What's Changed
Security & hardening
- Refactor PowerShell login to a static
param()-bound script — eliminates string-interpolation in the AzPS login path so credential/config values can never be re-parsed as PowerShell (injection-safe by construction) by @MaddyMicrosoft in #607 - Pin third-party GitHub Actions to commit SHAs — supply-chain hardening for the CI/release workflows by @MaddyMicrosoft in #615
- Add admin-gated Release workflow — reproducible, approval-gated release + rollback pipeline by @MaddyMicrosoft in #610
Telemetry
- Emit the real action ref in telemetry via
GITHUB_ACTION_REF— corrects the previously stale hard-coded value so usage reports the version consumers actually pin by @MaddyMicrosoft in #614
Dependencies
- Cap
@actions/execand@actions/corebelow the ESM-only 3.x majors (keeps the CommonJSnccbuild working) by @MaddyMicrosoft in #628 - Harden Dependabot config for the CommonJS
nccbuild by @MaddyMicrosoft in #622 - Bump the github-actions group across 1 directory with 7 updates by @MaddyMicrosoft in #621
- Bump
uuidand@actions/coreby @dependabot in #589 - Bump
brace-expansionfrom 1.1.12 to 1.1.18 by @dependabot in #616 - Bump
picomatchfrom 2.3.1 to 2.3.2 by @dependabot in #582
Maintenance & docs
- Cleanup
package.jsonand Dependabot config by @MaddyMicrosoft in #608 - Workflows/CI hygiene by @MaddyMicrosoft in #609
- Docs uplift by @MaddyMicrosoft in #620
- Add version support policy and security update guidance by @Alex-AZPS in #604
Full Changelog: v3.0.1...v3.1.0