Bump PSModule/Process-PSModule/.github/workflows/workflow.yml from 6.1.13 to 7.0.0

[dependabot]

Bumps PSModule/Process-PSModule/.github/workflows/workflow.yml from 6.1.13 to 7.0.0.

Release notes

Sourced from PSModule/Process-PSModule/.github/workflows/workflow.yml's releases.

v7.0.0

🌟 [Major]: Reusable workflows now use GitHub App orchestration and explicit publish credentials (#408)

Process-PSModule now performs repository inspection, versioning, release management, and pull-request feedback through a configured GitHub App. Publishing uses the explicit PSGALLERY_API_KEY credential consistently from the reusable workflow through the publishing action.

Breaking Changes

Caller workflows must now pass GitHub App credentials and the PowerShell Gallery credential through the reusable workflow contract. Workflows that omit these required secrets fail before their dependent stages run.

secrets:
  PSGALLERY_API_KEY: ${{ secrets.PSGALLERY_API_KEY }}
  GitHubAppClientId: ${{ secrets.GITHUB_APP_CLIENT_ID }}
  GitHubAppPrivateKey: ${{ secrets.GITHUB_APP_PRIVATE_KEY }}

The caller can retain any local GitHub App secret names; only the reusable-workflow boundary names are fixed. PSGALLERY_API_KEY is also the input name of the publishing action.

Changed: Scoped GitHub automation

Every GitHub-dependent stage now mints a short-lived token for the triggering repository and requests only the access it needs. Version planning reads repository and pull-request data, builds read repository metadata, and publishing creates releases, uploads assets, cleans prereleases, and posts pull-request comments through the configured App.

The GitHub App installation needs Contents: write and Pull requests: write. Metadata: read is granted automatically. Permissions such as Actions, Statuses, Pages, and ID tokens remain part of the caller workflow's default github.token path and are not App permissions.

Technical Details

• Plan, Build-Module, and Publish-Module mint repository-scoped installation tokens with pinned actions/create-github-app-token.
• GitHub-facing actions receive the token only through step-scoped GH_TOKEN; the GitHub App path has no github.token fallback.
• The release path, version resolution, repository metadata reads, settings, comments, and prerelease cleanup all use the App token.
• The reusable workflow, publishing action input, action environment variable, and Process-PSModule documentation use PSGALLERY_API_KEY.
• Canonical caller templates and Process-PSModule documentation include the App credential contract, PowerShell Gallery credential, permission matrix, and Dependabot configuration requirement.
• The GitHub-Script named-token-input hardening follow-up remains tracked separately.

• Fixes PSModule/Process-PSModule#510
• PSModule/Process-PSModule#343
• PSModule/GitHub-Script#103

v6.1.20

⚙️ [Maintenance]: Publish and release execution paths are now decoupled (#407)

PowerShell Gallery publishing and GitHub Release creation now run as independent publish-pipeline responsibilities, so each operation reports its own outcome and a partial release can be safely retried.

Changed: Publishing and release operations are separate

Publish-PSModule now publishes the tested module artifact to PowerShell Gallery only. GitHub release creation, release notes, and release-asset upload run through the dedicated Release-PSModule action.

... (truncated)

Commits

• 68a2a7f 🌟 [Major]: Reusable workflows now use GitHub App orchestration and explicit p...
• 15c2814 ⚙️ [Maintenance]: Publish and release execution paths are now decoupled (#407)
• 120554a 📖 [Docs]: Process-PSModule owns the documentation root (#452)
• aa89bbe 📖 [Docs]: Process-PSModule documentation is now organized by task (#448)
• d1e2feb 📖 [Docs]: Process documentation publishes from Process-PSModule (#447)
• bf67cd9 Add generic missed-path coverage reporting (#421)
• 10fc17b ⚙️ [Maintenance]: Authored Functions landing pages stay published (#409)
• 294e7b7 ⚙️ [Maintenance]: GitHub Actions checkouts use least-privilege settings (#412)
• 2b7a3c2 ⚙️ [Maintenance]: Repository agents follow canonical MSX guidance (#422)
• 169c576 🪲 [Fix]: Wildcard maximum versions no longer fail module processing (#446)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)