feat: support PowerShell 7.4 through 7.6

.github/ci-scripts/Actions_Bootstrap.ps1

@@ -9,83 +9,93 @@
 .EXAMPLE
     ./.github/scripts/Actions_Bootstrap.ps1
 
+.PARAMETER ModuleInstallPath
+    Optional isolated module root. Exact tool versions are saved here and the path is
+    prepended only to this process's PSModulePath. No user-scope module path is mutated.
+
 .NOTES
     Run this script at the beginning of CI/CD workflows to ensure all dependencies are available.
 #>
 
 [CmdletBinding()]
 [System.Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingWriteHost', '')]
 
-param()
+param(
+    [Parameter()]
+    [string]$ModuleInstallPath
+)
 
 $ErrorActionPreference = 'Stop'
 $ProgressPreference = 'SilentlyContinue'
 
 Write-Host '🔨 Bootstrapping CI/CD Environment...'
 
+$RepositoryRoot = Split-Path -Path (Split-Path -Path $PSScriptRoot -Parent) -Parent
+$ToolingScriptPath = Join-Path -Path $RepositoryRoot -ChildPath 'build/DLLPickle.Tooling.ps1'
+$ToolPolicyPath = Join-Path -Path $RepositoryRoot -ChildPath 'build/build-tool-versions.json'
+. $ToolingScriptPath
+$ToolPolicy = Get-DLLPickleBuildToolPolicy -Path $ToolPolicyPath
+
+if (-not [string]::IsNullOrWhiteSpace($ModuleInstallPath)) {
+    $ModuleInstallPath = [System.IO.Path]::GetFullPath($ModuleInstallPath)
+    if (-not (Test-Path -LiteralPath $ModuleInstallPath -PathType Container)) {
+        $null = New-Item -Path $ModuleInstallPath -ItemType Directory -Force
+    }
+    $ExistingModulePathEntries = @($env:PSModulePath -split [System.IO.Path]::PathSeparator | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
+    $env:PSModulePath = @($ModuleInstallPath) + $ExistingModulePathEntries -join [System.IO.Path]::PathSeparator
+}
+
 # https://docs.microsoft.com/powershell/module/packagemanagement/get-packageprovider
 Get-PackageProvider -Name Nuget -ForceBootstrap | Out-Null
 
 # https://docs.microsoft.com/powershell/module/powershellget/set-psrepository
 Set-PSRepository -Name PSGallery -InstallationPolicy Trusted
 
-# List of PowerShell Modules required for the build.
-$ModulesToInstall = New-Object System.Collections.Generic.List[object]
-
-# https://github.com/pester/Pester
-$ModulesToInstall.Add(([PSCustomObject]@{
-            ModuleName         = 'Pester'
-            SkipPublisherCheck = $true # Skip publisher check for older Pester versions due to certificate mismatch.
-            #ModuleVersion = '5.7.1'
-        })) | Out-Null
-
-# https://github.com/nightroman/Invoke-Build
-$ModulesToInstall.Add(([PSCustomObject]@{
-            ModuleName = 'InvokeBuild'
-            #ModuleVersion = '5.12.1'
-        })) | Out-Null
-
-# https://github.com/PowerShell/PSScriptAnalyzer
-$ModulesToInstall.Add(([PSCustomObject]@{
-            ModuleName = 'PSScriptAnalyzer'
-            #ModuleVersion = '1.23.0'
-        })) | Out-Null
-
-# https://github.com/PowerShell/Microsoft.PowerShell.PlatyPS
-$ModulesToInstall.Add(([PSCustomObject]@{
-            ModuleName = 'Microsoft.PowerShell.PlatyPS'
-        })) | Out-Null
-# https://github.com/PowerShell/platyPS
-# Older version used due to: https://github.com/PowerShell/platyPS/issues/457
-#$ModulesToInstall.Add(([PSCustomObject]@{
-#    ModuleName    = 'platyPS'
-#    #ModuleVersion = '0.12.0'
-#})) | Out-Null
-
-Write-Host '📦 Installing PowerShell Modules'
-foreach ($Module in $ModulesToInstall) {
-    $InstallSplat = @{
-        Name        = $Module.ModuleName
-        Repository  = 'PSGallery'
-        Force       = $true
-        ErrorAction = 'Stop'
-    }
-    if ($Module.ModuleVersion) {
-        $InstallSplat['RequiredVersion'] = $Module.ModuleVersion
-    }
-    if ($Module.SkipPublisherCheck) {
-        $InstallSplat['SkipPublisherCheck'] = $true
+Write-Host '📦 Installing exact PowerShell build-tool versions'
+$ModuleInstallCommandName = if ([string]::IsNullOrWhiteSpace($ModuleInstallPath)) {
+    'Install-Module'
+} else {
+    'Save-Module'
+}
+$ModuleInstallCommand = Get-Command -Name $ModuleInstallCommandName -ErrorAction Stop
+
+foreach ($Module in @($ToolPolicy.modules)) {
+    $RequiredVersion = [version]$Module.version
+    $InstalledModule = Get-Module -ListAvailable -Name $Module.name |
+        Where-Object { Test-DLLPickleToolVersionMatch -ActualVersion $_.Version -RequiredVersion $RequiredVersion } |
+        Select-Object -First 1
+
+    if (-not $InstalledModule) {
+        $ModuleCommandSplat = @{
+            Name            = $Module.name
+            RequiredVersion = $Module.version
+            Repository      = 'PSGallery'
+            Force           = $true
+            ErrorAction     = 'Stop'
+        }
+        if (
+            $Module.skipPublisherCheck -and
+            (Test-DLLPickleCommandParameter -Command $ModuleInstallCommand -ParameterName 'SkipPublisherCheck')
+        ) {
+            $ModuleCommandSplat['SkipPublisherCheck'] = $true
+        }
+
+        try {
+            if ([string]::IsNullOrWhiteSpace($ModuleInstallPath)) {
+                $ModuleCommandSplat['Scope'] = 'CurrentUser'
+                & $ModuleInstallCommand @ModuleCommandSplat
+            } else {
+                $ModuleCommandSplat['Path'] = $ModuleInstallPath
+                & $ModuleInstallCommand @ModuleCommandSplat
+            }
+        } catch {
+            Write-Host "  - Failed to install $($Module.name) $RequiredVersion"
+            throw
+        }
     }
 
-    try {
-        Install-Module @InstallSplat
-        Import-Module -Name $Module.ModuleName -ErrorAction Stop
-        Write-Host "  - Successfully installed $($Module.ModuleName)"
-    } catch {
-        $message = 'Failed to install {0}' -f $Module.ModuleName
-        Write-Host "  - $message"
-        throw
-    }
+    $ImportedModule = Import-DLLPickleBuildTool -Name $Module.name -RequiredVersion $RequiredVersion
+    Write-Host "  - $($ImportedModule.Name) $($ImportedModule.Version) ready"
 }
 
 # Ensure .NET tools are available

.github/dependabot.yml

@@ -25,7 +25,7 @@ updates:
       interval: "weekly"
       day: "sunday"
     groups:
-      all-actions:
+      ci-tooling-actions:
         patterns: ["*"]
     commit-message:
       prefix: "ci"
@@ -36,15 +36,25 @@ updates:
     schedule:
       interval: "daily"
     groups:
-      nuget-minor-patch:
-        patterns: ["*"]
+      runtime-bundle-minor-patch:
+        patterns:
+          - "Microsoft.Identity.Client*"
+          - "Microsoft.IdentityModel.*"
+          - "System.IdentityModel.Tokens.Jwt"
+          - "System.Security.Cryptography.ProtectedData"
+          - "Microsoft.Extensions.DependencyInjection.Abstractions"
+          - "Microsoft.Extensions.Logging.Abstractions"
         update-types:
           - "minor"
           - "patch"
     commit-message:
       prefix: "deps"
       prefix-development: "deps"
-    # Note: Major version PRs are created but require manual approval. The Dependabot-Auto-Approve workflow handles selective auto-approval:
+    # Runtime dependencies are intentionally separate from GitHub Actions and the
+    # exact PowerShell build-tool pins in build/build-tool-versions.json. The
+    # optional pre-1.0 multi-pwsh pin is CI provisioning policy and always requires
+    # reviewed test-matrix evidence; it is not a NuGet dependency.
+    # Major version PRs are created but require manual approval. The Dependabot-Auto-Approve workflow handles selective auto-approval:
     # - Auto-approves: patch and minor updates
     # - Requires manual review: major version updates