fix: clear the PowerShell lint debt and graduate lint to blocking

[LukeEvansTech]

Why this repo was never actually linted

super-linter lints changed files only. The only file changed since lint.yml landed was lint.yml itself, so the two PowerShell scripts have never been through it. A full-codebase pass (VALIDATE_ALL_CODEBASE=true, run locally against super-linter:v8.6.0 with this repo's exact CI env) reported 183 findings.

One of them is a real bug

Write-Host "`n" + ("="*60) -ForegroundColor Cyan

Write-Host's -Object parameter takes the remaining arguments and joins them with a space, so this passes three positional arguments and prints a literal +:

 + ============================================================

Parenthesised so it does the string concatenation that was intended. PSAvoidUsingPositionalParameters earned its keep.

Everything else

Rule	Count	Disposition
PSAvoidUsingWriteHost	72	Excluded, with rationale (below)
PSAvoidTrailingWhitespace	104	Fixed at source
PSReviewUnusedParameter	4	Fixed at source
PSAvoidUsingPositionalParameters	2	Fixed at source — real bug
PSUseBOMForUnicodeEncodedFile	1	Fixed at source

Unused parameters — Get-TestDocumentation never read $TestName (it derives everything from $TestFile); Get-RemediationUrl never read $TestType (its switch -Regex reads only $TestName). Each has exactly one caller passing by name, so the parameter and the argument are removed together. $testType is still assigned at line 273 and still lands in the CSV row — only the dead pass-through went.

BOM — added only to Run-MaesterExchangeHealthCheck.ps1, which actually contains non-ASCII (the U+2713 check marks). -Simple.ps1 is pure ASCII and is deliberately left alone.

PSAvoidUsingWriteHost — excluded in a new .github/linters/.powershell-psscriptanalyzer.psd1. Both scripts are interactive operator tools; an admin runs them at a console and reads a colour-coded health-check report as it streams. The colour is the interface, nothing consumes stdout as data, and the machine-readable output goes to test_results.csv and the exported summary. Same exclusion, for the same reason, already exists in LukeEvansTech/veeam-config. The rule's stated rationale ("cannot be suppressed, captured, or redirected") describes PowerShell 4 and earlier — since 5.0 Write-Host writes to the information stream.

Verification

Run in the super-linter:v8.6.0 container:

• With the settings file → PSScriptAnalyzer: 0 findings
• Without it (negative control) → 72 PSAvoidUsingWriteHost and nothing else

That second run is the one that matters: it proves the exclusion is doing exactly one job and not quietly masking the other 111, which are genuinely fixed.

Full super-linter over the whole codebase exits 0.

Graduation

soft-launch: false. Worth noting what soft-launch was actually costing here — per CLAUDE.md, super-linter posts a commit status per linter that escapes continue-on-error, so --> Linted: POWERSHELL would have started failing and silently blocking every Renovate PR the moment anything touched a .ps1.

[github-actions]

Super-linter summary

Language	Validation result
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
POWERSHELL	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter