feat: support PowerShell 7.4 through 7.6 - #284
Open
SamErde wants to merge 43 commits into
Open
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe change adds PowerShell 7.4–7.6 and .NET 8–10 support. It introduces exact runtime provisioning, profile-aware dependency validation, artifact policies, lifecycle automation, compatibility evidence, authenticated release checks, and expanded CI gates and tests. ChangesRuntime multitargeting and build tooling
Estimated code review effort: 5 (Critical) | ~120 minutes Sequence Diagram(s)sequenceDiagram
participant BuildWorkflow
participant RuntimeMatrix
participant PowerShellProvisioner
participant BuildScript
participant EvidenceTools
participant ReleaseGate
participant BuildGate
BuildWorkflow->>RuntimeMatrix: Generate exact runtime matrix
BuildWorkflow->>PowerShellProvisioner: Provision and verify runtime cell
PowerShellProvisioner-->>BuildWorkflow: Executable and runtime identity
BuildWorkflow->>BuildScript: Run pinned build tasks
BuildWorkflow->>EvidenceTools: Validate package, TFM, size, and profile evidence
EvidenceTools-->>BuildWorkflow: Reports and fingerprints
BuildWorkflow->>BuildGate: Aggregate build and evidence results
BuildGate-->>BuildWorkflow: Pass or fail gate
ReleaseGate->>EvidenceTools: Validate exact-commit authenticated evidence
EvidenceTools-->>ReleaseGate: Approved or rejected release evidence
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
github-actions
Bot
added
documentation
Contributor
Up to standards ✅🟢 Issues
|
| Category | Results |
|---|---|
| BestPractice | 32 minor |
| CodeStyle | 68 minor |
🟢 Metrics 0 complexity · 0 duplication
Metric Results Complexity ✅ 0 (≤ 100 complexity) Duplication ✅ 0 (≤ 1 duplication)
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
Contributor
There was a problem hiding this comment.
Pull request overview
Adds fail-closed PowerShell 7.4–7.6 runtime profiles with isolated net8/net9/net10 bundles, deterministic tooling, and profile-aware compatibility evidence.
Changes:
- Adds runtime selection, lifecycle, packaging, size, and compatibility policies.
- Expands CI and tests across nine OS/runtime cells.
- Updates support, dependency, and troubleshooting documentation.
Reviewed changes
Copilot reviewed 78 out of 80 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
tools/Test-DLLPickleRuntimeProfilePolicy.ps1 |
Validates runtime and lifecycle policy. |
tools/Test-DLLPickleProfileConflictBaseline.ps1 |
Enforces profile conflict baselines. |
tools/Test-DLLPickleFindingFingerprintReported.ps1 |
Detects reported fingerprints. |
tools/New-DLLPickleSupportDocumentation.ps1 |
Generates support documentation. |
tools/New-DLLPickleRuntimeProfileEvidence.ps1 |
Captures runtime evidence. |
tools/New-DLLPickleProfileEvidenceSummary.ps1 |
Aggregates profile findings. |
tools/New-DLLPicklePowerShellTestMatrix.ps1 |
Generates the nine-cell matrix. |
tools/New-DLLPickleConflictMatrix.ps1 |
Adds profile-keyed fingerprints. |
tools/Invoke-DLLPickleBuild.ps1 |
Wraps pinned InvokeBuild execution. |
tools/Get-DLLPickleRuntimeAssemblySnapshot.ps1 |
Adds exact-host assembly probing. |
tools/Get-DLLPickleLoadedTrackedAssembly.ps1 |
Records hashes and load contexts. |
tools/Compare-DLLPickleConflictMatrix.ps1 |
Adds profile-aware drift findings. |
tests/Unit/UpstreamScenarioEvidence.Tests.ps1 |
Tests deterministic import scenarios. |
tests/Unit/UpstreamInventoryProfile.Tests.ps1 |
Tests profile-aware inventories. |
tests/Unit/TfmAlignment.Tests.ps1 |
Tests restored asset selection. |
tests/Unit/SupportDocumentation.Tests.ps1 |
Tests generated documentation. |
tests/Unit/RuntimeProvisioning.Tests.ps1 |
Tests exact runtime provisioning. |
tests/Unit/RuntimeProfileSelection.Tests.ps1 |
Tests fail-closed profile selection. |
tests/Unit/RuntimeProfilePolicy.Tests.ps1 |
Tests lifecycle policy enforcement. |
tests/Unit/RuntimeProfileEvidence.Tests.ps1 |
Tests evidence import compatibility. |
tests/Unit/RuntimeAssemblyProbe.Tests.ps1 |
Tests isolated assembly probes. |
tests/Unit/ProfileConflictBaseline.Tests.ps1 |
Tests baseline and fingerprint gates. |
tests/Unit/PowerShellTestMatrix.Tests.ps1 |
Tests matrix generation. |
tests/Unit/KnownConflicts.Tests.ps1 |
Tests expanded conflict metadata. |
tests/Unit/Import-DPLibrary.Tests.ps1 |
Makes loader tests profile-aware. |
tests/Unit/DependencyPolicy.Tests.ps1 |
Tests per-profile dependency policy. |
tests/Unit/DependencyChangeReport.Tests.ps1 |
Tests per-TFM change reports. |
tests/Unit/ConflictMatrixDrift.Tests.ps1 |
Tests profile drift fingerprints. |
tests/Unit/ConflictMatrix.Tests.ps1 |
Tests profile-keyed matrices. |
tests/Unit/BuildTooling.Tests.ps1 |
Tests pinned build tooling. |
tests/Unit/ArtifactPolicy.Tests.ps1 |
Tests composition and size policy. |
tests/Integration/Invoke-DLLPickleScenario.ps1 |
Captures richer scenario evidence. |
tests/Integration/DLLPickle.Issue34.GraphAuth.Tests.ps1 |
Adds Graph regression coverage. |
tests/Integration/DLLPickle.IntegrationTest.Tests.ps1 |
Selects profile-specific bundles. |
tests/Integration/DependencyPolicyRealization.Tests.ps1 |
Validates selected profile output. |
src/DLLPickle/SupportedRuntimeProfiles.json |
Declares shipped runtime mappings. |
src/DLLPickle/Public/Import-DPLibrary.ps1 |
Selects bundles from runtime policy. |
src/DLLPickle/Private/Get-DPRuntimeProfile.ps1 |
Implements fail-closed selection. |
src/DLLPickle/KnownConflicts.json |
Adds profile-aware OData metadata. |
src/DLLPickle.Build/DLLPickle.csproj |
Targets net8, net9, and net10. |
README.md |
Documents supported profiles. |
global.json |
Pins the .NET 10 SDK. |
docs/Troubleshooting.md |
Updates runtime troubleshooting. |
docs/generated/Support-Matrix.md |
Records the generated support contract. |
docs/gaps/README.md |
Updates GAP-003 status. |
docs/gaps/GAP-003-exo-teams-probe-commands.md |
Records probe implementation progress. |
docs/DEPENDENCIES.md |
Documents multi-target dependency policy. |
docs/Deep-Dive.md |
Explains profile-aware loading. |
CHANGELOG.md |
Summarizes the feature set. |
build/DLLPickle.Tooling.ps1 |
Implements exact tool loading. |
build/DLLPickle.Build.ps1 |
Builds all TFMs with pinned tools. |
build/build-tool-versions.json |
Pins PowerShell build tools. |
build/artifact-size-baseline.json |
Adds candidate size baselines. |
.github/workflows/Validate-Packages.yml |
Validates all restored TFM assets. |
.github/workflows/Release-and-Publish.yml |
Adds lifecycle and artifact gates. |
.github/workflows/Dependabot-Auto-Approve.yml |
Strengthens dependency review gates. |
.github/dependabot.yml |
Refines dependency grouping. |
.github/ci-scripts/Actions_Bootstrap.ps1 |
Installs exact isolated tools. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 80 out of 82 changed files in this pull request and generated 1 comment.
Suppressed comments (3)
docs/Troubleshooting.md:31
- Remove the duplicated article: “a supported PowerShell session.”
a supported PowerShell session — they still inspect the current-user Windows PowerShell
tools/New-DLLPickleProfileEvidenceSummary.ps1:45
- The scheduled workflow downloads all
upstream-*artifacts withmerge-multiple: true, while every profile artifact contains a root-levelbaseline-comparison.json. Those same-named files overwrite one another before this recursive search runs, so the summary sees at most one of nine comparisons and reports a permanently incomplete, potentially overwrite-order-dependent fingerprint. Preserve per-artifact directories or upload each profile under a unique directory before aggregation.
tools/New-DLLPickleRuntimeProfileEvidence.ps1:128 - The reported TFM and selected bundle are copied from the caller payload, not observed from
Import-DPLibrary. If the loader selects a different directory,assembliescan be empty while all import-result statuses remain non-failing, and this tool still publishes evidence claiming the requested bundle. Fail unless at least one assembly is observed under the expected bundle so the artifact actually proves runtime selection.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Pass every TFM inventory to dependency pin generation
The scheduled candidate job passes only the newly captured PowerShell 7.6/net10.0 Windows inventory, but every preload policy entry targets net8.0, net9.0, and net10.0. Update-DLLPickleDependencyPins.ps1 filters inventories by TFM and abandons each pin as soon as net8.0/net9.0 evidence is absent, so this workflow silently produces no dependency candidate changes even when upstream versions move. Download and pass the nine profile inventories already generated earlier in the run.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: da2fb699b4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 12
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (3)
tools/Get-DLLPicklePowerShellSupportUpdate.ps1 (1)
89-90: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winCulture-dependent date parsing remains in two evidence tools. Both sites parse an ISO-8601 timestamp with the current culture and the current culture calendar. On a host with a non-Gregorian calendar culture, such as
ar-SA, the parsed value differs, which changes release filtering and recorded capture dates. The other tools in this PR already parse withInvariantCulture.
tools/Get-DLLPicklePowerShellSupportUpdate.ps1#L89-L90: replace the[datetime]$Release.published_atcast with[datetime]::ParseusingInvariantCultureandRoundtripKind.tools/New-DLLPickleNormalizedProfileEvidence.ps1#L343-L350: replace[System.DateTimeOffset]::Parse($CapturedAtUtc)with the three-argument overload usingInvariantCultureandAssumeUniversal, matchingtools/Test-DLLPickleManualAuthenticatedEvidence.ps1Lines 104-108.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tools/Get-DLLPicklePowerShellSupportUpdate.ps1` around lines 89 - 90, Replace the culture-dependent date parsing at tools/Get-DLLPicklePowerShellSupportUpdate.ps1 lines 89-90 by parsing $Release.published_at with DateTime.Parse using InvariantCulture and RoundtripKind, while preserving the MinValue fallback. Also update tools/New-DLLPickleNormalizedProfileEvidence.ps1 lines 343-350 to parse $CapturedAtUtc with the three-argument DateTimeOffset.Parse overload using InvariantCulture and AssumeUniversal, matching the established parsing in Test-DLLPickleManualAuthenticatedEvidence.build/dependency-policy.json (1)
768-770: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winUpdate the
profile-evidenceJSON status fields for the new baselines.The snippets show
acceptedper-platform baselines with evidence paths and fingerprints, but the surrounding JSON still reports stale or unaccepted profile-level status. Alignprofile-evidence/ps7.4-net8.0-*,profile-evidence/ps7.5-net9.0-*, andprofile-evidence/ps7.6-net10.0-*evidence files with the added supported baselines so policy consumers cannot report accepted evidence while the lane remains unaccepted.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@build/dependency-policy.json` around lines 768 - 770, Update the profile-level status fields in dependency-policy.json for the ps7.4-net8.0-*, ps7.5-net9.0-*, and ps7.6-net10.0-* profile-evidence entries to match their newly accepted supported baselines. Replace stale or unaccepted statuses with the appropriate accepted state while preserving each platform’s evidence paths and fingerprints..github/workflows/Release-and-Publish.yml (1)
132-150: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winPass the repository slug through
envinstead of expanding it in the script body.Lines 134 and 150 expand
${{ github.repository }}directly into thepwshscript.zizmorflags line 150 as template injection. The value is the repository slug, so exploitation is not demonstrated here, but theenvform removes the expansion entirely and keeps the step consistent withRELEASE_SHAon line 124.♻️ Proposed change
env: GH_TOKEN: ${{ github.token }} RELEASE_SHA: ${{ steps.release-candidate.outputs.release_sha }} + GH_REPOSITORY: ${{ github.repository }}$RunArguments = @( 'run', 'list' - '--repo', '${{ github.repository }}' + '--repo', $env:GH_REPOSITORY- $ArtifactJson = gh api "/repos/${{ github.repository }}/actions/runs/$($CandidateRun.databaseId)/artifacts" 2>$null + $ArtifactJson = gh api "/repos/$($env:GH_REPOSITORY)/actions/runs/$($CandidateRun.databaseId)/artifacts" 2>$null🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/Release-and-Publish.yml around lines 132 - 150, Update the PowerShell workflow step to receive the repository slug through the step environment, then replace the direct `${{ github.repository }}` expansions in the `gh run list` arguments and `gh api` artifact request with that environment variable. Keep the existing repository targeting behavior and align with the `RELEASE_SHA` environment-variable pattern.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/Release-and-Publish.yml:
- Around line 141-162: Update the protected-evidence lookup around RunJson and
ArtifactJson so any non-zero gh run-list or artifact API result fails the
release instead of being treated as missing evidence. Preserve the existing
no-match behavior when calls succeed, but surface the failure through the
workflow’s established error/logging and summary path before the manual bridge
fallback at line 168 can be accepted.
In `@build/authenticated-evidence/manual-transition.schema.json`:
- Around line 28-38: Update the acceptance object schema so status-specific
validation requires non-null acceptedAtUtc, acceptedBy, and confidence whenever
status is "accepted", while preserving the pending-state behavior. Use
conditional schema logic within the acceptance definition and keep
Test-DLLPickleManualAuthenticatedEvidence.ps1 authoritative.
In `@build/profile-evidence/ps7.4-net8.0-macos-x64.json`:
- Around line 9-11: Update the evidence-generation logic that populates
observedOperatingSystems for macOS lanes to normalize Darwin kernel output to
the product-form macOS version string, such as macOS 15.7.7, instead of storing
the raw kernel string. Apply this consistently across all captured macOS lanes
so kernel build metadata does not affect compatibility evidence fingerprints.
In `@docs/plans/2026-08-09-credentialed-authentication-test-environment.md`:
- Around line 230-234: Remove the hard-coded Set-Location command from the
documented PowerShell setup block and retain only the script invocation, so
maintainers run it from their existing repository checkout without relying on a
specific local directory layout.
In `@tests/Unit/BundleSourceFingerprint.Tests.ps1`:
- Around line 21-37: Update the source-row ordering in the bundle fingerprint
implementation around Get-DLLPickleBundleSourceFingerprint to use canonicalized
paths and ordinal comparison before hashing, replacing the culture-sensitive
Sort-Object FullName -Unique behavior; reuse Get-DLLPickleOrdinalSequence if
appropriate. Extend the existing stability test with a changed process-culture
scenario, following ProfileEvidenceHelpers.Tests.ps1, so culture-dependent
ordering differences are detected while preserving exclusion of non-bundle
files.
In `@tests/Unit/ProfileConflictBaseline.Tests.ps1`:
- Around line 189-191: Add a FindingFingerprint assertion to the
missing-evidence test alongside the existing Status and FailureDetail checks,
matching the expected fingerprint assertion used by the sibling
tampered-evidence and unaccepted-baseline tests.
In `@tools/DLLPickle.ProfileEvidence.ps1`:
- Around line 20-23: Split the combined guard in
Get-DLLPickleNormalizedEvidenceFingerprint into separate schema-version and
missing-content checks, each with a distinct throw message. In
tools/DLLPickle.ProfileEvidence.ps1 lines 20-23, report only the relevant
validation failure; in tests/Unit/ProfileEvidenceHelpers.Tests.ps1 lines 24-29,
retain both Should -Throw assertions but tighten their patterns to match only
their corresponding message.
In `@tools/Get-DLLPickleBundleSourceFingerprint.ps1`:
- Around line 47-51: Make fingerprint generation deterministic in the
source-file collection and canonical-row construction around $SourceFiles:
normalize each file to its relative path, sort those paths using
StringComparer.Ordinal rather than culture-sensitive Sort-Object FullName, and
build canonical text in that order. Ensure emitted $Report.files uses the
identical ordinally sorted relative-path order so consumers can reproduce the
fingerprint.
In `@tools/Initialize-DLLPickleManualAuthenticatedCompatibility.ps1`:
- Around line 67-70: Update the $StaleSelections filter to use a Where-Object
script block that compares each module’s Version property with the
LatestCompatibleVersion property value, rather than treating the latter as a
literal string. Keep the existing count check and exception behavior unchanged.
In `@tools/Invoke-DLLPickleManualAuthenticatedScenario.ps1`:
- Around line 27-188: Add executing unit tests for the new functions in
tools/Invoke-DLLPickleManualAuthenticatedScenario.ps1 (lines 27-188): test
ConvertTo-CollapsedAssetPath and ConvertTo-ManualEvidencePath, including an
out-of-root throw, and test Invoke-ReadProbe with a failing probe result. Add
executing tests in tools/Invoke-DLLPickleManualAuthenticatedCompatibility.ps1
(lines 170-182) for ConvertTo-UpstreamManifestIdentifier covering in-cache,
out-of-cache, trailing-separator root, and mixed-separator paths; replace or
supplement regex-only assertions so behavior is exercised.
- Around line 245-254: Update the expectedTokenAudiences assignment to wrap the
Sort-Object -Unique result in @(), ensuring single-provider scenarios remain
one-element arrays and satisfy the schema’s array type.
In `@tools/Test-DLLPickleManualAuthenticatedEvidence.ps1`:
- Around line 87-109: Remove the local Get-ContentFingerprint and
ConvertTo-UtcDateTimeOffset definitions from
Test-DLLPickleManualAuthenticatedEvidence.ps1, centralize both helpers in
DLLPickle.ProfileEvidence.ps1, and dot-source that shared file from the
producer, validator, and documentation generator. Update callers to use the
shared helper names, including Get-DLLPickleNormalizedEvidenceFingerprint and
ConvertTo-DLLPickleUtcDateTimeOffset, so all evidence workflows use identical
implementations.
---
Outside diff comments:
In @.github/workflows/Release-and-Publish.yml:
- Around line 132-150: Update the PowerShell workflow step to receive the
repository slug through the step environment, then replace the direct `${{
github.repository }}` expansions in the `gh run list` arguments and `gh api`
artifact request with that environment variable. Keep the existing repository
targeting behavior and align with the `RELEASE_SHA` environment-variable
pattern.
In `@build/dependency-policy.json`:
- Around line 768-770: Update the profile-level status fields in
dependency-policy.json for the ps7.4-net8.0-*, ps7.5-net9.0-*, and
ps7.6-net10.0-* profile-evidence entries to match their newly accepted supported
baselines. Replace stale or unaccepted statuses with the appropriate accepted
state while preserving each platform’s evidence paths and fingerprints.
In `@tools/Get-DLLPicklePowerShellSupportUpdate.ps1`:
- Around line 89-90: Replace the culture-dependent date parsing at
tools/Get-DLLPicklePowerShellSupportUpdate.ps1 lines 89-90 by parsing
$Release.published_at with DateTime.Parse using InvariantCulture and
RoundtripKind, while preserving the MinValue fallback. Also update
tools/New-DLLPickleNormalizedProfileEvidence.ps1 lines 343-350 to parse
$CapturedAtUtc with the three-argument DateTimeOffset.Parse overload using
InvariantCulture and AssumeUniversal, matching the established parsing in
Test-DLLPickleManualAuthenticatedEvidence.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 5bca147b-55ed-42f1-9f46-a3ab663cc3f1
⛔ Files ignored due to path filters (1)
docs/generated/Compatibility-Evidence.mdis excluded by!**/generated/**
📒 Files selected for processing (38)
.github/workflows/Release-and-Publish.yml.github/workflows/Upstream-Compatibility.ymlbuild/authenticated-evidence/README.mdbuild/authenticated-evidence/manual-transition.schema.jsonbuild/dependency-policy.jsonbuild/profile-evidence/ps7.4-net8.0-linux-x64.jsonbuild/profile-evidence/ps7.4-net8.0-macos-x64.jsonbuild/profile-evidence/ps7.4-net8.0-windows-x64.jsonbuild/profile-evidence/ps7.5-net9.0-linux-x64.jsonbuild/profile-evidence/ps7.5-net9.0-macos-x64.jsonbuild/profile-evidence/ps7.5-net9.0-windows-x64.jsonbuild/profile-evidence/ps7.6-net10.0-linux-x64.jsonbuild/profile-evidence/ps7.6-net10.0-macos-x64.jsonbuild/profile-evidence/ps7.6-net10.0-windows-x64.jsondocs/Architecture.mddocs/plans/2026-08-09-credentialed-authentication-test-environment.mdtests/Unit/BundleSourceFingerprint.Tests.ps1tests/Unit/DependabotProjectPatch.Tests.ps1tests/Unit/ManualAuthenticatedEvidence.Tests.ps1tests/Unit/ManualAuthenticatedHarness.Tests.ps1tests/Unit/NormalizedProfileEvidence.Tests.ps1tests/Unit/PowerShellSupportUpdate.Tests.ps1tests/Unit/ProfileConflictBaseline.Tests.ps1tests/Unit/ProfileEvidenceHelpers.Tests.ps1tests/Unit/SupportDocumentation.Tests.ps1tests/Unit/WorkflowGuardrails.Tests.ps1tools/DLLPickle.ProfileEvidence.ps1tools/Get-DLLPickleBundleSourceFingerprint.ps1tools/Get-DLLPicklePowerShellSupportUpdate.ps1tools/Initialize-DLLPickleManualAuthenticatedCompatibility.ps1tools/Invoke-DLLPickleManualAuthenticatedCompatibility.ps1tools/Invoke-DLLPickleManualAuthenticatedScenario.ps1tools/New-DLLPickleNormalizedProfileEvidence.ps1tools/New-DLLPickleSupportDocumentation.ps1tools/Set-DLLPickleManualAuthenticatedEvidenceAcceptance.ps1tools/Test-DLLPickleManualAuthenticatedEvidence.ps1tools/Test-DLLPicklePackageReferenceUpdate.ps1tools/Test-DLLPickleProfileConflictBaseline.ps1
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7e634c51ab
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dab1367b29
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 97122ab5d3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a837b4b73f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| '^tools/New-DLLPickleNormalizedProfileEvidence\.ps1$', | ||
| '^tools/New-DLLPickleUpstreamScenarioEvidence\.ps1$', | ||
| '^tools/Test-DLLPickleProfileConflictBaseline\.ps1$', | ||
| '^tools/Install-DLLPickleTestPowerShell\.ps1$', |
There was a problem hiding this comment.
Add tools/New-DLLPicklePowerShellTestMatrix.ps1 to $LivePatterns. The profile-matrix job executes this script to decide which exact profile cells run, but a PR changing the generator is currently only relevant, so live_validation remains false and all profile evidence jobs are skipped. Such a change can therefore omit or misroute a runtime lane without validating its upstream inventory and accepted baseline.
Useful? React with 👍 / 👎.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
net8.0, 7.5.x ->net9.0, and 7.6.x ->net10.0with fail-closed PowerShell/CLR selection.Lifecycle behavior
Evidence status
scenarioPassed=true.RequiresAcceptanceafter uploading evidence.2026-08-09T17:36:05Z; material unpacked growth is the larger of 10% or 2 MiB. Compressed deltas remain report-only.docs/plans/2026-08-09-credentialed-authentication-test-environment.md.The artifact-size approval is complete. Profile conflict/scenario fingerprint acceptance is a separate maintainer decision and has not been inferred from the size approval.
Validation
actionlintandgit diff --checkpassed.Build gatepassed, including all nine exact stock PowerShell/OS cells and hosted Windows/Linux/macOS jobs.Scope boundary
This PR is ready for review. It does not authorize merge or release.
Summary by CodeRabbit
New Features
Bug Fixes
Documentation