pspete · Oct 8, 2026 · Oct 8, 2026 · Oct 8, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -0,0 +1,271 @@
+# Build, test and release the IdentityCommand.SIA PowerShell module.
+#
+# Repository secrets (Settings > Secrets and variables > Actions), mapped into steps via env:
+#   CODECOV_TOKEN  - Codecov upload token
+#   access_token   - GitHub fine-grained token, Contents read/write (version commit + GitHub Release)
+#   git_email      - commit author email for the version commit (mapped to env github_email; secret names cannot start with GITHUB_)
+#   psgallery_key  - PowerShell Gallery API key
+
+name: CI
+
+on:
+  push:
+    branches:
+    - '**'
+    paths:
+    - 'IdentityCommand.SIA/**'
+    - 'Tests/**'
+  # PRs also run on CHANGELOG.md and workflow edits: the CHANGELOG decides the release version.
+  pull_request:
+    branches:
+    - main
+    - master
+    - vNext
+    paths:
+    - 'IdentityCommand.SIA/**'
+    - 'Tests/**'
+    - CHANGELOG.md
+    - '.github/workflows/ci.yml'
+  # Manual runs ignore path filters.
+  workflow_dispatch:
+
+# One run at a time per ref, so release version commits cannot race.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+env:
+  MODULE_NAME: IdentityCommand.SIA
+  # pspete.Build tag or branch cloned into ./build by each job.
+  BUILD_REF: v1
+  MODULE_GUID: '634faae6-34c8-4887-a8fb-be9951c536f4'
+  GIT_USER_NAME: 'Pete Maan'
+  RELEASE_VERSION_GATE: '0.1.0'
+  # Stable release notes are written to a post per major.minor version in this folder; empty for none.
+  RELEASE_NOTES_PATH: 'docs/collections/_posts'
+  # vNext releases are prereleases: <version>-preview<n>.
+  PRERELEASE_LABEL: ${{ github.ref == 'refs/heads/vNext' && 'preview' || '' }}
+  # IdentityCommand version installed for tests and packaging; the module copies its private helpers.
+  IDENTITYCOMMAND_VERSION: '0.7.159'
+
+defaults:
+  run:
+    shell: pwsh
+
+jobs:
+  test:
+    name: Test Source (Code Coverage)
+    runs-on: windows-latest
+    steps:
+    - uses: actions/checkout@v7
+    - name: Get Build Scripts
+      run: git clone --depth 1 --branch $env:BUILD_REF https://github.com/pspete/pspete.Build build
+    - name: Install Dependencies
+      run: ./build/install.ps1
+    - name: Install IdentityCommand
+      run: |
+        . ./build/retry.ps1
+        Invoke-Retry { Install-PSResource -Name IdentityCommand -Version $env:IDENTITYCOMMAND_VERSION -Repository PSGallery -TrustRepository -ErrorAction Stop }
+    # Help is generated locally with platyPS 0.14 and committed; PlatyPS 1.x output regresses it.
+    #- name: Update External Help
+    #  run: ./build/help.ps1 -ModuleName $env:MODULE_NAME
+    - name: Test Source
+      run: ./build/test.ps1 -CodeCoverage -ModuleGuid $env:MODULE_GUID
+      env:
+        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+    - name: Upload Test Results
+      if: ${{ !cancelled() }}
+      uses: actions/upload-artifact@v7
+      with:
+        name: test-results-source
+        path: TestResults.xml
+        overwrite: true
+
+  changelog:
+    name: CHANGELOG Entry
+    if: github.event_name == 'pull_request'
+    runs-on: windows-latest
+    steps:
+    - uses: actions/checkout@v7
+    - name: Get Build Scripts
+      run: git clone --depth 1 --branch $env:BUILD_REF https://github.com/pspete/pspete.Build build
+    - name: Check Unreleased Notes
+      run: ./build/changelog.ps1
+
+  # Build and built module tests run for main/master/vNext and PRs (the pull_request trigger only includes main/master/vNext).
+  build:
+    name: Build
+    if: >-
+      github.event_name == 'pull_request' ||
+      contains(fromJSON('["refs/heads/main", "refs/heads/master", "refs/heads/vNext"]'), github.ref)
+    runs-on: windows-latest
+    outputs:
+      moduleVersion: ${{ steps.version.outputs.moduleVersion }}
+      releaseVersion: ${{ steps.version.outputs.releaseVersion }}
+    steps:
+    - uses: actions/checkout@v7
+    - name: Get Build Scripts
+      run: git clone --depth 1 --branch $env:BUILD_REF https://github.com/pspete/pspete.Build build
+    # moduleVersion is the manifest ModuleVersion (package folder name); releaseVersion adds any prerelease label.
+    - name: Set Module Version
+      id: version
+      run: |
+        $Version = ./build/version.ps1 -ModuleName $env:MODULE_NAME -PrereleaseLabel "$env:PRERELEASE_LABEL"
+        $ModuleVersion = ($Version -split '-')[0]
+        "moduleVersion=$ModuleVersion" >> $env:GITHUB_OUTPUT
+        "releaseVersion=$Version" >> $env:GITHUB_OUTPUT
+        "### $env:MODULE_NAME $Version" >> $env:GITHUB_STEP_SUMMARY
+    # Help is generated locally with platyPS 0.14 and committed; PlatyPS 1.x output regresses it.
+    #- name: Update External Help
+    #  run: ./build/help.ps1 -ModuleName $env:MODULE_NAME
+    - name: Build Module
+      run: >-
+        ./build/build.ps1
+        -ModuleName $env:MODULE_NAME
+        -BuildVersion '${{ steps.version.outputs.releaseVersion }}'
+        -OutputFolder "$env:RUNNER_TEMP/staging"
+    - name: Upload Built Module
+      uses: actions/upload-artifact@v7
+      with:
+        name: module
+        path: ${{ runner.temp }}/staging/${{ env.MODULE_NAME }}
+        overwrite: true
+
+  test-module:
+    name: Test Built Module (${{ matrix.name }})
+    needs: build
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - name: PowerShell
+          os: windows-latest
+          shell: pwsh
+        - name: WindowsPowerShell
+          os: windows-latest
+          shell: powershell
+        - name: Linux
+          os: ubuntu-latest
+          shell: pwsh
+        #- name: Mac
+        #  os: macos-latest
+        #  shell: pwsh
+    defaults:
+      run:
+        shell: ${{ matrix.shell }}
+    steps:
+    - uses: actions/checkout@v7
+    - name: Remove Module Source
+      run: Remove-Item -Path "./$env:MODULE_NAME" -Recurse -Force
+    - name: Get Build Scripts
+      run: git clone --depth 1 --branch $env:BUILD_REF https://github.com/pspete/pspete.Build build
+    - name: Download Built Module
+      uses: actions/download-artifact@v8
+      with:
+        name: module
+        path: ${{ env.MODULE_NAME }}
+    # Windows PowerShell 5.1 has no PSResourceGet; install.ps1 skips its ~60s bootstrap when the module is found.
+    # The key rolls monthly so a newer PSResourceGet is picked up.
+    - name: Cache Month
+      id: month
+      if: matrix.shell == 'powershell'
+      run: '"month=$(Get-Date -Format yyyy-MM)" >> $env:GITHUB_OUTPUT'
+    - name: Cache PSResourceGet
+      if: matrix.shell == 'powershell'
+      uses: actions/cache@v6
+      with:
+        path: ~/Documents/WindowsPowerShell/Modules/Microsoft.PowerShell.PSResourceGet
+        key: psresourceget-winps-${{ steps.month.outputs.month }}
+    - name: Install Dependencies
+      run: ./build/install.ps1
+    - name: Install IdentityCommand
+      run: |
+        . ./build/retry.ps1
+        Invoke-Retry { Install-PSResource -Name IdentityCommand -Version $env:IDENTITYCOMMAND_VERSION -Repository PSGallery -TrustRepository -ErrorAction Stop }
+    - name: Test Built Module
+      run: ./build/test.ps1 -ModuleGuid $env:MODULE_GUID
+    - name: Upload Test Results
+      if: ${{ !cancelled() }}
+      uses: actions/upload-artifact@v7
+      with:
+        name: test-results-${{ matrix.name }}
+        path: TestResults.xml
+        overwrite: true
+
+  # Release runs only for pushes and manual runs on main/master (stable) and vNext (prerelease), never for PRs.
+  release:
+    name: Release
+    needs:
+    - test
+    - build
+    - test-module
+    if: >-
+      github.event_name != 'pull_request' &&
+      contains(fromJSON('["refs/heads/main", "refs/heads/master", "refs/heads/vNext"]'), github.ref)
+    runs-on: windows-latest
+    env:
+      MODULE_VERSION: ${{ needs.build.outputs.moduleVersion }}
+      RELEASE_VERSION: ${{ needs.build.outputs.releaseVersion }}
+    steps:
+    # deploy-github.ps1 pushes with access_token; the checkout token must not override it.
+    - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
+    - name: Get Build Scripts
+      run: git clone --depth 1 --branch $env:BUILD_REF https://github.com/pspete/pspete.Build build
+    - name: Download Built Module
+      uses: actions/download-artifact@v8
+      with:
+        name: module
+        path: ${{ runner.temp }}/Package/${{ env.MODULE_NAME }}/${{ env.MODULE_VERSION }}
+    - name: Install IdentityCommand
+      run: |
+        . ./build/retry.ps1
+        Invoke-Retry { Install-PSResource -Name IdentityCommand -Version $env:IDENTITYCOMMAND_VERSION -Repository PSGallery -TrustRepository -ErrorAction Stop }
+
+    # Code signing of the packaged module goes here, before it is archived and published.
+
+    - name: Archive Module
+      run: >-
+        Compress-Archive
+        -Path "$env:RUNNER_TEMP/Package/$env:MODULE_NAME"
+        -DestinationPath "$env:RUNNER_TEMP/$env:MODULE_NAME-v$env:RELEASE_VERSION.zip"
+        -Force
+    - name: Upload Module Package
+      uses: actions/upload-artifact@v7
+      with:
+        name: package
+        path: ${{ runner.temp }}/${{ env.MODULE_NAME }}-v${{ env.RELEASE_VERSION }}.zip
+        overwrite: true
+    - name: Deploy to GitHub
+      run: >-
+        ./build/deploy-github.ps1
+        -ModuleName $env:MODULE_NAME
+        -Version $env:RELEASE_VERSION
+        -Branch '${{ github.ref_name }}'
+        -Repository '${{ github.repository }}'
+        -ModulePath "$env:RUNNER_TEMP/Package/$env:MODULE_NAME/$env:MODULE_VERSION"
+        -ArchivePath "$env:RUNNER_TEMP/$env:MODULE_NAME-v$env:RELEASE_VERSION.zip"
+        -ReleaseVersionGate $env:RELEASE_VERSION_GATE
+        -GitUserName $env:GIT_USER_NAME
+        -ReleaseNotesPath $env:RELEASE_NOTES_PATH
+      env:
+        access_token: ${{ secrets.access_token }}
+        github_email: ${{ secrets.git_email }}
+    # The commit message is passed via env so quotes in it cannot break the command line.
+    - name: Deploy to PowerShell Gallery
+      run: >-
+        ./build/deploy-psgallery.ps1
+        -ModuleName $env:MODULE_NAME
+        -Version $env:RELEASE_VERSION
+        -Branch '${{ github.ref_name }}'
+        -ModulePath "$env:RUNNER_TEMP/Package/$env:MODULE_NAME/$env:MODULE_VERSION"
+        -ReleaseVersionGate $env:RELEASE_VERSION_GATE
+        -CommitMessage $env:COMMIT_MESSAGE
+      env:
+        psgallery_key: ${{ secrets.psgallery_key }}
+        COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
diff --git a/.gitignore b/.gitignore
@@ -2,4 +2,5 @@
 CLAUDE.md
 coverage.xml
 TestResults.xml
-codecov.exe
+codecov.exe
+build/
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,9 +4,17 @@ All notable changes to this project will be documented in this file.
 
 ## Unreleased
 
-- N/A
+### Changed
+
+- Moved to the pspete.Build GitHub Actions pipeline; AppVeyor is retired.
+- Requires IdentityCommand 0.7.159 or later.
+- Argument completer registrations run from the module psm1, after IdentityCommand's helpers are copied in.
+
+### Fixed
+
+- `New-SIAPolicyProviderDefinition` help: `-vnetIds` now has a description, and `-vpcIds` describes AWS/GCP VPC IDs instead of Azure VNet IDs.
 
-## 0.6.67 - 07-10-2026
+## [0.6.67] - 2026-10-07
 
 ### Added
 
@@ -18,7 +26,7 @@ All notable changes to this project will be documented in this file.
 
 - The module loader copies `IdentityCommand`'s private helper functions from the loaded module's session state instead of dot-sourcing its `Private` folder, so it works with both the current `IdentityCommand` layout and the combined single-file layout of future releases. Each copied helper runs in this module's scope and uses its session.
 
-## 0.5.60 - 07-09-2026
+## [0.5.60] - 2026-09-07
 
 ### Changed
 
@@ -32,7 +40,7 @@ All notable changes to this project will be documented in this file.
 - The module loader resolves a single `IdentityCommand` module - the highest version - when more than one version is loaded. Previously every loaded version's `Private` folder was dot-sourced, last one winning.
 - Importing `IdentityCommand.SIA` without `IdentityCommand` loaded now throws a clear error instead of failing obscurely.
 
-## 0.4.50 - 5-9-2026
+## [0.4.50] - 2026-09-05
 
 ### Added
 
@@ -49,7 +57,7 @@ All notable changes to this project will be documented in this file.
 - `Get-SIADatabaseStrongAccount`, `Get-SIADatabaseTarget` **(breaking)**: `-cursor` removed - the commands now page results internally.
 - `Set-SIAPolicy`: `-policyId` parameter renamed `-policyid` for consistency with `Get-SIAPolicy` / `Remove-SIAPolicy`.
 
-## 0.3.32 - 01-09-2026
+## [0.3.32] - 2026-09-01
 
 ### Security
 
@@ -101,7 +109,7 @@ All notable changes to this project will be documented in this file.
 - `Get-SIAResource`
   - Updated to return correct property of output value.
 
-## 0.2.11 - 05-03-2024
+## [0.2.11] - 2024-03-05
 
 ### Added
 
@@ -117,7 +125,7 @@ All notable changes to this project will be documented in this file.
 
 - N/A
 
-## 0.1.10 - 03-03-2024
+## [0.1.10] - 2024-03-03
 
 ### Added
 
@@ -131,7 +139,7 @@ All notable changes to this project will be documented in this file.
 
 - N/A
 
-## 0.1.9 - 03-03-2024
+## [0.1.9] - 2024-03-03
 
 Initial release of `IdentityCommand.DPA` module
 

diff --git a/IdentityCommand.SIA/IdentityCommand.SIA.psd1 b/IdentityCommand.SIA/IdentityCommand.SIA.psd1
@@ -52,7 +52,7 @@
 
     # Modules that must be imported into the global environment prior to importing this module
     RequiredModules   = @(
-        @{ModuleName = 'IdentityCommand'; GUID = 'f6bb2bdf-0c53-443f-be07-3c25264a09b1'; ModuleVersion = '0.6.158' }
+        @{ModuleName = 'IdentityCommand'; GUID = 'f6bb2bdf-0c53-443f-be07-3c25264a09b1'; ModuleVersion = '0.7.159' }
     )
 
     # Assemblies that must be loaded prior to importing this module