fix(scripts): standardize timestamp in SecurityHelpers.psm1 to use Get-StandardTimestamp

[chaosdinosaur]

Pull Request

Description

Replaced all three instances of Get-Date -Format 'yyyy-MM-dd HH:mm:ss' (timezone-ambiguous timestamps) in SecurityHelpers.psm1 with Get-StandardTimestamp from CIHelpers.psm1:

1. Write-SecurityLog (line 76): Log entry timestamp in console output.
2. New-SecurityIssue (line 179): Timestamp field on security issue objects.
3. Write-SecurityReport (line 231): Timestamp field in JSON report output.

CIHelpers.psm1 was already imported at line 13, so no additional import was needed. Updated three Pester test assertions to match the new ISO 8601 UTC format.

Related Issue(s)

Fixes #1000

Type of Change

Select all that apply:

Code & Documentation:

• Bug fix (non-breaking change fixing an issue)
• New feature (non-breaking change adding functionality)
• Breaking change (fix or feature causing existing functionality to change)
• Documentation update

Infrastructure & Configuration:

• GitHub Actions workflow
• Linting configuration (markdown, PowerShell, etc.)
• Security configuration
• DevContainer configuration
• Dependency update

AI Artifacts:

• Reviewed contribution with prompt-builder agent and addressed all feedback
• Copilot instructions (.github/instructions/*.instructions.md)
• Copilot prompt (.github/prompts/*.prompt.md)
• Copilot agent (.github/agents/*.agent.md)
• Copilot skill (.github/skills/*/SKILL.md)

Other:

• Script/automation (.ps1, .sh, .py)
• Other (please describe):

Testing

• Verified all three Get-Date -Format 'yyyy-MM-dd HH:mm:ss' replaced with Get-StandardTimestamp.
• Updated Pester assertions: log message format, security issue timestamp, and JSON report timestamp.
• npm run lint:ps passed.
• npm run test:ps passed (81 tests for this file).

Checklist

Required Checks

• Documentation is updated (if applicable) (N/A — no docs change needed)
• Files follow existing naming conventions
• Changes are backwards compatible (if applicable)
• Tests added for new functionality (if applicable)

Required Automated Checks

The following validation commands must pass before merging:

• Markdown linting: npm run lint:md
• Spell checking: npm run spell-check
• Frontmatter validation: npm run lint:frontmatter
• Skill structure validation: npm run validate:skills
• Link validation: npm run lint:md-links
• PowerShell analysis: npm run lint:ps
• Plugin freshness: npm run plugin:generate

Security Considerations

• This PR does not contain any sensitive or NDA information
• Any new dependencies have been reviewed for security issues (N/A — no dependency changes)
• Security-related scripts follow the principle of least privilege

Additional Notes

This is part of the timestamp standardization series (issues #994-#1002). The prerequisite Get-StandardTimestamp function was merged in #993. CIHelpers.psm1 was already imported by this module, so the changes are direct expression swaps with no import changes required.

Note: the old yyyy-MM-dd HH:mm:ss format had no timezone indicator, making it impossible to determine UTC time. The new format includes explicit Z suffix for UTC.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.71%. Comparing base (84ddd5d) to head (46727e3).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1284      +/-   ##
==========================================
- Coverage   87.72%   87.71%   -0.02%     
==========================================
  Files          61       61              
  Lines        9320     9320              
==========================================
- Hits         8176     8175       -1     
- Misses       1144     1145       +1     

Flag	Coverage Δ
pester	85.31% <100.00%> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
scripts/security/Modules/SecurityHelpers.psm1	90.27% <100.00%> (ø)

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

Review Overview

This PR correctly addresses issue #1000 by replacing all three timezone-ambiguous Get-Date -Format 'yyyy-MM-dd HH:mm:ss' calls in SecurityHelpers.psm1 with Get-StandardTimestamp, and updating the corresponding Pester assertions to expect ISO 8601 UTC format. The implementation is clean, minimal, and well-scoped.

One inline suggestion is noted; no blocking issues were found.

---

Issue Alignment ✅

The changes precisely address all requirements from issue #1000:

• All three Get-Date usages replaced with Get-StandardTimestamp (lines 76, 179, 231 of SecurityHelpers.psm1)
• CIHelpers.psm1 import was already present — no new import needed, correctly noted in the PR description
• All three corresponding Pester assertions updated to the new ISO 8601 UTC format
• No scope creep detected

---

PR Template Compliance ✅

• Description is clear and detailed, enumerating each of the three replaced call sites
• Fixes #1000 issue reference is present and valid
• Checked type-of-change boxes (Bug fix, Security configuration, Script/automation) accurately reflect the changed files
• Testing section documents all verification steps including lint and test pass results
• All required checklist items are checked

---

Coding Standards ⚠️

Pre-existing (not introduced by this PR): SecurityHelpers.Tests.ps1 has the copyright header at lines 1–3 with #Requires -Modules Pester at line 5. Per pester-testing.instructions.md, the #Requires -Modules Pester directive must come before the copyright header. This convention violation pre-dates this PR and is out of scope here, but should be corrected in a follow-up.

---

Code Quality 💡

One inline suggestion filed on SecurityHelpers.Tests.ps1 line 241:

The Write-SecurityReport JSON timestamp assertion uses .*Z$ (any characters before Z), while the other two updated assertions — for Write-SecurityLog output and New-SecurityIssue.Timestamp — both use \.\d+Z$ to explicitly match the fractional-seconds component. Aligning all three assertions improves test precision and prevents false positives on malformed but Z-terminated strings.

No other quality concerns found. The three replacements in SecurityHelpers.psm1 are consistent and idiomatic. The ConvertTo-Json / ConvertFrom-Json round-trip in the JSON report test, and the use of .ToString('o') to recover a comparable string from the deserialized DateTime, are both correct for PowerShell 7.

---

Action Items

1. Optional (suggested): Tighten the Write-SecurityReport JSON timestamp regex from .*Z$ to \.\d+Z$ — see inline comment on line 241 of SecurityHelpers.Tests.ps1
2. Follow-up (out of scope for this PR): Correct the #Requires -Modules Pester header ordering in SecurityHelpers.Tests.ps1 per pester-testing.instructions.md

Generated by PR Review for issue #1284

[WilliamBerryiii]

Approved, but please address the regex issue from GH-actions bot.