Repository navigation
Use PSGALLERY_API_KEY for PowerShell Gallery publishing #343
Description
Module maintainers need one self-describing PowerShell Gallery publishing credential across the reusable workflow, publishing action, configuration, and documentation. A single name makes the credential easy to audit and prevents mismatched caller and action contracts.
Request
Desired experience
Publishing a module requires PSGALLERY_API_KEY at every workflow and action boundary. A caller provides that one credential, and the reusable workflow forwards it unchanged to the publishing action.
Acceptance criteria
- The reusable workflow declares and consumes
PSGALLERY_API_KEY - The Publish-Module reusable workflow and Publish-PSModule action input use
PSGALLERY_API_KEY - The publishing action's environment variable and PowerShell variable identify the PowerShell Gallery credential consistently
- Canonical caller templates and Process-PSModule documentation require
PSGALLERY_API_KEY - Publishing to the PowerShell Gallery continues to use the supplied credential
Technical decisions
Credential contract: Use PSGALLERY_API_KEY for the workflow secret, publishing action input, and action environment variable. This name is explicit about both its service and purpose.
PowerShell command interface: The underlying Publish-PSResource cmdlet keeps its -ApiKey parameter because that is the cmdlet's public PowerShell interface. The value passed to it is held in the action's $psGalleryApiKey variable.
Workflow scope: Publish-Module forwards PSGALLERY_API_KEY directly to Publish-PSModule. No translation is needed at any GitHub Actions boundary.
Documentation: Setup, caller, workflow-reference, design, and action documentation name only PSGALLERY_API_KEY as the required publishing credential.
Implementation plan
Credential contract
- Declare and forward
PSGALLERY_API_KEYin the root reusable workflow and Publish-Module workflow - Rename the Publish-PSModule action input and environment variable to
PSGALLERY_API_KEY - Update the publishing script to use
$psGalleryApiKey
Documentation and validation
- Update canonical caller templates and Process-PSModule documentation
- Run workflow self-tests and action unit tests
- Confirm a real consumer publish to the PowerShell Gallery succeeds with
PSGALLERY_API_KEY
Implementation is delivered by PR #408.
Activity
MariusStorhaug commentedon Jul 4, 2026
Restructured the issue description into the standard three-section format and grounded it in the current workflow source.
APIKeydeclared,secrets.APIKEYinPublish-Module.yml,secrets.APIKeyinworkflow.ymland the two self-test workflows) — this works only because GitHub secret names are case-insensitive.workflow_callsecrets contract, breaking both explicit-mapping consumers andsecrets: inheritconsumers. Added a warning callout and a consumer migration path.PSGALLERY_API_KEY(with alternatives considered), scope boundary clarifying that thePSModule/Publish-PSModuleaction'sAPIKeyinput is not renamed (only thesecrets.*reference is), the hard-rename strategy vs. a deprecation-window alternative, casing standardization, and preservation of theWhatIfself-test wiring.workflow.yml,Publish-Module.yml,Workflow-Test-Default.yml,Workflow-Test-WithManifest.yml, andREADME.md(setup step, usage example, secrets table), plus rollout and verification steps.Major(breaking change),github_actions, anddocumentation.Publish-PSModuleaction).Note: an existing issue already covered this exact work, so it was restructured in place rather than opening a duplicate.
MariusStorhaug commentedon Aug 9, 2026
Recorded implementation progress from PR #408.
APIKeyaction input[-]Rename PSGallery API key secret from `APIKEY` to `PSGALLERY_API_KEY`[/-][+]Use PSGALLERY_API_KEY for PowerShell Gallery publishing[/+]MariusStorhaug commentedon Aug 9, 2026
Updated the credential contract to use one name at every GitHub Actions boundary.
PSGALLERY_API_KEY$psGalleryApiKeywhile retaining the cmdlet's-ApiKeyparameter🌟 [Major]: Reusable workflows now use GitHub App orchestration and ex…