* upgrade nodejs from 20 to 24 and update dependencies

* update installation step of ps

* update az account count check

* upgrade actions/checkout and actions/setup-node from 4 to 6

* remove empty lines

Apply the same single-quote escape already used for the service principal
secret to the remaining values interpolated into the generated PowerShell
login script: tenant-id, subscription-id, client-id, federated token,
and the AzureStack resourceManagerEndpointUrl.

Factor the escape into a shared helper (escapePSSingleQuoted) so every
interpolation site uses the same treatment, and add regression tests that
assert each field is escaped across all supported auth paths.

No behaviour change for valid inputs; legitimate values contain no single quotes.

* Update azure/login pin from v1 to v3 in canary and integration tests

The canary and integration-test workflows still pinned azure/login@v1 while
the action is on v3, so they were validating a two-major-old release instead
of the current one.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Remove unused Slack notification jobs from canary and integration tests

The slack-post-result jobs posted to a Slack webhook that is no longer used,
and referenced a secret with broken interpolation. Removing them; the test
jobs themselves are unchanged.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Remove redundant pr-check workflow

pr-check.yml duplicated ci.yml's build+test (ci.yml already runs on master
PRs across windows and ubuntu). Removing the redundant workflow.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Run positive/negative live tests on pull requests instead of every push

These suites perform real Azure logins. Triggering on every push to any
branch ran the full matrix (and consumed live credentials) for incidental
commits. Switch to pull_request targeting master, keeping workflow_dispatch
for manual runs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Self-provision RG for live login tests; drop VM assertions

- positive/negative: add setup/teardown jobs that create and delete
  GitHubAction_CI_Group via azure/login@v3 (stable), gated on all jobs
- drop az vm list / Get-AzVM assertions (no VM is provisioned)
- negative permission tests keep targeting the never-created
  GitHubAction_CI_RG so they fail as expected
- shared concurrency group so positive/negative don't collide on the RG

* Merge positive/negative live tests into one self-provisioning workflow

Replace azure-login-positive.yml and azure-login-negative.yml with a
single azure-login-live-tests.yml. All 49 positive and 45 negative test
steps are preserved unchanged; only structure and provisioning change.

---------

Co-authored-by: Maddison Das <272712104+MaddyMicrosoft@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Remove accidental package-lock dependency

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Remove unused version field from package.json

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Add Dependabot config (npm + github-actions)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Maddison Das <272712104+MaddyMicrosoft@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>