Fix DSC_RESOURCE_PATH and add DSC_RESTRICTED_PATH

[SteveL-MSFT]

PR Summary

• Add DSC_RESTRICTED_PATH which limits both manifest and exe discovery, this works by replacing the PATH env var
• Update DSC_RESOURCE_PATH to be limited only to manifest discovery and not exe discovery by not overwriting PATH
• Old tests were designed expecting the previous DSC_RESOURCE_PATH behavior, so searched and replaced them to use DSC_RESTRICTED_PATH instead
• Added new tests, DSC_RESTRICTED_PATH takes precedence if DSC_RESOURCE_PATH is also defined

PR Context

Fix #1632

[Copilot]

Pull request overview

This PR addresses issue #1632 by separating “manifest discovery” from “executable discovery” behavior when environment variables are set, introducing DSC_RESTRICTED_PATH (restrict both) and adjusting DSC_RESOURCE_PATH (restrict manifests only).

Changes:

• Add DSC_RESTRICTED_PATH and give it precedence over DSC_RESOURCE_PATH.
• Update command discovery so DSC_RESOURCE_PATH no longer overwrites PATH (preventing extension executable lookup regressions).
• Update/extend Pester tests to reflect the new environment-variable semantics.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
lib/dsc-lib/src/discovery/command_discovery.rs	Implements DSC_RESTRICTED_PATH precedence and adjusts how PATH is handled during discovery.
lib/dsc-lib-jsonschema/.versions.json	Bumps JSON schema patch version metadata to V3_2_3.
dsc/tests/dsc_set.tests.ps1	Updates tests to use DSC_RESTRICTED_PATH where prior behavior depended on PATH replacement.
dsc/tests/dsc_resource_manifest.tests.ps1	Switches manifest-related test isolation to DSC_RESTRICTED_PATH.
dsc/tests/dsc_resource_list.tests.ps1	Updates resource listing tests to use DSC_RESTRICTED_PATH (but currently contains a typo).
dsc/tests/dsc_resource_input.tests.ps1	Updates resource input tests to use DSC_RESTRICTED_PATH.
dsc/tests/dsc_resource_deprecated.tests.ps1	Updates deprecated resource tests to use DSC_RESTRICTED_PATH.
dsc/tests/dsc_extension_secret.tests.ps1	Updates secret/extension tests to use DSC_RESTRICTED_PATH.
dsc/tests/dsc_extension_manifest.tests.ps1	Updates extension manifest tests to use DSC_RESTRICTED_PATH.
dsc/tests/dsc_extension_import.tests.ps1	Updates extension import tests to use DSC_RESTRICTED_PATH.
dsc/tests/dsc_extension_discover.tests.ps1	Updates extension discovery tests to use DSC_RESTRICTED_PATH.
dsc/tests/dsc_discovery.tests.ps1	Adds new coverage for restricted vs resource path semantics (but currently has non-portable path construction).
dsc/tests/dsc_args.tests.ps1	Updates argument tests to use DSC_RESTRICTED_PATH.
dsc/tests/dsc_adapter.tests.ps1	Updates adapter-related tests to use DSC_RESTRICTED_PATH.
adapters/powershell/Tests/win_powershellgroup.tests.ps1	Updates Windows PowerShell adapter tests to use DSC_RESTRICTED_PATH.
adapters/powershell/Tests/win_powershell_cache.tests.ps1	Updates Windows PowerShell adapter cache tests to use DSC_RESTRICTED_PATH.

[Copilot]

Pull request overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

lib/dsc-lib/src/discovery/command_discovery.rs:180

• DSC_RESOURCE_PATH being set currently disables PATH mutation even when allow_env_override is false (the env var is ignored for discovery, but it still changes behavior). Gate this check on allow_env_override so PATH behavior is unchanged unless DSC_RESOURCE_PATH is actually being honored.

        } else if dsc_resource_path.is_none() { // if DSC_RESOURCE_PATH is used, we don't want to modify the PATH env var, as it is intended to be used for resource discovery only

[tgauth]

Pull request overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)
lib/dsc-lib/src/discovery/command_discovery.rs:180

• DSC_RESOURCE_PATH being set currently disables PATH mutation even when allow_env_override is false (the env var is ignored for discovery, but it still changes behavior). Gate this check on allow_env_override so PATH behavior is unchanged unless DSC_RESOURCE_PATH is actually being honored.

        } else if dsc_resource_path.is_none() { // if DSC_RESOURCE_PATH is used, we don't want to modify the PATH env var, as it is intended to be used for resource discovery only

I think this might be a valid comment

[SteveL-MSFT]

Pull request overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (1)
lib/dsc-lib/src/discovery/command_discovery.rs:180

• DSC_RESOURCE_PATH being set currently disables PATH mutation even when allow_env_override is false (the env var is ignored for discovery, but it still changes behavior). Gate this check on allow_env_override so PATH behavior is unchanged unless DSC_RESOURCE_PATH is actually being honored.

        } else if dsc_resource_path.is_none() { // if DSC_RESOURCE_PATH is used, we don't want to modify the PATH env var, as it is intended to be used for resource discovery only

I think this might be a valid comment

I believe allow_env_override is literally "allow PATH env var to be overwritten". In this case DSC_RESOURCE_PATH doesn't overwrite PATH and instead is only used for resource discovery and PATH is still used for exe discovery. I guess the question is does allow_env_override affect both resource and exe PATH or literally just PATH. I'm thinking only the latter which is what I was conveying in the comment in the code.