[vartaxe]

Summary

• Install github-actions-hardening, pester-should-migration, docs-sync-audit, github-release, and batch-files.
• Remove disk serial values from task-sequence log messages while preserving internal identity and selection checks.
• Add regression coverage and regenerate CHECKSUMS.txt.

Validation

• Windows PowerShell 5.1 / Pester 6.2.0: 79 passed, 0 failed; PSScriptAnalyzer and parsing passed.
• Root and packaged scripts are byte-identical; checksum verification passed.
• Focused docs-drift test and git diff --check passed.

[Copilot]

🟡 Changes recommended

Broken batch control flow, unsafe temporary-directory cleanup, and audit and release guidance defects remain unresolved.

8 open issues

• Unconditional shift and exit break argument parsing · New
• Unconditional goto bypasses batch validation and processing · New
• Unconditional goto prevents help and function dispatch · New
• Unconditional cleanup jump skips all task execution · New
• Shared temp directory cleanup can delete unrelated files · New
• Line-number parsing retains the colon · New
• Path normalization strips meaningful relative path prefixes · New
• Release preparation omits version metadata and release notes · New

What changed in this PR

Protects disk serials in ConfigMgr task-sequence logs while preserving identity checks, and adds development and review skills.

Changes:

• Removes serial values from inventory and pre-erase messages.
• Adds regression tests for logging privacy and serial-change rejection.
• Installs five skills and refreshes checksums.

File	Description
Tests/​Invoke-OSDDiskLayout.Tests.ps1	Adds privacy and identity-check regressions.
Scripts/​Invoke-OSDDiskLayout.ps1	Removes serials from packaged-script logs.
Invoke-OSDDiskLayout.ps1	Applies matching logging changes.
CHECKSUMS.txt	Refreshes hashes and includes new files.
.github/​skills/​pester-should-migration/​SKILL.md	Adds assertion-migration guidance.
.github/​skills/​pester-should-migration/​references/​assertion-map.md	Documents assertion mappings.
.github/​skills/​github-release/​SKILL.md	Adds release preparation guidance.
.github/​skills/​github-release/​references/​semver-rules.md	Documents versioning rules.
.github/​skills/​github-release/​references/​commit-classification.md	Adds commit-classification guidance.
.github/​skills/​github-actions-hardening/​SKILL.md	Adds workflow security guidance.
.github/​skills/​github-actions-hardening/​references/​triggers-and-privilege.md	Explains workflow trust boundaries.
.github/​skills/​github-actions-hardening/​references/​supply-chain.md	Covers action and artifact security.
.github/​skills/​github-actions-hardening/​references/​report-format.md	Defines security-report formatting.
.github/​skills/​github-actions-hardening/​references/​permissions-and-tokens.md	Covers token permissions and secrets.
.github/​skills/​github-actions-hardening/​references/​injection.md	Documents injection prevention.
.github/​skills/​docs-sync-audit/​tests/​test_docs_drift.py	Adds scanner regression coverage.
.github/​skills/​docs-sync-audit/​SKILL.md	Adds documentation-audit guidance.
.github/​skills/​docs-sync-audit/​scripts/​docs_drift.py	Implements documentation drift checks.
.github/​skills/​batch-files/​SKILL.md	Adds batch scripting guidance.
.github/​skills/​batch-files/​references/​windows-subsystem-on-linux.md	Adds WSL resources.
.github/​skills/​batch-files/​references/​tools-and-resources.md	Lists Windows tooling resources.
.github/​skills/​batch-files/​references/​msys2.md	Adds MSYS2 references.
.github/​skills/​batch-files/​references/​cygwin.md	Adds Cygwin references.
.github/​skills/​batch-files/​references/​batch-files-and-functions.md	Documents batch scripting techniques.
.github/​skills/​batch-files/​assets/​task.txt	Adds an automation-task template.
.github/​skills/​batch-files/​assets/​library.txt	Adds a reusable-library template.
.github/​skills/​batch-files/​assets/​executable.txt	Adds a command-line tool template.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The documentation audit misses broken monorepo commands, while batch templates stop argument parsing prematurely and can report failed runs as successful.

8 open issues

• Resolve scripts in the applicable package · New
• Unconditional shift and exit break argument parsing
• Return nonzero codes for invalid input · New
• Padding fails for widths over input length plus 50 · New
• Preserve and return task failure codes · New
• Command scanner ignores tilde-fenced code blocks · New
• Recognize documented PowerShell environment variables · New
• Resolve repository-root links from the repository · New

7 resolved since last review

• Shared temp directory cleanup can delete unrelated files
• Unconditional cleanup jump skips all task execution
• Unconditional goto prevents help and function dispatch
• Unconditional goto bypasses batch validation and processing
• Path normalization strips meaningful relative path prefixes
• Line-number parsing retains the colon
• Release preparation omits version metadata and release notes

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Unresolved correctness issues cause the documentation audit to misvalidate commands and paths, while batch code corrupts arguments containing exclamation marks and accepts invalid widths.

2 open issues

• Reject semicolons before FOR /F width validation · New
• Preserve exclamation marks in captured arguments · New

4 previously missed issues

In code that hasn't changed since last review

Disable delayed expansion while parsing target paths

.github/​skills/​batch-files/​SKILL.md:435

Delayed expansion is enabled before arguments are parsed, so a valid target path containing !, such as C:\data\wow!\reports, loses that character when %* or %~2 is expanded. This makes the template process a different path than the caller supplied. Leave delayed expansion disabled here; this example does not use any !variable! expressions.

Scope Make targets to the applicable Makefile

.github/​skills/​docs-sync-audit/​scripts/​docs_drift.py:173

Make targets from every Makefile are pooled into one set, so a target in an unrelated subdirectory can hide a broken documented command. For example, with only help in the root Makefile and deploy in tools/Makefile, a root README's make deploy produces no finding even though that invocation fails. Keep targets keyed by Makefile directory and select the applicable Makefile using the invocation's working directory and any -C/-f options.

Skip Make options when parsing targets

.github/​skills/​docs-sync-audit/​scripts/​docs_drift.py:441

CMD_MAKE captures the first token after make, including options. Consequently, a valid documented command such as make -j2 package_only produces a high-severity missing-target finding for -j2; the actual target is never checked. Parse and skip make options and their arguments before validating the target names.

Resolve scripts using the tracked working directory

.github/​skills/​docs-sync-audit/​scripts/​docs_drift.py:455

Script-path checks ignore the directory changes already tracked in npm_cwd. For example, a root README containing cd tools followed by python check.py is reported as a missing script even when tools/check.py exists: the resolver checks only the repository root, documentation directory, and skill root. Resolve script invocations against the tracked shell working directory after an explicit directory change, rather than those fallback locations.

8 resolved since last review

• Resolve scripts in the applicable package
• Unconditional shift and exit break argument parsing
• Resolve repository-root links from the repository
• Recognize documented PowerShell environment variables
• Command scanner ignores tilde-fenced code blocks
• Preserve and return task failure codes
• Padding fails for widths over input length plus 50
• Return nonzero codes for invalid input

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The checksum manifest omits Tests/BatchLibrary.Tests.ps1 and contains stale hashes for three maintained files, causing validation to fail even if tests pass.

1 open issue

• Regenerate the manifest to include current files and hashes · New

2 resolved since last review

• Preserve exclamation marks in captured arguments
• Reject semicolons before FOR /F width validation

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed to evaluate unpublished findings affecting command-validation accuracy and failure-status handling.

No open issues 🎉

1 resolved since last review

• Regenerate the manifest to include current files and hashes

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Critical validation gaps silently accept unknown Make targets and missing scripts in selected npm workspaces, while rejected batch-function calls can still return success.

3 open issues

• Workspace script union hides missing scripts · New
• Explicit Makefile operands disable unknown-target validation · New
• Rejected calls return a successful exit status · New

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Active CMD escaping defects can corrupt caret-only arguments and cause filename metacharacters to execute unintended commands during version output.

2 open issues

• Unquoted script names with metacharacters break version output · New
• Caret-only arguments are over-escaped with delayed expansion enabled · New

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The changes miscount Makefile targets and corrupt caret-only values in batch helpers when the caller has delayed expansion enabled.

4 open issues

• Preserve carets in toLower values without exclamation marks · New
• Count distinct Make targets, not Makefile directories · New
• Caret-only arguments are over-escaped with delayed expansion enabled
• Unquoted script names with metacharacters break version output

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed because unpublished findings identify false-positive drift checks for valid workspace, Make, and Java configurations, plus a migration example that can fail valid tests.

No open issues 🎉

4 resolved since last review

• Count distinct Make targets, not Makefile directories
• Preserve carets in toLower values without exclamation marks
• Caret-only arguments are over-escaped with delayed expansion enabled
• Unquoted script names with metacharacters break version output

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The Makefile parser incorrectly marks variable-expanded target inventories complete, causing false missing-target reports, and the assertion example uses literal comparison where wildcard matching is intended.

2 open issues

• Mark variable-expanded Make targets as incomplete · New
• Use the correct matcher for wildcard exception messages · New

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed to weigh unpublished findings about argument expansion altering target paths and incomplete Makefile inventories producing false high-severity findings.

No open issues 🎉

2 resolved since last review

• Mark variable-expanded Make targets as incomplete
• Use the correct matcher for wildcard exception messages

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Unresolved issues cause heredoc content to be scanned as commands, hide broken links in nested lists, and run release validation before checksums are regenerated, producing a checksum mismatch that blocks the workflow.

3 open issues

• Preserve nested-list links during indented-code detection · New
• Exclude heredoc bodies from shell command scanning · New
• Run version validation only after regenerating checksums · New

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed because JavaScript comments and strings can trigger false findings or mask unused settings, while split PowerShell continuations can cause commands to be checked against the wrong package.

No open issues 🎉

3 resolved since last review

• Run version validation only after regenerating checksums
• Exclude heredoc bodies from shell command scanning
• Preserve nested-list links during indented-code detection

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The recorded hashes for test_docs_drift.py and docs_drift.py do not match the checked-in files, causing mandatory checksum verification to fail even if all tests pass.

1 open issue

• Regenerate stale checksums for docs drift files · New

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed because unpublished findings identify test-generated bytecode that can break checksum validation and audit logic that can produce false findings.

No open issues 🎉

1 resolved since last review

• Regenerate stale checksums for docs drift files

_{Review effort: Balanced}