fix(ci): isolate racing signing analyzer rules #41

2026-10-12T16:00:46Z

KofTwentyTwo commented

2026-10-12 16:00:46 +00:00

(Migrated from github.com)

The Windows signing gate intermittently crashes inside PSScriptAnalyzer 1.25.0 while its rules share lazy PowerShell command metadata. This blocks the standards 1.1.0 release and MarkdownViewr's production signing rollout. The unchanged gate reproduced the CommandInfo.get_Parameters failure locally on the fourth cold process; the first two-pass candidate also failed in CommandInfo.ResolveParameter.

Run PSUseCorrectCasing and PSReservedCmdletChar separately, followed by every remaining configured rule. The latter shares Helper.GetExportedFunction with the comment-help rule, so separating casing alone is insufficient for this exported signing module. All three original source files, pinned analyzer/Pester versions, settings, fatal findings/exceptions, 35 signing tests and ten-minute job timeout are retained. No rules or checks are disabled and no retry conceals failures.

Three negative fixtures require detection of incorrect command casing, a reserved character in an exported cmdlet name, and Write-Host. These validate each pass before analyzing the real signing files. Full exception details remain visible if the analyzer fails again.

Validation:

Exact workflow analyzer body passed 20 predetermined cold PowerShell processes, each covering all three files and all three negative fixtures. Original race reproduced; the rejected two-pass candidate's failure is retained.
All 35 signing/Velopack tests passed with zero skips.
actionlint, actual authenticated online zizmor --min-severity medium, and git diff --check passed; existing suppressions unchanged.
Hosted checks pending at creation. Maintainer review of this exact change is required before merge under K22-AI-01; earlier review of the signing implementation/reference correction is not reused for this new behavior.

Related: PowerShell/PSScriptAnalyzer#1708, KofTwentyTwo/MarkdownViewr.Windows#5, and #40. Substantial AI assistance: Codex (GPT-6).

The Windows signing gate intermittently crashes inside PSScriptAnalyzer 1.25.0 while its rules share lazy PowerShell command metadata. This blocks the standards 1.1.0 release and MarkdownViewr's production signing rollout. The unchanged gate reproduced the `CommandInfo.get_Parameters` failure locally on the fourth cold process; the first two-pass candidate also failed in `CommandInfo.ResolveParameter`. Run `PSUseCorrectCasing` and `PSReservedCmdletChar` separately, followed by every remaining configured rule. The latter shares `Helper.GetExportedFunction` with the comment-help rule, so separating casing alone is insufficient for this exported signing module. All three original source files, pinned analyzer/Pester versions, settings, fatal findings/exceptions, 35 signing tests and ten-minute job timeout are retained. No rules or checks are disabled and no retry conceals failures. Three negative fixtures require detection of incorrect command casing, a reserved character in an exported cmdlet name, and `Write-Host`. These validate each pass before analyzing the real signing files. Full exception details remain visible if the analyzer fails again. Validation: - Exact workflow analyzer body passed 20 predetermined cold PowerShell processes, each covering all three files and all three negative fixtures. Original race reproduced; the rejected two-pass candidate's failure is retained. - All 35 signing/Velopack tests passed with zero skips. - `actionlint`, actual authenticated online `zizmor --min-severity medium`, and `git diff --check` passed; existing suppressions unchanged. - Hosted checks pending at creation. Maintainer review of this exact change is required before merge under K22-AI-01; earlier review of the signing implementation/reference correction is not reused for this new behavior. Related: PowerShell/PSScriptAnalyzer#1708, KofTwentyTwo/MarkdownViewr.Windows#5, and #40. Substantial AI assistance: Codex (GPT-6).

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/standards#41