Pre-release v1.48.0-B0088

[BernieWhite]

PR Summary

What's changed since v1.47.0:

• New features:
  • Experimental: Added Terraform plan expansion support for AzAPI provider resources by @polatengin.
    #1193
    • Expands azapi_resource and azapi_update_resource from Terraform plan JSON files into ARM format for rule evaluation.
    • Enable with configuration option AZURE_TERRAFORM_PLAN_EXPANSION.
  • Added March 2026 baselines Azure.GA_2026_03, Azure.Preview_2026_03, and Azure.CAF_2026_03 by @BernieWhite.
    #3709
    • Includes rules released before or during March 2026.
    • Marked Azure.GA_2025_12 and Azure.Preview_2025_12 baselines as obsolete.
• New rules:
  • Automation Account:
    • Added Azure.Automation.RunbookPinned to check runbook external scripts use pinned commit hash by @BernieWhite.
      #3324
  • Azure Container Registry:
    • Check that audit diagnostic logs are enabled for Container Registry by @BernieWhite.
      #3445
  • Azure Fleet:
    • Check for public key usage on Linux fleet VM profiles by @BernieWhite.
  • Container Apps:
    • Check that liveness and readiness health probes use HTTP checks for HTTP-based ingress by @BernieWhite.
      #3111
  • Deployment Script:
    • Added Azure.DeploymentScript.Pinned to check deployment script external script to use pinned commit hash by @BernieWhite.
      #3324
  • Service Bus:
    • Added Azure.ServiceBus.ReplicaLocation to check that geo-replication replica locations are within allowed regions by @BernieWhite.
      #3381
  • Virtual Machine:
    • Check that virtual machines have Secure Boot enabled by @coder999999999.
      #3728
  • Virtual Machine Scale Sets:
    • Check that virtual machine scale sets have Secure Boot enabled by @coder999999999.
      #3730
• Updated rules:
  • Azure Kubernetes Service:
    • Updated Azure.AKS.Version to use 1.33.7 as the minimum version by @BernieWhite.
      #3708
  • Virtual Machine:
    • Updated Azure.VM.DiskCaching to check for ReadWrite caching on OS disks instead only by @BernieWhite.
      #3673
      • Renamed the rule from Azure.VM.DiskCaching to Azure.VM.OSDiskCache to reflect updated scope.
      • Updates to provide more complete documentation.
• Engineering
  • Improved documentation for expansion internals with a high-level flow diagram and code references by @BernieWhite.
    #3715
  • Bump Azure.Identity to 1.21.0.
    #3751
  • Bump Azure.Core to 1.54.0
    #3778
  • Bump Azure.Identity.Broker to 1.5.0.
    #3744
  • Bump Microsoft.Extensions.Hosting to 10.0.7.
    #3769
  • Bump Microsoft.Extensions.Logging.Console to 10.0.7.
    #3777
• Bug fixes:
  • Improved Bicep expansion errors to surface captured CLI restore failures during timeout windows by @polatengin.
    #2896

PR Checklist

• PR has a meaningful title
• Summarized changes
• Change is not breaking
• This PR is ready to merge and is not Work in Progress