Get-IssueFormData#31
• Bring the action into compliance with the GitHub Actions standard GitHub-Script#95
• Bring the action into compliance with the GitHub Actions standard Install-PowerShell#30
• Bring the action into compliance with the GitHub Actions standard Invoke-Pester#69
• Bring the action into compliance with the GitHub Actions standard Invoke-ScriptAnalyzer#37
• Bring the action into compliance with the GitHub Actions standard Release-GHRepository#105
• Bring the action into compliance with the GitHub Actions standard Template-Action#36

Repositories with issues disabled (tracked here)

• Build-PSModule — pin runners in Action-Test.yml, Linter.yml, Release.yml; set cancel-in-progress: false in Release.yml
• Document-PSModule — pin runners in Action-Test.yml, Linter.yml, Release.yml; set cancel-in-progress: false in Release.yml
• Get-PesterCodeCoverage — pin runners in Action-Test.yml, Linter.yml, Release.yml; set cancel-in-progress: false in Release.yml
• Get-PesterTestResults — pin runners in Action-Test.yml, Linter.yml, Release.yml; set cancel-in-progress: false in Release.yml
• Get-PSModuleSettings — pin runners in Action-Test.yml, Linter.yml, Release.yml; set cancel-in-progress: false in Release.yml
• Initialize-PSModule — pin runners in Action-Test.yml, Linter.yml, Release.yml; (pin matrix OS in Action-Test.yml); set cancel-in-progress: false in Release.yml
• Install-PSModuleHelpers — pin runners in Action-Test.yml, Linter.yml, Release.yml; set cancel-in-progress: false in Release.yml
• Publish-PSModule — pin runners in Action-Test.yml, Linter.yml, Release.yml; set cancel-in-progress: false in Release.yml
• Resolve-PSModuleVersion — pin runners in Action-Test.yml, Auto-Release.yml, Linter.yml; set cancel-in-progress: false in Auto-Release.yml; move scripts/main.ps1 -> src/main.ps1
• Test-PSModule — pin runners in Action-Test-Src-Default.yml, Action-Test-Src-WithManifest.yml, Action-Test-outputs.yml, Linter.yml, Release.yml; (pin matrix OS in Action-Test-Src-Default.yml, Action-Test-Src-WithManifest.yml, Action-Test-outputs.yml); set cancel-in-progress: false in Release.yml

Scaffold

• Apply the runner-pinning and concurrency corrections to Template-Action (Bring the action into compliance with the GitHub Actions standard Template-Action#36)