feat(ci): path detector + Invoke-GoTest wrapper (#562 2/4)

[WilliamBerryiii]

Pull Request

IMPORTANT: Before submitting, please remove all sensitive data, secrets, tokens, or confidential information. Ensure you've redacted any NDA-covered information, IP addresses, resource names, or security-related details that shouldn't be publicly disclosed.

Description

Second PR (2 of 4) in the Go static contract tests stack for #562. Adds the path-change detector and the opt-in npm run go-test wrapper for the Go contract tests, without wiring any CI gate yet. The required check lands in PR 3.

Stacked on top of #571.

Related Issue

Closes #568
Relates to #562

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Blueprint modification or addition
• Component modification or addition
• Documentation update
• CI/CD pipeline change
• Other (please describe):

Implementation Details

• scripts/build/Detect-Folder-Changes.ps1
  • New helpers:
    • Test-IsGoContractTestChangeFile — classifies a single changed path as relevant to the Go contract test surface.
    • Test-GoContractTestHasChange — boolean roll-up over a change set.
    • Test-IsTerraformInstallChangeFile — classifies scripts/install-terraform-docs.sh (the Go tests shell out to terraform-docs).
  • Detector regex covers:
    • blueprints/full-single-node-cluster/{terraform,bicep}/**
    • blueprints/full-single-node-cluster/tests/**/*.go and go.{mod,sum}
    • src/900-tools-utilities/904-test-utilities/**
    • scripts/install-terraform-docs.sh
    • scripts/linting/Invoke-GoTest.ps1
    • scripts/tests/linting/Invoke-GoTest.Tests.ps1
    • .github/workflows/{go-tests,matrix-folder-check,pr-validation}.yml
    • scripts/build/Detect-Folder-Changes.ps1
    • package.json, package-lock.json
• scripts/linting/Invoke-GoTest.ps1 (new)
  • Wraps go test . -run '^(TestTerraformOutputsContract|TestBicepOutputsContract)$' in blueprints/full-single-node-cluster/tests.
  • Parameters: -RepoRoot, -BaseBranch (default origin/main), -ChangedOnly switch, -ChangedFiles, -CommandRunner (test injection seam).
  • Imports CIHelpers.psm1 + LintingHelpers.psm1.
  • Emits Set-CIOutput -Name 'goContractTestsRan' -Value 'true'|'false' and Set-CIOutput -Name 'goContractTestsExitCode' for a future CI step to branch on.
• package.json
  • New go-test npm script: pwsh -File ./scripts/linting/Invoke-GoTest.ps1.

PR 1 added the per-test terraform-docs.yml writer in contract.go and the Go test modules under minimum- and only-cloud-single-node-cluster. The CI gate (PR 3) needs a deterministic, testable way to (1) decide whether a PR's changes can affect Go contract tests and (2) run those tests locally and in CI through one consistent entry point. This PR delivers both. Until PR 3 lands, npm run go-test is fully opt-in for contributors.

Testing Performed

• Terraform plan/apply
• Blueprint deployment test
• Unit tests
• Integration tests
• Bug fix includes regression test (see Test Policy)
• Manual validation
• Other:

Validation Steps

• scripts/tests/build/Detect-Folder-Changes.Tests.ps1 — 27 / 0 / 0 (Pester v5.7.1).
• scripts/tests/linting/Invoke-GoTest.Tests.ps1 (new, 14 cases covering arg parsing, change detection, exit-code propagation, CI output emission) — 14 / 0 / 0.
• npm run go-test — exit 0. Direct go test run:
  • --- PASS: TestBicepOutputsContract (28.78s)
  • --- PASS: TestTerraformOutputsContract (0.12s)
  • ok github.com/microsoft/edge-ai/blueprints/full-single-node-cluster/tests 29.180s
• npm run lint — exit 0 (only pre-existing yamllint/hadolint warnings on unrelated files).

Checklist

• I have updated the documentation accordingly
• I have added tests to cover my changes
• All new and existing tests passed
• I have run terraform fmt on all Terraform code
• I have run terraform validate on all Terraform code
• I have run az bicep format on all Bicep code
• I have run az bicep build to validate all Bicep code
• I have checked for any sensitive data/tokens that should not be committed
• Lint checks pass (run applicable linters for changed file types)

Security Review

• No credentials, secrets, or tokens are hardcoded or logged
• RBAC and identity changes follow least-privilege principles
• No new network exposure or public endpoints introduced without justification
• Dependency additions or updates have been reviewed for known vulnerabilities
• Container image changes use pinned digests or SHA references

This PR does not touch SECURITY.md, src/000-cloud/010-security-identity/, or deploy/.

Additional Notes

CI shape (added but not activated):

• New named outputs goContractTestsRan and goContractTestsExitCode available for future steps.
• No new required gate is added in this PR.
• No existing workflow is modified.

Stack (4 of 4 for #562):

1. #571 — Foundation (contract.go + minimum/only-cloud Go tests).
2. this PR — Detector + Invoke-GoTest wrapper + npm run go-test.
3. Next — CI wiring (go-tests.yml reusable, matrix-folder-check.yml + pr-validation.yml aggregation).
4. Final — Docs cleanup (replace legacy shell wrappers with npm + PowerShell guidance).

Base branch: feature/562-pr1-foundation.

Screenshots (if applicable)

N/A.

🔒 - Generated by Copilot

[bindsi]

🤖 Automated review: CI path detector and Invoke-GoTest wrapper. Adds Go contract test infrastructure with proper test utilities import, Bicep/Terraform contract validation, and CI workflow integration. No security or functional issues detected in the test scaffolding.

[bindsi]

Approved: the CI path detector and Invoke-GoTest wrapper changes are scoped and align with the existing validation patterns. I did not find actionable correctness or security issues.

[rezatnoMsirhC]

The script help text for Detect-Folder-Changes.ps1 describes an older JSON shape than the implementation now returns. The implementation emits applications.folders, while the docs still refer to changed_applications, services, and dependencies, so the contract should be aligned.