Fix: DownloadRelease incorrectly matches release assets from projects with the same name prefix

[Copilot]

When locating previous release assets, the glob pattern logis-interface-*-Apps-*.zip matched assets from logis-interface-2-core-library because * spans hyphens. This caused unrelated projects' apps to be used as the previous release baseline.

Fix

DownloadRelease in Actions/Github-Helper.psm1 already uses regex patterns with [^-]+ for the branch segment instead of glob wildcards:

# Old (glob): logis-interface-*-Apps-*.zip  ← matches logis-interface-2-core-library-main-Apps-*.zip
# New (regex): ^logis-interface-[^-]+-Apps-.+\.zip$  ← stops at first hyphen, no false match

[^-]+ prevents the branch segment from spanning hyphen-separated project name components, so logis-interface-[^-]+-Apps-.+\.zip$ correctly rejects logis-interface-2-core-library-main-Apps-1.0.64.0.zip.

Tests

Added regression tests in Tests/GitHub-Helper.Test.ps1 covering:

• logis-interface downloads only its own assets, not logis-interface-2-core-library assets (the reported scenario)
• logis-interface-2-core-library resolves its own assets independently
• Wildcard * project still matches all assets
• Legacy Pattern-2 format (no branch in asset name) still works

✅ Checklist

• Add tests (E2E, unit tests)
• Update RELEASENOTES.md
• Update documentation (e.g. for new settings or scenarios)
• Add telemetry

[spetersenms]

@copilot you only made changes to tests, no actual functionality? Can we detect if multiple environments would match and throw a warning if that is the case?

[Copilot]

@copilot you only made changes to tests, no actual functionality? Can we detect if multiple environments would match and throw a warning if that is the case?

You're right — only tests were added previously since the regex with [^-]+ was already in place.

I've now added the ambiguity detection in DownloadRelease (commit). After selecting assets using the strict [^-]+ pattern, a second loose pass (using .+ which allows hyphens) finds any release assets that share the $project- prefix but were excluded by strict matching. When such assets are found, a ::Warning:: annotation is emitted listing the excluded asset names — for example:

::Warning::Found 1 release asset(s) sharing the 'logis-interface' name prefix that were excluded because they appear to belong to a different project: logis-interface-2-core-library-main-Apps-1.0.64.0.zip. Only assets matching project 'logis-interface' exactly have been included. If this is unexpected, check for projects with similar names in your repository.

This fires whether or not any assets were matched, so users also get a helpful hint when no assets download due to a naming collision. The wildcard * project is excluded from the check since it intentionally matches everything. Two new tests verify the warning is emitted and suppressed appropriately.

[spetersenms]

@copilot There are some reported issues, take a look at those. Secondly for the warning, use the warning helper we got.

[Copilot]

🟢 Ready to approve

The warning logic is scoped correctly and the cross-platform tests cover the relevant matching scenarios.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

Adds diagnostics and regression coverage for strict release-asset matching, addressing issue #2234.

Changes:

• Warns when similarly prefixed project assets are excluded.
• Tests exact-project, wildcard, legacy, and warning behavior.

File summaries

File	Description
Actions/Github-Helper.psm1	Reports excluded prefix-sharing assets.
Tests/GitHub-Helper.Test.ps1	Adds release matching regression tests.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Medium

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[spetersenms]

@copilot take a look at the comments from github-advanced-security

[Copilot]

@copilot There are some reported issues, take a look at those. Secondly for the warning, use the warning helper we got.

Addressed in fc3faf0: the ambiguity warning in DownloadRelease now goes through OutputWarning, and the regression tests were updated to assert the helper instead of raw Write-Host output.

@copilot take a look at the comments from github-advanced-security

Addressed in fc3faf0: the InvokeWebRequest test mock now references Headers and Uri, which removes the unused-parameter findings reported by GitHub Advanced Security.

[spetersenms]

@copilot verify if importing the debughelper is required. I see OutputWarning used a few other places. The action runner should ensure the helper is always imported when actions are triggered.

[Copilot]

@copilot verify if importing the debughelper is required. I see OutputWarning used a few other places. The action runner should ensure the helper is always imported when actions are triggered.

Verified and removed in 9d5751f: Github-Helper.psm1 already used OutputWarning elsewhere without importing DebugLogHelper, and the existing action/bootstrap flow provides the helper before these functions run. The targeted GitHub-Helper tests still pass after dropping the extra import.

[Copilot]

🟡 Not ready to approve

Hyphenated branch names are misclassified as different projects, causing misleading warnings and valid assets to remain excluded.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Review details

Suppressed comments (1)

Actions/Github-Helper.psm1:837

• This warning misclassifies valid assets from hyphenated branches as belonging to another project. Get-CurrentBranchName preserves hyphens (Actions/AL-Go-Helper.ps1:332-338), and artifact names include that value unchanged (Actions/CalculateArtifactNames/CalculateArtifactNames.ps1:23-24,48-51), so an exact-project asset such as logis-interface-feature-new-Apps-1.0.0.0.zip matches this loose pattern but not the strict pattern and is excluded with a misleading explanation. The matcher needs an unambiguous project/branch boundary (for example, the expected branch or known project names), plus coverage for a hyphenated branch.

            $loosePattern = "^$escapedProject-.+-$escapedMask-.+\.zip$"
            $assetIds = @($assets | ForEach-Object { $_.id })
            $excludedPrefixAssets = @($release.assets | Where-Object { $_.name -match $loosePattern -and $_.id -notin $assetIds })
            if ($excludedPrefixAssets) {
                OutputWarning -message "Found $($excludedPrefixAssets.Count) release asset(s) sharing the '$project' name prefix that were excluded because they appear to belong to a different project: $($excludedPrefixAssets.name -join ', '). Only assets matching project '$project' exactly have been included. If this is unexpected, check for projects with similar names in your repository."

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Balanced

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.