Add cross-platform Maester action smoke test

[merill]

Summary

• add scheduled, post-preview, and manually triggered smoke tests for the published standard Maester GitHub Action
• run the action end to end against a real Microsoft 365 tenant on Ubuntu, Windows, and macOS
• gate every credentialed matrix job behind the protected maester-smoke-test environment and verify Maester results
• retain each OS's self-contained HTML report as a private release asset for core-maintainer review
• document the GitHub Environment, Entra workload identity, and private report-storage configuration

Security

• no pull_request or push trigger
• top-level token permissions are empty; only the protected smoke job receives contents: read and id-token: write
• tenant, client, and report-uploader credentials are Environment-scoped and cannot be read before required-reviewer approval
• Entra federation trusts only repo:maester365/maester:environment:maester-smoke-test
• public summaries, public artifacts, and telemetry remain disabled
• a dedicated GitHub App mints short-lived tokens for only maester365/maester-smoke-reports, reduced to contents: write
• the private report repository grants read access only to maester365/core-module (plus unavoidable organization-owner administration) and deletes reports after 30 days

Deployment configuration

The protected GitHub Environment, dedicated Entra application, private report repository, and repository-scoped GitHub App have been provisioned following the setup guide.

• organization base repository permission is none; the existing private .github readers were preserved explicitly
• maester-smoke-reports has core-module as its only explicit team and no direct collaborators
• do-not-delete-maester-reports is installed using Only select repositories with only the report repository selected and only Contents: write/Metadata: read
• MAESTER_REPORTS_APP_CLIENT_ID and MAESTER_REPORTS_APP_PRIVATE_KEY are stored in the protected Environment

The first manual smoke run after merge will still require approval from an authorized core maintainer.

Validation

• actionlint .github/workflows/maester-action-smoke-test.yaml
• standalone and embedded PowerShell scripts parsed without errors
• PSScriptAnalyzer found no errors or warnings in the report publisher
• local mock GitHub API verified release creation and binary HTML upload end to end
• workflow security invariants checked for trusted triggers, secret isolation, environment gating, job-level OIDC permission, disabled public artifacts, and repository-scoped uploader access
• staged diff checks passed

Summary by CodeRabbit

• New Features
  • Added a cross-platform (Linux/Windows/macOS) Maester tenant smoke test that runs against a real Microsoft 365 tenant.
  • Supports manual runs, weekly scheduling, and auto-runs after preview module publishing.
  • Gate-kept by a protected GitHub Actions environment with required approvals, minimal job permissions, and validated input secrets.
  • Produces and publishes a private HTML report asset, and verifies results consistency, tenant/OS match, and expected metadata.
• Documentation
  • Added workflow documentation covering approval behavior, trigger rules, and required Entra app setup.

[coderabbitai]

📝 Walkthrough

Walkthrough

Changes

Maester tenant smoke testing

Layer / File(s)	Summary
Workflow triggers and protected execution .github/workflows/maester-action-smoke-test.yaml	Adds manual, scheduled, and successful preview-publish triggers, trusted-ref preflight checks, concurrency control, protected environment approval, and a Linux/Windows/macOS matrix with minimal permissions.
Smoke execution, validation, and private reporting .github/workflows/maester-action-smoke-test.yaml, .github/scripts/Publish-MaesterSmokeReport.ps1	Validates credentials, runs pinned Maester MT.1068 checks, verifies result consistency and metadata, and publishes each HTML report as a private release asset with concurrent-creation handling.
Environment and integration documentation .github/workflows/maester-action-smoke-test.md	Documents protected environment settings, Entra registration, permissions, triggers, acceptance rules, private report storage, and disabled public outputs.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Trigger
  participant Preflight
  participant SmokeJob
  participant MaesterAction
  participant ResultsJson
  participant ReportPublisher
  participant PrivateReports
  Trigger->>Preflight: Start workflow
  Preflight->>SmokeJob: Permit trusted successful run
  SmokeJob->>MaesterAction: Execute MT.1068 with approved credentials
  MaesterAction->>ResultsJson: Write results
  SmokeJob->>ResultsJson: Validate output and metadata
  SmokeJob->>ReportPublisher: Publish HTML report
  ReportPublisher->>PrivateReports: Create release and upload asset

Loading

Suggested labels: documentation, enhancement, github_actions, automation

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title is concise and accurately summarizes the main change: a cross-platform Maester action smoke test.
Description check	✅ Passed	The description covers the PR’s purpose, security model, deployment setup, and validation, with only minor template differences.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/add-maester-action-smoke-test

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[cloudflare-workers-and-pages]

Deploying maester with    Cloudflare Pages

Latest commit:	341197b
Status:	✅  Deploy successful!
Preview URL:	https://f5025750.maester.pages.dev
Branch Preview URL:	https://codex-add-maester-action-smo.maester.pages.dev

View logs

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/maester-action-smoke-test.yaml:
- Line 31: Update publish-module-preview to emit the exact published
tag/version, then have the smoke workflow retrieve and use that value at job
start for workflow_run executions instead of inputs.maester_version; retain
preview only for manual or scheduled runs. Apply this in
.github/workflows/maester-action-smoke-test.yaml at lines 31 and 106, and update
.github/workflows/maester-action-smoke-test.md lines 73-75 to describe testing
the newly published preview after the protected workflow completes rather than
immediately.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 9710202a-14a0-4962-b058-041b3fe91388

📥 Commits

Reviewing files that changed from the base of the PR and between c2e32d9 and e6b2b67.

📒 Files selected for processing (2)

• .github/workflows/maester-action-smoke-test.md
• .github/workflows/maester-action-smoke-test.yaml