Apply the same single-quote escape already used for the service principal
secret to the remaining values interpolated into the generated PowerShell
login script: tenant-id, subscription-id, client-id, federated token,
and the AzureStack resourceManagerEndpointUrl.

Factor the escape into a shared helper (escapePSSingleQuoted) so every
interpolation site uses the same treatment, and add regression tests that
assert each field is escaped across all supported auth paths.

No behaviour change for valid inputs; legitimate values contain no single quotes.

* Update azure/login pin from v1 to v3 in canary and integration tests

The canary and integration-test workflows still pinned azure/login@v1 while
the action is on v3, so they were validating a two-major-old release instead
of the current one.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Remove unused Slack notification jobs from canary and integration tests

The slack-post-result jobs posted to a Slack webhook that is no longer used,
and referenced a secret with broken interpolation. Removing them; the test
jobs themselves are unchanged.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Remove redundant pr-check workflow

pr-check.yml duplicated ci.yml's build+test (ci.yml already runs on master
PRs across windows and ubuntu). Removing the redundant workflow.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Run positive/negative live tests on pull requests instead of every push

These suites perform real Azure logins. Triggering on every push to any
branch ran the full matrix (and consumed live credentials) for incidental
commits. Switch to pull_request targeting master, keeping workflow_dispatch
for manual runs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Self-provision RG for live login tests; drop VM assertions

- positive/negative: add setup/teardown jobs that create and delete
  GitHubAction_CI_Group via azure/login@v3 (stable), gated on all jobs
- drop az vm list / Get-AzVM assertions (no VM is provisioned)
- negative permission tests keep targeting the never-created
  GitHubAction_CI_RG so they fail as expected
- shared concurrency group so positive/negative don't collide on the RG

* Merge positive/negative live tests into one self-provisioning workflow

Replace azure-login-positive.yml and azure-login-negative.yml with a
single azure-login-live-tests.yml. All 49 positive and 45 negative test
steps are preserved unchanged; only structure and provisioning change.

---------

Co-authored-by: Maddison Das <272712104+MaddyMicrosoft@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Remove accidental package-lock dependency

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Remove unused version field from package.json

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Add Dependabot config (npm + github-actions)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Maddison Das <272712104+MaddyMicrosoft@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Add in dynamic version for telemetry using GITHUB_ACTION_REF

* Isolate live-test resource group per run; scope concurrency to the branch

The live-tests workflow used a fixed resource group name
(GitHubAction_CI_Group) plus a repo-wide concurrency group. Because the
test jobs run behind the Automation test approval gate, an unapproved run
sits in the 'waiting' state holding the shared concurrency lock, which
blocked live-tests on every other PR indefinitely.

Give each run its own resource group by suffixing the name with
github.run_id, and reference it via the RG_POSITIVE env var everywhere
(previously nine jobs used the literal name). With per-run isolation the
repo-wide lock is no longer needed to prevent collisions, so the
concurrency group is now scoped to the branch (github.ref) and only
prevents pile-ups on rapid pushes to the same ref - never across PRs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix resource group name expansion on Windows runners

The per-run resource group name was referenced as the bash-style
"$RG_POSITIVE" in az group show/create/delete run steps. Those steps use
the runner default shell, which is PowerShell on windows-latest, so the
name expanded to an empty string there and az failed with "argument
--name/-n/--resource-group/-g: expected one argument".

Reference the value through the GitHub Actions env expression instead, so
it is substituted before the shell runs, making it shell-agnostic across
ubuntu, windows, and macos. The azure/powershell inline scripts keep
using the PowerShell env form, which is correct there.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Maddison Das <272712104+MaddyMicrosoft@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Third-party actions were referenced by movable major tags (e.g.
actions/checkout@v6). A tag can be repointed by the upstream owner or an
attacker who compromises that action's repo, silently running new code
in our CI - the class of supply-chain attack seen with tj-actions in 2025.

Pin the externally-owned actions to the immutable commit SHA the tag
resolves to, with the version kept in a trailing comment. Dependabot
(github-actions ecosystem) updates both the SHA and the comment together,
so they do not drift.

Pinned: actions/checkout, actions/setup-node, actions/github-script,
actions/stale, github/codeql-action (init/autobuild/analyze).

Deliberately NOT pinned: azure/login and azure/powershell stay on @V3.
These are our own actions used as test/provisioning tooling - the canary
and integration suites exist to validate the current v3, so pinning them
to a SHA would freeze what the tests exercise and cause them to drift
from the released major. The supply-chain threat model (us attacking our
own action's CI) does not apply.

Co-authored-by: Maddison Das <272712104+MaddyMicrosoft@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Bumps [picomatch](https://github.com/micromatch/picomatch) from 2.3.1 to 2.3.2.
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

---
updated-dependencies:
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: MaddyMicrosoft <maddisondas@microsoft.com>

* Add Troubleshooting section for OIDC federated credential subject mismatch

Document the AADSTS700213 / AADSTS7002138 "no matching federated identity
record" failures caused by case-sensitive subject matching and by portal-
generated subjects that include GitHub owner/repository numeric IDs.

Addresses Azure#617. Also relevant to Azure#573.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Document intentional client-id masking in workflow logs

Explain in the client-id input section that the action registers the
client-id as a secret (core.setSecret), why it is masked, and that
tenant-id and subscription-id are not masked.

Addresses Azure#566.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Document Azure CLI 2.66.x requirement for Azure Stack Hub

Note in the Azure Stack Hub section that Azure CLI newer than 2.66.x no
longer supports Azure Stack Hub, so environment: 'AzureStack' requires
pinning Azure CLI to 2.66.x (LTS). Prevents the failure reported when
using the example on a current runner.

Addresses Azure#534.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Maddison Das <272712104+MaddyMicrosoft@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Ignore typescript >=7: the native compiler rewrite. ts-jest declares a peer
  of "typescript >=4.3 <7", so TS 7 fails npm install with an ERESOLVE conflict.
- Ignore @actions/io >=3: 3.x is ESM-only, which the CommonJS ncc bundle cannot
  require(). Stay on 2.x (CommonJS, Node 24 support) until the action moves to ESM.
- Limit the dev-dependencies group to minor and patch updates so a breaking
  major no longer poisons the whole grouped PR; majors now arrive as isolated,
  reviewable PRs.
- Label npm dependency PRs with "dependencies".

Production dependencies are intentionally left ungrouped so each runtime bump
is reviewed individually and one breaking major cannot block the others.

Co-authored-by: Maddison Das <272712104+MaddyMicrosoft@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…e#621)

Bumps the github-actions group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `6.1.0` | `7.0.1` |
| [actions/setup-node](https://github.com/actions/setup-node) | `6.5.0` | `7.0.0` |
| [actions/github-script](https://github.com/actions/github-script) | `7.1.0` | `9.0.0` |
| [github/codeql-action/init](https://github.com/github/codeql-action) | `3.37.7` | `4.37.7` |
| [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `3.37.7` | `4.37.7` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `3.37.7` | `4.37.7` |
| [actions/stale](https://github.com/actions/stale) | `8.0.0` | `11.0.0` |



Updates `actions/checkout` from 6.1.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@d23441a...3d3c42e)

Updates `actions/setup-node` from 6.5.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@2499707...8207627)

Updates `actions/github-script` from 7.1.0 to 9.0.0
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](actions/github-script@f28e40c...3a2844b)

Updates `github/codeql-action/init` from 3.37.7 to 4.37.7
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@f371297...ff2f1c6)

Updates `github/codeql-action/autobuild` from 3.37.7 to 4.37.7
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@f371297...ff2f1c6)

Updates `github/codeql-action/analyze` from 3.37.7 to 4.37.7
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@f371297...ff2f1c6)

Updates `actions/stale` from 8.0.0 to 11.0.0
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](actions/stale@1160a22...4391f3d)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/github-script
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.7
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: github/codeql-action/autobuild
  dependency-version: 4.37.7
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.7
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/stale
  dependency-version: 11.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Add admin-gated Release workflow

Reproduces the Azure Login Action release runbook as a manually
dispatched workflow: checkout master, build, test, commit the built
lib/ to a releases/vX.Y.Z branch, tag that commit, force-move the major
tag (e.g. v3), and publish a GitHub Release.

Admin-only is enforced two ways:
- environment: release, which pauses the run until a required reviewer
  (admin) approves. This is the primary gate and must be configured with
  required reviewers in repo settings before the first real release.
- an 'Ensure triggered by an admin' step that fails fast for non-admins.

Actions are pinned to @v6 to match the rest of the repo.

* Add admin-gated Rollback workflow

Undo a bad release by re-pointing the major tag (e.g. v3) back to a
known-good, already-published version tag. This is the fast
consumer-facing fix: anyone on azure/login@v3 recovers immediately.

- Admin-gated the same two ways as release.yml: environment: release
  approval plus an actor-admin check.
- Shares the 'release' concurrency group so a rollback can never race an
  in-flight release (both push the same major tag).
- Verifies the target tag exists and carries both built entry points
  (lib/main/index.js and lib/cleanup/index.js) before moving the major
  tag, so it can never point consumers at unbuilt code.
- Optionally resets the 'Latest' release badge; tolerates a missing
  Release object so a cosmetic badge failure never fails a successful
  tag rollback.
- Does NOT delete the bad tag/branch/release (someone may have pinned the
  exact version); left as a deliberate manual step.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Build releases with the node version from action.yml

* Restrict release ref allowlist to master and hotfix/* branches

The allowlist previously accepted releases/v2 for v2 maintenance, but
releases/v2 is a stale early-v2 snapshot that does not contain the later
v2 releases (v2.3.0, v2.3.1, ...). Releasing from it would ship old code.

The latest v2 source lives in the newest v2 release tag. To cut a
back-major release, branch a hotfix off that tag
(git checkout -b hotfix/v2.3.2 v2.3.1), apply the fix, and release from
the hotfix/* branch. Drop releases/v2 from the allowlist so it can no
longer be selected by mistake.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Drop explicit 'latest' handling; rely on GitHub auto-latest

gh release create defaults to marking the highest-version release as
"Latest", so a back-major release (e.g. a v2 hotfix) never steals the
badge from the current major on its own. The explicit latest controls
were therefore redundant, and rollback's badge edit conflicted with
immutable releases.

- release.yml: remove the latest input, the back-major latest guard, and
  the --latest flag on gh release create.
- rollback.yml: remove the set_latest input and the gh release edit
  --latest badge step. Rollback now does only the major-tag move (matching
  the original runbook) plus the admin gate and built-artifact checks.

The "Latest" badge is display-only and never affects what azure/login@vN
resolves to, so this is behaviourally safe.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Maddison Das <272712104+MaddyMicrosoft@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Refactor PS login to use a static param()-bound script

* Update readme

* Add injection-safety test for federated token argv handling

---------

Co-authored-by: Maddison Das <272712104+MaddyMicrosoft@users.noreply.github.com>

Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.12 to 1.1.18.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.18)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.18
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: MaddyMicrosoft <maddisondas@microsoft.com>

Removes [uuid](https://github.com/uuidjs/uuid). It's no longer used after updating ancestor dependency [@actions/core](https://github.com/actions/toolkit/tree/HEAD/packages/core). These dependencies need to be updated together.


Removes `uuid`

Updates `@actions/core` from 1.9.1 to 1.11.1
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md)
- [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/core)

---
updated-dependencies:
- dependency-name: uuid
  dependency-version: 
  dependency-type: indirect
- dependency-name: "@actions/core"
  dependency-version: 1.11.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: MaddyMicrosoft <maddisondas@microsoft.com>

…ure#628)

@actions/exec 3.0.0 and @actions/core 3.0.1 ship as ESM-only
(package.json "type": "module"), which the CommonJS ncc bundle cannot
require() (see the failing bumps in Azure#623 and Azure#624, same failure mode as the
already-capped @actions/io). Extend the existing ESM cap to these two packages
so Dependabot stays on their 2.x (CommonJS) line until the action migrates to
ESM. @actions/http-client 3.x remains CommonJS and is intentionally not capped.

Co-authored-by: Maddison Das <272712104+MaddyMicrosoft@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>