name: PSScriptAnalyzer

on:

workflow_call:

inputs:

soft-fail:

description: 'Whether to continue on PSScriptAnalyzer violations'

required: false

type: boolean

default: false

changed-files-only:

description: 'Only analyze changed PowerShell files'

required: false

type: boolean

default: true

permissions:

contents: read

jobs:

psscriptanalyzer:

name: PowerShell Lint

runs-on: ubuntu-latest

permissions:

contents: read

steps:

- name: Checkout code

uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

with:

persist-credentials: false

fetch-depth: 0

- name: Run PSScriptAnalyzer

id: analyze

shell: pwsh

run: |

New-Item -ItemType Directory -Force -Path logs | Out-Null

$params = @{}

if ('${{ inputs.changed-files-only }}' -eq 'true') {

$params['ChangedFilesOnly'] = $true

}

& scripts/linting/Invoke-PSScriptAnalyzer.ps1 @params

if ($LASTEXITCODE -ne 0) {

"PSSCRIPTANALYZER_FAILED=true" | Out-File -FilePath $env:GITHUB_ENV -Append

}

continue-on-error: ${{ inputs.soft-fail }}

- name: Upload results

if: always()

uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

with:

name: psscriptanalyzer-results

path: |

logs/psscriptanalyzer-results.json

logs/psscriptanalyzer-summary.json

retention-days: 30

if-no-files-found: ignore

- name: Check results

if: "!inputs.soft-fail"

shell: pwsh

run: |

if ($env:PSSCRIPTANALYZER_FAILED -eq 'true') {

Write-Error "PSScriptAnalyzer found violations"

exit 1

}