⚙️ [Maintenance]: Process-PSModule caller fleets can be audited consistently

[Marius Storhaug (MariusStorhaug)]

Process-PSModule maintainers can now inventory caller workflows consistently from GitHub or local checkouts, compare the fleet with a target workflow reference, and use one documented caller and lifecycle contract when planning upgrades.

New: Refreshable caller fleet inventory

The inventory command discovers Process-PSModule callers from authenticated GitHub data or checked-out repositories and reports workflow identity, triggers, concurrency, permissions, conditions, references, inputs, secrets, and additional jobs. It produces JSON for automation and linked Markdown for review.

Discovery fails closed when results are incomplete, no matching callers exist, or any matching workflow cannot be parsed. Diagnostic reports still include malformed workflows, and target-reference compliance counts them in the denominator so an incomplete fleet cannot appear fully compliant.

New: Documented caller and lifecycle contracts

The caller contract records the common Process-PSModule job boundary, required controls, explicit credential mappings, restricted fork validation, optional TestData, and rollout prerequisites. The lifecycle specification and design define Plan authority, validation, release reconciliation, recovery, cleanup, concurrency, token boundaries, and immutable prerelease handling without changing runtime workflow code.

The calling guide also clarifies that a reusable-workflow call job cannot declare a GitHub Environment.

---

Technical details

• Adds .github/scripts/Get-ProcessPSModuleWorkflowInventory.ps1 with authenticated GitHub and local Git parameter sets, default-branch reads, worktree deduplication, complete pagination checks, normalized YAML shapes, case-sensitive target matching, and JSON/Markdown output.
• Adds seven Pester tests covering local discovery, target casing, remote default-branch reads, report generation, malformed YAML, empty discovery, and shorthand triggers.
• Adds the generated 60-workflow baseline and the caller-contract evidence page.
• Includes the evergreen lifecycle specification and selected architecture from 📖 [Docs]: Workflow lifecycle behavior ready for review #517.
• Changes no functional workflow implementation and migrates no consumer repository.
• Validation: all seven targeted Pester tests pass; hosted build, lint, CodeQL, and workflow analysis checks gate the final head.
• Implementation plan progress: this PR delivers the inventory and decision-support artifacts for Agree the Process-PSModule caller workflow structure #514. Caller rollout remains in ⚙️ [Maintenance]: [process-v8-major-tag] Roll the v8 caller across the fleet #438.
• Issue convergence sweep: Agree the Process-PSModule caller workflow structure #514 and ⚙️ [Maintenance]: [process-v8-major-tag] Roll the v8 caller across the fleet #438 remain open because this PR supports their decisions and rollout rather than completing them.

Changed surface	Standards checked	Framework docs checked	Result
.github/scripts/**	MSX PowerShell naming, functions, error handling, and testing	Process-PSModule repository and workflow contract	Aligned
docs/content/reference/process-workflow-fleet-*	MSX Markdown and documentation model	Process-PSModule caller interface	Aligned
docs/content/reference/process-workflow-lifecycle-*	MSX spec-driven development and Markdown	Process-PSModule workflow architecture	Aligned
docs/content/guides/calling-the-workflow.md	MSX Markdown and documentation model	GitHub reusable-workflow caller constraints	Fixed in this PR
docs/zensical.toml	MSX documentation navigation	Process-PSModule documentation structure	Aligned

Relevant issues (or links)

Related work

• References Agree the Process-PSModule caller workflow structure #514
• Followed by ⚙️ [Maintenance]: [process-v8-major-tag] Roll the v8 caller across the fleet #438
• References 📖 [Docs]: Workflow lifecycle behavior ready for review #517
• References 📖 [Docs]: Owned automation can roll compatible releases out centrally MSXOrg/docs#176

[github-actions]

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
CSS	Pass ✅
CSS_PRETTIER	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
HTML	Pass ✅
JAVASCRIPT_ES	Pass ✅
JAVASCRIPT_PRETTIER	Pass ✅
MARKDOWN	Pass ✅
NATURAL_LANGUAGE	Pass ✅
POWERSHELL	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter