Narrow the Gallery existence probe to PackageNotFound

Addresses review feedback on #528: -ErrorAction SilentlyContinue swallowed
every Find-PSResource failure, not just 'version not found'. During a Gallery
outage the probe returned null, publish was attempted anyway, and an
already-published version failed the upload with a conflict - losing the
resume behaviour the probe exists to provide.

The probe now runs with -ErrorAction Stop and only treats the
PackageNotFound error ID as 'not yet published'. Any other error stays fatal.

Also fixed the test harness, which could not observe whether publish ran:
- The $script:publishInvoked flag was never set, because the publish script
  runs in its own scope. Both existing assertions were vacuous. Replaced with
  a hashtable captured by GetNewClosure(), shared by reference.
- The marker-file variant depended on $env:GITHUB_WORKSPACE, which is
  process-wide and races between parallel Pester runspaces.
- The not-found shim used ThrowTerminatingError, which ignores -ErrorAction
  and so could not distinguish the fix from the bug. It now uses Write-Error
  with the real PackageNotFound error ID.

Added a case asserting a non-PackageNotFound lookup failure stays fatal and
does not publish. Verified each test fails against the defect it guards.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: 2 people

.github/actions/Publish-PSModule/src/publish.ps1

@@ -145,7 +145,18 @@ LogGroup 'Publish to PSGallery' {
     if ($whatIf) {
         Write-Host "Publish-PSResource -Path $modulePath -Repository PSGallery -ApiKey ***"
     } else {
-        $publishedPackage = Find-PSResource -Name $name -Version $publishPSVersion -Repository PSGallery -ErrorAction SilentlyContinue
+        # A version that is not on the Gallery is the expected state for a new release, but PSResourceGet
+        # reports it as a PackageNotFound error, which -ErrorAction Stop turns into a throw. Only that error
+        # may be treated as 'not published'; any other failure (for example a Gallery outage) must stay fatal,
+        # otherwise a version that already exists would be re-published and fail the upload with a conflict.
+        $publishedPackage = $null
+        try {
+            $publishedPackage = Find-PSResource -Name $name -Version $publishPSVersion -Repository PSGallery -ErrorAction Stop
+        } catch {
+            if ($_.FullyQualifiedErrorId -notlike 'PackageNotFound,*') { throw }
+            Write-Host "$name $publishPSVersion is not on the PowerShell Gallery yet."
+        }
+
         if ($publishedPackage) {
             Write-Host (
                 "::notice title=♻️ Resuming Gallery-only publication::$name $publishPSVersion is already " +

.github/actions/Publish-PSModule/tests/Publish-PSModule.Recovery.Tests.ps1

@@ -70,25 +70,28 @@ Describe 'Publish-PSModule recovery' {
         $env:PSMODULE_PUBLISH_PSMODULE_INPUT_PSGALLERY_API_KEY = 'test-key'
         $env:PSMODULE_PUBLISH_PSMODULE_INPUT_PullRequest = ''
         $env:PSMODULE_PUBLISH_PSMODULE_INPUT_WhatIf = 'false'
-        $script:publishInvoked = $false
+        # The publish script runs in its own scope, so a $script: flag set inside a shim never reaches the
+        # test. A hashtable captured by GetNewClosure() is shared by reference and records the call reliably.
+        # The closure captures local variables only, so $calls must be local here, not $script:-qualified.
+        $calls = @{ PublishInvoked = $false }
+        $script:calls = $calls
 
         Set-Item -Path function:global:Resolve-PSModuleDependency -Value {}
         Set-Item -Path function:global:Find-PSResource -Value {
             [PSCustomObject]@{ Name = 'TestModule'; Version = '1.2.4' }
         }
         Set-Item -Path function:global:Publish-PSResource -Value {
-            $script:publishInvoked = $true
-        }
+            $calls.PublishInvoked = $true
+        }.GetNewClosure()
     }
 
     It 'skips Gallery publication when the resolved version already exists' {
         { & $script:publishScriptPath } | Should -Not -Throw
 
-        $script:publishInvoked | Should -BeFalse
+        $script:calls.PublishInvoked | Should -BeFalse
     }
 
     It 'publishes when the resolved version is not in the Gallery' {
-        $publishMarkerPath = Join-Path -Path $script:workspacePath -ChildPath 'publish-invoked'
         Set-Item -Path function:global:Find-PSResource -Value {
             [CmdletBinding()]
             param(
@@ -97,14 +100,34 @@ Describe 'Publish-PSModule recovery' {
                 [string] $Repository
             )
 
-            Write-Error "Package with name '$Name', version '$Version' could not be found in repository '$Repository'."
-        }
-        Set-Item -Path function:global:Publish-PSResource -Value {
-            $null = New-Item -Path (Join-Path -Path $env:GITHUB_WORKSPACE -ChildPath 'publish-invoked') -ItemType File -Force
+            # Mirrors how PSResourceGet reports an absent version: an error with the PackageNotFound error ID
+            # that honours -ErrorAction, so the shim reacts to -ErrorAction the same way the real cmdlet does.
+            Write-Error -Message "Package with name '$Name', version '$Version' could not be found in repository '$Repository'." `
+                -ErrorId 'PackageNotFound' -Category ObjectNotFound -TargetObject $Name
         }
 
         { & $script:publishScriptPath } | Should -Not -Throw
 
-        (Test-Path -Path $publishMarkerPath) | Should -BeTrue
+        $script:calls.PublishInvoked | Should -BeTrue
+    }
+
+    It 'fails without publishing when the Gallery lookup errors for another reason' {
+        Set-Item -Path function:global:Find-PSResource -Value {
+            [CmdletBinding()]
+            param(
+                [string] $Name,
+                [string] $Version,
+                [string] $Repository
+            )
+
+            # A transient Gallery failure carries a different error ID and must not be mistaken for
+            # 'version not published', otherwise an already-published version would be re-uploaded.
+            Write-Error -Message "Error occured while trying to find '$Name' '$Version' in repository '$Repository': Service Unavailable" `
+                -ErrorId 'HttpRequestCallFailure' -Category ResourceUnavailable -TargetObject $Name
+        }
+
+        { & $script:publishScriptPath } | Should -Throw
+
+        $script:calls.PublishInvoked | Should -BeFalse
     }
 }