* upgrade nodejs from 20 to 24 and update dependencies

* update installation step of ps

* update az account count check

* upgrade actions/checkout and actions/setup-node from 4 to 6

* remove empty lines

Apply the same single-quote escape already used for the service principal
secret to the remaining values interpolated into the generated PowerShell
login script: tenant-id, subscription-id, client-id, federated token,
and the AzureStack resourceManagerEndpointUrl.

Factor the escape into a shared helper (escapePSSingleQuoted) so every
interpolation site uses the same treatment, and add regression tests that
assert each field is escaped across all supported auth paths.

No behaviour change for valid inputs; legitimate values contain no single quotes.

* Update azure/login pin from v1 to v3 in canary and integration tests

The canary and integration-test workflows still pinned azure/login@v1 while
the action is on v3, so they were validating a two-major-old release instead
of the current one.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Remove unused Slack notification jobs from canary and integration tests

The slack-post-result jobs posted to a Slack webhook that is no longer used,
and referenced a secret with broken interpolation. Removing them; the test
jobs themselves are unchanged.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Remove redundant pr-check workflow

pr-check.yml duplicated ci.yml's build+test (ci.yml already runs on master
PRs across windows and ubuntu). Removing the redundant workflow.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Run positive/negative live tests on pull requests instead of every push

These suites perform real Azure logins. Triggering on every push to any
branch ran the full matrix (and consumed live credentials) for incidental
commits. Switch to pull_request targeting master, keeping workflow_dispatch
for manual runs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Self-provision RG for live login tests; drop VM assertions

- positive/negative: add setup/teardown jobs that create and delete
  GitHubAction_CI_Group via azure/login@v3 (stable), gated on all jobs
- drop az vm list / Get-AzVM assertions (no VM is provisioned)
- negative permission tests keep targeting the never-created
  GitHubAction_CI_RG so they fail as expected
- shared concurrency group so positive/negative don't collide on the RG

* Merge positive/negative live tests into one self-provisioning workflow

Replace azure-login-positive.yml and azure-login-negative.yml with a
single azure-login-live-tests.yml. All 49 positive and 45 negative test
steps are preserved unchanged; only structure and provisioning change.

---------

Co-authored-by: Maddison Das <272712104+MaddyMicrosoft@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Remove accidental package-lock dependency

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Remove unused version field from package.json

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Add Dependabot config (npm + github-actions)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Maddison Das <272712104+MaddyMicrosoft@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Add in dynamic version for telemetry using GITHUB_ACTION_REF

* Isolate live-test resource group per run; scope concurrency to the branch

The live-tests workflow used a fixed resource group name
(GitHubAction_CI_Group) plus a repo-wide concurrency group. Because the
test jobs run behind the Automation test approval gate, an unapproved run
sits in the 'waiting' state holding the shared concurrency lock, which
blocked live-tests on every other PR indefinitely.

Give each run its own resource group by suffixing the name with
github.run_id, and reference it via the RG_POSITIVE env var everywhere
(previously nine jobs used the literal name). With per-run isolation the
repo-wide lock is no longer needed to prevent collisions, so the
concurrency group is now scoped to the branch (github.ref) and only
prevents pile-ups on rapid pushes to the same ref - never across PRs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix resource group name expansion on Windows runners

The per-run resource group name was referenced as the bash-style
"$RG_POSITIVE" in az group show/create/delete run steps. Those steps use
the runner default shell, which is PowerShell on windows-latest, so the
name expanded to an empty string there and az failed with "argument
--name/-n/--resource-group/-g: expected one argument".

Reference the value through the GitHub Actions env expression instead, so
it is substituted before the shell runs, making it shell-agnostic across
ubuntu, windows, and macos. The azure/powershell inline scripts keep
using the PowerShell env form, which is correct there.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Maddison Das <272712104+MaddyMicrosoft@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>