🩹 [Patch]: Actions are internalized and automatically follow the workflow version

[Marius Storhaug (MariusStorhaug)]

When you reference Process-PSModule at a release tag, run it from a branch during development, or test it from a fork, the actions it calls now automatically match that same version. There's no more keeping a workflow and its actions in sync by hand — pin the workflow, and the actions follow.

• Fixes Consolidate scattered PSModule action repositories into Process-PSModule #384

New: Actions automatically follow the workflow version in use

Every stage workflow now checks out its own source at the exact commit it is running from, then calls its actions from that local copy instead of a separately pinned action reference. In practice this means:

• Reference a release tag → you get that tag's actions.
• Run a development branch → the branch's actions run together with it, with no separate action release or pin update needed to test a change.
• Fork the repository → your fork's actions are used, not upstream's.

This is possible using job.workflow_repository and job.workflow_sha, a set of GitHub Actions context properties that let a reusable workflow discover its own source repository and commit. This capability did not exist before — it was introduced by GitHub in April 2026 (shipped in Actions Runner v2.334.0, see actions/runner#4335) and is documented in the job context reference. No official GitHub changelog announcement could be found for this change — the runner release and context documentation are the primary references.

GitHub-Script, Invoke-Pester, and Invoke-ScriptAnalyzer continue to be consumed from their own repositories at pinned commits, as before.

No changes are required to consumer workflows. Inputs, outputs, and secrets are unchanged.

Changed: Internalized actions have moved out of their standalone repositories

Build-PSModule, Document-PSModule, Get-PSModuleSettings, Get-PesterCodeCoverage, Get-PesterTestResults, Initialize-PSModule, Install-PSModuleHelpers, Publish-PSModule, Resolve-PSModuleVersion, and Test-PSModule now ship directly inside Process-PSModule instead of living in their own PSModule repositories.

Those standalone repositories are now archived and will be deleted soon. If you reference any of them directly, switch to Process-PSModule instead. The old actions will also be the ones older versions of Process-PSModule will use, so be sure to update to be able to use the framework.

Technical Details

• Ten composite actions are now bundled under .github/actions/: Build-PSModule, Document-PSModule, Get-PSModuleSettings, Get-PesterCodeCoverage, Get-PesterTestResults, Initialize-PSModule, Install-PSModuleHelpers, Publish-PSModule, Resolve-PSModuleVersion, Test-PSModule.
• All stage workflows add a self-checkout step before any action call: repository: ${{ job.workflow_repository }}, ref: ${{ job.workflow_sha }}, path: _wf.
• Action call sites change from PSModule/<Name>@<sha> to ./_wf/.github/actions/<Name>.
• Nested dependencies on Install-PSModuleHelpers resolve from the same bundled revision.
• .github/actionlint.yaml is updated to recognize the self-checkout pattern and the job.workflow_* properties.
• Action READMEs and test-suite consolidation are out of scope for this change.

Validation

• MariusTestModule SHA-pinned consumer run passed.
• MariusTestModule ref-based consumer run passed and resolved feat/internalize-process-actions to the invoked workflow commit.

[github-actions]

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
MARKDOWN	Pass ✅
NATURAL_LANGUAGE	Pass ✅
POWERSHELL	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter