[Jan Egil Ring (janegilring)]

This pull request improves the security and handling of deployment parameters, especially the administrator password, in the Adaptive Apps lab automation scripts. Instead of embedding sensitive credentials in PowerShell arguments, a temporary ARM parameter file is now used, which is securely created, used, and deleted. The test suite is updated to verify this new approach, ensuring no sensitive data is leaked or serialized, even across job boundaries.

Deployment security and parameter handling:

• The deployment now generates a temporary ARM parameter file containing the admin password in plaintext, stored with strict file permissions (0600) in a job-private directory. This avoids passing SecureString objects in PowerShell arguments and prevents secure-string serialization issues at job boundaries. The parameter file is deleted immediately after use, and credentials are never printed or published. The ARM template continues to declare adminPassword as @secure(), so the value is not recorded in deployment history. [1] [2]

• The deployment script (deploy-lab.ps1) is updated to prepare and use this secure parameter file for infrastructure deployment, with explicit validation and cleanup steps. [1] [2]

Test suite enhancements:

• The test mocks and assertions in console.Tests.ps1 are updated to expect and validate the use of a parameter file instead of direct parameter objects, including file existence, permissions, and contents. It also verifies that the parameter file is removed after deployment, even on failure. [1] [2] [3] [4] [5]

• New tests ensure that deployment arguments can be passed through child jobs without serializing a SecureString and that exceptions during deployment are preserved while sensitive files are cleaned up.…for admin passwords