fix(scripts): standardize timestamps in Test-DependencyPinning.ps1 and SecurityClasses.psm1

[chaosdinosaur]

Pull Request

Description

Standardized timestamps in Test-DependencyPinning.ps1 and SecurityClasses.psm1:

• SecurityClasses.psm1: Replaced the fake UTC format $this.Timestamp.ToString('yyyy-MM-ddTHH:mm:ss.fffZ') in ComplianceReport.ToHashtable() with Get-StandardTimestamp for genuine UTC timestamps. Added CIHelpers.psm1 import since the module had no previous import.
• Test-DependencyPinning.ps1: Replaced $report.Timestamp.ToString('yyyy-MM-ddTHH:mm:ss.fffZ') in the metadata ScanTimestamp field with Get-StandardTimestamp. CIHelpers.psm1 was already imported at line 122.

Updated the Pester test assertion for ToHashtable timestamp format to accept full-precision ISO 8601 output (\d+ instead of \d{3} for fractional seconds).

Related Issue(s)

Fixes #998

Type of Change

Select all that apply:

Code & Documentation:

• Bug fix (non-breaking change fixing an issue)
• New feature (non-breaking change adding functionality)
• Breaking change (fix or feature causing existing functionality to change)
• Documentation update

Infrastructure & Configuration:

• GitHub Actions workflow
• Linting configuration (markdown, PowerShell, etc.)
• Security configuration
• DevContainer configuration
• Dependency update

AI Artifacts:

• Reviewed contribution with prompt-builder agent and addressed all feedback
• Copilot instructions (.github/instructions/*.instructions.md)
• Copilot prompt (.github/prompts/*.prompt.md)
• Copilot agent (.github/agents/*.agent.md)
• Copilot skill (.github/skills/*/SKILL.md)

Other:

• Script/automation (.ps1, .sh, .py)
• Other (please describe):

Testing

• Verified fake UTC format replaced with Get-StandardTimestamp in SecurityClasses.psm1 ToHashtable().
• Verified local-offset ScanTimestamp replaced with Get-StandardTimestamp in Test-DependencyPinning.ps1.
• Updated Pester assertion from \d{3}Z to \d+Z for full-precision matching.
• npm run lint:ps passed.
• npm run test:ps passed (41 SecurityClasses tests, 118 Test-DependencyPinning tests).

Checklist

Required Checks

• Documentation is updated (if applicable) (N/A — no docs change needed)
• Files follow existing naming conventions
• Changes are backwards compatible (if applicable)
• Tests added for new functionality (if applicable)

Required Automated Checks

The following validation commands must pass before merging:

• Markdown linting: npm run lint:md
• Spell checking: npm run spell-check
• Frontmatter validation: npm run lint:frontmatter
• Skill structure validation: npm run validate:skills
• Link validation: npm run lint:md-links
• PowerShell analysis: npm run lint:ps
• Plugin freshness: npm run plugin:generate

Security Considerations

• This PR does not contain any sensitive or NDA information
• Any new dependencies have been reviewed for security issues (N/A — no dependency changes)
• Security-related scripts follow the principle of least privilege

Additional Notes

The ComplianceReport class Timestamp property remains typed [datetime] for backward compatibility — the Get-StandardTimestamp call is used only in the ToHashtable() serialization method and the metadata hashtable, which are the JSON output paths. The markdown report display format (yyyy-MM-dd HH:mm:ss) was left unchanged as it serves a different human-readable purpose.

This is part of the timestamp standardization series (issues #994-#1002). The prerequisite Get-StandardTimestamp function was merged in #993.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.71%. Comparing base (84ddd5d) to head (6088c15).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1282      +/-   ##
==========================================
- Coverage   87.72%   87.71%   -0.02%     
==========================================
  Files          61       61              
  Lines        9320     9320              
==========================================
- Hits         8176     8175       -1     
- Misses       1144     1145       +1     

Flag	Coverage Δ
pester	85.31% <100.00%> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
scripts/security/Modules/SecurityClasses.psm1	97.22% <100.00%> (ø)
scripts/security/Test-DependencyPinning.ps1	89.85% <100.00%> (ø)

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

PR Review: fix/998-standardize-timestamp-dependency-pinning

The goal is clear, the issue link is valid, the PR template is properly completed, and all automation checks pass. The approach of using Get-StandardTimestamp from CIHelpers.psm1 is the right direction. Three focused issues worth addressing are noted below.

---

Issue Alignment

✅ PR correctly targets #998. The fake-UTC format (ToString('yyyy-MM-ddTHH:mm:ss.fffZ')) is replaced in both files, and the CIHelpers.psm1 import is added to SecurityClasses.psm1. The note about the markdown display format (yyyy-MM-dd HH:mm:ss) being intentionally left unchanged is accurate and appreciated.

---

PR Template Compliance

✅ Description is substantive, issue is linked, Type of Change checkboxes are checked and match the diff (bug fix + script/automation), testing evidence is provided, and all required automated checks are checked.

---

Coding Standards

✅ Import-Module placement in SecurityClasses.psm1 (between the header comment block and the first class definition) follows the module structure convention from the PowerShell instructions. The CIHelpers.psm1 import path uses the Join-Path $PSScriptRoot pattern correctly.

---

Code Quality Findings

⚠️ Timestamp semantic drift (both changed files)

Both ToHashtable() and Get-ComplianceReportData now call Get-StandardTimestamp at serialization time, discarding the $this.Timestamp value that was set at object-construction time (scan start). The ComplianceReport class still stores a [datetime]$Timestamp property that is never used in the JSON output path after this change. See inline comments for a concrete remediation.

💡 Loosened test assertion (SecurityClasses.Tests.ps1)

The regex change from \d{3} to \d+ is technically correct for Get-StandardTimestamp's full-precision output, but overly permissive. A bounded quantifier like \d{3,7} better documents the expected range. See inline comment.

---

Suggested Action Items

1. In SecurityClasses.psm1 constructors, stamp with UTC at construction ((Get-Date).ToUniversalTime()) and format $this.Timestamp in ToHashtable() — or rename the output key to make the serialization-time semantics explicit.
2. Apply the same pattern to the ScanTimestamp field in Test-DependencyPinning.ps1 to keep both call sites consistent with the object's own timestamp.
3. Tighten the test regex to \d{3,7} for a more intentional assertion.

Generated by PR Review for issue #1282