Skip to content

v0.8.85: consolidate setup onboarding workflow and align version metadata#91

Merged
NeilBird merged 11 commits into
mainfrom
users/nebird/development
Jun 16, 2026
Merged

v0.8.85: consolidate setup onboarding workflow and align version metadata#91
NeilBird merged 11 commits into
mainfrom
users/nebird/development

Conversation

@NeilBird

Copy link
Copy Markdown
Owner

Summary

This PR finalizes the v0.8.85 pipeline UX consolidation work for AzLocal.UpdateManagement.

What changed

  • Added merged GitHub Setup workflow: setup-validate-and-inventory.yml.
  • Removed superseded GitHub workflows:
    • authentication-test.yml
    • inventory-clusters.yml
  • Standardized Setup/Fleet naming across bundled GitHub Actions and Azure DevOps pipeline templates.
  • Updated pipeline helper cmdlets and docs for deprecated-workflow pruning behavior.
  • Bumped module version metadata to 0.8.85:
    • AzLocal.UpdateManagement.psd1
    • AzLocal.UpdateManagement.psm1
    • README version banner and latest What's New section
    • CHANGELOG top entry
  • Updated tests to match the consolidated GitHub workflow count (10 templates) and new version.

Validation

  • Ran full Pester suite via Tests/Invoke-Tests.ps1 with output redirected to file (safe terminal pattern).
  • Result: Tests Passed: 1256, Failed: 0, Skipped: 1, NotRun: 38.

NeilBird added 11 commits June 16, 2026 10:50
…AzLocalAuthValidationReport cmdlet; track test-run-timings.csv
…tionPreference, Step.3 path, Step.4 SummaryPath)
…rune tests

- Get-AzLocalPipelineManifest: collapse legacy authentication-test +
  inventory-clusters rows into the merged setup-validate-and-inventory entry
- appendix-pipelines.md / README.md: replace removed filenames + old Step
  naming with Setup:/Fleet: numbering; fix section 13 file-layout block and
  section 14 reference; repair broken cross-doc anchors (README 8.1.1 ->
  #fleet-01, sideload.md -> #fleet-03); update present-tense Step.7 reference
- appendix-pipelines.md: reconcile Setup: 01 trigger docs to the shipped
  weekly Sunday 08:00 UTC cron
- fleet-update-status.yml: fix mojibake in YAML comment
- apply-updates-schedule.example.yml: replace Step.5/Step.7 with stable
  apply-updates.yml / Fleet: 04 references
- Tests: add 10 -PruneDeprecated regression tests (6 Copy- + 4 Update-)
  covering both-removed, single-removed, ID-mismatch-preserved, omitted-flag
  and -WhatIf paths
@NeilBird
NeilBird merged commit 2e9b54f into main Jun 16, 2026
1 check passed
NeilBird added a commit that referenced this pull request Jun 16, 2026
… Environments are optional (#92)

* v0.8.85: consolidate setup workflow and align pipeline/version metadata

* test-run-timings

* v0.8.85 follow-up: delete ADO auth+inventory workflows and add merged ADO setup pipeline

* v0.8.85 follow-up: move collapsible subscription section into Export-AzLocalAuthValidationReport cmdlet; track test-run-timings.csv

* v0.8.85 follow-up: fix live integration test failures (Step.0 ErrorActionPreference, Step.3 path, Step.4 SummaryPath)

* Add test-run-timings.csv to repo (test performance metrics)

* docs: align pipeline appendix with Setup/Fleet naming

* chore: update test run timings

* v0.8.85: address PR #91 review findings - manifest, docs, mojibake, prune tests

- Get-AzLocalPipelineManifest: collapse legacy authentication-test +
  inventory-clusters rows into the merged setup-validate-and-inventory entry
- appendix-pipelines.md / README.md: replace removed filenames + old Step
  naming with Setup:/Fleet: numbering; fix section 13 file-layout block and
  section 14 reference; repair broken cross-doc anchors (README 8.1.1 ->
  #fleet-01, sideload.md -> #fleet-03); update present-tense Step.7 reference
- appendix-pipelines.md: reconcile Setup: 01 trigger docs to the shipped
  weekly Sunday 08:00 UTC cron
- fleet-update-status.yml: fix mojibake in YAML comment
- apply-updates-schedule.example.yml: replace Step.5/Step.7 with stable
  apply-updates.yml / Fleet: 04 references
- Tests: add 10 -PruneDeprecated regression tests (6 Copy- + 4 Update-)
  covering both-removed, single-removed, ID-mismatch-preserved, omitted-flag
  and -WhatIf paths

* docs: clarify sideload-catalog.example.yml header comment (v0.8.7 on-prem solution/SBE update sideloading)

* docs: fix grammar in sideload-catalog.example.yml header (introduce -> introduced)

* v0.8.86: rename onboarding pipelines Setup -> Config + clarify GitHub Environments are optional

- Rename the three onboarding workflow display names from `Setup: 0N` to
  `Config: 0N` (GitHub Actions `name:` and Azure DevOps `displayName:`/`name:`)
  so the Actions sidebar / ADO Pipelines list sorts the onboarding workflows
  ahead of the `Fleet: 0N` operational workflows (C sorts before F; the old
  `Setup:` prefix sorted after `Fleet:`). Display-name-only change - filenames,
  AZLOCAL-PIPELINE-ID values, aliases and prune logic are unchanged.
- Update bundled pipeline README.md + docs/appendix-pipelines.md (headings,
  cross-references, anchors, naming rationale) to the Config: NN naming.
- README.md (Automation-Pipeline-Examples): clarify that GitHub Environments
  are OPTIONAL. The branch-scoped federated credential is all OIDC needs, so a
  blank `environment` input is the supported minimal setup. Environments are a
  governance wrapper (approval gates, deployment-branch rules, wait timers,
  per-ring identities); environment-scoped federated credentials are only
  needed when a run actually names an environment. Mark the environment table,
  the inline + PowerShell env-scoped credential blocks, the subject-claim table
  row, and the section-5 secrets script accordingly.
- Version bump to 0.8.86: psd1 ModuleVersion + ReleaseNotes, psm1
  $script:ModuleVersion, CHANGELOG.md, both README files, docs/release-history,
  Tests version assertion, and all GENERATED_AGAINST_MODULE_VERSION pins across
  the bundled GitHub Actions and Azure DevOps templates.

Full Pester suite: 1266 passed, 0 failed, 1 skipped.

* ci: disable hosted Pester workflow (comment out pull_request + push triggers; keep workflow_dispatch). Suite is run locally before every push.
NeilBird added a commit that referenced this pull request Jun 16, 2026
…ctivity output + monitor ITSM (#93)

* v0.8.85: consolidate setup workflow and align pipeline/version metadata

* test-run-timings

* v0.8.85 follow-up: delete ADO auth+inventory workflows and add merged ADO setup pipeline

* v0.8.85 follow-up: move collapsible subscription section into Export-AzLocalAuthValidationReport cmdlet; track test-run-timings.csv

* v0.8.85 follow-up: fix live integration test failures (Step.0 ErrorActionPreference, Step.3 path, Step.4 SummaryPath)

* Add test-run-timings.csv to repo (test performance metrics)

* docs: align pipeline appendix with Setup/Fleet naming

* chore: update test run timings

* v0.8.85: address PR #91 review findings - manifest, docs, mojibake, prune tests

- Get-AzLocalPipelineManifest: collapse legacy authentication-test +
  inventory-clusters rows into the merged setup-validate-and-inventory entry
- appendix-pipelines.md / README.md: replace removed filenames + old Step
  naming with Setup:/Fleet: numbering; fix section 13 file-layout block and
  section 14 reference; repair broken cross-doc anchors (README 8.1.1 ->
  #fleet-01, sideload.md -> #fleet-03); update present-tense Step.7 reference
- appendix-pipelines.md: reconcile Setup: 01 trigger docs to the shipped
  weekly Sunday 08:00 UTC cron
- fleet-update-status.yml: fix mojibake in YAML comment
- apply-updates-schedule.example.yml: replace Step.5/Step.7 with stable
  apply-updates.yml / Fleet: 04 references
- Tests: add 10 -PruneDeprecated regression tests (6 Copy- + 4 Update-)
  covering both-removed, single-removed, ID-mismatch-preserved, omitted-flag
  and -WhatIf paths

* docs: clarify sideload-catalog.example.yml header comment (v0.8.7 on-prem solution/SBE update sideloading)

* docs: fix grammar in sideload-catalog.example.yml header (introduce -> introduced)

* v0.8.86: rename onboarding pipelines Setup -> Config + clarify GitHub Environments are optional

- Rename the three onboarding workflow display names from `Setup: 0N` to
  `Config: 0N` (GitHub Actions `name:` and Azure DevOps `displayName:`/`name:`)
  so the Actions sidebar / ADO Pipelines list sorts the onboarding workflows
  ahead of the `Fleet: 0N` operational workflows (C sorts before F; the old
  `Setup:` prefix sorted after `Fleet:`). Display-name-only change - filenames,
  AZLOCAL-PIPELINE-ID values, aliases and prune logic are unchanged.
- Update bundled pipeline README.md + docs/appendix-pipelines.md (headings,
  cross-references, anchors, naming rationale) to the Config: NN naming.
- README.md (Automation-Pipeline-Examples): clarify that GitHub Environments
  are OPTIONAL. The branch-scoped federated credential is all OIDC needs, so a
  blank `environment` input is the supported minimal setup. Environments are a
  governance wrapper (approval gates, deployment-branch rules, wait timers,
  per-ring identities); environment-scoped federated credentials are only
  needed when a run actually names an environment. Mark the environment table,
  the inline + PowerShell env-scoped credential blocks, the subject-claim table
  row, and the section-5 secrets script accordingly.
- Version bump to 0.8.86: psd1 ModuleVersion + ReleaseNotes, psm1
  $script:ModuleVersion, CHANGELOG.md, both README files, docs/release-history,
  Tests version assertion, and all GENERATED_AGAINST_MODULE_VERSION pins across
  the bundled GitHub Actions and Azure DevOps templates.

Full Pester suite: 1266 passed, 0 failed, 1 skipped.

* ci: disable hosted Pester workflow (comment out pull_request + push triggers; keep workflow_dispatch). Suite is run locally before every push.

* v0.8.87: rename 'Orphan ARBs' section to 'Non-Azure Local and/or Orphan ARB appliances'

New-AzLocalFleetConnectivityStatusSummary (Fleet: 02) markdown output: rename the
Orphan ARBs section, add intro line, and expand the caveat to note that an Arc
resource bridge with no matching in-scope Azure Local cluster is NOT necessarily
orphaned - Arc resource bridge is also used by VMware vSphere and SCVMM. Adds
investigate-before-acting guidance. KPI note, causes list, and cluster-table
cross-reference updated to match. Output text only; no API or behavioural change.

Lock-step version bump 0.8.86 -> 0.8.87: psd1 (ModuleVersion + ReleaseNotes),
psm1 ($script:ModuleVersion), CHANGELOG, both README sections + appendix,
Tests assertion, docs/release-history.md, and all 20 GENERATED_AGAINST_MODULE_VERSION
pins. Full Pester suite green (1266 passed, 0 failed, 1 skipped, 38 not-run).

* v0.8.87: collapse Cluster Connectivity (with ARB Status) table by default

New-AzLocalFleetConnectivityStatusSummary now wraps the per-cluster Cluster
Connectivity (with ARB Status) table in a collapsed <details> block with an
'Expand to view clusters' summary, so the Fleet: 02 step summary stays compact.
Added a Pester assertion for the details/summary wrapper. Output text only; no
API or behavioural change. Release notes (psd1/CHANGELOG/README/release-history)
updated within the in-flight v0.8.87. Full Pester suite green (1267 passed,
0 failed, 1 skipped).

* v0.8.87: split Cluster Connectivity table into with/without connectivity issues

New-AzLocalFleetConnectivityStatusSummary now renders two per-cluster tables
instead of one:

- '### Cluster with Connectivity Issues' - clusters that are NOT (Connectivity =
  Connected AND ARB Status = Running). Shown first and expanded.
- '### Cluster without Connectivity Issues' - clusters that ARE Connected with a
  Running ARB. Collapsed behind an 'Expand to view clusters' details block.

Both tables share the same heading columns. Row rendering is factored into a
plain scriptblock (no .GetNewClosure()) reused by both tables. Added/updated
Pester assertions for both headings, the partitioning, and the collapsed block;
fixed the CSV-input context assertion that referenced the old single heading.

Release notes (psd1/CHANGELOG/README/release-history) updated within the
in-flight v0.8.87 (ReleaseNotes 9872 chars, under the 10000 limit). Full Pester
suite green (1270 passed, 0 failed, 1 skipped). Output text only; no API change.

* v0.8.87: rename bundled pipeline display names to Config:/Monitor:/Update: scheme

Renames all bundled pipeline display names (name: on GitHub Actions,
displayName:/name: on Azure DevOps) into a three-group single-digit scheme:
Config: 1-3 (onboarding/config), Monitor: 1-3 (day-2 fleet monitoring),
Update: 1-4 (update lifecycle), replacing the former Setup: 0N / Fleet: 0N
prefixes. Monitor: 2 is Fleet Health Status and Monitor: 3 is Fleet Update
Status so the numbering matches alphabetical order.

Display name only - filenames, AZLOCAL-PIPELINE-ID values, aliases, and
-PruneDeprecated logic are unchanged. Updates the bundled README,
appendix-pipelines.md (grouped/ordered conventions, alphabetical file layout),
ITSM docs, release docs, the manifest ReleaseNotes, CHANGELOG, the schedule
auditor's emitted markdown (Update: 4), and the matching Pester assertions.

Full suite green: 1282 passed, 0 failed, 1 skipped.
NeilBird added a commit that referenced this pull request Jun 17, 2026
…checkUpdates) + stale-assessment auto-scan (#94)

* v0.8.85: consolidate setup workflow and align pipeline/version metadata

* test-run-timings

* v0.8.85 follow-up: delete ADO auth+inventory workflows and add merged ADO setup pipeline

* v0.8.85 follow-up: move collapsible subscription section into Export-AzLocalAuthValidationReport cmdlet; track test-run-timings.csv

* v0.8.85 follow-up: fix live integration test failures (Step.0 ErrorActionPreference, Step.3 path, Step.4 SummaryPath)

* Add test-run-timings.csv to repo (test performance metrics)

* docs: align pipeline appendix with Setup/Fleet naming

* chore: update test run timings

* v0.8.85: address PR #91 review findings - manifest, docs, mojibake, prune tests

- Get-AzLocalPipelineManifest: collapse legacy authentication-test +
  inventory-clusters rows into the merged setup-validate-and-inventory entry
- appendix-pipelines.md / README.md: replace removed filenames + old Step
  naming with Setup:/Fleet: numbering; fix section 13 file-layout block and
  section 14 reference; repair broken cross-doc anchors (README 8.1.1 ->
  #fleet-01, sideload.md -> #fleet-03); update present-tense Step.7 reference
- appendix-pipelines.md: reconcile Setup: 01 trigger docs to the shipped
  weekly Sunday 08:00 UTC cron
- fleet-update-status.yml: fix mojibake in YAML comment
- apply-updates-schedule.example.yml: replace Step.5/Step.7 with stable
  apply-updates.yml / Fleet: 04 references
- Tests: add 10 -PruneDeprecated regression tests (6 Copy- + 4 Update-)
  covering both-removed, single-removed, ID-mismatch-preserved, omitted-flag
  and -WhatIf paths

* docs: clarify sideload-catalog.example.yml header comment (v0.8.7 on-prem solution/SBE update sideloading)

* docs: fix grammar in sideload-catalog.example.yml header (introduce -> introduced)

* v0.8.86: rename onboarding pipelines Setup -> Config + clarify GitHub Environments are optional

- Rename the three onboarding workflow display names from `Setup: 0N` to
  `Config: 0N` (GitHub Actions `name:` and Azure DevOps `displayName:`/`name:`)
  so the Actions sidebar / ADO Pipelines list sorts the onboarding workflows
  ahead of the `Fleet: 0N` operational workflows (C sorts before F; the old
  `Setup:` prefix sorted after `Fleet:`). Display-name-only change - filenames,
  AZLOCAL-PIPELINE-ID values, aliases and prune logic are unchanged.
- Update bundled pipeline README.md + docs/appendix-pipelines.md (headings,
  cross-references, anchors, naming rationale) to the Config: NN naming.
- README.md (Automation-Pipeline-Examples): clarify that GitHub Environments
  are OPTIONAL. The branch-scoped federated credential is all OIDC needs, so a
  blank `environment` input is the supported minimal setup. Environments are a
  governance wrapper (approval gates, deployment-branch rules, wait timers,
  per-ring identities); environment-scoped federated credentials are only
  needed when a run actually names an environment. Mark the environment table,
  the inline + PowerShell env-scoped credential blocks, the subject-claim table
  row, and the section-5 secrets script accordingly.
- Version bump to 0.8.86: psd1 ModuleVersion + ReleaseNotes, psm1
  $script:ModuleVersion, CHANGELOG.md, both README files, docs/release-history,
  Tests version assertion, and all GENERATED_AGAINST_MODULE_VERSION pins across
  the bundled GitHub Actions and Azure DevOps templates.

Full Pester suite: 1266 passed, 0 failed, 1 skipped.

* ci: disable hosted Pester workflow (comment out pull_request + push triggers; keep workflow_dispatch). Suite is run locally before every push.

* v0.8.87: rename 'Orphan ARBs' section to 'Non-Azure Local and/or Orphan ARB appliances'

New-AzLocalFleetConnectivityStatusSummary (Fleet: 02) markdown output: rename the
Orphan ARBs section, add intro line, and expand the caveat to note that an Arc
resource bridge with no matching in-scope Azure Local cluster is NOT necessarily
orphaned - Arc resource bridge is also used by VMware vSphere and SCVMM. Adds
investigate-before-acting guidance. KPI note, causes list, and cluster-table
cross-reference updated to match. Output text only; no API or behavioural change.

Lock-step version bump 0.8.86 -> 0.8.87: psd1 (ModuleVersion + ReleaseNotes),
psm1 ($script:ModuleVersion), CHANGELOG, both README sections + appendix,
Tests assertion, docs/release-history.md, and all 20 GENERATED_AGAINST_MODULE_VERSION
pins. Full Pester suite green (1266 passed, 0 failed, 1 skipped, 38 not-run).

* v0.8.87: collapse Cluster Connectivity (with ARB Status) table by default

New-AzLocalFleetConnectivityStatusSummary now wraps the per-cluster Cluster
Connectivity (with ARB Status) table in a collapsed <details> block with an
'Expand to view clusters' summary, so the Fleet: 02 step summary stays compact.
Added a Pester assertion for the details/summary wrapper. Output text only; no
API or behavioural change. Release notes (psd1/CHANGELOG/README/release-history)
updated within the in-flight v0.8.87. Full Pester suite green (1267 passed,
0 failed, 1 skipped).

* v0.8.87: split Cluster Connectivity table into with/without connectivity issues

New-AzLocalFleetConnectivityStatusSummary now renders two per-cluster tables
instead of one:

- '### Cluster with Connectivity Issues' - clusters that are NOT (Connectivity =
  Connected AND ARB Status = Running). Shown first and expanded.
- '### Cluster without Connectivity Issues' - clusters that ARE Connected with a
  Running ARB. Collapsed behind an 'Expand to view clusters' details block.

Both tables share the same heading columns. Row rendering is factored into a
plain scriptblock (no .GetNewClosure()) reused by both tables. Added/updated
Pester assertions for both headings, the partitioning, and the collapsed block;
fixed the CSV-input context assertion that referenced the old single heading.

Release notes (psd1/CHANGELOG/README/release-history) updated within the
in-flight v0.8.87 (ReleaseNotes 9872 chars, under the 10000 limit). Full Pester
suite green (1270 passed, 0 failed, 1 skipped). Output text only; no API change.

* v0.8.87: rename bundled pipeline display names to Config:/Monitor:/Update: scheme

Renames all bundled pipeline display names (name: on GitHub Actions,
displayName:/name: on Azure DevOps) into a three-group single-digit scheme:
Config: 1-3 (onboarding/config), Monitor: 1-3 (day-2 fleet monitoring),
Update: 1-4 (update lifecycle), replacing the former Setup: 0N / Fleet: 0N
prefixes. Monitor: 2 is Fleet Health Status and Monitor: 3 is Fleet Update
Status so the numbering matches alphabetical order.

Display name only - filenames, AZLOCAL-PIPELINE-ID values, aliases, and
-PruneDeprecated logic are unchanged. Updates the bundled README,
appendix-pipelines.md (grouped/ordered conventions, alphabetical file layout),
ITSM docs, release docs, the manifest ReleaseNotes, CHANGELOG, the schedule
auditor's emitted markdown (Update: 4), and the matching Pester assertions.

Full suite green: 1282 passed, 0 failed, 1 skipped.

* v0.8.88: add Sync-AzLocalClusterUpdateSummary (Check for updates / checkUpdates)

Adds Sync-AzLocalClusterUpdateSummary (POST updateSummaries/default/checkUpdates) to refresh a cluster's update assessment - the programmatic 'Check for updates'. Fire-and-forget by default, -Wait polls lastChecked. Selectable ByName/ByResourceId/ByTag; SupportsShouldProcess.

Adds Private Test-AzLocalUpdateAssessmentStale detector (installed YYMM strictly behind manifest LatestYYMM) and wires an opt-out auto-scan into Export-AzLocalClusterUpdateReadinessReport (-SkipStaleAssessmentScan).

Surfaces 403/AuthorizationFailed from checkUpdates in the console (Status=AuthorizationFailed + RBAC warning naming the denied Action) so least-privilege custom-role gaps are visible. checkUpdates is preview and not yet in the provider operations catalog, so it cannot be added to the custom role - documented as a GA follow-up in module README, docs/rbac.md and Automation-Pipeline-Examples/README.md.

Option C: de-numbered remaining Step.N references in operator-facing output. Version bump 0.8.87 -> 0.8.88 (manifest, psm1, 21 pipeline YAML pins, CHANGELOG, ReleaseNotes, README). Export count 60 -> 61. Adds Pester coverage (suite 1303 passed, 0 failed).
NeilBird added a commit that referenced this pull request Jun 17, 2026
…checks and publish script (#95)

* v0.8.85: consolidate setup workflow and align pipeline/version metadata

* test-run-timings

* v0.8.85 follow-up: delete ADO auth+inventory workflows and add merged ADO setup pipeline

* v0.8.85 follow-up: move collapsible subscription section into Export-AzLocalAuthValidationReport cmdlet; track test-run-timings.csv

* v0.8.85 follow-up: fix live integration test failures (Step.0 ErrorActionPreference, Step.3 path, Step.4 SummaryPath)

* Add test-run-timings.csv to repo (test performance metrics)

* docs: align pipeline appendix with Setup/Fleet naming

* chore: update test run timings

* v0.8.85: address PR #91 review findings - manifest, docs, mojibake, prune tests

- Get-AzLocalPipelineManifest: collapse legacy authentication-test +
  inventory-clusters rows into the merged setup-validate-and-inventory entry
- appendix-pipelines.md / README.md: replace removed filenames + old Step
  naming with Setup:/Fleet: numbering; fix section 13 file-layout block and
  section 14 reference; repair broken cross-doc anchors (README 8.1.1 ->
  #fleet-01, sideload.md -> #fleet-03); update present-tense Step.7 reference
- appendix-pipelines.md: reconcile Setup: 01 trigger docs to the shipped
  weekly Sunday 08:00 UTC cron
- fleet-update-status.yml: fix mojibake in YAML comment
- apply-updates-schedule.example.yml: replace Step.5/Step.7 with stable
  apply-updates.yml / Fleet: 04 references
- Tests: add 10 -PruneDeprecated regression tests (6 Copy- + 4 Update-)
  covering both-removed, single-removed, ID-mismatch-preserved, omitted-flag
  and -WhatIf paths

* docs: clarify sideload-catalog.example.yml header comment (v0.8.7 on-prem solution/SBE update sideloading)

* docs: fix grammar in sideload-catalog.example.yml header (introduce -> introduced)

* v0.8.86: rename onboarding pipelines Setup -> Config + clarify GitHub Environments are optional

- Rename the three onboarding workflow display names from `Setup: 0N` to
  `Config: 0N` (GitHub Actions `name:` and Azure DevOps `displayName:`/`name:`)
  so the Actions sidebar / ADO Pipelines list sorts the onboarding workflows
  ahead of the `Fleet: 0N` operational workflows (C sorts before F; the old
  `Setup:` prefix sorted after `Fleet:`). Display-name-only change - filenames,
  AZLOCAL-PIPELINE-ID values, aliases and prune logic are unchanged.
- Update bundled pipeline README.md + docs/appendix-pipelines.md (headings,
  cross-references, anchors, naming rationale) to the Config: NN naming.
- README.md (Automation-Pipeline-Examples): clarify that GitHub Environments
  are OPTIONAL. The branch-scoped federated credential is all OIDC needs, so a
  blank `environment` input is the supported minimal setup. Environments are a
  governance wrapper (approval gates, deployment-branch rules, wait timers,
  per-ring identities); environment-scoped federated credentials are only
  needed when a run actually names an environment. Mark the environment table,
  the inline + PowerShell env-scoped credential blocks, the subject-claim table
  row, and the section-5 secrets script accordingly.
- Version bump to 0.8.86: psd1 ModuleVersion + ReleaseNotes, psm1
  $script:ModuleVersion, CHANGELOG.md, both README files, docs/release-history,
  Tests version assertion, and all GENERATED_AGAINST_MODULE_VERSION pins across
  the bundled GitHub Actions and Azure DevOps templates.

Full Pester suite: 1266 passed, 0 failed, 1 skipped.

* ci: disable hosted Pester workflow (comment out pull_request + push triggers; keep workflow_dispatch). Suite is run locally before every push.

* v0.8.87: rename 'Orphan ARBs' section to 'Non-Azure Local and/or Orphan ARB appliances'

New-AzLocalFleetConnectivityStatusSummary (Fleet: 02) markdown output: rename the
Orphan ARBs section, add intro line, and expand the caveat to note that an Arc
resource bridge with no matching in-scope Azure Local cluster is NOT necessarily
orphaned - Arc resource bridge is also used by VMware vSphere and SCVMM. Adds
investigate-before-acting guidance. KPI note, causes list, and cluster-table
cross-reference updated to match. Output text only; no API or behavioural change.

Lock-step version bump 0.8.86 -> 0.8.87: psd1 (ModuleVersion + ReleaseNotes),
psm1 ($script:ModuleVersion), CHANGELOG, both README sections + appendix,
Tests assertion, docs/release-history.md, and all 20 GENERATED_AGAINST_MODULE_VERSION
pins. Full Pester suite green (1266 passed, 0 failed, 1 skipped, 38 not-run).

* v0.8.87: collapse Cluster Connectivity (with ARB Status) table by default

New-AzLocalFleetConnectivityStatusSummary now wraps the per-cluster Cluster
Connectivity (with ARB Status) table in a collapsed <details> block with an
'Expand to view clusters' summary, so the Fleet: 02 step summary stays compact.
Added a Pester assertion for the details/summary wrapper. Output text only; no
API or behavioural change. Release notes (psd1/CHANGELOG/README/release-history)
updated within the in-flight v0.8.87. Full Pester suite green (1267 passed,
0 failed, 1 skipped).

* v0.8.87: split Cluster Connectivity table into with/without connectivity issues

New-AzLocalFleetConnectivityStatusSummary now renders two per-cluster tables
instead of one:

- '### Cluster with Connectivity Issues' - clusters that are NOT (Connectivity =
  Connected AND ARB Status = Running). Shown first and expanded.
- '### Cluster without Connectivity Issues' - clusters that ARE Connected with a
  Running ARB. Collapsed behind an 'Expand to view clusters' details block.

Both tables share the same heading columns. Row rendering is factored into a
plain scriptblock (no .GetNewClosure()) reused by both tables. Added/updated
Pester assertions for both headings, the partitioning, and the collapsed block;
fixed the CSV-input context assertion that referenced the old single heading.

Release notes (psd1/CHANGELOG/README/release-history) updated within the
in-flight v0.8.87 (ReleaseNotes 9872 chars, under the 10000 limit). Full Pester
suite green (1270 passed, 0 failed, 1 skipped). Output text only; no API change.

* v0.8.87: rename bundled pipeline display names to Config:/Monitor:/Update: scheme

Renames all bundled pipeline display names (name: on GitHub Actions,
displayName:/name: on Azure DevOps) into a three-group single-digit scheme:
Config: 1-3 (onboarding/config), Monitor: 1-3 (day-2 fleet monitoring),
Update: 1-4 (update lifecycle), replacing the former Setup: 0N / Fleet: 0N
prefixes. Monitor: 2 is Fleet Health Status and Monitor: 3 is Fleet Update
Status so the numbering matches alphabetical order.

Display name only - filenames, AZLOCAL-PIPELINE-ID values, aliases, and
-PruneDeprecated logic are unchanged. Updates the bundled README,
appendix-pipelines.md (grouped/ordered conventions, alphabetical file layout),
ITSM docs, release docs, the manifest ReleaseNotes, CHANGELOG, the schedule
auditor's emitted markdown (Update: 4), and the matching Pester assertions.

Full suite green: 1282 passed, 0 failed, 1 skipped.

* v0.8.88: add Sync-AzLocalClusterUpdateSummary (Check for updates / checkUpdates)

Adds Sync-AzLocalClusterUpdateSummary (POST updateSummaries/default/checkUpdates) to refresh a cluster's update assessment - the programmatic 'Check for updates'. Fire-and-forget by default, -Wait polls lastChecked. Selectable ByName/ByResourceId/ByTag; SupportsShouldProcess.

Adds Private Test-AzLocalUpdateAssessmentStale detector (installed YYMM strictly behind manifest LatestYYMM) and wires an opt-out auto-scan into Export-AzLocalClusterUpdateReadinessReport (-SkipStaleAssessmentScan).

Surfaces 403/AuthorizationFailed from checkUpdates in the console (Status=AuthorizationFailed + RBAC warning naming the denied Action) so least-privilege custom-role gaps are visible. checkUpdates is preview and not yet in the provider operations catalog, so it cannot be added to the custom role - documented as a GA follow-up in module README, docs/rbac.md and Automation-Pipeline-Examples/README.md.

Option C: de-numbered remaining Step.N references in operator-facing output. Version bump 0.8.87 -> 0.8.88 (manifest, psm1, 21 pipeline YAML pins, CHANGELOG, ReleaseNotes, README). Export count 60 -> 61. Adds Pester coverage (suite 1303 passed, 0 failed).

* AzLocal.DeploymentAutomation v1.0.2: harden Azure resource existence checks

Replaces Get-AzResource -ErrorAction SilentlyContinue (which masked HTTP 400 api-version, auth, RBAC and transport errors as 'not found') with a new existence-aware private helper Get-AzLocalArmResource that returns null only for a genuine 404, throws on real failures, and self-heals an unsupported auto-negotiated api-version by parsing ARM's supported-versions list and retrying with the newest stable version.

All four existence-check call sites (Start-AzLocalTemplateDeployment, Test-AzLocalClusterPreFlight x2, Get-AzLocalDeploymentStatus) now use the helper; Arc node lookups default to the GA Microsoft.HybridCompute/machines api-version 2025-01-13. Start-AzLocalTemplateDeployment now pins context via Set-AzContext on the direct path to avoid wrong-subscription defaults in multi-sub tenants. Adds helper unit tests and source guards.

* AzLocal.DeploymentAutomation: harden Publish-Module.ps1

- Stage under per-user TEMP instead of predictable/world-writable C:\Temp.

- Add pre-publish secret-leak guard: scans staged files for real subscription/tenant/object GUIDs, private-key blocks, and storage account keys; throws before publishing if any are found.

- Assert shipped .config naming config keeps placeholder tenantId / empty objectId.

- Allowlist synthetic placeholder GUIDs, the module manifest GUID, and Azure built-in role-definition GUIDs to avoid false positives. README and automation-pipelines remain in the package.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant