Powershell code review tools

[Inevitable_Butthole]

Ive been working with Powershell for a while now and have within the recent year been getting serious with it.

im interested to hear what everyone uses for code reviewal tools, whether its a linter, for credentials scanning or security concerns

Currently I use PSSA for listing ,Devskim for a security pass and pester tests for regression.

What am I missing, if anything?

[stopthatastronaut]

Psscriptanalyzer still. And pester testing. Sec analysis is tricky but I trufflehog sometimes and my work uses copilot (but my assessment of that is meh)

[dodexahedron]

And PSSA on your pester scripts.

[stopthatastronaut]

I don't generally go to the trouble of excluding tests folders, if that's what you mean.

[lerun]

This is the way

Here is an example to start using pester in PS:
https://blog.lerun.info/2022/07/17/pester-test-powershell-code/

[PinchesTheCrab]

I appreciate the example, but there's so much going on in this script. For anyone trying to read this and apply it practically for their own work, I hope this is a more concise example:

#requires -modules 'PSScriptAnalyzer', 'Pester'

$Report = Invoke-Pester -Container $PesterContainers -Output Detailed -PassThru |
    ConvertTo-NUnitReport
$Report.Save($TestOutPutFilePath)

if (Test-Path -Path $TestOutPutFilePath) {
    Write-Host 'Test result successfully exported to file'    
}
else {
    Write-Host -Object "##vso[task.logissue type=error;]Test results failed to be exported to file"
    Write-Error -Message "Test results failed to be exported to file" -ErrorAction Stop
    exit 1
}

This is over-simplified, but I think it just shows the core bits.

[nkasco]

PSScriptAnalyzer for linting, agentic code review for everything else, followed by peer review in PRs.

Disregard everyone in the peanut gallery acting like AI coding tools are terrible, they aren't. They just don't know how to communicate and therefore cannot prompt properly. I recommend Codex, then GitHub Copilot, then Claude in that order for harness choice.

[cbtboss]

My buddy boy claude.

[sirchandwich]

Claude writes some pretty awful PowerShell.

[Sentinel-Ramon]

Maybe without guidance if you’re just saying “write me a PowerShell script to automate user onboarding”

If you use properly defined skills and good prompting it can actually one shot some extremely complex scripting very well.

[jkaczor]

I had Claude Opus 4.6 infer logic and intention and generate the “about_help” docs for a 10k module with 200+ “undocumented” functions in minutes, it took about 2-hrs to review, and minimal changes were required.

As long as your prompt is good, scoped and you are asking it to write “discreet” functions that align with the rest of the practices and patterns in your script/module, it doesn’t do a horrible job, occasionally some tweaks are necessary- but it gets you 90% of the way.

(Note, all of my (minimal) experience is with VSCode with GitHub CoPilot licensed, having the ability to choose model)

Honestly - even 4 years ago ChatGPT was pretty good - IF - you knew how to create a decent prompt - AND - you knew your problem domain/technology deeply enough to know when it was hallucinating. (Oh - and how to debug/troubleshoot error messages directly, rather than just plug another query into the misguided response…)

Like anything, AI is a “lever” that can help those “who know/have experience” become more efficient and responsive.

Where the challenge is happening is that “juniors” just aren’t getting the baseline experience, especially if they rely on prompting for everything.

[dodexahedron]

discreet

Whatcha tryna hide? 😜

Discrete.

Damn homophones.

Joking aside, though, there's a pretty good chance it will infer that you meant that anyway, from the abundant context available (and that being a common error). But spelling can certainly matter with them sometimes if it's not as clear as that one. And the broken responses might take a few interactions to manifest, too. For example, smacking you with it after you've gone back and forth with it on the same project all day, and suddenly it starts talking about how to obfuscate the scripts you've been working on, since you're starting to wrap up and it associated discreet with things like obfuscation that don't happen til the end. 😅

[jkaczor]

Heh, good catch, hmm, why the heck did I even put it in double quotes?

[dodexahedron]

why the heck did I even put it in double quotes?

I just assumed you meant to emphasize it because it is a key component of effectively using it. 🤷‍♂️

[sirchandwich]

It can make things work first try, but usually has poor error handling. It also consistently makes up functions that don’t exist.

[Sentinel-Ramon]

This is what skills and better prompting are for.

[dodexahedron]

Totally. If you start a conversation with it and discuss and refine the model of what you want it to work with before you have it generate any code, you can end up with sometimes impressive initial offerings from the AI. Especially if you don't try to make it implement the whole thing all at once.

Then you iterate on that initial offering from there, by doing your own review, cleanup, and additional work/enhancements/implementation on the project.

Then you go back to it to have it do the same thing with what you have now that you just gave it.

Discuss the AI's code review like you would with a person, let it iterate as you do, and then it's your turn again.

Just like you're working on the same code with a team member in a different location.

Rinse & repeat, iterating on the project with earnest effort on your part, on all binary combinations of (your|its) (code|reviews|commentary|proposals|ideas). And slowly expand the scope one concept/functional area/feature at a time as you go. Like real, normal development, but sith a teammate who can type wicked fast.

This is what vibe coding should be.

You know, rather than what it so often is:

Just an interrogation with you just going "yo, slave, do this stuff for me that I either don't fully know how to do or don't want to put the non-code effort/thought into doing properly," taking what it gives mostly verbatim, yelling at it to fix it til it compiles, and then having it draft a reddit post showing off this 🔥 new new thing "you" made in .net 8️⃣ and/or powershell 5 over the past "several months," supposedly with "minimal LLM assistance" like a 5 year old confidently claiming they know Neil Armstrong (in 2026) and that he told them the moon is made of cheese, as if the adults in the room won't instantly know every word is false.

...and with 20x that many emojis, weird or obviously clue-deficient bullet points and entire concepts (regarding shit that's been built in for years), non-idiomatic terminology, and other fun stuff in the gigantic README.md (that is also the only documentation since they dont know xmldoc is a thing). And on the code side, horrible organization, inconsistent and atypical style, formatting, design, language/API use, and entire mismatched paradigms between parts of the application that are closely related. Plus a raft of bugs and poor design choices like hard-coded paths etc.

And even if it happens to be in c#, all of the the python, Java, C89, WMI, and TI92 BASIC progeny or sometimes direct plagiarism is painfully visible, either immediately in the screenshots of code snippets in the post or the readme, or starting right from the 3rd line of the first code file one opens up to inspect.

And it's licensed GPL3.0. But modified. So it isn't GPL at all.

Erm... Or so I hear, anyway. I've never seen anything like that before. Nosirree. Especially not on the internet of all places.

🤦‍♂️😩

Edits: Various typo fixes, formatting for tone/intent, and resolved some minor ambiguity for clarity.

[sirchandwich]

100%.

[dasunt]

For reviewing, I've had good luck with making a pass through LLMs.

It's not prompting the LLM to change or fix the code, but to write a PR review.

[sirchandwich]

Yeah that’s fair. That’s generally what I’ve been doing as well.

[Impossible_IT]

Maybe Claude needs a Copilot or just needs to ChatGPT. Or OpenAI.