From 4ae6f2b90294d0916c94c74e48acffa4bf32480e Mon Sep 17 00:00:00 2001 From: ciregenz Date: Mon, 31 Aug 2026 17:27:48 -0700 Subject: [PATCH] [eric] ci: the defender drill reads Write-Host output via 6>&1, not the empty pipeline --- .github/workflows/defender-exclusion-drill.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/defender-exclusion-drill.yml b/.github/workflows/defender-exclusion-drill.yml index 1c858ce0..a783ab4e 100644 --- a/.github/workflows/defender-exclusion-drill.yml +++ b/.github/workflows/defender-exclusion-drill.yml @@ -55,7 +55,10 @@ jobs: - name: -Status reports them, so the user-facing read-back is honest too shell: pwsh run: | - $out = & backend\scripts\add-defender-exclusion.ps1 -Status | Out-String + # The script reports with Write-Host, which does NOT go down the pipeline; 6>&1 redirects the + # information stream so the drill reads what a user would actually see. (Piping to Out-String + # alone captured nothing and failed a step whose product behaviour was correct.) + $out = (& backend\scripts\add-defender-exclusion.ps1 -Status 6>&1) | Out-String Write-Host $out if ($out -notmatch 'openswarm') { throw "-Status did not report the exclusions it just added" }