From f49a963ec741356d766502a72e7d624b2bfcad06 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jakub=20Jare=C5=A1?= Date: Sat, 5 Sep 2026 11:50:37 +0200 Subject: [PATCH] Install PSScriptAnalyzer directly instead of via psmodulecache MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Same change as #3034 on main. sha_pinning_required applies to actions referenced inside composite actions, and potatoqualitee/psmodulecache does not pin its own actions/cache reference (v6.2.1 uses @v4.2.0, v6.3 uses @v5.0.5), so the job fails at "Set up job" while we depend on it. This branch triggers on rel/*, so it runs and would break the same way main did. 🤖 --- .github/workflows/code-analysis.yml | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/.github/workflows/code-analysis.yml b/.github/workflows/code-analysis.yml index 587a596de..a3df751b7 100644 --- a/.github/workflows/code-analysis.yml +++ b/.github/workflows/code-analysis.yml @@ -20,10 +20,17 @@ jobs: - name: Checkout code uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - - name: PowerShell Module Cache - uses: potatoqualitee/psmodulecache@ee5e9494714abf56f6efbfa51527b2aec5c761b8 # v6.2.1 - with: - modules-to-cache: PSScriptAnalyzer, ConvertToSARIF:1.0.0 + # Installed directly rather than through potatoqualitee/psmodulecache. That is a + # composite action and its own actions/cache reference is not pinned - v6.2.1 uses + # actions/cache@v4.2.0, v6.3 uses @v5.0.5 - and sha_pinning_required applies to + # nested references too, so the whole job fails while we depend on it. Two modules + # from PSGallery take seconds, so the cache was not buying much. + - name: Install PSScriptAnalyzer and ConvertToSARIF + shell: pwsh + run: | + Set-PSRepository -Name PSGallery -InstallationPolicy Trusted + Install-Module PSScriptAnalyzer -Force -SkipPublisherCheck -Scope CurrentUser + Install-Module ConvertToSARIF -RequiredVersion 1.0.0 -Force -Scope CurrentUser # Not using microsoft/psscriptanalyzer-action@v1.0 because we're missing psm1 in src + need to exclude generated ps1xml - name: Run PSScriptAnalyzer