📖 [Docs]: Fill gaps in coding standards

[Marius Storhaug (MariusStorhaug)]

Adds only the guidance that was missing after comparing the candidate standards from PSModule/docs PR #61 against the existing canonical MSXOrg/docs coding standards.

Topic-by-topic comparison

GitHub Actions

Already covered in src/docs/Coding-Standards/GitHub-Actions.md:

• SHA pinning and updating pinned actions
• explicit least-privilege permissions
• OIDC instead of long-lived cloud secrets
• vars vs secrets
• untrusted context interpolation via env:
• action vs reusable workflow boundaries
• PowerShell-first workflow scripting
• script extraction into composite actions
• reusable workflows with colocated composite actions
• concurrency, named jobs/steps, logging, summaries, PR comments, and required checks

Missing and added:

• actions/checkout should use persist-credentials: false unless a job intentionally pushes
• pull_request_target and workflow_run should be avoided unless the elevated context is required, and privileged work must not execute untrusted code
• actionlint/zizmor severity handling and audit focus areas

PowerShell

Already covered in src/docs/Coding-Standards/PowerShell/:

• advanced functions, classes, scripts
• #Requires -Modules and version constraints
• Verb-Noun naming, casing, full command and parameter names
• OTBS, indentation, spacing, line length, splatting
• null comparisons, string matching, reuse order, .NET performance paths
• output streams, ShouldProcess, credentials, and error behavior

Missing and added:

• predictable data-module and integration-module verb mapping
• lowercase PowerShell language keywords
• avoiding semicolons, ternary expressions, and regions in shared code
• built-in checks for blank strings and wildcard detection
• avoiding explicit -Verbose / -Debug forwarding to internal calls
• cross-platform environment reads through [Environment]::GetEnvironmentVariable() when the provider is not the point

Validation

• pwsh .github/scripts/Update-DocumentationIndex.ps1 -Check
• pwsh .github/scripts/Test-DocumentationLink.ps1