🚦 [Feature]: Release stable modules on pushes to main

[Marius Storhaug (MariusStorhaug)]

Summary

Moves stable module releases from merged pull_request events to push events on the default branch, while preserving prereleases for open labeled PRs and cleanup-only behavior for closed PRs.

Closes #390.

Changes

• Adds push-to-main coverage and event-safe run names to repository release and workflow validation callers.
• Resolves the merged pull request for a pushed commit with GET /repos/{owner}/{repo}/commits/{sha}/pulls.
• Requires an exact merged-PR commit match before using PR labels, title, body, head ref, or number for a stable release.
• Normalizes event and PR context in Plan settings for version, publish, and cleanup actions.
• Targets stable GitHub tags at the exact tested push SHA.
• Routes open prerelease-labeled PRs to prereleases, default-branch pushes to stable releases, and all closed PRs to prerelease cleanup only.
• Keeps direct pushes build/test-capable but prevents stable publication by default. Set Publish.Module.AllowDirectPushRelease: true to explicitly allow an unassociated default-branch push; normal version-label/auto-patching rules still apply.
• Preserves the existing reusable workflow_call inputs and secrets.

Migration guidance

Caller workflows should add a push trigger for their default branch and retain the existing pull_request trigger for open/update and closed events. Stable publishing now occurs in the push-triggered run, not the merged-PR closed run.

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
    types:
      - opened
      - reopened
      - synchronize
      - labeled
      - unlabeled
      - closed

Callers with event-specific job conditions or run names must avoid assuming github.event.pull_request exists during push runs. Ensure the calling workflow grants contents: write for stable publication and pull-requests: write where PR comments or cleanup are enabled. No reusable workflow input or secret changes are required.

Direct pushes without an associated merged PR are safe by default: build/test stages run, but no stable release is published. Only repositories that intentionally support this path should opt in with:

Publish:
  Module:
    AllowDirectPushRelease: true

Validation

• Associated push to main resolves exact merged PR metadata and routes a stable release.
• Stable GitHub release targets the tested push SHA.
• Open or mismatched PR associations cannot authorize stable publication.
• Direct push without an associated merged PR does not publish by default.
• Open prerelease-labeled PR with important changes retains prerelease behavior.
• Closed merged and unmerged PR events perform prerelease cleanup without stable publication.
• Targeted Pester routing/context tests pass (11 tests).
• Changed PowerShell files pass the repository PSScriptAnalyzer configuration.
• Live commit-to-PR API resolution succeeds against a known merged commit.

Follow-up

After this merges, #84 can be closed as a duplicate of #390. Issue #38 remains the adjacent broader workflow/permission architecture effort.

[github-actions]

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
MARKDOWN	Pass ✅
NATURAL_LANGUAGE	Pass ✅
POWERSHELL	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter