Repository: Accenture/AutoFixture.XUnit2.AutoMock
Pull request #247: Prevent run shell injection on actions
Author: login: piotrzajac
Created: 2025-04-18T05:58:50Z | Merged: 2025-04-18T13:13:08Z



<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit

- **Chores**
  - Updated internal workflows to use environment variables for passing inputs to scripts, improving clarity and consistency in GitHub Actions.
  - Explicitly specified the PowerShell shell for relevant workflow steps.
  - Enhanced error handling in workflows by configuring scripts to halt immediately on errors.
  - Added semantic version validation to tagging workflow to ensure correct version formats.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->


Diff:
diff --git a/.github/actions/materialize-signing-key/action.yml b/.github/actions/materialize-signing-key/action.yml
index dd244b58..e7b2020d 100644
--- a/.github/actions/materialize-signing-key/action.yml
+++ b/.github/actions/materialize-signing-key/action.yml
@@ -17,10 +17,13 @@ runs:
   steps:
     - name: 🖊️ materialize signing key
       id: signing-key
+      shell: pwsh
       run: |
-        $path = [IO.Path]::Combine("${{ github.workspace }}","src","${{ inputs.signing-key-file-name }}")
-        [IO.File]::WriteAllBytes($path, [Convert]::FromBase64String("$env:StrongNameKey"))
+        $ErrorActionPreference = 'stop'
+        $path = [IO.Path]::Combine("${env:WORKING_DIRECTORY}","src","${env:SIGNING_KEY_FILE_NAME}")
+        [IO.File]::WriteAllBytes($path, [Convert]::FromBase64String("${env:STRONG_NAME_KEY}"))
         "PATH=$path" >> $env:GITHUB_OUTPUT
-      shell: pwsh
       env:
-        StrongNameKey: ${{ inputs.signing-key-value }}
+        STRONG_NAME_KEY: ${{ inputs.signing-key-value }}
+        SIGNING_KEY_FILE_NAME: ${{ inputs.signing-key-file-name }}
+        WORKING_DIRECTORY: ${{ github.workspace }}
diff --git a/.github/actions/test-and-collect-coverage/action.yml b/.github/actions/test-and-collect-coverage/action.yml
index 6d26921b..76ed5d5b 100644
--- a/.github/actions/test-and-collect-coverage/action.yml
+++ b/.github/actions/test-and-collect-coverage/action.yml
@@ -22,11 +22,21 @@ runs:
   steps:
     - name: 🧪 test ${{ inputs.module-name }} in ${{ inputs.target-framework }} & collect coverage
       id: test-and-collect-code-coverage
-      run: |
-        $path = [IO.Path]::Combine("${{ inputs.coverage-directory }}","${{ inputs.module-namespace }}.${{ inputs.module-name }}.xml")
-        dotnet test ./src/${{ inputs.module-namespace }}.${{ inputs.module-name }}.Tests/ --no-build -f ${{ inputs.target-framework }} -e:CollectCoverage=true -e:CoverletOutputFormat=opencover -e:Exclude="[xunit*]*" -e:CoverletOutput=$path
-        "FILE=${{ inputs.module-namespace }}.${{ inputs.module-name }}.${{ inputs.target-framework }}.xml" >> $env:GITHUB_OUTPUT
       shell: pwsh
+      run: |
+        $ErrorActionPreference = 'stop'
+        $path = [IO.Path]::Combine("${env:COVERAGE_DIRECTORY}", "${env:MODULE_NAMESPACE}.${env:MODULE_NAME}.xml")
+        dotnet test ./src/${env:MODULE_NAMESPACE}.${env:MODULE_NAME}.Tests/ --no-build -f ${env:TARGET_FRAMEWORK} -e:CollectCoverage=true -e:CoverletOutputFormat=opencover -e:Exclude="[xunit*]*" -e:CoverletOutput=$path
+        if ($LastExitCode -ne 0) {
+          throw "dotnet test failed with exit code $LastExitCode"
+        }
+
+        "FILE=${env:MODULE_NAMESPACE}.${env:MODULE_NAME}.${env:TARGET_FRAMEWORK}.xml" >> $env:GITHUB_OUTPUT
+      env:
+        COVERAGE_DIRECTORY: ${{ inputs.coverage-directory }}
+        MODULE_NAME: ${{ inputs.module-name }}
+        MODULE_NAMESPACE: ${{ inputs.module-namespace }}
+        TARGET_FRAMEWORK: ${{ inputs.target-framework }}
     - name: 📤 upload coverage reports to Codecov
       uses: codecov/codecov-action@v3
       with:
diff --git a/.github/workflows/build-test-pack.yml b/.github/workflows/build-test-pack.yml
index 80b909e4..c618e80a 100644
--- a/.github/workflows/build-test-pack.yml
+++ b/.github/workflows/build-test-pack.yml
@@ -62,14 +62,32 @@ jobs:
         restore-keys: |
           ${{ runner.os }}-nuget-${{ inputs.module-name }}
     - name: 🏗️ build
-      run: dotnet build ./src/${{ inputs.module-namespace }}.${{ inputs.module-name }}.sln
+      run: |
+        $ErrorActionPreference = 'stop'
+        dotnet build ./src/${env:MODULE_NAMESPACE}.${env:MODULE_NAME}.sln
+        if ($LastExitCode -ne 0) {
+          throw "dotnet build failed with exit code $LastExitCode"
+        }
       env:
+        MODULE_NAMESPACE: ${{ inputs.module-namespace }}
+        MODULE_NAME: ${{ inputs.module-name }}
         StrongNameKey: ${{ secrets.signing-key-value }}
         StrongNameKeyPath: ${{ steps.signing-key.outputs.file-path }}
     - name: 🧪 test ${{ inputs.module-name }} in [net472, net48]
       run: |
-        dotnet test ./src/${{ inputs.module-namespace }}.${{ inputs.module-name }}.Tests/ --no-build -f net472
-        dotnet test ./src/${{ inputs.module-namespace }}.${{ inputs.module-name }}.Tests/ --no-build -f net48
+        $ErrorActionPreference = 'stop'
+        dotnet test ./src/${env:MODULE_NAMESPACE}.${env:MODULE_NAME}.Tests/ --no-build -f net472
+        if ($LastExitCode -ne 0) {
+          throw "dotnet test failed with exit code $LastExitCode"
+        }
+
+        dotnet test ./src/${env:MODULE_NAMESPACE}.${env:MODULE_NAME}.Tests/ --no-build -f net48
+        if ($LastExitCode -ne 0) {
+          throw "dotnet test failed with exit code $LastExitCode"
+        }
+      env:
+          MODULE_NAMESPACE: ${{ inputs.module-namespace }}
+          MODULE_NAME: ${{ inputs.module-name }}
     - name: 🧪 test ${{ inputs.module-name }} in net8.0 & collect coverage
       uses: ./.github/actions/test-and-collect-coverage
       with:
@@ -79,10 +97,17 @@ jobs:
         target-framework: net8.0
     - name: 📦 pack
       if: ${{ startsWith(inputs.module-name, 'Auto' ) }}
-      run: dotnet pack ./src/${{ inputs.module-namespace }}.${{ inputs.module-name }}
+      run: |
+        $ErrorActionPreference = 'stop'
+        dotnet pack ./src/${env:MODULE_NAMESPACE}.${env:MODULE_NAME}
+        if ($LastExitCode -ne 0) {
+          throw "dotnet pack failed with exit code $LastExitCode"
+        }
       env:
-          StrongNameKey: ${{ secrets.signing-key-value }}
-          StrongNameKeyPath: ${{ steps.signing-key.outputs.file-path }}
+        MODULE_NAMESPACE: ${{ inputs.module-namespace }}
+        MODULE_NAME: ${{ inputs.module-name }}
+        StrongNameKey: ${{ secrets.signing-key-value }}
+        StrongNameKeyPath: ${{ steps.signing-key.outputs.file-path }}
     - name: 🔼 upload packages
       if: ${{ startsWith(inputs.module-name, 'Auto' ) }}
       uses: actions/upload-artifact@v4
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 35e4661b..02814e71 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -55,7 +55,12 @@ jobs:
       with:
         languages: ${{ matrix.language }}
     - name: 🏗️ build
-      run: dotnet build ./src/Objectivity.AutoFixture.XUnit2.AutoMock.sln
+      run: |
+        $ErrorActionPreference = 'stop'
+        dotnet build ./src/Objectivity.AutoFixture.XUnit2.AutoMock.sln
+        if ($LastExitCode -ne 0) {
+          throw "dotnet build failed with exit code $LastExitCode"
+        }
     - name: 🔬 analyze with CodeQL
       uses: github/codeql-action/analyze@v3
       with:
diff --git a/.github/workflows/init.yml b/.github/workflows/init.yml
index 61a9575d..a17dca2a 100644
--- a/.github/workflows/init.yml
+++ b/.github/workflows/init.yml
@@ -53,14 +53,42 @@ jobs:
     - name: 🎰 determine modules
       id: determine-modules
       run: |
-        $allModules = @{
-          AutoMoq = if ('${{inputs.buildAutoMoq}}') { $${{inputs.buildAutoMoq}} } else { $true };
-          AutoNSubstitute = if ('${{inputs.buildAutoNSubstitute}}') { $${{inputs.buildAutoNSubstitute}} } else { $true };
-          AutoFakeItEasy = if ('${{inputs.buildAutoFakeItEasy}}') { $${{inputs.buildAutoFakeItEasy}} } else { $true }
+        $ErrorActionPreference = 'stop'
+        $inputModules = @{
+          AutoMoq = "${env:BUILD_AUTO_MOQ}";
+          AutoNSubstitute = "${env:BUILD_AUTO_NSUBSTITUTE}";
+          AutoFakeItEasy = "${env:BUILD_AUTO_FAKEITEASY}"
         }
-        $selectedModules = @(Foreach ($module in ($allModules.GetEnumerator() | Where-Object { $_.Value })) {$module.Name})
+
+        Write-Output "::group::Input parameters"
+        foreach ($module in $inputModules.GetEnumerator()) {
+          Write-Output "Build $($module.Name): $($module.Value)"
+        }
+        Write-Output "::endgroup::"
+
+        $selectedModules = @()
+        foreach ($module in $inputModules.GetEnumerator()) {
+          [bool]$shouldBuildModule = $true
+          if ([bool]::TryParse($module.Value, [ref]$shouldBuildModule) -eq $false) {
+            Write-Host "::debug::Unable to parse input value for module $($module.Name)."
+          }
+          if ($shouldBuildModule) {
+            $selectedModules += $module.Name
+          }
+        }
+
         if ($selectedModules.count -gt 0) { $selectedModules = @("Core") + $selectedModules }
+        Write-Output "::group::Selected modules"
+        foreach ($selectedModule in $selectedModules) {
+          Write-Output "$($selectedModule)"
+        }
+        Write-Output "::endgroup::"
+
         "modules=$($selectedModules | ConvertTo-JSON -AsArray -Compress)" >> $env:GITHUB_OUTPUT
+      env:
+        BUILD_AUTO_FAKEITEASY: ${{ inputs.buildAutoFakeItEasy }}
+        BUILD_AUTO_MOQ: ${{ inputs.buildAutoMoq }}
+        BUILD_AUTO_NSUBSTITUTE: ${{ inputs.buildAutoNSubstitute }}
     - name: 🎱 determine next version
       id: determine-version
       uses: ./.github/actions/determine-next-version
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index ded2db41..3336bb06 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -37,4 +37,12 @@ jobs:
         pattern: packages-*
         merge-multiple: true
     - name: 📤 push
-      run: dotnet nuget push **/*.nupkg --api-key ${{ secrets[matrix.packageSource.apiKeySecretName] }} --source "${{ matrix.packageSource.url }}" --skip-duplicate
+      run: |
+        $ErrorActionPreference = 'stop'
+        dotnet nuget push **/*.nupkg --api-key ${env:API_KEY} --source "${env:PACKAGE_SOURCE_URL}" --skip-duplicate
+        if ($LastExitCode -ne 0) {
+          throw "dotnet nuget push failed with exit code $LastExitCode"
+        }
+      env:
+        API_KEY: ${{ secrets[matrix.packageSource.apiKeySecretName] }}
+        PACKAGE_SOURCE_URL: ${{ matrix.packageSource.url }}
diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index 8d27b249..c377b041 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -18,6 +18,10 @@ on:
     - cron: '38 7 * * 0' # Random time
   workflow_dispatch:
 
+defaults:
+  run:
+    shell: bash
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
diff --git a/.github/workflows/snyk.yml b/.github/workflows/snyk.yml
index 3adc291f..192da1a3 100644
--- a/.github/workflows/snyk.yml
+++ b/.github/workflows/snyk.yml
@@ -18,10 +18,14 @@ on:
     - cron: '14 6 * * 0' # Random time
   workflow_dispatch:
   
+defaults:
+  run:
+    shell: pwsh
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
-  
+
 jobs:
   scan:
     runs-on: ubuntu-latest
@@ -35,7 +39,12 @@ jobs:
         with:
           fetch-depth: 0 
       - name: 🏗️ restore dependencies
-        run: dotnet restore ./src/Objectivity.AutoFixture.XUnit2.AutoMock.sln
+        run: |
+          $ErrorActionPreference = 'stop'
+          dotnet restore ./src/Objectivity.AutoFixture.XUnit2.AutoMock.sln
+          if ($LastExitCode -ne 0) {
+            throw "dotnet restore failed with exit code $LastExitCode"
+          }
       - name: 🔬 snyk opensource scan
         uses: snyk/actions/dotnet@master
         continue-on-error: true
@@ -62,4 +71,4 @@ jobs:
         uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: snyk
-        if: ${{ always() }}
\ No newline at end of file
+        if: ${{ always() }}
diff --git a/.github/workflows/tag.yml b/.github/workflows/tag.yml
index b086dd88..ce46e56c 100644
--- a/.github/workflows/tag.yml
+++ b/.github/workflows/tag.yml
@@ -25,5 +25,20 @@ jobs:
         fetch-depth: 0
     - name: 🏷️ tag version
       run: |
-        git tag "${{ inputs.version }}"
-        git push origin "${{ inputs.version }}"        
\ No newline at end of file
+        $ErrorActionPreference = 'stop'
+        $semanticVersionFormat = '^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$'
+        if ($env:PACKAGE_VERSION -notmatch $semanticVersionFormat) {
+          throw "Invalid version format: $($env:PACKAGE_VERSION). Expected format should follow Semantic Versioning 2.0.0 (https://semver.org/)."
+        }
+
+        git tag "${env:PACKAGE_VERSION}"
+        if ($LastExitCode -ne 0) {
+          throw "git tag failed with exit code $LastExitCode"
+        }
+
+        git push origin "${env:PACKAGE_VERSION}"
+        if ($LastExitCode -ne 0) {
+          throw "git push failed with exit code $LastExitCode"
+        }
+      env:
+        PACKAGE_VERSION: ${{ inputs.version }}
diff --git a/.github/workflows/test-mutations.yml b/.github/workflows/test-mutations.yml
index 2ab66ff7..3a31dbcc 100644
--- a/.github/workflows/test-mutations.yml
+++ b/.github/workflows/test-mutations.yml
@@ -48,12 +48,26 @@ jobs:
         signing-key-value: ${{ secrets.SIGNING_KEY }}
     - name: 💾 install stryker.net
       run: |
+        $ErrorActionPreference = 'stop'
         dotnet new tool-manifest
+        if ($LastExitCode -ne 0) {
+          throw "dotnet new failed with exit code $LastExitCode"
+        }
+
         dotnet tool install --local dotnet-stryker
+        if ($LastExitCode -ne 0) {
+          throw "dotnet tool install failed with exit code $LastExitCode"
+        }
     - name: 👾 test mutations
       working-directory: ./src
       run: |
-        dotnet tool run dotnet-stryker -f ../stryker-config.yml -r dashboard -v ${{ github.ref_name }} --dashboard-api-key ${{ secrets.STRYKER_API_KEY }}
+        $ErrorActionPreference = 'stop'
+        dotnet tool run dotnet-stryker -f ../stryker-config.yml -r dashboard -v ${env:BRANCH_NAME} --dashboard-api-key ${env:API_KEY}
+        if ($LastExitCode -ne 0) {
+          throw "dotnet tool run failed with exit code $LastExitCode"
+        }
       env:
+        API_KEY: ${{ secrets.STRYKER_API_KEY }}
+        BRANCH_NAME: ${{ github.ref_name }}
         StrongNameKey: ${{ secrets.SIGNING_KEY }}
         StrongNameKeyPath: ${{ steps.signing-key.outputs.file-path }}


Reviews:
user: login: coderabbitai[bot]
body: **Actionable comments posted: 0**

<details>
<summary>🧹 Nitpick comments (2)</summary><blockquote>

<details>
<summary>.github/actions/materialize-signing-key/action.yml (1)</summary><blockquote>

`22-24`: **Enable fail-fast behavior in the PowerShell script**  
By default, non-terminating errors in PowerShell may not stop the script. It’s best practice to set a strict error policy so that any failure in path construction or base64 decoding aborts the action immediately.  


Apply this patch inside the `run: |` block to enforce stop-on-error:

```diff
 run: |
+        $ErrorActionPreference = 'Stop'
         $path = [IO.Path]::Combine("$env:WORKING_DIRECTORY","src","$env:SIGNING_KEY_FILE_NAME")
         [IO.File]::WriteAllBytes($path, [Convert]::FromBase64String("$env:STRONG_NAME_KEY"))
         "PATH=$path" >> $env:GITHUB_OUTPUT
```

</blockquote></details>
<details>
<summary>.github/actions/test-and-collect-coverage/action.yml (1)</summary><blockquote>

`27-29`: **Enable fail-fast behavior in the PowerShell script**  
To prevent silent continuation on non-terminating errors (e.g., path issues or dotnet failures), set an explicit error policy.  


Apply this patch at the top of the `run: |` block:

```diff
 run: |
+        $ErrorActionPreference = 'Stop'
         $path = [IO.Path]::Combine("$env:COVERAGE_DIRECTORY", "$env:MODULE_NAMESPACE.$env:MODULE_NAME.xml")
         dotnet test ./src/$env:MODULE_NAMESPACE.$env:MODULE_NAME.Tests/ --no-build -f $env:TARGET_FRAMEWORK -e:CollectCoverage=true -e:CoverletOutputFormat=opencover -e:Exclude="[xunit*]*" -e:CoverletOutput=$path
         "FILE=$env:MODULE_NAMESPACE.$env:MODULE_NAME.$env:TARGET_FRAMEWORK.xml" >> $env:GITHUB_OUTPUT
```

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between ad278dacc523111c810750306ff25a0255866bce and 733b3a6aa1329bef3b0cebabcab3c6dc9720a157.

</details>

<details>
<summary>📒 Files selected for processing (2)</summary>

* `.github/actions/materialize-signing-key/action.yml` (1 hunks)
* `.github/actions/test-and-collect-coverage/action.yml` (1 hunks)

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (5)</summary>

* GitHub Check: build-test-pack (AutoFakeItEasy) / run
* GitHub Check: build-test-pack (AutoNSubstitute) / run
* GitHub Check: build-test-pack (Core) / run
* GitHub Check: build-test-pack (AutoMoq) / run
* GitHub Check: test

</details>

<details>
<summary>🔇 Additional comments (4)</summary><blockquote>

<details>
<summary>.github/actions/materialize-signing-key/action.yml (2)</summary>

`20-20`: **Explicitly set PowerShell as the shell**  
Specifying `shell: pwsh` makes the composite action’s behavior consistent across runners and prevents fallback to default shells.

---

`26-28`: **Centralize inputs via environment variables**  
Mapping inputs to `STRONG_NAME_KEY`, `SIGNING_KEY_FILE_NAME`, and `WORKING_DIRECTORY` reduces direct interpolation and mitigates shell‐injection risks.

</details>
<details>
<summary>.github/actions/test-and-collect-coverage/action.yml (2)</summary>

`25-25`: **Explicitly set PowerShell as the shell**  
Consistently using `shell: pwsh` ensures the script runs under PowerShell and avoids surprises on different runners.

---

`31-34`: **Centralize inputs via environment variables**  
Assigning `coverage-directory`, `module-name`, `module-namespace`, and `target-framework` to `COVERAGE_DIRECTORY`, `MODULE_NAME`, `MODULE_NAMESPACE`, and `TARGET_FRAMEWORK` aligns with the materialize-key action pattern and guards against injection.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: NONE
submitted_at: 2025-04-18T06:01:21Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 1**

<details>
<summary>🧹 Nitpick comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/snyk.yml (1)</summary><blockquote>

`21-24`: **Default shell set to PowerShell**  
Introducing the `defaults` block with `shell: pwsh` standardizes all run steps to PowerShell. This aligns with other workflows and ensures consistent behavior.  
However, line 24 contains trailing spaces—this can cause YAML lint warnings. Consider removing these extra spaces.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 YAMLlint (1.35.1)</summary>

[error] 24-24: trailing spaces

(trailing-spaces)

</details>

</details>

</blockquote></details>
<details>
<summary>.github/workflows/tag.yml (1)</summary><blockquote>

`28-32`: **Use environment variable for tagging and enforce strict error handling**  
Switching to `$env:PACKAGE_VERSION` prevents shell interpolation risks and standardizes input access. Setting `$ErrorActionPreference = 'stop'` ensures that tagging or push failures are caught immediately.  
The file currently lacks a newline at EOF (YAMLlint warning at line 32); please add a trailing newline.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 YAMLlint (1.35.1)</summary>

[error] 32-32: no new line character at the end of file

(new-line-at-end-of-file)

</details>

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between c10adef149451fdfc71aa4ebfaa8f0aa4c1cebc1 and 9deb657350fba83a14bda26cd3dc50104c4da231.

</details>

<details>
<summary>📒 Files selected for processing (8)</summary>

* `.github/workflows/build-test-pack.yml` (2 hunks)
* `.github/workflows/codeql.yml` (1 hunks)
* `.github/workflows/init.yml` (1 hunks)
* `.github/workflows/publish.yml` (1 hunks)
* `.github/workflows/semgrep.yml` (2 hunks)
* `.github/workflows/snyk.yml` (2 hunks)
* `.github/workflows/tag.yml` (1 hunks)
* `.github/workflows/test-mutations.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 YAMLlint (1.35.1)</summary>

<details>
<summary>.github/workflows/tag.yml</summary>

[error] 32-32: no new line character at the end of file

(new-line-at-end-of-file)

</details>
<details>
<summary>.github/workflows/snyk.yml</summary>

[error] 24-24: trailing spaces

(trailing-spaces)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: scan (csharp)
* GitHub Check: test

</details>

<details>
<summary>🔇 Additional comments (14)</summary><blockquote>

<details>
<summary>.github/workflows/codeql.yml (1)</summary>

`58-60`: **Set PowerShell to halt on errors in build step**  
Setting `$ErrorActionPreference = 'stop'` before `dotnet build` enforces immediate failure on any build error, improving the reliability of your CI pipeline.

</details>
<details>
<summary>.github/workflows/snyk.yml (1)</summary>

`42-44`: **Enforce failure on errors during dependency restore**  
Adding `$ErrorActionPreference = 'stop'` to the `dotnet restore` command ensures that any restore failures fail the step immediately, preventing false positives.

</details>
<details>
<summary>.github/workflows/semgrep.yml (2)</summary>

`21-24`: **Standardize PowerShell as default shell**  
Adding the `defaults` block with `shell: pwsh` ensures consistency across all run steps, aligning with other workflows in this PR.

---

`47-49`: **Immediate failure on Semgrep errors**  
Setting `$ErrorActionPreference = 'stop'` before `semgrep ci` ensures any scan errors surface immediately rather than being overlooked.

</details>
<details>
<summary>.github/workflows/publish.yml (1)</summary>

`40-45`: **Secure and robust NuGet push step**  
Using `$ErrorActionPreference = 'stop'` along with explicit environment variables for `API_KEY` and `PACKAGE_SOURCE_URL` avoids inline secret interpolation and guards against silent failures. Paths and variables are correctly quoted to prevent injection.

</details>
<details>
<summary>.github/workflows/test-mutations.yml (3)</summary>

`51-51`: **Set PowerShell to halt on errors in install step.**

The addition of `$ErrorActionPreference = 'stop'` ensures the script will fail immediately on any error during the Stryker.NET tool installation, preventing silent failures.

---

`57-58`: **Enforce error handling and use environment variables for safe parameter passing.**

Adding `$ErrorActionPreference = 'stop'` in the mutation testing step improves reliability, and referencing `$env:BRANCH_NAME` and `$env:API_KEY` instead of inline context expressions mitigates shell-injection risks.

---

`60-61`: **Explicitly define environment variables for the dashboard API key and branch.**

Mapping `API_KEY` to `${{ secrets.STRYKER_API_KEY }}` and `BRANCH_NAME` to `${{ github.ref_name }}` is clear, keeps secrets masked, and aligns with the new pattern of env-based parameter passing.

</details>
<details>
<summary>.github/workflows/init.yml (2)</summary>

`56-56`: **Set PowerShell to halt on errors in the module-selection step.**

Including `$ErrorActionPreference = 'stop'` at the start of the determine-modules script guarantees the workflow will abort on any unexpected errors during flag evaluation.

---

`65-68`: **Explicitly pass inputs as environment variables.**

Mapping `BUILD_AUTO_FAKEITEASY`, `BUILD_AUTO_MOQ`, and `BUILD_AUTO_NSUBSTITUTE` from the `workflow_call` inputs into the `env` block improves consistency with other workflows and makes the script’s dependencies explicit.

</details>
<details>
<summary>.github/workflows/build-test-pack.yml (4)</summary>

`66-70`: **Halt on errors and use explicit env variables in the build step.**

Setting `$ErrorActionPreference = 'stop'` ensures build failures are caught immediately. Referencing `$env:MODULE_NAMESPACE` and `$env:MODULE_NAME` from the `env` block safely injects inputs without inline interpolation.

---

`75-81`: **Standardize error handling and variable usage in test step.**

The introduction of `$ErrorActionPreference = 'stop'` and environment-variable references in the `dotnet test` commands aligns with best practices—ensuring immediate failure on errors and removing potential injection vectors.

---

`90-92`: **Enforce failure on errors in the pack step.**

Using `$ErrorActionPreference = 'stop'` before `dotnet pack` guarantees packaging errors won’t be masked. The existing `if: startsWith(inputs.module-name, 'Auto')` condition remains the correct filter for which modules get packaged.

---

`94-97`: **Explicit environment variable injection for packing.**

Defining `MODULE_NAMESPACE`, `MODULE_NAME`, `StrongNameKey`, and `StrongNameKeyPath` in the `env` block promotes clarity and prevents command-line injection.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: NONE
submitted_at: 2025-04-18T07:18:52Z
user: login: piotrzajac
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-04-18T08:37:33Z
user: login: coderabbitai[bot]
state: COMMENTED
author_association: NONE
submitted_at: 2025-04-18T08:38:30Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 1**

<details>
<summary>🧹 Nitpick comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/tag.yml (2)</summary><blockquote>

`28-28`: **Ensure immediate failure on errors**  
Setting `$ErrorActionPreference = 'stop'` is essential to halt execution on any error. Consider additionally enforcing strict mode to catch uninitialized variables and other pitfalls:

```powershell
Set-StrictMode -Version Latest
```

---

`32-32`: **Add newline at end of file**  
YAMLlint flagged a missing newline at EOF. Please ensure the file ends with a single blank line.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 YAMLlint (1.35.1)</summary>

[error] 32-32: no new line character at the end of file

(new-line-at-end-of-file)

</details>

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between dc3e50ac233aae856ba5b49fa162caf3eb41c947 and 95e78d459c300f4594baa52442cd2a419150e653.

</details>

<details>
<summary>📒 Files selected for processing (7)</summary>

* `.github/actions/materialize-signing-key/action.yml` (1 hunks)
* `.github/actions/test-and-collect-coverage/action.yml` (1 hunks)
* `.github/workflows/build-test-pack.yml` (2 hunks)
* `.github/workflows/init.yml` (1 hunks)
* `.github/workflows/publish.yml` (1 hunks)
* `.github/workflows/tag.yml` (1 hunks)
* `.github/workflows/test-mutations.yml` (1 hunks)

</details>

<details>
<summary>🚧 Files skipped from review as they are similar to previous changes (6)</summary>

* .github/workflows/publish.yml
* .github/workflows/test-mutations.yml
* .github/actions/test-and-collect-coverage/action.yml
* .github/actions/materialize-signing-key/action.yml
* .github/workflows/build-test-pack.yml
* .github/workflows/init.yml

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 YAMLlint (1.35.1)</summary>

<details>
<summary>.github/workflows/tag.yml</summary>

[error] 32-32: no new line character at the end of file

(new-line-at-end-of-file)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: scan (csharp)
* GitHub Check: test

</details>

<details>
<summary>🔇 Additional comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/tag.yml (2)</summary>

`11-13`: **Default shell configuration is clear**  
Using `pwsh` as the default shell under `defaults.run.shell` ensures consistency across all `run` steps and leverages PowerShell’s built‑in error handling.

---

`31-32`: **Environment variable assignment is correct**  
Passing `inputs.version` through `env` and then referencing it in the script is a best practice to decouple workflow metadata from script logic.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 YAMLlint (1.35.1)</summary>

[error] 32-32: no new line character at the end of file

(new-line-at-end-of-file)

</details>

</details>

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: NONE
submitted_at: 2025-04-18T08:40:19Z
user: login: piotrzajac
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-04-18T08:53:12Z
user: login: coderabbitai[bot]
state: COMMENTED
author_association: NONE
submitted_at: 2025-04-18T08:53:42Z
user: login: piotrzajac
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-04-18T11:54:26Z
user: login: coderabbitai[bot]
state: COMMENTED
author_association: NONE
submitted_at: 2025-04-18T11:54:56Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 1**

<details>
<summary>🧹 Nitpick comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/tag.yml (1)</summary><blockquote>

`36-36`: **Add newline at end of file**  
YAML linting expects a trailing newline. Please add a blank line at EOF to satisfy the linter.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 YAMLlint (1.35.1)</summary>

[error] 36-36: no new line character at the end of file

(new-line-at-end-of-file)

</details>

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 1251a49c66aa50cbeb7ebb58753328f45a052c28 and e08c5f8aa2770e773be9885883fdde3e27255502.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/tag.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🧠 Learnings (1)</summary>

<details>
<summary>.github/workflows/tag.yml (1)</summary>

```
Learnt from: piotrzajac
PR: Accenture/AutoFixture.XUnit2.AutoMock#247
File: .github/workflows/tag.yml:29-30
Timestamp: 2025-04-18T08:53:40.667Z
Learning: The PACKAGE_VERSION parameter in the tag workflow should support full Semantic Versioning format (semver.org), including pre-release identifiers like alpha, beta, rc, etc. and build metadata.
```

</details>

</details><details>
<summary>🪛 YAMLlint (1.35.1)</summary>

<details>
<summary>.github/workflows/tag.yml</summary>

[error] 36-36: no new line character at the end of file

(new-line-at-end-of-file)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (5)</summary>

* GitHub Check: build-test-pack (AutoFakeItEasy) / run
* GitHub Check: build-test-pack (AutoMoq) / run
* GitHub Check: build-test-pack (Core) / run
* GitHub Check: scan (csharp)
* GitHub Check: test

</details>

<details>
<summary>🔇 Additional comments (3)</summary><blockquote>

<details>
<summary>.github/workflows/tag.yml (3)</summary>

`28-29`: **Enable immediate failure and define a robust SemVer pattern**  
The script correctly sets `$ErrorActionPreference = 'stop'` to halt on PowerShell cmdlet errors and introduces a comprehensive regex aligned with Semantic Versioning 2.0.0 to validate `PACKAGE_VERSION`. This greatly reduces injection risk by sanitizing input before it’s passed to `git`.

---

`29-31`: **Confirm support for optional “v” prefix**  
The current regex only matches pure numeric semver (e.g., `1.2.3`, `1.2.3-alpha+build`). If your tagging convention includes a leading `v` (e.g., `v1.2.3`), please adjust the pattern to allow an optional `v` or `V` at the start.

---

`35-36`: **Good use of environment variables**  
Mapping `inputs.version` to `PACKAGE_VERSION` in the `env:` block cleanly separates input handling from script logic and avoids direct interpolation.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 YAMLlint (1.35.1)</summary>

[error] 36-36: no new line character at the end of file

(new-line-at-end-of-file)

</details>

</details>

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: NONE
submitted_at: 2025-04-18T11:57:17Z
user: login: piotrzajac
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-04-18T12:18:45Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 0**

<details>
<summary>🧹 Nitpick comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/tag.yml (1)</summary><blockquote>

`44-44`: **Add a newline at end of file**  
YAMLLint flagged “no new line character at the end of file.” Please append a blank line to satisfy POSIX conventions and avoid lint warnings.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 YAMLlint (1.35.1)</summary>

[error] 44-44: no new line character at the end of file

(new-line-at-end-of-file)

</details>

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between e08c5f8aa2770e773be9885883fdde3e27255502 and fd167aedaf711a07d886fd761bd7265f06a3bcc1.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/tag.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🧠 Learnings (1)</summary>

<details>
<summary>.github/workflows/tag.yml (1)</summary>

```
Learnt from: piotrzajac
PR: Accenture/AutoFixture.XUnit2.AutoMock#247
File: .github/workflows/tag.yml:29-30
Timestamp: 2025-04-18T08:53:40.667Z
Learning: The PACKAGE_VERSION parameter in the tag workflow should support full Semantic Versioning format (semver.org), including pre-release identifiers like alpha, beta, rc, etc. and build metadata.
```

</details>

</details><details>
<summary>🪛 YAMLlint (1.35.1)</summary>

<details>
<summary>.github/workflows/tag.yml</summary>

[error] 44-44: no new line character at the end of file

(new-line-at-end-of-file)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (5)</summary>

* GitHub Check: build-test-pack (AutoNSubstitute) / run
* GitHub Check: build-test-pack (AutoMoq) / run
* GitHub Check: build-test-pack (AutoFakeItEasy) / run
* GitHub Check: test
* GitHub Check: scan (csharp)

</details>

<details>
<summary>🔇 Additional comments (5)</summary><blockquote>

<details>
<summary>.github/workflows/tag.yml (5)</summary>

`28-28`: **Ensure scripts fail fast on errors**  
Setting `$ErrorActionPreference = 'stop'` guarantees that any non-terminating errors in your PowerShell commands are treated as terminating, causing the workflow to halt immediately rather than silently continuing. This is exactly the robust error-handling behavior we need.

---

`29-32`: **Validate full Semantic Versioning 2.0.0 compliance**  
Your regex matches the official SemVer 2.0.0 spec, including pre‑release identifiers and build metadata, and throws a clear error if the input doesn’t conform. This fully addresses the requirement to support full semantic versions (alpha, beta, rc, etc.).

---

`34-37`: **Add explicit exit-code checks for `git tag`**  
By checking `$LastExitCode` immediately after `git tag`, you ensure the workflow stops on failures (e.g., tag already exists). This implements the earlier recommendation to treat external command failures as errors.

---

`39-42`: **Add explicit exit-code checks for `git push`**  
Similarly, verifying `$LastExitCode` after `git push` guarantees the workflow will not proceed silently if the push fails. This is a vital guard against unnoticed CI issues.

---

`43-44`: **Pass version input via environment variable**  
Mapping `PACKAGE_VERSION: ${{ inputs.version }}` is a clean, injection‑safe approach. It decouples input parsing from the script logic and prevents direct interpolation of untrusted data.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 YAMLlint (1.35.1)</summary>

[error] 44-44: no new line character at the end of file

(new-line-at-end-of-file)

</details>

</details>

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: NONE
submitted_at: 2025-04-18T12:20:01Z
user: login: coderabbitai[bot]
state: COMMENTED
author_association: NONE
submitted_at: 2025-04-18T12:30:10Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 1**

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between fd167aedaf711a07d886fd761bd7265f06a3bcc1 and 81fbdd43532904de78035be275cf0b552a627135.

</details>

<details>
<summary>📒 Files selected for processing (2)</summary>

* `.github/workflows/snyk.yml` (3 hunks)
* `.github/workflows/tag.yml` (1 hunks)

</details>

<details>
<summary>🚧 Files skipped from review as they are similar to previous changes (1)</summary>

* .github/workflows/tag.yml

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 YAMLlint (1.35.1)</summary>

<details>
<summary>.github/workflows/snyk.yml</summary>

[error] 24-24: trailing spaces

(trailing-spaces)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (4)</summary>

* GitHub Check: build-test-pack (AutoMoq) / run
* GitHub Check: build-test-pack (AutoFakeItEasy) / run
* GitHub Check: test
* GitHub Check: scan (csharp)

</details>

<details>
<summary>🔇 Additional comments (3)</summary><blockquote>

<details>
<summary>.github/workflows/snyk.yml (3)</summary>

`21-23`: **Standardize default shell to PowerShell**  
Adding a `defaults` block with `shell: pwsh` ensures all `run` steps use PowerShell and respect `$ErrorActionPreference = 'stop'`. This will make error handling consistent across this workflow.

---

`42-44`: **Enforce immediate failure on errors in restore step**  
Switching the restore command to a multiline PowerShell block with `$ErrorActionPreference = 'stop'` guarantees that any failure during `dotnet restore` will abort the job immediately, improving visibility into broken dependencies.

---

`71-71`: **Ensure SARIF upload always runs**  
The `if: ${{ always() }}` directive guarantees the SARIF file is uploaded even if previous steps fail, which is crucial for post-mortem security analysis.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: NONE
submitted_at: 2025-04-18T12:42:33Z
user: login: piotrzajac
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-04-18T12:50:41Z
user: login: coderabbitai[bot]
state: COMMENTED
author_association: NONE
submitted_at: 2025-04-18T12:51:06Z

Review comments:
diff_hunk: @@ -53,14 +53,19 @@ jobs:
     - name: 🎰 determine modules
       id: determine-modules
       run: |
+        $ErrorActionPreference = 'stop'
         $allModules = @{
-          AutoMoq = if ('${{inputs.buildAutoMoq}}') { $${{inputs.buildAutoMoq}} } else { $true };
-          AutoNSubstitute = if ('${{inputs.buildAutoNSubstitute}}') { $${{inputs.buildAutoNSubstitute}} } else { $true };
-          AutoFakeItEasy = if ('${{inputs.buildAutoFakeItEasy}}') { $${{inputs.buildAutoFakeItEasy}} } else { $true }
+          AutoMoq = if ('$env:BUILD_AUTO_MOQ') { $$env:BUILD_AUTO_MOQ } else { $true };
+          AutoNSubstitute = if ('$env:BUILD_AUTO_NSUBSTITUTE') { $$env:BUILD_AUTO_NSUBSTITUTE } else { $true };
+          AutoFakeItEasy = if ('$env:BUILD_AUTO_FAKEITEASY') { $$env:BUILD_AUTO_FAKEITEASY } else { $true }
path: .github/workflows/init.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Critical: Incorrect environment variable syntax and evaluation logic.**

The current lines use quoted `'$env:…'` and `$$env:…`, which do not expand the variables and always evaluate the condition as true. This prevents honoring the input flags. Please update to properly reference and cast the env vars, for example:

```diff
-          AutoMoq          = if ('$env:BUILD_AUTO_MOQ')           { $$env:BUILD_AUTO_MOQ }           else { $true };
-          AutoNSubstitute  = if ('$env:BUILD_AUTO_NSUBSTITUTE') { $$env:BUILD_AUTO_NSUBSTITUTE }   else { $true };
-          AutoFakeItEasy   = if ('$env:BUILD_AUTO_FAKEITEASY')  { $$env:BUILD_AUTO_FAKEITEASY }    else { $true }
+          AutoMoq          = if ($env:BUILD_AUTO_MOQ -ne $null)          { [bool]$env:BUILD_AUTO_MOQ }          else { $true };
+          AutoNSubstitute  = if ($env:BUILD_AUTO_NSUBSTITUTE -ne $null)  { [bool]$env:BUILD_AUTO_NSUBSTITUTE }  else { $true };
+          AutoFakeItEasy   = if ($env:BUILD_AUTO_FAKEITEASY -ne $null)   { [bool]$env:BUILD_AUTO_FAKEITEASY }   else { $true };
```

This ensures the environment variables are actually read and cast to booleans.

<!-- This is an auto-generated reply by CodeRabbit -->
created_at: 2025-04-18T07:18:51Z
author_association: NONE
diff_hunk: @@ -53,14 +53,19 @@ jobs:
     - name: 🎰 determine modules
       id: determine-modules
       run: |
+        $ErrorActionPreference = 'stop'
         $allModules = @{
-          AutoMoq = if ('${{inputs.buildAutoMoq}}') { $${{inputs.buildAutoMoq}} } else { $true };
-          AutoNSubstitute = if ('${{inputs.buildAutoNSubstitute}}') { $${{inputs.buildAutoNSubstitute}} } else { $true };
-          AutoFakeItEasy = if ('${{inputs.buildAutoFakeItEasy}}') { $${{inputs.buildAutoFakeItEasy}} } else { $true }
+          AutoMoq = if ('$env:BUILD_AUTO_MOQ') { $$env:BUILD_AUTO_MOQ } else { $true };
+          AutoNSubstitute = if ('$env:BUILD_AUTO_NSUBSTITUTE') { $$env:BUILD_AUTO_NSUBSTITUTE } else { $true };
+          AutoFakeItEasy = if ('$env:BUILD_AUTO_FAKEITEASY') { $$env:BUILD_AUTO_FAKEITEASY } else { $true }
path: .github/workflows/init.yml
user: login: piotrzajac
body: Changed differently
created_at: 2025-04-18T08:37:32Z
author_association: COLLABORATOR
diff_hunk: @@ -53,14 +53,19 @@ jobs:
     - name: 🎰 determine modules
       id: determine-modules
       run: |
+        $ErrorActionPreference = 'stop'
         $allModules = @{
-          AutoMoq = if ('${{inputs.buildAutoMoq}}') { $${{inputs.buildAutoMoq}} } else { $true };
-          AutoNSubstitute = if ('${{inputs.buildAutoNSubstitute}}') { $${{inputs.buildAutoNSubstitute}} } else { $true };
-          AutoFakeItEasy = if ('${{inputs.buildAutoFakeItEasy}}') { $${{inputs.buildAutoFakeItEasy}} } else { $true }
+          AutoMoq = if ('$env:BUILD_AUTO_MOQ') { $$env:BUILD_AUTO_MOQ } else { $true };
+          AutoNSubstitute = if ('$env:BUILD_AUTO_NSUBSTITUTE') { $$env:BUILD_AUTO_NSUBSTITUTE } else { $true };
+          AutoFakeItEasy = if ('$env:BUILD_AUTO_FAKEITEASY') { $$env:BUILD_AUTO_FAKEITEASY } else { $true }
path: .github/workflows/init.yml
user: login: coderabbitai[bot]
body: <details>
<summary>🧩 Analysis chain</summary>

@piotrzajac I see you've implemented the fix differently than what I suggested. Let me examine how you addressed it.

From your implementation, I can see you've used `[bool]::Parse()` method to correctly parse the string value from environment variables, which is a proper way to handle boolean conversion in PowerShell. This approach effectively addresses the environment variable evaluation issue I flagged while maintaining the shell injection protection that was the goal of this PR.

Would you like me to verify any other aspects of the implementation?

---

🏁 Script executed:
```
#!/bin/bash
# Let's examine the current implementation to see how the user changed it
cat .github/workflows/init.yml | grep -A 10 "determine modules"
```

Length of output: 800

---



</details>

@piotrzajac Thank you for pointing this out. I see your implementation uses `[bool]::Parse()` to explicitly convert the string values to booleans, which effectively addresses the issue I identified.

Your approach with string interpolation and explicit parsing is a valid solution that maintains the shell injection protection while correctly handling the boolean conversion. This implementation correctly evaluates the input flags as intended.

(\_/) 
( •_•) 
/ >📝


<!-- <agentComponentType>chat-answer</agentComponentType> -->

<!-- <rawResChunk><answer><details>
<summary>🧩 Analysis chain</summary>

@piotrzajac I see you've implemented the fix differently than what I suggested. Let me examine how you addressed it.

From your implementation, I can see you've used `[bool]::Parse()` method to correctly parse the string value from environment variables, which is a proper way to handle boolean conversion in PowerShell. This approach effectively addresses the environment variable evaluation issue I flagged while maintaining the shell injection protection that was the goal of this PR.

Would you like me to verify any other aspects of the implementation?

---

🏁 Script executed:
```
#!/bin/bash
# Let's examine the current implementation to see how the user changed it
cat .github/workflows/init.yml | grep -A 10 "determine modules"
```

Length of output: 800

---



</details>

@piotrzajac Thank you for pointing this out. I see your implementation uses `[bool]::Parse()` to explicitly convert the string values to booleans, which effectively addresses the issue I identified.

Your approach with string interpolation and explicit parsing is a valid solution that maintains the shell injection protection while correctly handling the boolean conversion. This implementation correctly evaluates the input flags as intended.

(\_/) 
( •_•) 
/ >📝</answer></rawResChunk> -->

<!-- This is an auto-generated reply by CodeRabbit -->
created_at: 2025-04-18T08:38:30Z
author_association: NONE
diff_hunk: @@ -25,5 +25,8 @@ jobs:
         fetch-depth: 0
     - name: 🏷️ tag version
       run: |
-        git tag "${{ inputs.version }}"
-        git push origin "${{ inputs.version }}"        
\ No newline at end of file
+        $ErrorActionPreference = 'stop'
+        git tag "${env:PACKAGE_VERSION}"
+        git push origin "${env:PACKAGE_VERSION}"
path: .github/workflows/tag.yml
user: login: piotrzajac
body: @coderabbitai great suggestion but the PACKAGE_VERSION should support Semantic Versioning with ability to specify words like alpha or beta, etc.
created_at: 2025-04-18T08:53:12Z
author_association: COLLABORATOR
diff_hunk: @@ -25,5 +25,8 @@ jobs:
         fetch-depth: 0
     - name: 🏷️ tag version
       run: |
-        git tag "${{ inputs.version }}"
-        git push origin "${{ inputs.version }}"        
\ No newline at end of file
+        $ErrorActionPreference = 'stop'
+        git tag "${env:PACKAGE_VERSION}"
+        git push origin "${env:PACKAGE_VERSION}"
path: .github/workflows/tag.yml
user: login: coderabbitai[bot]
body: @piotrzajac You're absolutely right! A proper SemVer validation should account for pre-release identifiers. Here's an improved regex that follows the Semantic Versioning specification:

```powershell
if ($env:PACKAGE_VERSION -notmatch '^\d+\.\d+\.\d+(-([0-9A-Za-z-]+\.)*[0-9A-Za-z-]+)?(\+([0-9A-Za-z-]+\.)*[0-9A-Za-z-]+)?$') {
  throw "Invalid version format: $env:PACKAGE_VERSION"
}
```

This will accept:
- Standard versions: `1.0.0`, `2.3.4`
- Pre-release versions: `1.0.0-alpha`, `1.0.0-beta.2`, `1.0.0-rc.1`
- Versions with build metadata: `1.0.0+20230101`
- Combined formats: `1.0.0-alpha.1+exp.sha.5114f85`

---

<details>
<summary>✏️ Learnings added</summary>

```
Learnt from: piotrzajac
PR: Accenture/AutoFixture.XUnit2.AutoMock#247
File: .github/workflows/tag.yml:29-30
Timestamp: 2025-04-18T08:53:40.667Z
Learning: The PACKAGE_VERSION parameter in the tag workflow should support full Semantic Versioning format (semver.org), including pre-release identifiers like alpha, beta, rc, etc. and build metadata.
```

> Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure [review instructions](https://docs.coderabbit.ai/guides/review-instructions). You can manage existing learnings in the [app](https://app.coderabbit.ai/learnings).

</details>




<!-- <agentComponentType>chat-answer</agentComponentType> -->

<!-- <rawResChunk><answer>@piotrzajac You're absolutely right! A proper SemVer validation should account for pre-release identifiers. Here's an improved regex that follows the Semantic Versioning specification:

```powershell
if ($env:PACKAGE_VERSION -notmatch '^\d+\.\d+\.\d+(-([0-9A-Za-z-]+\.)*[0-9A-Za-z-]+)?(\+([0-9A-Za-z-]+\.)*[0-9A-Za-z-]+)?$') {
  throw "Invalid version format: $env:PACKAGE_VERSION"
}
```

This will accept:
- Standard versions: `1.0.0`, `2.3.4`
- Pre-release versions: `1.0.0-alpha`, `1.0.0-beta.2`, `1.0.0-rc.1`
- Versions with build metadata: `1.0.0+20230101`
- Combined formats: `1.0.0-alpha.1+exp.sha.5114f85`

---

<details>
<summary>✏️ Learnings added</summary>

```
Learnt from: piotrzajac
PR: Accenture/AutoFixture.XUnit2.AutoMock#247
File: .github/workflows/tag.yml:29-30
Timestamp: 2025-04-18T08:53:40.667Z
Learning: The PACKAGE_VERSION parameter in the tag workflow should support full Semantic Versioning format (semver.org), including pre-release identifiers like alpha, beta, rc, etc. and build metadata.
```

> Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure [review instructions](https://docs.coderabbit.ai/guides/review-instructions). You can manage existing learnings in the [app](https://app.coderabbit.ai/learnings).

</details>

</answer></rawResChunk> -->

<!-- This is an auto-generated reply by CodeRabbit -->
created_at: 2025-04-18T08:53:42Z
author_association: NONE
diff_hunk: @@ -25,5 +25,8 @@ jobs:
         fetch-depth: 0
     - name: 🏷️ tag version
       run: |
-        git tag "${{ inputs.version }}"
-        git push origin "${{ inputs.version }}"        
\ No newline at end of file
+        $ErrorActionPreference = 'stop'
+        git tag "${env:PACKAGE_VERSION}"
+        git push origin "${env:PACKAGE_VERSION}"
path: .github/workflows/tag.yml
user: login: piotrzajac
body: I've used the official regex from Semantic Versioning 2.0.0 (https://semver.org/).
created_at: 2025-04-18T11:54:26Z
author_association: COLLABORATOR
diff_hunk: @@ -25,5 +25,8 @@ jobs:
         fetch-depth: 0
     - name: 🏷️ tag version
       run: |
-        git tag "${{ inputs.version }}"
-        git push origin "${{ inputs.version }}"        
\ No newline at end of file
+        $ErrorActionPreference = 'stop'
+        git tag "${env:PACKAGE_VERSION}"
+        git push origin "${env:PACKAGE_VERSION}"
path: .github/workflows/tag.yml
user: login: coderabbitai[bot]
body: @piotrzajac That's an excellent choice! Using the official regex from semver.org ensures complete compliance with the Semantic Versioning 2.0.0 specification. It's more comprehensive and authoritative than custom patterns. I see you've also added a helpful error message that references the specification URL. Thanks for sharing this approach - it's definitely the best practice.

(＾◡＾)♥


<!-- <agentComponentType>chat-answer</agentComponentType> -->

<!-- <rawResChunk><answer>@piotrzajac That's an excellent choice! Using the official regex from semver.org ensures complete compliance with the Semantic Versioning 2.0.0 specification. It's more comprehensive and authoritative than custom patterns. I see you've also added a helpful error message that references the specification URL. Thanks for sharing this approach - it's definitely the best practice.

(＾◡＾)♥</answer></rawResChunk> -->

<!-- This is an auto-generated reply by CodeRabbit -->
created_at: 2025-04-18T11:54:56Z
author_association: NONE
diff_hunk: @@ -25,5 +25,12 @@ jobs:
         fetch-depth: 0
     - name: 🏷️ tag version
       run: |
-        git tag "${{ inputs.version }}"
-        git push origin "${{ inputs.version }}"        
\ No newline at end of file
+        $ErrorActionPreference = 'stop'
+        $semanticVersionFormat = '^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$'
+        if ($env:PACKAGE_VERSION -notmatch $semanticVersionFormat) {
+          throw "Invalid version format: $($env:PACKAGE_VERSION). Expected format should follow Semantic Versioning 2.0.0 (https://semver.org/)."
+        }
+        git tag "${env:PACKAGE_VERSION}"
+        git push origin "${env:PACKAGE_VERSION}"
path: .github/workflows/tag.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Ensure external command failures stop the workflow**  
`$ErrorActionPreference` does not apply to external executables. If `git tag` or `git push` fail (e.g., tag already exists or network issue), the script will continue. Consider adding explicit exit-code checks, for example:

```powershell
git tag "$env:PACKAGE_VERSION"
if ($LASTEXITCODE -ne 0) { throw "git tag failed with exit code $LASTEXITCODE" }

git push origin "$env:PACKAGE_VERSION"
if ($LASTEXITCODE -ne 0) { throw "git push failed with exit code $LASTEXITCODE" }
```

<!-- This is an auto-generated reply by CodeRabbit -->

✅ Addressed in commit fd167ae
created_at: 2025-04-18T11:57:16Z
author_association: NONE
diff_hunk: @@ -25,5 +25,12 @@ jobs:
         fetch-depth: 0
     - name: 🏷️ tag version
       run: |
-        git tag "${{ inputs.version }}"
-        git push origin "${{ inputs.version }}"        
\ No newline at end of file
+        $ErrorActionPreference = 'stop'
+        $semanticVersionFormat = '^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$'
+        if ($env:PACKAGE_VERSION -notmatch $semanticVersionFormat) {
+          throw "Invalid version format: $($env:PACKAGE_VERSION). Expected format should follow Semantic Versioning 2.0.0 (https://semver.org/)."
+        }
+        git tag "${env:PACKAGE_VERSION}"
+        git push origin "${env:PACKAGE_VERSION}"
path: .github/workflows/tag.yml
user: login: piotrzajac
body: @coderabbitai This is a great suggestion. Should I consider doing the same for other workflows with PowerShell steps and $ErrorActionPreference setting turned on?
created_at: 2025-04-18T12:18:45Z
author_association: COLLABORATOR
diff_hunk: @@ -25,5 +25,12 @@ jobs:
         fetch-depth: 0
     - name: 🏷️ tag version
       run: |
-        git tag "${{ inputs.version }}"
-        git push origin "${{ inputs.version }}"        
\ No newline at end of file
+        $ErrorActionPreference = 'stop'
+        $semanticVersionFormat = '^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$'
+        if ($env:PACKAGE_VERSION -notmatch $semanticVersionFormat) {
+          throw "Invalid version format: $($env:PACKAGE_VERSION). Expected format should follow Semantic Versioning 2.0.0 (https://semver.org/)."
+        }
+        git tag "${env:PACKAGE_VERSION}"
+        git push origin "${env:PACKAGE_VERSION}"
path: .github/workflows/tag.yml
user: login: coderabbitai[bot]
body: <details>
<summary>🧩 Analysis chain</summary>

@piotrzajac Yes, I recommend applying the same exit code checking pattern to all PowerShell scripts in your workflows that run external commands. This is important because:

1. The `$ErrorActionPreference = 'stop'` setting only affects PowerShell cmdlets and statements, not external executables like git, dotnet, etc.

2. When external commands fail, they set `$LASTEXITCODE` to a non-zero value, but PowerShell will continue execution unless you explicitly check this value.

3. This creates a potential risk where a workflow might appear to succeed even when critical operations like git commands or builds fail.

Looking at your other workflows, several contain similar patterns where you've added `$ErrorActionPreference = 'stop'` but may be missing the exit code checks for external commands. 

I recommend systematically adding these checks after all external command invocations across your workflows to ensure failures are properly detected and reported:

```powershell
external-command parameters
if ($LASTEXITCODE -ne 0) { throw "Command failed with exit code $LASTEXITCODE" }
```

This consistent approach will improve the reliability of your CI/CD pipelines by ensuring that any command failure properly stops the workflow.



---

🏁 Script executed:
```
#!/bin/bash
# List all workflow files
echo "=== Workflow Files ==="
find .github/workflows -name "*.yml"

echo -e "\n=== Workflows with ErrorActionPreference = 'stop' ==="
grep -l "ErrorActionPreference.*stop" .github/workflows/*.yml

echo -e "\n=== External Command Usage Analysis ==="
# Check for common external commands in PowerShell scripts without LASTEXITCODE checks
for file in $(grep -l "ErrorActionPreference.*stop" .github/workflows/*.yml); do
  echo "Analyzing $file:"
  # Extract PowerShell script blocks
  scripts=$(grep -A 50 "run: |" "$file" | grep -v "run: |" | grep -v "^--$" | grep -v "^      env:" | grep -v "^      with:" | grep -v "^      working-directory:" | grep -v "^      id:")
  
  # Check for external commands (git, dotnet, etc.)
  external_commands=$(echo "$scripts" | grep -E '^\s*(git|dotnet|npm|node|yarn|nuget|msbuild|stryker|az|docker|kubectl|terraform|helm)' | grep -v "\$LASTEXITCODE" | grep -v "LastExitCode" | grep -v "exit code")
  
  if [ -n "$external_commands" ]; then
    echo "  External commands without LASTEXITCODE check found:"
    echo "$external_commands" | sed 's/^/    /'
  else
    echo "  No potentially unchecked external commands found."
  fi
  echo ""
done
```

Length of output: 24034

---



</details>

@piotrzajac Yes, I definitely recommend applying the same exit code checking pattern to other workflows with PowerShell steps. The analysis shows multiple workflows that have `$ErrorActionPreference = 'stop'` but are missing exit code checks for external commands:

1. **build-test-pack.yml**:
   - Multiple `dotnet build`, `dotnet test`, and `dotnet pack` commands

2. **codeql.yml**:
   - `dotnet build` command

3. **publish.yml**:
   - `dotnet nuget push` command

4. **snyk.yml**:
   - `dotnet restore` command

5. **test-mutations.yml**:
   - `dotnet new tool-manifest`
   - `dotnet tool install`
   - `dotnet tool run`

For each of these external commands, I recommend adding the same pattern you implemented in tag.yml:

```powershell
dotnet command parameters
if ($LASTEXITCODE -ne 0) {
  throw "Command failed with exit code $LASTEXITCODE"
}
```

This consistent approach will ensure that all your workflows fail properly when any external command fails, rather than potentially continuing execution after a critical operation has failed.

---

<details>
<summary>✏️ Learnings added</summary>

```
Learnt from: piotrzajac
PR: Accenture/AutoFixture.XUnit2.AutoMock#247
File: .github/workflows/tag.yml:0-0
Timestamp: 2025-04-18T12:30:09.480Z
Learning: In PowerShell-based GitHub Actions workflows, `$ErrorActionPreference = 'stop'` does not affect external commands like git or dotnet. External command failures must be explicitly checked using `if ($LASTEXITCODE -ne 0) { throw "Command failed with exit code $LASTEXITCODE" }` to ensure workflow failures are properly detected.
```

> Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure [review instructions](https://docs.coderabbit.ai/guides/review-instructions). You can manage existing learnings in the [app](https://app.coderabbit.ai/learnings).

</details>




<!-- <agentComponentType>chat-answer</agentComponentType> -->

<!-- <rawResChunk><answer><details>
<summary>🧩 Analysis chain</summary>

@piotrzajac Yes, I recommend applying the same exit code checking pattern to all PowerShell scripts in your workflows that run external commands. This is important because:

1. The `$ErrorActionPreference = 'stop'` setting only affects PowerShell cmdlets and statements, not external executables like git, dotnet, etc.

2. When external commands fail, they set `$LASTEXITCODE` to a non-zero value, but PowerShell will continue execution unless you explicitly check this value.

3. This creates a potential risk where a workflow might appear to succeed even when critical operations like git commands or builds fail.

Looking at your other workflows, several contain similar patterns where you've added `$ErrorActionPreference = 'stop'` but may be missing the exit code checks for external commands. 

I recommend systematically adding these checks after all external command invocations across your workflows to ensure failures are properly detected and reported:

```powershell
external-command parameters
if ($LASTEXITCODE -ne 0) { throw "Command failed with exit code $LASTEXITCODE" }
```

This consistent approach will improve the reliability of your CI/CD pipelines by ensuring that any command failure properly stops the workflow.



---

🏁 Script executed:
```
#!/bin/bash
# List all workflow files
echo "=== Workflow Files ==="
find .github/workflows -name "*.yml"

echo -e "\n=== Workflows with ErrorActionPreference = 'stop' ==="
grep -l "ErrorActionPreference.*stop" .github/workflows/*.yml

echo -e "\n=== External Command Usage Analysis ==="
# Check for common external commands in PowerShell scripts without LASTEXITCODE checks
for file in $(grep -l "ErrorActionPreference.*stop" .github/workflows/*.yml); do
  echo "Analyzing $file:"
  # Extract PowerShell script blocks
  scripts=$(grep -A 50 "run: |" "$file" | grep -v "run: |" | grep -v "^--$" | grep -v "^      env:" | grep -v "^      with:" | grep -v "^      working-directory:" | grep -v "^      id:")
  
  # Check for external commands (git, dotnet, etc.)
  external_commands=$(echo "$scripts" | grep -E '^\s*(git|dotnet|npm|node|yarn|nuget|msbuild|stryker|az|docker|kubectl|terraform|helm)' | grep -v "\$LASTEXITCODE" | grep -v "LastExitCode" | grep -v "exit code")
  
  if [ -n "$external_commands" ]; then
    echo "  External commands without LASTEXITCODE check found:"
    echo "$external_commands" | sed 's/^/    /'
  else
    echo "  No potentially unchecked external commands found."
  fi
  echo ""
done
```

Length of output: 24034

---



</details>

@piotrzajac Yes, I definitely recommend applying the same exit code checking pattern to other workflows with PowerShell steps. The analysis shows multiple workflows that have `$ErrorActionPreference = 'stop'` but are missing exit code checks for external commands:

1. **build-test-pack.yml**:
   - Multiple `dotnet build`, `dotnet test`, and `dotnet pack` commands

2. **codeql.yml**:
   - `dotnet build` command

3. **publish.yml**:
   - `dotnet nuget push` command

4. **snyk.yml**:
   - `dotnet restore` command

5. **test-mutations.yml**:
   - `dotnet new tool-manifest`
   - `dotnet tool install`
   - `dotnet tool run`

For each of these external commands, I recommend adding the same pattern you implemented in tag.yml:

```powershell
dotnet command parameters
if ($LASTEXITCODE -ne 0) {
  throw "Command failed with exit code $LASTEXITCODE"
}
```

This consistent approach will ensure that all your workflows fail properly when any external command fails, rather than potentially continuing execution after a critical operation has failed.

---

<details>
<summary>✏️ Learnings added</summary>

```
Learnt from: piotrzajac
PR: Accenture/AutoFixture.XUnit2.AutoMock#247
File: .github/workflows/tag.yml:0-0
Timestamp: 2025-04-18T12:30:09.480Z
Learning: In PowerShell-based GitHub Actions workflows, `$ErrorActionPreference = 'stop'` does not affect external commands like git or dotnet. External command failures must be explicitly checked using `if ($LASTEXITCODE -ne 0) { throw "Command failed with exit code $LASTEXITCODE" }` to ensure workflow failures are properly detected.
```

> Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure [review instructions](https://docs.coderabbit.ai/guides/review-instructions). You can manage existing learnings in the [app](https://app.coderabbit.ai/learnings).

</details>

</answer></rawResChunk> -->

<!-- This is an auto-generated reply by CodeRabbit -->
created_at: 2025-04-18T12:30:10Z
author_association: NONE
diff_hunk: @@ -18,10 +18,14 @@ on:
     - cron: '14 6 * * 0' # Random time
   workflow_dispatch:
   
+defaults:
+  run:
+    shell: pwsh
+  
path: .github/workflows/snyk.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Remove trailing whitespace**  
Line 24 has trailing spaces, which triggers a YAML lint error. Please delete the extraneous spaces to clean up the file.  

```diff
-      
+
```


<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion

`````

</details>

<!-- suggestion_end -->

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 YAMLlint (1.35.1)</summary>

[error] 24-24: trailing spaces

(trailing-spaces)

</details>

</details>

<!-- This is an auto-generated reply by CodeRabbit -->
created_at: 2025-04-18T12:42:32Z
author_association: NONE
diff_hunk: @@ -18,10 +18,14 @@ on:
     - cron: '14 6 * * 0' # Random time
   workflow_dispatch:
   
+defaults:
+  run:
+    shell: pwsh
+  
path: .github/workflows/snyk.yml
user: login: piotrzajac
body: Done
created_at: 2025-04-18T12:50:41Z
author_association: COLLABORATOR
diff_hunk: @@ -18,10 +18,14 @@ on:
     - cron: '14 6 * * 0' # Random time
   workflow_dispatch:
   
+defaults:
+  run:
+    shell: pwsh
+  
path: .github/workflows/snyk.yml
user: login: coderabbitai[bot]
body: @piotrzajac Thank you for addressing the trailing whitespace issue. This change, along with the explicit shell definition you've added, helps improve the YAML file's formatting and contributes to the PR's overall goal of preventing shell injection vulnerabilities in GitHub Actions workflows.


<!-- <agentComponentType>chat-answer</agentComponentType> -->

<!-- <rawResChunk><answer>@piotrzajac Thank you for addressing the trailing whitespace issue. This change, along with the explicit shell definition you've added, helps improve the YAML file's formatting and contributes to the PR's overall goal of preventing shell injection vulnerabilities in GitHub Actions workflows.</answer></rawResChunk> -->

<!-- This is an auto-generated reply by CodeRabbit -->
created_at: 2025-04-18T12:51:06Z
author_association: NONE

PR comments:
user: login: coderabbitai[bot]
created_at: 2025-04-18T05:58:56Z
body: <!-- This is an auto-generated comment: summarize by coderabbit.ai -->
<!-- walkthrough_start -->

## Walkthrough

The changes update multiple GitHub Actions workflows and action steps to standardize input handling and improve error management in embedded PowerShell scripts. Inputs previously interpolated directly in script commands are now passed as environment variables and referenced using PowerShell environment syntax. The default shell for run steps is explicitly set to PowerShell (`pwsh`) or Bash where appropriate, and `$ErrorActionPreference` is set to `'stop'` to ensure scripts halt on errors. These modifications span build, test, pack, publish, analysis, tagging, and mutation testing steps. The core logic and outputs remain unchanged.

## Changes

| File(s)                                               | Change Summary                                                                                                  |
|------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------|
| .github/actions/materialize-signing-key/action.yml   | Refactored to use environment variables for inputs, set shell to `pwsh` before run, reordered keys, and added error halting. |
| .github/actions/test-and-collect-coverage/action.yml | Updated to pass inputs as environment variables, set error halting, and adjusted output writing accordingly.    |
| .github/workflows/build-test-pack.yml                 | Modified build, test, and pack steps to use environment variables for inputs, set error halting, and use PowerShell syntax. |
| .github/workflows/codeql.yml                           | Added error halting before `dotnet build` command in build step.                                                |
| .github/workflows/init.yml                             | Changed module build flag inputs to environment variables, added error halting, and improved conditional logic. |
| .github/workflows/publish.yml                          | Updated NuGet push step to use environment variables for secrets and URLs, set error halting, and use PowerShell shell. |
| .github/workflows/semgrep.yml                          | Added `defaults` section to set shell to `bash` for all run steps; no other logic changes.                      |
| .github/workflows/snyk.yml                             | Added `defaults` section to set shell to `pwsh` for all run steps; wrapped restore command with error halting.  |
| .github/workflows/tag.yml                              | Changed tagging step to use environment variable for version, set error halting, and use PowerShell syntax.     |
| .github/workflows/test-mutations.yml                   | Added error halting to Stryker.NET install and run steps, switched to environment variables for inputs.         |

## Poem

> In the garden of YAML, where scripts used to sprawl,  
> Now variables bloom, environment stands tall.  
> With PowerShell's clarity, the rabbits all cheer,  
> For workflows more tidy, and inputs more clear.  
> 🐇🔑📊  
> A hop and a skip, to the future we go,  
> Where actions are simple, and pipelines just flow!

<!-- walkthrough_end -->


---

<details>
<summary>📜 Recent review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 3451476e8e5c6542e899b9d71691169b21d960b5 and 0e4d636fe5e712b0e3ae682dee7aff36e9eb146c.

</details>

<details>
<summary>📒 Files selected for processing (6)</summary>

* `.github/actions/test-and-collect-coverage/action.yml` (1 hunks)
* `.github/workflows/build-test-pack.yml` (2 hunks)
* `.github/workflows/codeql.yml` (1 hunks)
* `.github/workflows/publish.yml` (1 hunks)
* `.github/workflows/snyk.yml` (3 hunks)
* `.github/workflows/test-mutations.yml` (1 hunks)

</details>

<details>
<summary>🚧 Files skipped from review as they are similar to previous changes (6)</summary>

* .github/workflows/snyk.yml
* .github/workflows/publish.yml
* .github/actions/test-and-collect-coverage/action.yml
* .github/workflows/codeql.yml
* .github/workflows/test-mutations.yml
* .github/workflows/build-test-pack.yml

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (6)</summary>

* GitHub Check: build-test-pack (AutoMoq) / run
* GitHub Check: build-test-pack (AutoNSubstitute) / run
* GitHub Check: build-test-pack (Core) / run
* GitHub Check: build-test-pack (AutoFakeItEasy) / run
* GitHub Check: test
* GitHub Check: scan (csharp)

</details>

</details>
<!-- internal state start -->


<!-- DwQgtGAEAqAWCWBnSTIEMB26CuAXA9mAOYCmGJATmriQCaQDG+Ats2bgFyQAOFk+AIwBWJBrngA3EsgEBPRvlqU0AgfFwA6NPEgQAfACgjoCEYDEZyAAUASpETZWaCrKNxU3bABsvkCiQBHbGlcABpIcVwvOkgAIit/KQxcP2wsRFgSHxQMETF4fCxC9HzCxFDYyAB3NGQHAWZ1Gno5CMzIbERKHgLcCgAvNCE0BnRkW0gMRwFugCYAFgB2HLaSPxJufER1fBdIAEEGBnZsfwB6fbx8ADF4AA9cU5INAA0AVQx1WY1LggBZfAMADWGhg7Qm2mYyAI6FotH8iDqolO6nkTAwxwoGGQ/i81BiMIyWV88FyonExQk3nIVDUXnU8GkKxGFKwJDuyNZiFBADl8LDaAzCmhfEpEAwKPBuKz+Hx4MxuNE2MlqAUsEpcNovMgqpQ1rx8BJ4EoWiRZIV6Lh2pFohpzJYAMIsZW4OqOZjOVwGOBrJisdjIYpW1ATdHbRApdjwXHyfAAM3QWDQVw9zXWmwoKVINPxLXkTqUTAk4TQCiUCikVFIiZFsnDEXw+C8oJ96d2KXRcejULa1HQ2WYingXZimHoReUAmikHp5GQpL6imwxzzbRDdmcvsNetXNAj5UgHoX2k+GCI6B4FHweQ726ra3jkAAjAAGF8aN8AUlB+wUCucSDFDMuC6mQqyQAItRbqw6iQAAFAABmgtCzIsAActBoAhACUiaWu0mTIX+jQpIhADM8wAKxPksABsOH2LA+BVMgGD8gwsCYNWpIVso1ZsH08AMAeVTqLA4FTMwMx8I+XbRAes7SCWGAtFQGKZDiJBHqe55WmsiBoGwyn0CKviKcgCApK0e6una3rtAWoiGsR7DdAI+ApEgDijtUzg6esfrKoKZ7gaSEamaqxSPnpkCOUWkAAOLqAAEtgAjoNw3ANpAZAOP46z0io07YIq+DIcgY4uckl6AtI2xniWOrEmM2VkEVaxxt4vidRirIiqi/AJjFC4kEQVCsi27T+BmnkYl42BiheE73pAcZ4uepKCgwqohVafZpE0IS8St/jaXUmpTmsfYAJzXRoiy0Z+4SiVakz8uQRCqlIKD/mIq1Xsw4EcVxTILletDLnQdl8oemDYCKVWuuEQQhGqB67JAgrip02xlP9LDrEaJC6hQgZ8DFyZWhjm6XtI7ArDFBpGiamPUGgk0dSQdCQcCKDIPSJEEuxd5oNW4XiBGQkVSpF7+IFZCYTKMJhZq2QxXFzloJlq0Y2QnEYjEI1jZFSYy7i8AqPA9K4LIdkWJAbzcIrMSCDekhMg4TguG46jRFwCQkEkKQUGkjHNaSbtRUmpTYpAkAGDy0yUFwCzLPHbxdBQXDcL0AxDCMRj6MY4BQArg04AQxBkMoaby8k2cycI5LuzIaKKJOaiaNouhgIYJhQO487SxXhDZjXMR15wfhoFU9jup6EFt0otKd1oOhF8XpgGBoRBiWlZwsmjZyppQFv0v0JBgNsRA6WAQJmgfMcaLIzBeBwBixJ/Bj2/sACSVc5jTJ7D0exHzAzPNINw7Qkq4FSulQ4XI/ybG2DQEoMoIwbB1nwE+kp+r9FJLpdo19/L33kDUZAg5BQjktPyLoKQYpEjVvyKwzFKAAGVMjZEQtwFisAGLskVEJX28gZhxl2GsGKIcsCBTHBzewEopQpDYrPOhyAEIABIACiFArwUAQWqAOcY9QGwQtlBCAByCM+BuDmNMTCXKTwco6N2BZEUkYOQMDwGqUEmiMBGivBgF0kAJAAXak1fK/gMCGSFh0TKlBtpdHgghNh0AbAAHkeQJQAPo8n2H8TRWSADSmiACaCFwjJN/glHkv9MlFNKVk64v8AAyBTcn5PKZABCAB1NJNhCm1OyQAEV/jYTRDpoB9LKbhSqNNOiG2xMaCRRCFHSmymGPoy56HtDkvqag4lKqFnbuBYhBDICkPCNNPEDAzmM0SAUToORFKJRSmlBQyR2QpEqqSTws0aAUE2HiLkcj8B4F+TwfZfN7DiGyFUSUuAaBYBhDFGBcD+BgrwME0Jl0ulWH2NAZKpi0jgNILQORZB/GFCCV0GOvlkACLHDE0kDB5rlkqdUwZ9SSmNJaW0vJmjTGVR6X0gZdSRljImVMwVXhChEG2OWSRbU2D0GSakjJ2T2kFOKWUuy9oDheH+SbaE/IYqFjxONNG5cBHthdnwTwU4hI5WSAySBBgoAwxJUyexdwZq2p4Glekowow20xqIc1RqADc/AMBeHkCi158CY46l2ECNazFoWYPlIqLS7ATZ0sPEOahdpP6xELlvHee8BCPy5GcGyYAxxgCYD4ckjaRakGrd4l+b8P5fx/v/Me40YjAIXmA/WpBEBQLWCwkmHDmriklGsniMU60NqbdEMQralCtsrKLfSNAsrkMJkgGJ8ynWUsCfTEJuDLrIDEXKDA4KQnzVBtiGgRFHyCjllEeQI0AVNh2ueVFbz9HFB+XgHUYkl0rIXZoME+lVlKPTaorpWjnF6JjoY4xxw7H8ksQQGx2VOIGpyh4rxUcnG6O5HB46u7VpWz2a9SqNliKzIoEQRwAZ1hGMiccM90YqWXuxfJJJ6iKUcAdGkgAapomw+wEoFPFeMyZNgykVNE34jgfw0lDLeK0nJ/K2F4odAKtTYmtM6b05qzpGixPQH2DYeT0BGmyfyb0/pDFxqZHJvrFDABvXzORfncgAFSQAAL5hYQj+OM/zUgYH8ghWgHlyD0JCJ0hhCGSOCJud+xgmRgTQnaOyWCTByyIXUc02ouBNF3HUI5BiTHYBXhYomCjGNhzgWYzImWcYtRUdbKC3A4LnlwoZLtdoy1aO7MmNEsx6mJAcASr/AlbwABCWS0lvGgFYLbpjD0lWdjQjoiSKX8YvdVK9Fsb0tV1D4DmJ2/FnaCZdsJ6B8oCMDcI0NXZyD0B4pgLpYnTFTkBECfGgMYpMB0dITYKkzlgdstRkW2QZW71GJVbrtBNLaQ6OpEGtBwiFFjeBASTF6CPm4LUeq55KdUAEpQY1JzMuVUoLoyA+taCznPIetxO5dXf0sPsA1NdLXIvaGa5wRqrU+pteTu1AbHXBsZBOt1kAPVjq9fya1mY/X2sDU6yI8gJcWrxiTNYHpyxQdQFQuMxav5uvLbvK0+8qgprTSxM4AhsBW1oGAOtlPgTP1fu/EtAuDj9uroO+gw7QEJk9Sr1sXuffhBssZCFvMMHcHnEi6BCaDhJuqG7mVs9OLfRmGBShw5GRHakdUSDWBp3sM4b4ediiIIyoK72dx2Wvt0JQ9o3RIGMCYZ42sAAvJAPD1jbGEbcSRzkapo1tdJj4kY4lM9vVnhxUQQJCtrGK7eNlFWqs1bq+3QVMXuhSP8jFRLyWSC4FMZj5AiEk9eFoNZmynShUB6BA1mWVozWw8rOGML0Byoare0o7sh4dUtGHWkOzolUvWVs/WE2iBKkmk3GZAvGlC3gawUSbAiAAeV0MsBBawRopYjeFAs62Qp2ASz2QmTICE5mumfK+Shm+wxmgqMszB2mrB+mHSOQGC76CYn65ILysCwGBeCOOQ/ygKJs92++j29Bgm16wmNMH2QiuWlOiICy4ECEFKpiNKMod64Eb+BOEQR0cEKWSwsweEkwD+8waE2Eaev+GaWecipyIUpCfGKhF2jB2OJ4uOnqLQmKNMY0oK3AMQYBEkxMvhAm/hahL64EbhmecizGG+phNhiwdhlUNhaE/00SruFAu+m+OQLKC0HsGwkuqCB+ZYvo+WpRaAl+fAJAa+XSSWuAKWlhEYpipIEggIChSOO62Q6Ii43Uxe9hqOjqp0QRYYSAiKYQder0MUOOnqEEJAtyRCCAMW2UVBNBvgIBfAHOXO9hdBCRKQL2OKnQu6/OP8wuJuscYuawxuUuj42uaYGMeuiuzq4grqfI5AdupaDuYARgFazuVaxRqaxeiAZwpWgQzYXaIevaguEegCQ688seeWIMCeuekhiaiCUJ7u7hWCEE3u7+WxawGgPImi0A9gTYZGWAh6esmAK4i8WWn2uWdC4g42U6rC1Bzey+aCi+vAJAWBBs2UU+BGoi4iOQAxQIZyd+XRD+ZJPuUWBwcIQoUSPgsg4QsEyieWO+e+JGJWxy0U7Q5hLGMsjWQBrWRxKAQ0Fp5J9AyB2o4QDikovJJJrp84/ogo+IxOQEzpy+OI+y3Qe0WAmwixZ8xOYxpI3uIU2w0QyQsavI/IHkXm2JECjOMURJkxZusMSgdxguDxUuzxoaLKNRlq7xMuOucu/qDqQavxyuRgAJJAPawJEAoJ28TusALuRezEsJpI6gQe3aoefaAC480emJsYceGuuJ5uS404XQ66Mo0xowh69yXQR2WaV430MhJxZyLOaGbYmYBCoIv8r6bR5OCYv68hPJgGeeQ+2eQWmM0Y5IxOYUSy4E+xgpkBSxw0D64Gb2eyuhJk9KyhFxWKSRL+CEq2bwLSQyWS+wW2aSjS+wxSy2mi+wbCqmXS8FiFyFqFWSWmAAitZgRc0khShZMjkmwmtikstltgKthJ4ZlshhogPrsEPiPtgSQDhl0lKTPjCERikMUEcdLPQKjsaTIecedpcQEcsQgFgBESVC7BiikMYWjBedsmBOoOPIGJWKsIkjIU+sEAeNQDQAqA+dlLTidu0RGJ6bpPyKWO5E2G0VgJ0IqQANpuVeAAC6HAHA0ALgVgzgXQcE2E6pv8CYdlZyPpJYoaXu54hBBk3E9KJEzQ4QXuul32yYxGZlawsxYUKGmy/FoIAIEMwmMRpYdlMQCEZVpihVIFCgzaYgUMkAMViY8guB6h+UK55IdA4QsQTo/glQHg00CsMSMU9IEYciP2CMA17V9AvVTIs1nkgYGlLUpYfoopYFkAAAUmwhkm9lQHGianiWis+eikNmETLKjqSsyJAKpVEdHs3IUHbCWYaoguWa8YgjWb6vWd8U2ZEC2QnIUM8NRvHi1Z2KSNNe0HmUhplr+tqZJfEfJdBVdtOIeWeFGmxFlrLrKA2frkrkyAWchCaJclpNuBYRjJxPhJsXwMQtQE8MgCEUCWWt2eCX2ZCQOR7t8RkKOciaWhOQOrmHPF7LOVmeOpOhIVdQXojSovuqSZ4BkGconAlCqb/rujqLUAWlQtXq1BgPrLxvaTjeeCzpBRjVccVGlZDQNpKLvNqfYAQtEGAM8kqd0VMKQCkKrXwlafQDEaSM8jSv4F8jLG8DYM0lxlhmTXrVciMDEK0KWMwN4OIO7XDdYPyQcfIjBpNKgP+fYA/moqhoPhhv4OKdhmYkJQJaJfPp4jKOJWhgeFIsaX7QHTHTxpSQcFYL/OcmaPYdrWLKChQLxpHdHRQejQwTBSJr5mJvsL3VypFvYRonPRpkZoUnJgUsdZHcZlkuPZFi4WcT6pybGY0caXUfCSJpVhGKfrgPVqxZ1Y6fvrVofmsKgGxBgGABfFeHqdsraQDvaTVRAQhtAalbcdRnJdPVjUyDTEoD9noQDgYX4sDh3kCOEIgCPTcrydGFis+regDCTtQJKHcO8jQA8PYaHcXZ4YKcVbHL+c1NwrwjhGnrfhAIgAqdwGABDNlviKYmtKLFCmHSeFDEYHqkLt9aLhdS8WGlWXjADYTV8QriDS6irm2RzSCWCb2f2SUe7rCV0MwGNBsELR2WHn/JOVHhLSAlLfHrLUBgSZaore8l2Oxo8aSTFGwlpEY1lOLI6lfZgLWPWPtk7OLTCBTReIlmKfla6EYe9ekFETcnGLIFsX2KZF0lIkYfunUExN4PQKerfpBBkEYYKa0PA9E/nZpIqIndLD+gqJyUTaKUaKCogMTn3owqKFE2nRBoxmyCfVoV0oU/7e06SWk8/vXXgHobmXzWmfwHpHwNDTCGMVeBMcxO6SeebYTnwEIIIO4eEubshM8OI6WT9dIxWeGv9QmB8brsowbqo4XGruxPOa1LWZ8fLo2bc38YgFGkTmQnzc4/AK43moepXkWqY5oz2ZWmcIrfoxgLICCEiaY6LZHuLTHjY/ObLU4wachqap08RsM6YWk7Xpnozgw1wghDwkU7hMnZqSFKWJE71l07E7SjEQhFIhoO07E/QvyOS8wxeTnmsLEAiAQPlEoFESpNgcrpUJninkQq7ZfB7Z0d0UK+Ik/ugX9pU9ctEWJBeKnQalbJnaSy3plntJpcXf3mhjxRXbHQJRYlYjYp0q3eBMq/lJjmnpoTlsToAYOXaSefAWgU4CpJYiaW/VCp/d/ZQPgBU9LUoXescL6cqhbKgq6Y4k3ZRpjCiF6c63usYw87M5mQs6c04+uUTUs02KtPmXqIWYc2I/cZI3jL9bI48YGJcy89c+86TWoxDRo12Vo5C9C7WqLCY+OaiRYyizOeXLY/ZGsPY/noSX85kRjJqEQE7RbcEgzovsycbayUnfIBTWcu67BIa0KebUpea2XayLxRKRPjXXIpWLjFgDIR/emlTgC79tlIA1bdA+1LipwZvfJlktJjYGwr/Bkn0VeSIRsWcmIWIJ+R8n+kCpM/6x6BgT+EXch+IKMHe2qPFbsKmHg8aHmqgGDEuGyV5bS+sKQKQ5TgipQDnn2KmNvsgJ4+h46pJuu4UGct8O+O+E/eBFh8UElkyGxLeBgHehDhdR4JZbRzK/BjBm0AA2yCeZVHa/SqRhNAcC0fh4rGqDJ4Xro5MY6whE7hEKLNwSqsZ37aqwG1jsdt3VA6oTA+ENvsCHZ6/fUegJp20RxB3TacxEeYp2zh1psXMx3T6cWfqnW08ac39dWS24DQ0zcx262V22Cz2xCxCVC3zbCXWqnZqMCgi8O+HqO0AuO6OjiRi/O8rSa0IarNqOBGwn0HC5QNSbSQ2GW1i2a4a0G/aYfMUKKZXRIrhna+YsfT3rls56UTFJfccs0bFl5+JJjkkoqyqeQLPAQE2GAMh8OGlivct1y2WyrGkxAB3gjHt1fI1/fBQCw/J357SwF+1s/aF31qCGwvKFbM4LGnqfy4eHgHmjZGctK+BD17Sv17HVCn3jCEJaw0Vm51feaWsJ7Sqet74LXmd45U11dx3agBN0NTd6JHd0KcUMm/4HIv0YMY3Y9w1y4Jdy13Scj+znreXtIhrkdqevZ4kTA7BeomvQtqtrJjyA6MlAIZosvUKtz/PYvdqofe4xaWpN52QfYZhBkO5M4PQAvX3T4SrNeValJHQMFI+fiWQ58llgiPe8gNB7llBtBMh1JXDYoVPQ569nA2KXDfQAe5b995nkG8gxIKg6DuEB6JlIqer1ygJQwqIGHV0ikipsUjYMhZL6UmZ/hfz4L8L2H5dW8la6PjNmwCCiF+zwpTPbiKE7QouCFAQWcnQ8ESz+FxIyLvW9F4228XF4o28yTc2f8Sl6Hg7oYAYP3E6jeSPMVxPM6OwFwFQCouO60PCSvCOd3EXP34FOoFksaIgFkvcsTHQFkuFJmD3L3/34sGRGRAIGRGgLRGgGgE+GRLMNdKIsfy+McJBAINtCfwwLRLQAwNdDkS+Jf5RMsAvyXEYCvgDmcYGiNdCohPg4wtAOMAwEWBPgL+8wEgAIF6xoA0IcYH/mgHmAMAnwj/bAXvz76ADroSgAQLRD/5kRKIL4OMJBDQin8aIAgTCLMFogMBaAZED/hQNfBYD5gDAsiE+HwH98P+ZEEgBQJGCzAj+F/EgGhEoi0RIIlEAQPMGui9YnwtEWYNtDjCCC5BOA8Af/17gECIAkAa6JRBIDoRaAVEa6AwDIhvg4wpg+YJBDQCUQFg8wFQShEwFPhroT4CgSQFIFkQ+BgAyiFQOaLzBaI10NCNdFohgDaA10F8GhE/72C0ImArgWgBIBf8uYcYW/gIDQhoReBAAvQeAOkELAzBD0OMIYNmBX8vByApgdtHcEPQJB10HgYgJXClhshUAWYJRHmCuCkhKgVgX4Mv6H9WBt0J8IsBIE0QohaEBYBRAYBoRaIL4HIj4JyFKDRAT4AQC0ImE5E0IcgsUi+DIiTCxSswZomRHAEMBZgAgF8AIHcEn81gTQyALMFmA0DRBSg+YEf1oiLBaAcgw/iMHSGQDqIFgpYIsAeFoRFgaAWYCQECGzCoAaEaYYsFqFLAf+mwl8FzAiHXDFglEZEccAogYR3+YpSATgOaIvhQRz4FofAPkFv9z+dgh/jMAECLAkBAgSiP8MohH8bhVgyiGgBfD2DDhBRS4SQCiEMA/BcQwEYsEWBwj+Rx/JIRkJpE0CoBSgQQahBaHIiXwdhS4VAKUEAi6AzROAfAOmG0AMhtEKAQ9EWG0AcipA9Aef2P5HAshOg/vpkKoFwgHhdIm/i+C4FGDwR5AmYKhEogMB0B1I+wWf1QhX9KIeIiiNRDogSChBb/VoUCJCG38iBcAoIU+CUG38ShEQqYdSLxFwiuBtEMiNqKEFGCnwRwuEaf08GjClARg5omoNohJCkBNEJgfgN0FQAl+uAFfljnX6BxGQuoWgFkjLj6AgAA -->

<!-- internal state end -->
<!-- tips_start -->

---



<details>
<summary>🪧 Tips</summary>

### Chat

There are 3 ways to chat with [CodeRabbit](https://coderabbit.ai?utm_source=oss&utm_medium=github&utm_campaign=Accenture/AutoFixture.XUnit2.AutoMock&utm_content=247):

- Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  - `I pushed a fix in commit <commit_id>, please review it.`
  - `Generate unit testing code for this file.`
  - `Open a follow-up GitHub issue for this discussion.`
- Files and specific lines of code (under the "Files changed" tab): Tag `@coderabbitai` in a new review comment at the desired location with your query. Examples:
  - `@coderabbitai generate unit testing code for this file.`
  -	`@coderabbitai modularize this function.`
- PR comments: Tag `@coderabbitai` in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  - `@coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.`
  - `@coderabbitai read src/utils.ts and generate unit testing code.`
  - `@coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.`
  - `@coderabbitai help me debug CodeRabbit configuration file.`

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

### CodeRabbit Commands (Invoked using PR comments)

- `@coderabbitai pause` to pause the reviews on a PR.
- `@coderabbitai resume` to resume the paused reviews.
- `@coderabbitai review` to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
- `@coderabbitai full review` to do a full review from scratch and review all the files again.
- `@coderabbitai summary` to regenerate the summary of the PR.
- `@coderabbitai generate docstrings` to [generate docstrings](https://docs.coderabbit.ai/finishing-touches/docstrings) for this PR.
- `@coderabbitai resolve` resolve all the CodeRabbit review comments.
- `@coderabbitai configuration` to show the current CodeRabbit configuration for the repository.
- `@coderabbitai help` to get help.

### Other keywords and placeholders

- Add `@coderabbitai ignore` anywhere in the PR description to prevent this PR from being reviewed.
- Add `@coderabbitai summary` to generate the high-level summary at a specific location in the PR description.
- Add `@coderabbitai` anywhere in the PR title to generate the title automatically.

### CodeRabbit Configuration File (`.coderabbit.yaml`)

- You can programmatically configure CodeRabbit by adding a `.coderabbit.yaml` file to the root of your repository.
- Please see the [configuration documentation](https://docs.coderabbit.ai/guides/configure-coderabbit) for more information.
- If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: `# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json`

### Documentation and Community

- Visit our [Documentation](https://docs.coderabbit.ai) for detailed information on how to use CodeRabbit.
- Join our [Discord Community](http://discord.gg/coderabbit) to get help, request features, and share feedback.
- Follow us on [X/Twitter](https://twitter.com/coderabbitai) for updates and announcements.

</details>

<!-- tips_end -->
author_association: NONE
user: login: codecov-commenter
created_at: 2025-04-18T06:01:23Z
body: :warning: Please install the !['codecov app svg image'](https://github.com/codecov/engineering-team/assets/152432831/e90313f4-9d3a-4b63-8b54-cfe14e7ec20d) to ensure uploads and comments are reliably processed by Codecov.

## [Codecov](https://app.codecov.io/gh/Accenture/AutoFixture.XUnit2.AutoMock/pull/247?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Accenture) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 100.00%. Comparing base ([`ad278da`](https://app.codecov.io/gh/Accenture/AutoFixture.XUnit2.AutoMock/commit/ad278dacc523111c810750306ff25a0255866bce?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Accenture)) to head ([`0e4d636`](https://app.codecov.io/gh/Accenture/AutoFixture.XUnit2.AutoMock/commit/0e4d636fe5e712b0e3ae682dee7aff36e9eb146c?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Accenture)).
:warning: Report is 39 commits behind head on master.
:exclamation: Your organization needs to install the [Codecov GitHub app](https://github.com/apps/codecov/installations/select_target) to enable full functionality.

<details><summary>Additional details and impacted files</summary>



```diff
@@            Coverage Diff            @@
##            master      #247   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           39        39           
  Lines          424       424           
  Branches        55        55           
=========================================
  Hits           424       424           
```

| [Flag](https://app.codecov.io/gh/Accenture/AutoFixture.XUnit2.AutoMock/pull/247/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Accenture) | Coverage Δ | |
|---|---|---|
| [unittests](https://app.codecov.io/gh/Accenture/AutoFixture.XUnit2.AutoMock/pull/247/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Accenture) | `99.76% <ø> (ø)` | |

Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Accenture#carryforward-flags-in-the-pull-request-comment) to find out more.
</details>

[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/Accenture/AutoFixture.XUnit2.AutoMock/pull/247?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Accenture).   
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Accenture).
<details><summary> :rocket: New features to boost your workflow: </summary>

- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
</details>
author_association: NONE