From 70ee34974716c1e52408370d2c0e125bf4a479a9 Mon Sep 17 00:00:00 2001
From: Marius Storhaug <marstor@hotmail.com>
Date: Tue, 7 Jul 2026 16:31:37 +0200
Subject: [PATCH 1/3] Lock Pester to the 6.x major version

Install Pester with the version range [6.0.0,7.0.0) so the action always uses the latest 6.x and a future major release cannot be adopted silently. Adds an optional -Version parameter to Install-PSResourceWithRetry.
---
 README.md        |  1 +
 src/Helpers.psm1 | 18 ++++++++++++++++--
 src/init.ps1     |  4 +++-
 3 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index aa681cb9..e1f5231f 100644
--- a/README.md
+++ b/README.md
@@ -122,6 +122,7 @@ If you specify `CodeCoverage_Enabled: true` here, it will enable coverage even i
 
 1. **Prerequisite Setup**
    - Installs required PowerShell modules if they're not present.
+   - Pester is locked to the `6.x` major version (`[6.0.0,7.0.0)`), so a future major release cannot be adopted silently.
    - Imports the modules so the testing framework is ready to use.
 2. **Loading Inputs and Configuration**
    - Loads a default Pester configuration.
diff --git a/src/Helpers.psm1 b/src/Helpers.psm1
index 5cda07f2..05cae05a 100644
--- a/src/Helpers.psm1
+++ b/src/Helpers.psm1
@@ -1298,6 +1298,11 @@ function Install-PSResourceWithRetry {
         )]
         [string] $Name,
 
+        # Version of the module to install. Accepts an exact version or a NuGet version range,
+        # e.g. '[6.0.0,7.0.0)' to lock to the 6.x major version. Defaults to the latest version.
+        [Parameter()]
+        [string] $Version,
+
         # Number of times to retry installation, default is 5
         [Parameter()]
         [int] $RetryCount = 5,
@@ -1308,10 +1313,19 @@ function Install-PSResourceWithRetry {
     )
 
     process {
-        Write-Output "Installing module: $Name"
+        $installParams = @{
+            Name            = $Name
+            Repository      = 'PSGallery'
+            TrustRepository = $true
+            WarningAction   = 'SilentlyContinue'
+        }
+        if (-not [string]::IsNullOrEmpty($Version)) {
+            $installParams['Version'] = $Version
+        }
+        Write-Output "Installing module: $Name $Version".Trim()
         for ($i = 0; $i -lt $RetryCount; $i++) {
             try {
-                Install-PSResource -Name $Name -WarningAction SilentlyContinue -TrustRepository -Repository PSGallery
+                Install-PSResource @installParams
                 break
             } catch {
                 Write-Warning "Installation of $Name failed with error: $_"
diff --git a/src/init.ps1 b/src/init.ps1
index 990f9ac8..0e6c3626 100644
--- a/src/init.ps1
+++ b/src/init.ps1
@@ -3,7 +3,9 @@ param()
 
 LogGroup 'Init - Setup prerequisites' {
     Import-Module "$PSScriptRoot/Helpers.psm1"
-    'Pester', 'Hashtable', 'TimeSpan', 'Markdown' | Install-PSResourceWithRetry
+    # Lock Pester to the 6.x major version so a future major release cannot be adopted silently.
+    Install-PSResourceWithRetry -Name 'Pester' -Version '[6.0.0,7.0.0)'
+    'Hashtable', 'TimeSpan', 'Markdown' | Install-PSResourceWithRetry
 }
 
 LogGroup 'Init - Get test kit versions' {

From 0a79b9e74cb0ebf8d03012359c2faefe7efd9fdc Mon Sep 17 00:00:00 2001
From: Marius Storhaug <marstor@hotmail.com>
Date: Wed, 8 Jul 2026 00:09:57 +0200
Subject: [PATCH 2/3] Pin Pester to the 6.x major version in exec.ps1

exec.ps1 runs after init.ps1 and re-installed Pester without a version in both the Exec and Eval setup steps, which could pull a newer major and defeat the lock. Install Pester with the same [6.0.0,7.0.0) range used in init.ps1.
---
 src/exec.ps1 | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/exec.ps1 b/src/exec.ps1
index ab0de546..220ab2c2 100644
--- a/src/exec.ps1
+++ b/src/exec.ps1
@@ -7,7 +7,8 @@ $PSStyle.OutputRendering = 'Ansi'
 
 '::group::Exec - Setup prerequisites'
 Import-Module "$PSScriptRoot/Helpers.psm1"
-'Pester' | Install-PSResourceWithRetry
+# Lock Pester to the 6.x major version so a future major release cannot be adopted silently.
+Install-PSResourceWithRetry -Name 'Pester' -Version '[6.0.0,7.0.0)'
 '::endgroup::'
 
 '::group::Exec - Get test kit versions'
@@ -59,7 +60,9 @@ $testResults = Invoke-Pester -Configuration $configuration
 $PSStyle.OutputRendering = 'Ansi'
 
 '::group::Eval - Setup prerequisites'
-'Pester', 'Hashtable', 'TimeSpan', 'Markdown' | Install-PSResourceWithRetry
+# Lock Pester to the 6.x major version so a future major release cannot be adopted silently.
+Install-PSResourceWithRetry -Name 'Pester' -Version '[6.0.0,7.0.0)'
+'Hashtable', 'TimeSpan', 'Markdown' | Install-PSResourceWithRetry
 '::endgroup::'
 
 '::group::Eval - Get test kit versions'

From 82dae1f412b970a471903d07b7f5c994c3c34732 Mon Sep 17 00:00:00 2001
From: Marius Storhaug <marstor@hotmail.com>
Date: Wed, 8 Jul 2026 00:09:57 +0200
Subject: [PATCH 3/3] Reject whitespace-only version input in
 Install-PSResourceWithRetry

Use IsNullOrWhiteSpace so a whitespace-only -Version is not forwarded to Install-PSResource as an invalid version.
---
 src/Helpers.psm1 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Helpers.psm1 b/src/Helpers.psm1
index 05cae05a..e582b34b 100644
--- a/src/Helpers.psm1
+++ b/src/Helpers.psm1
@@ -1319,7 +1319,7 @@ function Install-PSResourceWithRetry {
             TrustRepository = $true
             WarningAction   = 'SilentlyContinue'
         }
-        if (-not [string]::IsNullOrEmpty($Version)) {
+        if (-not [string]::IsNullOrWhiteSpace($Version)) {
             $installParams['Version'] = $Version
         }
         Write-Output "Installing module: $Name $Version".Trim()