[alerickson]

PR Summary

Adds automated PowerShell Gallery outage reporting.

• psgallery-health-check.yml: scheduled workflow that runs every 30 minutes. It sends the same search queries PSResourceGet uses for Find-PSResource (find by name, wildcard name with -Type, and tag searches for modules, scripts and prerelease), 17 requests in total. Only hard failures count: HTTP 404, 5xx, or no response within 60 seconds. If 2 or more of the search requests fail, or find-by-name fails 3 times in a row, it triggers the outage reporter.

The requests come from the Find-PSResource CI tests that most often fail with 500s:

Probe	Command it mirrors	What makes it different
Find by name	Find-PSResource -Name test_module	FindPackagesById() with an Id eq filter
Wildcard name with type	Find-PSResource -Name 'test*' -Type Module	Search() with startswith(Id) and a substringof filter on Tags
Tag search, modules	Find-PSResource -Tag CommandsAndResource	Search() with substringof filters on Tags, $top=6000, $orderby
Tag search, scripts	Find-PSResource -Tag 'Tag-Required-Script1-2.5'	The separate items/psscript/Search() route
Tag search, prerelease	Find-PSResource -Tag MyPSTag -Prerelease	IsAbsoluteLatestVersion with includePrerelease=true

There are 5 kinds of request, but some are sent more than once per run:

Probe	Sent per run
Wildcard name with type	4
Tag search, modules	4
Tag search, scripts	4
Tag search, prerelease	4
Find by name	1
Total	17

Search probes, 4 each: one bad instance only fails some requests, about 1 in 5 in my sampling, so a single request per query would usually land on a healthy instance and miss it. Sending each one 4 times gives 16 search requests. A run is flagged when 2 or more of those 16 fail, which catches a bad instance about 86% of the time per run, or about 98% within an hour.

Find by name, 1: it's only there to catch a full outage, so one request is enough. It's retried only if it fails, up to 3 tries. A healthy run sends 17 requests, and a run where find by name fails sends up to 19.

You can change the 4 with $searchSamples in psgallery-health-check.yml. Lowering it to 2 would mean 9 requests per run, but a partial outage would be caught less often per run.

• psgallery-outage-reporter.md (+ compiled .lock.yml): an agentic workflow (gh-aw, Copilot engine) that re-checks the failing requests and, if they're still failing, opens a PR in PowerShell/PowerShellGallery. The PR adds an "Ongoing" entry to the top of psgallery_status.md for the Gallery team to review and merge. If a matching PR is already open, it comments on that PR instead. If the status page already has a matching ongoing entry, it does nothing.
• .github/aw/actions-lock.json and .gitattributes: broilerplate files that (for actions-lock.json) pin the gh-aw setup action and (for .gitattributes) mark generated *.lock.yml files as generated.

Guardrails:

• The agent only has read access to repositories.
• All writes go through gh-aw safe outputs: at most 1 PR and 1 comment per run, only in PowerShell/PowerShellGallery, and the PR may only change psgallery_status.md.
• Shell access is limited to curl, jq, sleep, date, cat and head, and network access is limited to GitHub and PowerShell Gallery domains.

Security review: this adds the repository secret PSGALLERY_STATUS_PR_TOKEN. Only gh-aw's safe-outputs job uses it, to open the PR or comment in PowerShell/PowerShellGallery; the agent itself has read-only permissions. It needs Contents, Pull requests and Issues write on PowerShell/PowerShellGallery. It also requires the existing gh-aw COPILOT_GITHUB_TOKEN secret.

PR Context

This workflow is meant to catch Gallery failures and update the status page as quickly as possible with a ready-to-merge PR.

Tested end to end on a fork (alerickson/PSResourceGet, targeting alerickson/PowerShellGallery):

• With a failing probe, the reporter opened a PR that added a correctly formatted "Ongoing" entry to psgallery_status.md. (see: https://github.com/alerickson/PowerShellGallery/pull/1/changes)
• When the Gallery was healthy, the health check reported no failures and didn't trigger the reporter.

PR Checklist

• PR has a meaningful title
  • Use the present tense and imperative mood when describing your changes
• Summarized changes
• Make sure all .h, .cpp, .cs, .ps1 and .psm1 files have the correct copyright header
• This PR is ready to merge and is not Work in Progress.
  • If the PR is work in progress, please add the prefix WIP: or [ WIP ] to the beginning of the title (the WIP bot will keep its status check at Pending while the prefix is present) and remove the prefix when the PR is ready.
• Breaking changes
  • None
  • OR
  • Documentation needed
    • Issue filed:
• User-facing changes
  • Not Applicable
  • OR
  • Documentation needed
    • Issue filed:
• Testing - New and feature
  • N/A or can only be tested interactively
  • OR
  • Make sure you've added a new test if existing tests do not effectively test the code changed
• Tooling
  • I have considered the user experience from a tooling perspective and don't believe tooling will be impacted.
  • OR
  • I have considered the user experience from a tooling perspective and enumerated concerns in the summary.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟡 Changes recommended

Unresolved issues can misclassify timed-out requests as healthy, duplicate ongoing outage reports, allow broader-than-stated network access, and prevent diagnostic issues from being created.

4 open issues

• Treat curl timeouts as unhealthy even when HTTP status is 200 · New
• Restrict network allowlist to the stated destinations · New
• Use host-repository credentials for diagnostic issues · New
• Match continuing outages regardless of report age · New

What changed in this PR

Adds automated PowerShell Gallery monitoring to help surface failures affecting PSResourceGet users and prepare status-page updates for the Gallery team to review.

Changes:

• Runs scheduled probes every 30 minutes using representative Find-PSResource queries and pooled failure thresholds.
• Adds an agentic reporter that rechecks failures and proposes a status-page PR or comments on an existing report.
• Includes the compiled workflow, pinned setup action, and generated-file metadata.

File	Description
.github/​workflows/​psgallery-outage-reporter.md	Defines re-verification, incident matching, reporting, and write restrictions.
.github/​workflows/​psgallery-outage-reporter.lock.yml	Compiles the reporter into executable GitHub Actions jobs.
.github/​workflows/​psgallery-health-check.yml	Schedules Gallery probes and dispatches the reporter when thresholds are met.
.github/​aw/​actions-lock.json	Pins the gh-aw setup action to a commit.
.gitattributes	Marks compiled workflow files as generated.

_{Review effort: Balanced}

[alerickson]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).