maester365 · thetechgy · Jul 26, 2026 · Jul 26, 2026 · Jul 26, 2026 · Jul 26, 2026
@@ -15,24 +15,24 @@ jobs:
   build:
     permissions:
       contents: read
-      pull-requests: read
     runs-on: ubuntu-latest
     steps:
-      - name: Generate maester-bot app token
-        id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          app-id: ${{ secrets.MAESTER_BOT_APP_ID }}
-          private-key: ${{ secrets.MAESTER_BOT_PRIVATE_KEY }}
-
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          token: ${{ steps.app-token.outputs.token }}
           persist-credentials: false
       - name: Update docs
         run: ./build/Update-CommandReference.ps1
         shell: pwsh
 
+      - name: Generate maester-bot app token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.MAESTER_BOT_APP_ID }}
+          private-key: ${{ secrets.MAESTER_BOT_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
+
       - name: Create PR to update repo
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:

@@ -20,6 +20,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

@@ -48,6 +48,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Check command reference inputs
         if: github.event_name == 'pull_request'
@@ -72,6 +74,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Generate command reference
         shell: pwsh
@@ -125,6 +129,7 @@ jobs:
         with:
           # Full history so contributor attribution can be derived from git.
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Download generated command reference
         if: needs.detect-command-reference-changes.outputs.generate == 'true'

@@ -62,10 +62,12 @@ jobs:
         # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
-    - name: Checkout repository
+    - name: Checkout repository
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-    # Add any setup steps before running the `github/codeql-action/init` action.
+      with:
+        persist-credentials: false
+
+    # Add any setup steps before running the `github/codeql-action/init` action.
     # This includes steps like installing compilers or runtimes (`actions/setup-node`
     # or others). This is typically only required for manual builds.
     # - name: Setup runtime (example)

@@ -22,6 +22,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Dependency review
         uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

@@ -41,10 +41,12 @@ jobs:
       actions: read
 
     steps:
-      - name: Checkout repository
+      - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      # Install OpenGrep by downloading the release binary directly from
+        with:
+          persist-credentials: false
+
+      # Install OpenGrep by downloading the release binary directly from
       # GitHub Releases (pinned by tag) and verifying its SHA256 before
       # executing it. Avoids piping a moving `install.sh` into bash and
       # closes the integrity gap left by trusting a mutable release tag.

@@ -60,7 +60,9 @@ jobs:
 
       - name: Stamp maester-config.json version fields
         shell: pwsh
-        run: ./build/Update-MaesterConfigVersion.ps1 -ConfigPath tests/maester-config.json -ModuleVersion '${{ steps.moduleversion.outputs.tag }}'
+        env:
+          MODULE_VERSION: ${{ steps.moduleversion.outputs.tag }}
+        run: ./build/Update-MaesterConfigVersion.ps1 -ConfigPath tests/maester-config.json -ModuleVersion $env:MODULE_VERSION
 
       # ./module/ is a build artifact produced by Build-MaesterModule.ps1.
       # It is ignored by git and must never be committed to source control.
@@ -95,7 +97,9 @@ jobs:
         run: npm ci
 
       - name: Update website release version
-        run: node ./build/Update-WebsiteReleaseVersion.mjs ${{ steps.moduleversion.outputs.tag }}
+        env:
+          MODULE_VERSION: ${{ steps.moduleversion.outputs.tag }}
+        run: node ./build/Update-WebsiteReleaseVersion.mjs "$MODULE_VERSION"
 
       - name: Create website release version pull request
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1

@@ -49,7 +49,9 @@ jobs:
 
       - name: Stamp maester-config.json version fields
         shell: pwsh
-        run: ./build/Update-MaesterConfigVersion.ps1 -ConfigPath tests/maester-config.json -ModuleVersion '${{ steps.moduleversion.outputs.tag }}'
+        env:
+          MODULE_VERSION: ${{ steps.moduleversion.outputs.tag }}
+        run: ./build/Update-MaesterConfigVersion.ps1 -ConfigPath tests/maester-config.json -ModuleVersion $env:MODULE_VERSION
 
       # ./module/ is a build artifact produced by Build-MaesterModule.ps1.
       # It is ignored by git and must never be committed to source control.
@@ -80,7 +82,9 @@ jobs:
           commit: ${{ github.sha }}
 
       - name: Update website preview version
-        run: node ./build/Update-WebsitePreviewVersion.mjs ${{ steps.moduleversion.outputs.tag }}
+        env:
+          MODULE_VERSION: ${{ steps.moduleversion.outputs.tag }}
+        run: node ./build/Update-WebsitePreviewVersion.mjs "$MODULE_VERSION"
 
       - name: Commit website preview version
         uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d #v5

@@ -60,7 +60,9 @@ jobs:
 
       - name: Stamp maester-config.json version fields
         shell: pwsh
-        run: ./build/Update-MaesterConfigVersion.ps1 -ConfigPath tests/maester-config.json -ModuleVersion '${{ steps.moduleversion.outputs.tag }}'
+        env:
+          MODULE_VERSION: ${{ steps.moduleversion.outputs.tag }}
+        run: ./build/Update-MaesterConfigVersion.ps1 -ConfigPath tests/maester-config.json -ModuleVersion $env:MODULE_VERSION
 
       # ./module/ is a build artifact produced by Build-MaesterModule.ps1.
       # It is ignored by git and must never be committed to source control.
@@ -95,7 +97,9 @@ jobs:
         run: npm ci
 
       - name: Update website release version
-        run: node ./build/Update-WebsiteReleaseVersion.mjs ${{ steps.moduleversion.outputs.tag }}
+        env:
+          MODULE_VERSION: ${{ steps.moduleversion.outputs.tag }}
+        run: node ./build/Update-WebsiteReleaseVersion.mjs "$MODULE_VERSION"
 
       - name: Create website release version pull request
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1

@@ -23,14 +23,16 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Resolve latest release tag
         id: release_tag
         shell: pwsh
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
         run: |
-          $tag = '${{ github.event.release.tag_name }}'
+          $tag = $env:RELEASE_TAG
           if ([string]::IsNullOrWhiteSpace($tag)) {
             $tag = (gh release view --repo $env:GITHUB_REPOSITORY --json tagName -q .tagName)
           }
@@ -41,10 +43,12 @@ jobs:
 
       - name: Stamp maester-config.json version fields
         shell: pwsh
-        run: ./build/Update-MaesterConfigVersion.ps1 -ConfigPath ./tests/maester-config.json -ModuleVersion '${{ steps.release_tag.outputs.tag }}'
+        env:
+          RELEASE_TAG: ${{ steps.release_tag.outputs.tag }}
+        run: ./build/Update-MaesterConfigVersion.ps1 -ConfigPath ./tests/maester-config.json -ModuleVersion $env:RELEASE_TAG
       - name: Publish to maester-tests
         id: push_directory
-        uses: cpina/github-action-push-to-another-repository@3fc9348237c8c6954ff88e58719af8a88af543f7
+        uses: cpina/github-action-push-to-another-repository@55306faa4ed53b815ae49e564af8cfb359d32ae2 # v1.7.3
         env:
           SSH_DEPLOY_KEY: ${{ secrets.SSH_DEPLOY_KEY }}
         with:

@@ -51,7 +51,9 @@ jobs:
         run: npm ci
 
       - name: Update website release version
-        run: node ./build/Update-WebsiteReleaseVersion.mjs ${{ inputs.version }}
+        env:
+          WEBSITE_VERSION: ${{ inputs.version }}
+        run: node ./build/Update-WebsiteReleaseVersion.mjs "$WEBSITE_VERSION"
 
       - name: ✍️ Create Version Files Pull Request
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1

@@ -20,25 +20,26 @@ jobs:
     runs-on: windows-latest
     permissions:
       contents: read
-      pull-requests: read
-
-    steps:
-      - name: Generate maester-bot app token
-        id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          app-id: ${{ secrets.MAESTER_BOT_APP_ID }}
-          private-key: ${{ secrets.MAESTER_BOT_PRIVATE_KEY }}
-
+
+    steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          token: ${{ steps.app-token.outputs.token }}
-      - name: Update maester.dev powershell docs
-        run: ./build/Update-CommandReference.ps1
-        shell: pwsh
-
-      - name: Create Pull Request
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          persist-credentials: false
+      - name: Update maester.dev powershell docs
+        run: ./build/Update-CommandReference.ps1
+        shell: pwsh
+
+      - name: Generate maester-bot app token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.MAESTER_BOT_APP_ID }}
+          private-key: ${{ secrets.MAESTER_BOT_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
+
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ steps.app-token.outputs.token }}
           title: Update maester.dev powershell docs
@@ -15,26 +15,26 @@ jobs:
   update-public-suffix-list:
     runs-on: ubuntu-latest
     permissions:
-      contents: write
-      pull-requests: write
+      contents: read
 
     steps:
-      - name: Generate maester-bot app token
-        id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          app-id: ${{ secrets.MAESTER_BOT_APP_ID }}
-          private-key: ${{ secrets.MAESTER_BOT_PRIVATE_KEY }}
-
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          token: ${{ steps.app-token.outputs.token }}
           persist-credentials: false
 
       - name: Update public suffix list
         shell: pwsh
         run: ./build/Update-PublicSuffixList.ps1
 
+      - name: Generate maester-bot app token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.MAESTER_BOT_APP_ID }}
+          private-key: ${{ secrets.MAESTER_BOT_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
+
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:

@@ -12,34 +12,32 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  update-role-definitions:
-    runs-on: windows-latest
-    permissions:
-      contents: read
-      pull-requests: read
-
-    steps:
-      - name: Generate maester-bot app token
-        id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          app-id: ${{ secrets.MAESTER_BOT_APP_ID }}
-          private-key: ${{ secrets.MAESTER_BOT_PRIVATE_KEY }}
-          permission-contents: write
-          permission-pull-requests: write
-
+  update-role-definitions:
+    runs-on: windows-latest
+    permissions:
+      contents: read
+
+    steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          token: ${{ steps.app-token.outputs.token }}
-          persist-credentials: false
-
-      - name: Update Entra ID role definitions
-        id: update
-        run: ./build/Update-MtRoleDefinitions.ps1
-        shell: pwsh
-
-      - name: Create Pull Request
-        if: success()
+        with:
+          persist-credentials: false
+
+      - name: Update Entra ID role definitions
+        id: update
+        run: ./build/Update-MtRoleDefinitions.ps1
+        shell: pwsh
+
+      - name: Generate maester-bot app token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.MAESTER_BOT_APP_ID }}
+          private-key: ${{ secrets.MAESTER_BOT_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
+
+      - name: Create Pull Request
+        if: success()
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ steps.app-token.outputs.token }}