v0.8.0: Step.7 form-defaults + Pii-Guard + Publish-Module + Step.2 UX fixes + historical-version cleanup

Patch release rolling up three follow-ups to v0.7.99 plus Step.2 UX fixes
and operator-visible historical-version mention cleanup. No public API
changes. Set-AzLocalClusterUpdateRingTag -PassThru gains two new enum
values (Action='NoChange' and Status='AlreadyInSync') to distinguish
steady-state clusters from genuinely-skipped ones; existing scripts that
switch on Created/Updated/Skipped/Failed continue to work, with
already-in-sync clusters now surfacing under the new bucket rather than
spurious Skipped.

Step.2 manage-updatering-tags - UX fixes:
  - Set-AzLocalClusterUpdateRingTag skip branch no longer logs misleading
    "use -Force to overwrite" Warning on clusters that are already in the
    desired state. Splits skip path: (a) all managed tags match desired
    state -> Info log + new Action='NoChange' / Status='AlreadyInSync';
    (b) UpdateRing differs from target -> existing Warning + -Force hint
    is preserved.
  - -Force short-circuits when all managed tags already match desired
    state - saves a redundant ARM PATCH per cluster on already-clean
    fleets. Behaviour when there IS something to change is unchanged.
  - Cmdlet summary section gains 'Already in sync (no change needed):'
    tally line; 'Skipped (existing tag, no -Force):' line correctly
    renamed 'Skipped (UpdateRing differs, no -Force):'.
  - Step.2 GitHub Actions + Azure DevOps job summaries now include the
    per-cluster result breakdown (counts table + collapsible per-cluster
    details), at parity with Step.3 / Step.5 / Step.6 / Step.8. Apply
    step captures -PassThru into a UpdateRingTag_Results.json artifact
    sidecar that the Summary step reads.

Step.7 monitor-updates form-default regressions (GH + ADO):
  - critical_elapsed_days input default '7' -> '3' (was undoing v0.7.99 fix)
  - updateRing input default 'Wave1' -> '' (align with Step.8 + Step.9)

Repo-hygiene guard:
  - Tests/Pii-Guard.Tests.ps1 (new) - block emails, .onmicrosoft.com,
    identity-context GUIDs, and unallowlisted public IPv4 in Tests/

Publish-Module.ps1:
  - exclude docs/RELEASE-PROCESS.md from the published package

Historical-version cleanup (operator-visible surfaces only):
  - Step.4 fleet-connectivity summary table: drop the
    'pre-v0.7.84 used the wrong property name' parenthetical
  - Step.7 workflow_dispatch / pipeline-parameter form descriptions:
    drop the v0.7.96+ / demoted from 6 in v0.7.96 / v0.7.99+ annotations
  - generated apply-updates-schedule.yml starter file: drop the
    'historic v0.7.88 default' parenthetical

Pin and version drift:
  - GENERATED_AGAINST_MODULE_VERSION '0.7.99' -> '0.8.0' on all 20 templates
  - psd1 ModuleVersion / psm1 $script:ModuleVersion / Tests assertion = '0.8.0'

Pester: 834 passed / 0 failed / 1 skipped (added 4 new source-level
assertions pinning the Step.2 AlreadyInSync logging contract, summary
bucket, and -Force no-op short-circuit, on top of the new Pii-Guard
tests added in this release).

Author: NeilBird

AzLocal.UpdateManagement/Automation-Pipeline-Examples/azure-devops/Step.0_authentication-test.yml

@@ -59,7 +59,7 @@ variables:
   # log if the YAML appears stale - prompting you to refresh via
   # Copy-AzLocalPipelineExample -Update. See Automation-Pipeline-Examples/README.md section 5.
   - name: GENERATED_AGAINST_MODULE_VERSION
-    value: '0.7.99'
+    value: '0.8.0'
   # Resolution order for the module version pin (leave all unset to install the latest,
   # which is the default "fix-forward" behaviour): queue-time parameter > pipeline variable
   # 'REQUIRED_MODULE_VERSION' overridden at queue time > empty (latest).

AzLocal.UpdateManagement/Automation-Pipeline-Examples/azure-devops/Step.1_inventory-clusters.yml

@@ -42,7 +42,7 @@ variables:
   # log if the YAML appears stale - prompting you to refresh via
   # Copy-AzLocalPipelineExample -Update. See Automation-Pipeline-Examples/README.md section 5.
   - name: GENERATED_AGAINST_MODULE_VERSION
-    value: '0.7.99'
+    value: '0.8.0'
   # Resolution order for the module version pin (leave all unset to install the latest,
   # which is the default "fix-forward" behaviour): queue-time parameter > pipeline variable
   # 'REQUIRED_MODULE_VERSION' overridden at queue time > empty (latest).

AzLocal.UpdateManagement/Automation-Pipeline-Examples/azure-devops/Step.2_manage-updatering-tags.yml

@@ -45,7 +45,7 @@ variables:
   # log if the YAML appears stale - prompting you to refresh via
   # Copy-AzLocalPipelineExample -Update. See Automation-Pipeline-Examples/README.md section 5.
   - name: GENERATED_AGAINST_MODULE_VERSION
-    value: '0.7.99'
+    value: '0.8.0'
   # Resolution order for the module version pin (leave all unset to install the latest,
   # which is the default "fix-forward" behaviour): queue-time parameter > pipeline variable
   # 'REQUIRED_MODULE_VERSION' overridden at queue time > empty (latest).
@@ -243,10 +243,24 @@ stages:
                 Write-Host "========================================" -ForegroundColor Cyan
                 Write-Host "Applying UpdateRing Tags" -ForegroundColor Cyan
                 Write-Host "========================================" -ForegroundColor Cyan
-                
-                # Run tag management
-                Set-AzLocalClusterUpdateRingTag @params
-                
+
+                # Run tag management. -PassThru returns the per-cluster results so
+                # the Summary task can build a breakdown table rather than parroting
+                # only the pipeline inputs back at the operator.
+                $results = Set-AzLocalClusterUpdateRingTag @params -PassThru
+
+                # Persist results to a JSON sidecar so the Summary task (separate
+                # PowerShell process) can read them. Lives in the artifact staging
+                # dir that gets published.
+                $resultsJsonPath = Join-Path $outputDir 'UpdateRingTag_Results.json'
+                if ($null -ne $results) {
+                    @($results) | ConvertTo-Json -Depth 5 | Out-File -FilePath $resultsJsonPath -Encoding utf8
+                    Write-Host "Wrote $($results.Count) per-cluster result row(s) to: $resultsJsonPath"
+                } else {
+                    '[]' | Out-File -FilePath $resultsJsonPath -Encoding utf8
+                    Write-Host "No per-cluster results returned (empty CSV?). Wrote empty array to: $resultsJsonPath"
+                }
+
                 Write-Host ""
                 Write-Host "Tag management complete"
           
@@ -273,21 +287,74 @@ stages:
               script: |
                 $dryRun = [System.Convert]::ToBoolean("${{ parameters.dryRun }}")
                 $forceOverwrite = [System.Convert]::ToBoolean("${{ parameters.forceOverwrite }}")
-                
-                $summary = @"
-                # UpdateRing Tag Management Summary
-                
-                | Setting | Value |
-                |---------|-------|
-                | Dry Run | $dryRun |
-                | Force Overwrite | $forceOverwrite |
-                "@
-                
+
+                $lines = New-Object System.Collections.Generic.List[string]
+                [void]$lines.Add('# UpdateRing Tag Management Summary')
+                [void]$lines.Add('')
+                [void]$lines.Add('| Setting | Value |')
+                [void]$lines.Add('|---------|-------|')
+                [void]$lines.Add("| Dry Run | $dryRun |")
+                [void]$lines.Add("| Force Overwrite | $forceOverwrite |")
+
+                # Per-cluster results breakdown - read the JSON sidecar the apply task wrote.
+                # See AzLocal.UpdateManagement Set-AzLocalClusterUpdateRingTag -PassThru schema.
+                $resultsJsonPath = Join-Path '$(Build.ArtifactStagingDirectory)' 'UpdateRingTag_Results.json'
+                if (Test-Path $resultsJsonPath) {
+                    $results = @(Get-Content -Raw -Path $resultsJsonPath | ConvertFrom-Json)
+                    $total         = $results.Count
+                    $created       = @($results | Where-Object { $_.Action -eq 'Created'  -and $_.Status -eq 'Success'       }).Count
+                    $updated       = @($results | Where-Object { $_.Action -eq 'Updated'  -and $_.Status -eq 'Success'       }).Count
+                    $alreadyInSync = @($results | Where-Object { $_.Status -eq 'AlreadyInSync' }).Count
+                    $skipped       = @($results | Where-Object { $_.Status -eq 'Skipped'       }).Count
+                    $failed        = @($results | Where-Object { $_.Status -eq 'Failed'        }).Count
+                    $whatIf        = @($results | Where-Object { $_.Status -eq 'WhatIf'        }).Count
+
+                    [void]$lines.Add('')
+                    [void]$lines.Add('## Result breakdown')
+                    [void]$lines.Add('')
+                    [void]$lines.Add('| Outcome | Count |')
+                    [void]$lines.Add('|---------|------:|')
+                    [void]$lines.Add("| Total clusters processed | $total |")
+                    [void]$lines.Add("| Tags created             | $created |")
+                    [void]$lines.Add("| Tags updated             | $updated |")
+                    [void]$lines.Add("| Already in sync (no-op)  | $alreadyInSync |")
+                    [void]$lines.Add("| Skipped (UpdateRing differs, no -Force) | $skipped |")
+                    if ($whatIf -gt 0) {
+                        [void]$lines.Add("| WhatIf (dry-run preview) | $whatIf |")
+                    }
+                    [void]$lines.Add("| Failed                   | $failed |")
+
+                    if ($total -gt 0) {
+                        [void]$lines.Add('')
+                        [void]$lines.Add("<details><summary>Per-cluster results ($total rows)</summary>")
+                        [void]$lines.Add('')
+                        [void]$lines.Add('| Cluster | Action | Previous | New | Status | Message |')
+                        [void]$lines.Add('|---------|--------|----------|-----|--------|---------|')
+                        foreach ($r in $results) {
+                            $cn  = ("$($r.ClusterName)")      -replace '\|','\|'
+                            $act = ("$($r.Action)")           -replace '\|','\|'
+                            $pv  = ("$($r.PreviousTagValue)") -replace '\|','\|'
+                            $nv  = ("$($r.NewTagValue)")      -replace '\|','\|'
+                            $st  = ("$($r.Status)")           -replace '\|','\|'
+                            $msg = ("$($r.Message)")          -replace '\|','\|' -replace '\r?\n',' '
+                            [void]$lines.Add("| $cn | $act | $pv | $nv | $st | $msg |")
+                        }
+                        [void]$lines.Add('')
+                        [void]$lines.Add('</details>')
+                    }
+                } else {
+                    [void]$lines.Add('')
+                    [void]$lines.Add("_No per-cluster results JSON found at $resultsJsonPath - apply step may have failed before producing results._")
+                }
+
                 if ($dryRun) {
-                    $summary += "`n`n**This was a dry run. No changes were applied.**"
-                    $summary += "`n`nRe-run the pipeline with 'Preview changes' set to false to apply changes."
+                    [void]$lines.Add('')
+                    [void]$lines.Add('**This was a dry run. No changes were applied.**')
+                    [void]$lines.Add('')
+                    [void]$lines.Add("Re-run the pipeline with 'Preview changes' set to false to apply changes.")
                 }
-                
-                $summary | Out-File "$(Build.ArtifactStagingDirectory)/summary.md" -Encoding UTF8
-                Write-Host "##vso[task.uploadsummary]$(Build.ArtifactStagingDirectory)/summary.md"
+
+                $summaryPath = '$(Build.ArtifactStagingDirectory)/summary.md'
+                $lines -join [Environment]::NewLine | Out-File $summaryPath -Encoding UTF8
+                Write-Host "##vso[task.uploadsummary]$summaryPath"
 

AzLocal.UpdateManagement/Automation-Pipeline-Examples/azure-devops/Step.3_apply-updates-schedule-audit.yml

@@ -81,7 +81,7 @@ parameters:
     default: false
 
 variables:
-  GENERATED_AGAINST_MODULE_VERSION: '0.7.99'
+  GENERATED_AGAINST_MODULE_VERSION: '0.8.0'
   REQUIRED_MODULE_VERSION: '${{ parameters.moduleVersion }}'
   reportsPath: '$(Build.ArtifactStagingDirectory)/reports'
 

AzLocal.UpdateManagement/Automation-Pipeline-Examples/azure-devops/Step.4_fleet-connectivity-status.yml

@@ -102,7 +102,7 @@ variables:
   # the version actually installed and to the latest on PSGallery, and emits a warning
   # log if the YAML appears stale - prompting you to refresh via
   # Copy-AzLocalPipelineExample -Update. See Automation-Pipeline-Examples/README.md section 5.
-  GENERATED_AGAINST_MODULE_VERSION: '0.7.99'
+  GENERATED_AGAINST_MODULE_VERSION: '0.8.0'
   # Resolution order for the module version pin (leave all unset to install the latest,
   # which is the default "fix-forward" behaviour): queue-time parameter > pipeline variable
   # 'REQUIRED_MODULE_VERSION' overridden at queue time > empty (latest).

AzLocal.UpdateManagement/Automation-Pipeline-Examples/azure-devops/Step.5_assess-update-readiness.yml

@@ -63,7 +63,7 @@ variables:
   # the version actually installed and to the latest on PSGallery, and emits a warning
   # log if the YAML appears stale - prompting you to refresh via
   # Copy-AzLocalPipelineExample -Update. See Automation-Pipeline-Examples/README.md section 5.
-  GENERATED_AGAINST_MODULE_VERSION: '0.7.99'
+  GENERATED_AGAINST_MODULE_VERSION: '0.8.0'
   # Resolution order for the module version pin (leave all unset to install the latest,
   # which is the default "fix-forward" behaviour): queue-time parameter > pipeline variable
   # 'REQUIRED_MODULE_VERSION' overridden at queue time > empty (latest).

AzLocal.UpdateManagement/Automation-Pipeline-Examples/azure-devops/Step.6_apply-updates.yml

@@ -98,7 +98,7 @@ variables:
   # log if the YAML appears stale - prompting you to refresh via
   # Copy-AzLocalPipelineExample -Update. See Automation-Pipeline-Examples/README.md section 5.
   - name: GENERATED_AGAINST_MODULE_VERSION
-    value: '0.7.99'
+    value: '0.8.0'
   # Resolution order for the module version pin (leave all unset to install the latest,
   # which is the default "fix-forward" behaviour): queue-time parameter > pipeline variable
   # 'REQUIRED_MODULE_VERSION' overridden at queue time > empty (latest).

AzLocal.UpdateManagement/Automation-Pipeline-Examples/azure-devops/Step.7_monitor-updates.yml

@@ -58,12 +58,12 @@ parameters:
     default: ''
 
   - name: longRunningStepHours
-    displayName: 'PRIMARY signal (v0.7.96+). Flag in-flight runs whose CURRENT STEP has been running longer than this many hours.'
+    displayName: 'PRIMARY stuck-step signal. Flag in-flight runs whose CURRENT STEP has been running longer than this many hours.'
     type: string
     default: '2'
 
   - name: longRunningThresholdHours
-    displayName: 'Belt-and-braces overall-elapsed flag (default 24, demoted from 6 in v0.7.96).'
+    displayName: 'Belt-and-braces overall-elapsed flag (default 24h).'
     type: string
     default: '24'
 
@@ -73,7 +73,7 @@ parameters:
     default: '24'
 
   - name: criticalElapsedDays
-    displayName: 'CRITICAL tier for overall-elapsed (v0.7.99+, default 3 days). Runs older than this get a :rotating_light: chip; older than 2x get a :skull: chip - strongest visual signal that human intervention is needed.'
+    displayName: 'CRITICAL tier for overall-elapsed (default 3 days). Runs older than this get a :rotating_light: chip; older than 2x get a :skull: chip - strongest visual signal that human intervention is needed.'
     type: string
     default: '3'
 
@@ -83,7 +83,7 @@ parameters:
     default: ''
 
 variables:
-  GENERATED_AGAINST_MODULE_VERSION: '0.7.99'
+  GENERATED_AGAINST_MODULE_VERSION: '0.8.0'
   REQUIRED_MODULE_VERSION: '${{ parameters.moduleVersion }}'
   reportsPath: '$(Build.ArtifactStagingDirectory)/reports'
 

AzLocal.UpdateManagement/Automation-Pipeline-Examples/azure-devops/Step.8_fleet-update-status.yml

@@ -92,7 +92,7 @@ variables:
   # the version actually installed and to the latest on PSGallery, and emits a warning
   # log if the YAML appears stale - prompting you to refresh via
   # Copy-AzLocalPipelineExample -Update. See Automation-Pipeline-Examples/README.md section 5.
-  GENERATED_AGAINST_MODULE_VERSION: '0.7.99'
+  GENERATED_AGAINST_MODULE_VERSION: '0.8.0'
   # Resolution order for the module version pin (leave all unset to install the latest,
   # which is the default "fix-forward" behaviour): queue-time parameter > pipeline variable
   # 'REQUIRED_MODULE_VERSION' overridden at queue time > empty (latest).

AzLocal.UpdateManagement/Automation-Pipeline-Examples/azure-devops/Step.9_fleet-health-status.yml

@@ -104,7 +104,7 @@ variables:
   # the version actually installed and to the latest on PSGallery, and emits a warning
   # log if the YAML appears stale - prompting you to refresh via
   # Copy-AzLocalPipelineExample -Update. See Automation-Pipeline-Examples/README.md section 5.
-  GENERATED_AGAINST_MODULE_VERSION: '0.7.99'
+  GENERATED_AGAINST_MODULE_VERSION: '0.8.0'
   # Resolution order for the module version pin (leave all unset to install the latest,
   # which is the default "fix-forward" behaviour): queue-time parameter > pipeline variable
   # 'REQUIRED_MODULE_VERSION' overridden at queue time > empty (latest).