What's Changed
Security & hardening
- Refactor PowerShell login to a static
param()-bound script — eliminates string-interpolation in the AzPS login path so credential/config values can never be re-parsed as PowerShell (injection-safe by construction) by MaddyMicrosoft in #607 - Pin third-party GitHub Actions to commit SHAs — supply-chain hardening for the CI/release workflows by MaddyMicrosoft in #615
- Add admin-gated Release workflow — reproducible, approval-gated release + rollback pipeline by MaddyMicrosoft in #610
Telemetry
- Emit the real action ref in telemetry via
GITHUB_ACTION_REF— corrects the previously stale hard-coded value so usage reports the version consumers actually pin by MaddyMicrosoft in #614
Dependencies
- Cap
@actions/execand@actions/corebelow the ESM-only 3.x majors (keeps the CommonJSnccbuild working) by MaddyMicrosoft in #628 - Harden Dependabot config for the CommonJS
nccbuild by MaddyMicrosoft in #622 - Bump the github-actions group across 1 directory with 7 updates by MaddyMicrosoft in #621
- Bump
uuidand@actions/coreby Dependabot (@dependabot) in #589 - Bump
brace-expansionfrom 1.1.12 to 1.1.18 by Dependabot (@dependabot) in #616 - Bump
picomatchfrom 2.3.1 to 2.3.2 by Dependabot (@dependabot) in #582
Maintenance & docs
- Cleanup
package.jsonand Dependabot config by MaddyMicrosoft in #608 - Workflows/CI hygiene by MaddyMicrosoft in #609
- Docs uplift by MaddyMicrosoft in #620
- Add version support policy and security update guidance by Alex Wang (@Alex-AZPS) in #604
Full Changelog: v3.0.1...v3.1.0