[vartaxe]

Summary

• Install github-actions-hardening, pester-should-migration, docs-sync-audit, github-release, and batch-files.
• Remove disk serial values from task-sequence log messages while preserving internal identity and selection checks.
• Add regression coverage and regenerate CHECKSUMS.txt.

Validation

• Windows PowerShell 5.1 / Pester 6.2.0: 79 passed, 0 failed; PSScriptAnalyzer and parsing passed.
• Root and packaged scripts are byte-identical; checksum verification passed.
• Focused docs-drift test and git diff --check passed.

[Copilot]

🟡 Changes recommended

Broken batch control flow, unsafe temporary-directory cleanup, and audit and release guidance defects remain unresolved.

8 open issues

• Unconditional shift and exit break argument parsing · New
• Unconditional goto bypasses batch validation and processing · New
• Unconditional goto prevents help and function dispatch · New
• Unconditional cleanup jump skips all task execution · New
• Shared temp directory cleanup can delete unrelated files · New
• Line-number parsing retains the colon · New
• Path normalization strips meaningful relative path prefixes · New
• Release preparation omits version metadata and release notes · New

What changed in this PR

Protects disk serials in ConfigMgr task-sequence logs while preserving identity checks, and adds development and review skills.

Changes:

• Removes serial values from inventory and pre-erase messages.
• Adds regression tests for logging privacy and serial-change rejection.
• Installs five skills and refreshes checksums.

File	Description
Tests/​Invoke-OSDDiskLayout.Tests.ps1	Adds privacy and identity-check regressions.
Scripts/​Invoke-OSDDiskLayout.ps1	Removes serials from packaged-script logs.
Invoke-OSDDiskLayout.ps1	Applies matching logging changes.
CHECKSUMS.txt	Refreshes hashes and includes new files.
.github/​skills/​pester-should-migration/​SKILL.md	Adds assertion-migration guidance.
.github/​skills/​pester-should-migration/​references/​assertion-map.md	Documents assertion mappings.
.github/​skills/​github-release/​SKILL.md	Adds release preparation guidance.
.github/​skills/​github-release/​references/​semver-rules.md	Documents versioning rules.
.github/​skills/​github-release/​references/​commit-classification.md	Adds commit-classification guidance.
.github/​skills/​github-actions-hardening/​SKILL.md	Adds workflow security guidance.
.github/​skills/​github-actions-hardening/​references/​triggers-and-privilege.md	Explains workflow trust boundaries.
.github/​skills/​github-actions-hardening/​references/​supply-chain.md	Covers action and artifact security.
.github/​skills/​github-actions-hardening/​references/​report-format.md	Defines security-report formatting.
.github/​skills/​github-actions-hardening/​references/​permissions-and-tokens.md	Covers token permissions and secrets.
.github/​skills/​github-actions-hardening/​references/​injection.md	Documents injection prevention.
.github/​skills/​docs-sync-audit/​tests/​test_docs_drift.py	Adds scanner regression coverage.
.github/​skills/​docs-sync-audit/​SKILL.md	Adds documentation-audit guidance.
.github/​skills/​docs-sync-audit/​scripts/​docs_drift.py	Implements documentation drift checks.
.github/​skills/​batch-files/​SKILL.md	Adds batch scripting guidance.
.github/​skills/​batch-files/​references/​windows-subsystem-on-linux.md	Adds WSL resources.
.github/​skills/​batch-files/​references/​tools-and-resources.md	Lists Windows tooling resources.
.github/​skills/​batch-files/​references/​msys2.md	Adds MSYS2 references.
.github/​skills/​batch-files/​references/​cygwin.md	Adds Cygwin references.
.github/​skills/​batch-files/​references/​batch-files-and-functions.md	Documents batch scripting techniques.
.github/​skills/​batch-files/​assets/​task.txt	Adds an automation-task template.
.github/​skills/​batch-files/​assets/​library.txt	Adds a reusable-library template.
.github/​skills/​batch-files/​assets/​executable.txt	Adds a command-line tool template.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The documentation audit misses broken monorepo commands, while batch templates stop argument parsing prematurely and can report failed runs as successful.

8 open issues

• Resolve scripts in the applicable package · New
• Unconditional shift and exit break argument parsing
• Return nonzero codes for invalid input · New
• Padding fails for widths over input length plus 50 · New
• Preserve and return task failure codes · New
• Command scanner ignores tilde-fenced code blocks · New
• Recognize documented PowerShell environment variables · New
• Resolve repository-root links from the repository · New

7 resolved since last review

• Shared temp directory cleanup can delete unrelated files
• Unconditional cleanup jump skips all task execution
• Unconditional goto prevents help and function dispatch
• Unconditional goto bypasses batch validation and processing
• Path normalization strips meaningful relative path prefixes
• Line-number parsing retains the colon
• Release preparation omits version metadata and release notes

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Unresolved correctness issues cause the documentation audit to misvalidate commands and paths, while batch code corrupts arguments containing exclamation marks and accepts invalid widths.

2 open issues

• Reject semicolons before FOR /F width validation · New
• Preserve exclamation marks in captured arguments · New

4 previously missed issues

In code that hasn't changed since last review

Disable delayed expansion while parsing target paths

.github/​skills/​batch-files/​SKILL.md:435

Delayed expansion is enabled before arguments are parsed, so a valid target path containing !, such as C:\data\wow!\reports, loses that character when %* or %~2 is expanded. This makes the template process a different path than the caller supplied. Leave delayed expansion disabled here; this example does not use any !variable! expressions.

Scope Make targets to the applicable Makefile

.github/​skills/​docs-sync-audit/​scripts/​docs_drift.py:173

Make targets from every Makefile are pooled into one set, so a target in an unrelated subdirectory can hide a broken documented command. For example, with only help in the root Makefile and deploy in tools/Makefile, a root README's make deploy produces no finding even though that invocation fails. Keep targets keyed by Makefile directory and select the applicable Makefile using the invocation's working directory and any -C/-f options.

Skip Make options when parsing targets

.github/​skills/​docs-sync-audit/​scripts/​docs_drift.py:441

CMD_MAKE captures the first token after make, including options. Consequently, a valid documented command such as make -j2 package_only produces a high-severity missing-target finding for -j2; the actual target is never checked. Parse and skip make options and their arguments before validating the target names.

Resolve scripts using the tracked working directory

.github/​skills/​docs-sync-audit/​scripts/​docs_drift.py:455

Script-path checks ignore the directory changes already tracked in npm_cwd. For example, a root README containing cd tools followed by python check.py is reported as a missing script even when tools/check.py exists: the resolver checks only the repository root, documentation directory, and skill root. Resolve script invocations against the tracked shell working directory after an explicit directory change, rather than those fallback locations.

8 resolved since last review

• Resolve scripts in the applicable package
• Unconditional shift and exit break argument parsing
• Resolve repository-root links from the repository
• Recognize documented PowerShell environment variables
• Command scanner ignores tilde-fenced code blocks
• Preserve and return task failure codes
• Padding fails for widths over input length plus 50
• Return nonzero codes for invalid input

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The checksum manifest omits Tests/BatchLibrary.Tests.ps1 and contains stale hashes for three maintained files, causing validation to fail even if tests pass.

1 open issue

• Regenerate the manifest to include current files and hashes · New

2 resolved since last review

• Preserve exclamation marks in captured arguments
• Reject semicolons before FOR /F width validation

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed to evaluate unpublished findings affecting command-validation accuracy and failure-status handling.

No open issues 🎉

1 resolved since last review

• Regenerate the manifest to include current files and hashes

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Critical validation gaps silently accept unknown Make targets and missing scripts in selected npm workspaces, while rejected batch-function calls can still return success.

3 open issues

• Workspace script union hides missing scripts · New
• Explicit Makefile operands disable unknown-target validation · New
• Rejected calls return a successful exit status · New

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Shell parsing and directory tracking can produce false or missed drift findings, while delayed expansion can corrupt batch arguments and cause invalid widths to be accepted.

4 open issues

• Preserve literal exclamation marks in arguments · New
• Ignore separators inside quoted strings · New
• Resolve variable-based cd destinations consistently · New
• Keep prior cwd when pushd destination is unresolved · New

3 resolved since last review

• Explicit Makefile operands disable unknown-target validation
• Workspace script union hides missing scripts
• Rejected calls return a successful exit status

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Uninitialized cleanup state lets nested help/version invocations delete a parent’s temporary directory, while argument scanning produces false missing-command and missing-file findings.

3 open issues

• Clear inherited temp-directory state before early exits · New
• Initialize cleanup state before handling help · New
• Limit command and script detection to executable positions · New

4 resolved since last review

• Keep prior cwd when pushd destination is unresolved
• Resolve variable-based cd destinations consistently
• Ignore separators inside quoted strings
• Preserve literal exclamation marks in arguments

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Embedded quotes in batch-library values can cause unintended CMD execution, while make-option parsing and tag verification also contain unresolved correctness errors.

3 open issues

• Embedded quotes in values can execute as CMD syntax · New
• Make option operands are incorrectly collected as targets · New
• Regex dots can falsely match a different remote tag · New

3 resolved since last review

• Initialize cleanup state before handling help
• Clear inherited temp-directory state before early exits
• Limit command and script detection to executable positions

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The command scanner can falsely report missing scripts because workspace paths ignore the effective command directory and options on continued lines are lost.

2 open issues

• Resolve workspace paths from the command directory · New
• Scan continued commands as logical lines · New

3 resolved since last review

• Embedded quotes in values can execute as CMD syntax
• Regex dots can falsely match a different remote tag
• Make option operands are incorrectly collected as targets

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed because the published review omits moderate findings involving keyword-based environment lookups and incorrectly successful padRight calls with missing or empty widths.

No open issues 🎉

2 resolved since last review

• Scan continued commands as logical lines
• Resolve workspace paths from the command directory

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Active CMD escaping defects can corrupt caret-only arguments and cause filename metacharacters to execute unintended commands during version output.

2 open issues

• Unquoted script names with metacharacters break version output · New
• Caret-only arguments are over-escaped with delayed expansion enabled · New

_{Review effort: Balanced}