fix(scripts): add per-violation Write-Host and Write-CIAnnotation output to Test-DependencyPinning

[AhmedMustafa249]

Pull Request

Description

• add grouped-by-file Write-Host output with per-violation detail lines
• add Write-CIAnnotation Warning call per unpinned dependency with file and line
• add global Pester mocks for Write-Host, Write-CIAnnotation, and Write-CIStepSummary
• add 6 test assertions covering violation and clean-scan CI output paths

Related Issue(s)

Fixes #631

Type of Change

Select all that apply:

Code & Documentation:

• Bug fix (non-breaking change fixing an issue)
• New feature (non-breaking change adding functionality)
• Breaking change (fix or feature causing existing functionality to change)
• Documentation update

Infrastructure & Configuration:

• GitHub Actions workflow
• Linting configuration (markdown, PowerShell, etc.)
• Security configuration
• DevContainer configuration
• Dependency update

Other:

• Script/automation (.ps1, .sh, .py)
• Other (please describe):

Testing

• npm run lint:ps — All 49 PowerShell files pass PSScriptAnalyzer checks
• npm run test:ps — 62/62 dependency pinning tests pass, 0 failures, 0 regressions
• Patch coverage: 100% (9/9 executable lines), exceeds 80% gate

Checklist

Required Checks

• Documentation is updated (if applicable)
• Files follow existing naming conventions
• Changes are backwards compatible (if applicable)
• Tests added for new functionality (if applicable)

Required Automated Checks

The following validation commands must pass before merging:

• Markdown linting: npm run lint:md
• Spell checking: npm run spell-check
• Frontmatter validation: npm run lint:frontmatter
• Link validation: npm run lint:md-links
• PowerShell analysis: npm run lint:ps

Security Considerations

• This PR does not contain any sensitive or NDA information
• Any new dependencies have been reviewed for security issues
• Security-related scripts follow the principle of least privilege

Additional Notes

• Annotation placement order

The reference pattern in Invoke-PSScriptAnalyzer.ps1 emits Write-CIAnnotation before Write-Host for each violation. This implementation reverses that order (Write-Host first, then Write-CIAnnotation). Both execute synchronously within the same loop iteration so there is no functional impact. A follow-up can swap the order for cross-script consistency.

• Workflow annotation deduplication

Dependency-pinning-scan.yml (lines 116–136) iterates violations from the JSON report and emits ::warning annotations. The script now also emits Write-CIAnnotation -Level Warning per violation, producing duplicate annotations with different message formats. This duplication is accepted per issue #631 scope. A follow-up issue can remove the workflow's inline ::warning loop or gate it on a script output flag.

[Copilot]

Pull request overview

Adds richer CI/log output to the dependency pinning security scan so contributors can see per-violation details directly in logs and as CI annotations, with accompanying Pester coverage.

Changes:

• Emit grouped-by-file Write-Host output for dependency pinning violations (and a success line when clean).
• Emit per-violation Write-CIAnnotation -Level Warning with file/line targeting.
• Add Pester mocks + assertions to validate both “clean scan” and “violations” output paths.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
scripts/security/Test-DependencyPinning.ps1	Adds per-violation console output and CI annotations within Invoke-DependencyPinningAnalysis.
scripts/tests/security/Test-DependencyPinning.Tests.ps1	Mocks CI output functions and adds assertions for success/no-violation and violation scenarios.

[WilliamBerryiii]

Thanks for the contribution, @AhmedMustafa249! Welcome to the project 🎉

We'll start the review shortly.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 12.50000% with 14 lines in your changes missing coverage. Please review.
✅ Project coverage is 85.08%. Comparing base (ae3a35d) to head (6f47f0e).

Files with missing lines	Patch %	Lines
scripts/security/Test-DependencyPinning.ps1	12.50%	14 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #640      +/-   ##
==========================================
- Coverage   85.36%   85.08%   -0.29%     
==========================================
  Files          23       23              
  Lines        4475     4491      +16     
==========================================
+ Hits         3820     3821       +1     
- Misses        655      670      +15     

Flag	Coverage Δ
pester	85.08% <12.50%> (-0.29%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
scripts/security/Test-DependencyPinning.ps1	84.21% <12.50%> (-3.52%)	⬇️

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.