Import-TestData: use Write-Host for workflow commands/status; validate GITHUB_ENV

Addresses Copilot review threads: switch the four Write-Output calls (no-op notice, ::add-mask::, and the two 'Exposed N ...' status lines) to Write-Host so they go to the information stream instead of the success/pipeline stream. This keeps the secret embedded in ::add-mask:: out of the function's return value and prevents status text from interfering with callers using Import-TestData in an expression context. Module already carries a module-level PSAvoidUsingWriteHost suppression, so no new suppression is needed.

Also validate GITHUB_ENV up front and throw a clear message instead of letting Add-Content fail with a generic parameter-binding error when run outside GitHub Actions.

Adds tests/Import-TestData.Tests.ps1 (wired into Action-Test.yml) to close the coverage gap: asserts nothing reaches the success stream, masking still happens on the information stream, the no-op path is silent, and the GITHUB_ENV guard fires.

Author: MariusStorhaug

.github/workflows/Action-Test.yml

@@ -42,3 +42,7 @@ jobs:
       - name: Run Install-PSModule regression tests
         shell: pwsh
         run: ./tests/Install-PSModule.Tests.ps1
+
+      - name: Run Import-TestData tests
+        shell: pwsh
+        run: ./tests/Import-TestData.Tests.ps1

src/Helpers/Helpers.psm1

@@ -1207,9 +1207,12 @@ function Import-TestData {
     param()
 
     if ([string]::IsNullOrWhiteSpace($env:PSMODULE_TEST_DATA)) {
-        Write-Output 'No test data was provided by the calling workflow.'
+        Write-Host 'No test data was provided by the calling workflow.'
         return
     }
+    if ([string]::IsNullOrWhiteSpace($env:GITHUB_ENV)) {
+        throw 'Import-TestData requires the GITHUB_ENV environment file, which is only available inside GitHub Actions.'
+    }
     try {
         $data = $env:PSMODULE_TEST_DATA | ConvertFrom-Json -ErrorAction Stop
     } catch {
@@ -1298,7 +1301,7 @@ function Import-TestData {
                 foreach ($line in ($value -split "`n")) {
                     $line = $line.TrimEnd("`r")
                     if ($line.Length -gt 0) {
-                        Write-Output "::add-mask::$line"
+                        Write-Host "::add-mask::$line"
                     }
                 }
             }
@@ -1312,9 +1315,9 @@ function Import-TestData {
         }
         if ($count -gt 0) {
             if ($Mask) {
-                Write-Output "Exposed $count secret value(s) as environment variables."
+                Write-Host "Exposed $count secret value(s) as environment variables."
             } else {
-                Write-Output "Exposed $count variable value(s) as environment variables."
+                Write-Host "Exposed $count variable value(s) as environment variables."
             }
         }
     }

tests/Import-TestData.Tests.ps1

@@ -0,0 +1,75 @@
+[CmdletBinding()]
+param()
+
+$ErrorActionPreference = 'Stop'
+
+$repoRoot = Split-Path -Path $PSScriptRoot -Parent
+$helpersManifestPath = Join-Path -Path $repoRoot -ChildPath 'src/Helpers/Helpers.psd1'
+$testRoot = Join-Path -Path ([System.IO.Path]::GetTempPath()) -ChildPath "Import-TestData-$([guid]::NewGuid())"
+
+$assert = {
+    param(
+        [bool] $Condition,
+        [string] $Message
+    )
+
+    if (-not $Condition) {
+        throw $Message
+    }
+}
+
+$originalTestData = $env:PSMODULE_TEST_DATA
+$originalGitHubEnv = $env:GITHUB_ENV
+
+try {
+    New-Item -Path $testRoot -ItemType Directory -Force | Out-Null
+
+    Remove-Module -Name Helpers -Force -ErrorAction SilentlyContinue
+    Import-Module -Name $helpersManifestPath -Force
+
+    $githubEnvPath = Join-Path -Path $testRoot -ChildPath 'github_env'
+
+    # Secrets and variables are written to GITHUB_ENV, and nothing leaks to the success/pipeline stream.
+    Set-Content -Path $githubEnvPath -Value '' -NoNewline
+    $env:GITHUB_ENV = $githubEnvPath
+    $env:PSMODULE_TEST_DATA = '{"secrets":{"MY_SECRET":"not-a-real-secret"},"variables":{"MY_VARIABLE":"plain-text-value"}}'
+
+    $pipelineOutput = Import-TestData 3> $null 4> $null 5> $null 6> $null
+
+    & $assert ($null -eq $pipelineOutput) 'Import-TestData must not write workflow commands or status messages to the success/pipeline output stream.'
+
+    $envContent = Get-Content -Path $githubEnvPath -Raw
+    & $assert ($envContent -match 'MY_SECRET<<') 'Expected the secret to be written to GITHUB_ENV using heredoc syntax.'
+    & $assert ($envContent -like '*not-a-real-secret*') 'Expected the secret value to be written to GITHUB_ENV.'
+    & $assert ($envContent -match 'MY_VARIABLE<<') 'Expected the variable to be written to GITHUB_ENV using heredoc syntax.'
+    & $assert ($envContent -like '*plain-text-value*') 'Expected the variable value to be written to GITHUB_ENV.'
+
+    # The mask command is emitted on the information stream (never the success stream).
+    Set-Content -Path $githubEnvPath -Value '' -NoNewline
+    $env:PSMODULE_TEST_DATA = '{"secrets":{"MY_SECRET":"not-a-real-secret"}}'
+    $information = Import-TestData 6>&1 | Out-String
+    & $assert ($information -match '::add-mask::not-a-real-secret') 'Expected the secret value to be masked via ::add-mask:: on the information stream.'
+
+    # A no-op when no test data is provided; nothing on the success/pipeline stream.
+    $env:PSMODULE_TEST_DATA = ''
+    $noopOutput = Import-TestData 3> $null 4> $null 5> $null 6> $null
+    & $assert ($null -eq $noopOutput) 'The no-op path must not emit anything to the success/pipeline output stream.'
+
+    # Missing GITHUB_ENV fails fast with a clear message instead of a generic parameter-binding error.
+    $env:PSMODULE_TEST_DATA = '{"variables":{"MY_VARIABLE":"plain-text-value"}}'
+    $env:GITHUB_ENV = ''
+    $clearError = $false
+    try {
+        Import-TestData 6> $null
+    } catch {
+        $clearError = $_.Exception.Message -like '*GITHUB_ENV*'
+    }
+    & $assert $clearError 'Expected a clear error mentioning GITHUB_ENV when the environment file is not available.'
+} finally {
+    $env:PSMODULE_TEST_DATA = $originalTestData
+    $env:GITHUB_ENV = $originalGitHubEnv
+    Remove-Module -Name Helpers -Force -ErrorAction SilentlyContinue
+    if (Test-Path -Path $testRoot) {
+        Remove-Item -Path $testRoot -Recurse -Force
+    }
+}