v0.8.4: Step.3 advisor enhancements (A/B/C) + Step.6 per-cluster Step Summary + Node 24 opt-in + RBAC role rename + install-step version banner (#73)

* Publish v0.8.4

* v0.8.4 follow-up: correct ADO Step.6 banner count + allow migration-tip line

Two Pester drift-test issues found by full-suite execution:

1. ADO Step.6 banner test expected 2 emits per file (one per install step).
   The second install step (ApplyUpdates stage) deliberately skips
   ##vso[task.uploadsummary] - there is a comment in the yml explaining
   that this avoids duplicating the banner in the rendered Summary. Correct
   the expectation to 1 per yml (10 ADO Summary emits total).

2. RBAC bare-name test flagged the migration-tip blockquote in
   Automation-Pipeline-Examples/README.md that intentionally quotes
   "Name": "Azure Stack HCI Update Operator" to explain the rename.
   Allowlist lines that contain "pre-v0.8.4" - that marker is exclusive
   to explicit migration documentation.

Also correct the stale "11 ADO install sites" claim in:
- AzLocal.UpdateManagement/README.md (What's New in v0.8.4)
- AzLocal.UpdateManagement/CHANGELOG.md (v0.8.4 section, 2 places)
- AzLocal.UpdateManagement/AzLocal.UpdateManagement.psd1 (ReleaseNotes)

Accurate description: one banner per yml across all 20 bundled Step.{0..9}.yml
templates (Step.6 ADO has 2 install steps but the second deliberately skips
upload to avoid duplicating the banner).

Drift subset re-run: 8 Passed, 0 Failed.

Author: NeilBird

AzLocal.UpdateManagement/Automation-Pipeline-Examples/README.md

@@ -1,7 +1,7 @@
 {
-  "Name": "Azure Stack HCI Update Operator",
+  "Name": "Azure Stack HCI Update Operator (custom)",
   "IsCustom": true,
-  "Description": "Can read and apply Azure Local cluster updates, manage UpdateRing tags, and read the fleet-connectivity inventory (Arc-enabled machines, edge-device NICs, Azure Resource Bridges) needed to assess pre-update connectivity.",
+  "Description": "Customer-managed custom role - reference by roleDefinitionId (GUID) in automation rather than by name to remain stable if Microsoft later ships a built-in role with a similar display name. Can read and apply Azure Local cluster updates, manage UpdateRing tags, and read the fleet-connectivity inventory (Arc-enabled machines, edge-device NICs, Azure Resource Bridges) needed to assess pre-update connectivity.",
   "Actions": [
     "Microsoft.AzureStackHCI/clusters/read",
     "Microsoft.AzureStackHCI/clusters/updateSummaries/read",

AzLocal.UpdateManagement/Automation-Pipeline-Examples/azlocal-update-management-custom-role.json

@@ -59,7 +59,7 @@ variables:
   # log if the YAML appears stale - prompting you to refresh via
   # Copy-AzLocalPipelineExample -Update. See Automation-Pipeline-Examples/README.md section 5.
   - name: GENERATED_AGAINST_MODULE_VERSION
-    value: '0.8.3'
+    value: '0.8.4'
   # Resolution order for the module version pin (leave all unset to install the latest,
   # which is the default "fix-forward" behaviour): queue-time parameter > pipeline variable
   # 'REQUIRED_MODULE_VERSION' overridden at queue time > empty (latest).
@@ -130,6 +130,23 @@ stages:
                     $msg = "AzLocal.UpdateManagement v$latest is available on PSGallery; this run installed v$installed. Review the module CHANGELOG before bumping REQUIRED_MODULE_VERSION (or clear the pin to install the latest automatically)."
                     Write-Host "##vso[task.logissue type=warning]$msg"
                 }
+
+                # v0.8.4 - one-line version banner uploaded to the build run
+                # Summary so the YAML version (GENERATED_AGAINST_MODULE_VERSION),
+                # the module version actually loaded on the agent, the PSGallery
+                # latest, and the REQUIRED_MODULE_VERSION pin status are visible
+                # at the top of every run summary without scrolling the agent
+                # log. Same data is also echoed to the console above.
+                $pin       = if ($env:REQUIRED_MODULE_VERSION) { "pinned to v$($env:REQUIRED_MODULE_VERSION)" } else { 'latest (fix-forward)' }
+                $latestStr = if ($latest) { "v$latest" } else { '(PSGallery lookup failed)' }
+                $verdict   = if ($installed -lt $generated) { 'YAML newer than module - check REQUIRED_MODULE_VERSION' }
+                             elseif ($installed -gt $generated) { 'YAML older than module - run Copy-AzLocalPipelineExample -Update' }
+                             elseif ($latest -and ($latest -gt $installed)) { 'newer module available on PSGallery' }
+                             else { 'in sync' }
+                $bannerPath = Join-Path $env:BUILD_ARTIFACTSTAGINGDIRECTORY 'module-version-banner.md'
+                "_Pipeline YAML v$generated | Module v$installed installed ($pin) | PSGallery latest $latestStr | $verdict_" | Out-File -FilePath $bannerPath -Encoding utf8
+                Write-Host "##vso[task.uploadsummary]$bannerPath"
+
                 # Persist the three versions so the report step (below) can include them
                 # in the JUnit XML + markdown summary alongside the auth/RBAC checks.
                 Write-Host "##vso[task.setvariable variable=installedModuleVersion;isOutput=false]$installed"

AzLocal.UpdateManagement/Automation-Pipeline-Examples/azure-devops/Step.0_authentication-test.yml

@@ -42,7 +42,7 @@ variables:
   # log if the YAML appears stale - prompting you to refresh via
   # Copy-AzLocalPipelineExample -Update. See Automation-Pipeline-Examples/README.md section 5.
   - name: GENERATED_AGAINST_MODULE_VERSION
-    value: '0.8.3'
+    value: '0.8.4'
   # Resolution order for the module version pin (leave all unset to install the latest,
   # which is the default "fix-forward" behaviour): queue-time parameter > pipeline variable
   # 'REQUIRED_MODULE_VERSION' overridden at queue time > empty (latest).
@@ -114,6 +114,22 @@ stages:
                     $msg = "AzLocal.UpdateManagement v$latest is available on PSGallery; this run installed v$installed. Review the module CHANGELOG before bumping REQUIRED_MODULE_VERSION (or clear the pin to install the latest automatically)."
                     Write-Host "##vso[task.logissue type=warning]$msg"
                 }
+
+                # v0.8.4 - one-line version banner uploaded to the build run
+                # Summary so the YAML version (GENERATED_AGAINST_MODULE_VERSION),
+                # the module version actually loaded on the agent, the PSGallery
+                # latest, and the REQUIRED_MODULE_VERSION pin status are visible
+                # at the top of every run summary without scrolling the agent
+                # log. Same data is also echoed to the console above.
+                $pin       = if ($env:REQUIRED_MODULE_VERSION) { "pinned to v$($env:REQUIRED_MODULE_VERSION)" } else { 'latest (fix-forward)' }
+                $latestStr = if ($latest) { "v$latest" } else { '(PSGallery lookup failed)' }
+                $verdict   = if ($installed -lt $generated) { 'YAML newer than module - check REQUIRED_MODULE_VERSION' }
+                             elseif ($installed -gt $generated) { 'YAML older than module - run Copy-AzLocalPipelineExample -Update' }
+                             elseif ($latest -and ($latest -gt $installed)) { 'newer module available on PSGallery' }
+                             else { 'in sync' }
+                $bannerPath = Join-Path $env:BUILD_ARTIFACTSTAGINGDIRECTORY 'module-version-banner.md'
+                "_Pipeline YAML v$generated | Module v$installed installed ($pin) | PSGallery latest $latestStr | $verdict_" | Out-File -FilePath $bannerPath -Encoding utf8
+                Write-Host "##vso[task.uploadsummary]$bannerPath"
           
           - task: AzureCLI@2
             displayName: 'Run Cluster Inventory'

AzLocal.UpdateManagement/Automation-Pipeline-Examples/azure-devops/Step.1_inventory-clusters.yml

@@ -45,7 +45,7 @@ variables:
   # log if the YAML appears stale - prompting you to refresh via
   # Copy-AzLocalPipelineExample -Update. See Automation-Pipeline-Examples/README.md section 5.
   - name: GENERATED_AGAINST_MODULE_VERSION
-    value: '0.8.3'
+    value: '0.8.4'
   # Resolution order for the module version pin (leave all unset to install the latest,
   # which is the default "fix-forward" behaviour): queue-time parameter > pipeline variable
   # 'REQUIRED_MODULE_VERSION' overridden at queue time > empty (latest).
@@ -206,6 +206,22 @@ stages:
                     $msg = "AzLocal.UpdateManagement v$latest is available on PSGallery; this run installed v$installed. Review the module CHANGELOG before bumping REQUIRED_MODULE_VERSION (or clear the pin to install the latest automatically)."
                     Write-Host "##vso[task.logissue type=warning]$msg"
                 }
+
+                # v0.8.4 - one-line version banner uploaded to the build run
+                # Summary so the YAML version (GENERATED_AGAINST_MODULE_VERSION),
+                # the module version actually loaded on the agent, the PSGallery
+                # latest, and the REQUIRED_MODULE_VERSION pin status are visible
+                # at the top of every run summary without scrolling the agent
+                # log. Same data is also echoed to the console above.
+                $pin       = if ($env:REQUIRED_MODULE_VERSION) { "pinned to v$($env:REQUIRED_MODULE_VERSION)" } else { 'latest (fix-forward)' }
+                $latestStr = if ($latest) { "v$latest" } else { '(PSGallery lookup failed)' }
+                $verdict   = if ($installed -lt $generated) { 'YAML newer than module - check REQUIRED_MODULE_VERSION' }
+                             elseif ($installed -gt $generated) { 'YAML older than module - run Copy-AzLocalPipelineExample -Update' }
+                             elseif ($latest -and ($latest -gt $installed)) { 'newer module available on PSGallery' }
+                             else { 'in sync' }
+                $bannerPath = Join-Path $env:BUILD_ARTIFACTSTAGINGDIRECTORY 'module-version-banner.md'
+                "_Pipeline YAML v$generated | Module v$installed installed ($pin) | PSGallery latest $latestStr | $verdict_" | Out-File -FilePath $bannerPath -Encoding utf8
+                Write-Host "##vso[task.uploadsummary]$bannerPath"
           
           - task: AzureCLI@2
             displayName: 'Apply UpdateRing Tags'

AzLocal.UpdateManagement/Automation-Pipeline-Examples/azure-devops/Step.2_manage-updatering-tags.yml

@@ -70,6 +70,11 @@ parameters:
     type: boolean
     default: true
 
+  - name: clusterCsvPath
+    displayName: 'Path to the source-controlled cluster inventory CSV (the same file Step.2 consumes - default `config/ClusterUpdateRings.csv`). When set, the Recommend view emits a NoWindowTag remediation section: for each cluster missing an UpdateStartWindow tag, the advisor proposes a peer-derived value and tells the operator which row of the CSV to edit (or to re-run Step.1 if the cluster is absent from the CSV). Leave empty to skip the CSV-driven remediation.'
+    type: string
+    default: 'config/ClusterUpdateRings.csv'
+
   - name: moduleVersion
     displayName: 'Pin AzLocal.UpdateManagement version (empty = latest from PSGallery). See Automation-Pipeline-Examples/README.md section 5 "Optional configuration".'
     type: string
@@ -81,7 +86,7 @@ parameters:
     default: false
 
 variables:
-  GENERATED_AGAINST_MODULE_VERSION: '0.8.3'
+  GENERATED_AGAINST_MODULE_VERSION: '0.8.4'
   REQUIRED_MODULE_VERSION: '${{ parameters.moduleVersion }}'
   reportsPath: '$(Build.ArtifactStagingDirectory)/reports'
 
@@ -136,6 +141,22 @@ stages:
               Write-Host "##vso[task.logissue type=warning]AzLocal.UpdateManagement v$latest is available on PSGallery; this run installed v$installed."
           }
 
+          # v0.8.4 - one-line version banner uploaded to the build run
+          # Summary so the YAML version (GENERATED_AGAINST_MODULE_VERSION),
+          # the module version actually loaded on the agent, the PSGallery
+          # latest, and the REQUIRED_MODULE_VERSION pin status are visible
+          # at the top of every run summary without scrolling the agent
+          # log. Same data is also echoed to the console above.
+          $pin       = if ($env:REQUIRED_MODULE_VERSION) { "pinned to v$($env:REQUIRED_MODULE_VERSION)" } else { 'latest (fix-forward)' }
+          $latestStr = if ($latest) { "v$latest" } else { '(PSGallery lookup failed)' }
+          $verdict   = if ($installed -lt $generated) { 'YAML newer than module - check REQUIRED_MODULE_VERSION' }
+                       elseif ($installed -gt $generated) { 'YAML older than module - run Copy-AzLocalPipelineExample -Update' }
+                       elseif ($latest -and ($latest -gt $installed)) { 'newer module available on PSGallery' }
+                       else { 'in sync' }
+          $bannerPath = Join-Path $env:BUILD_ARTIFACTSTAGINGDIRECTORY 'module-version-banner.md'
+          "_Pipeline YAML v$generated | Module v$installed installed ($pin) | PSGallery latest $latestStr | $verdict_" | Out-File -FilePath $bannerPath -Encoding utf8
+          Write-Host "##vso[task.uploadsummary]$bannerPath"
+
     - task: AzureCLI@2
       displayName: 'Run Schedule Coverage Audit'
       name: audit
@@ -157,6 +178,7 @@ stages:
           $leadTime     = [int]"${{ parameters.leadTimeMinutes }}"
           $firesPerWin  = [int]"${{ parameters.firesPerWindow }}"
           $includeUnt   = ${{ lower(parameters.includeUntagged) }}
+          $clusterCsv   = "${{ parameters.clusterCsvPath }}"
           $debug        = ('${{ parameters.debug }}' -ieq 'true')
 
           # Debug toggle: flips Verbose/Debug preferences and emits a
@@ -185,6 +207,11 @@ stages:
           # no 'required:' keyword, so validate at runtime instead.
           $havePipeline = -not [string]::IsNullOrWhiteSpace($pipelinePath)
           $haveSchedule = -not [string]::IsNullOrWhiteSpace($schedulePath) -and (Test-Path -LiteralPath $schedulePath)
+          # v0.8.4: clusterCsvPath is optional. If the file is missing on the agent
+          # we skip the NoWindowTag remediation section quietly (vs throwing) so the
+          # pipeline keeps emitting the legacy advisor output for repos that don't
+          # version-control a cluster CSV yet.
+          $haveCsv      = -not [string]::IsNullOrWhiteSpace($clusterCsv) -and (Test-Path -LiteralPath $clusterCsv)
           if (-not $havePipeline) {
               throw "pipelinePath parameter is required. Set it to the folder containing Step.6_apply-updates.yml (default '.azure-pipelines' matches the standard consumer layout). The Recommend view diffs its proposed crons against this file - leaving it empty would make every recommendation a false positive."
           }
@@ -202,6 +229,7 @@ stages:
           Write-Host "LeadTimeMinutes  : $leadTime"
           Write-Host "FiresPerWindow   : $firesPerWin   (1 = opening edge only, 2 = belt-and-braces opening + mid-window retry)"
           Write-Host "IncludeUntagged  : $includeUnt"
+          Write-Host "ClusterCsvPath   : $(if ($haveCsv) { $clusterCsv } else { '(skipped - clusterCsvPath empty or file missing)' })"
           Write-Host ""
 
           $auditCsv  = Join-Path $outputDir 'schedule-coverage-audit.csv'
@@ -224,12 +252,16 @@ stages:
           if ($havePipeline) { $auditArgs.PipelineYamlPath = $pipelinePath }
           if ($haveSchedule) { $auditArgs.SchedulePath     = $schedulePath }
           if ($includeUnt)   { $auditArgs.IncludeUntagged  = $true }
+          if ($haveCsv)      { $auditArgs.ClusterCsvPath   = $clusterCsv }
           $auditResult = Test-AzLocalApplyUpdatesScheduleCoverage @auditArgs
           if (-not $auditResult) { $auditResult = @() }
 
           Test-AzLocalApplyUpdatesScheduleCoverage -View Matrix -LeadTimeMinutes $leadTime -ExportPath $matrixCsv | Out-Null
           # v0.8.3: pass -PipelineYamlPath so Recommend diff-prunes crons
           # already present in Step.6 and only emits the truly missing ones.
+          # v0.8.4: also pass -SchedulePath (so the Cycle calendar +
+          # Configured exclusion windows informational sections render) and
+          # -ClusterCsvPath (so the NoWindowTag remediation section renders).
           $recoArgs = @{
               View                    = 'Recommend'
               LeadTimeMinutes         = $leadTime
@@ -238,6 +270,8 @@ stages:
               ExportPath              = $recoMd
           }
           if ($havePipeline) { $recoArgs.PipelineYamlPath = $pipelinePath }
+          if ($haveSchedule) { $recoArgs.SchedulePath     = $schedulePath }
+          if ($haveCsv)      { $recoArgs.ClusterCsvPath   = $clusterCsv }
           Test-AzLocalApplyUpdatesScheduleCoverage @recoArgs | Out-Null
 
           $covered     = @($auditResult | Where-Object Status -eq 'Covered')

AzLocal.UpdateManagement/Automation-Pipeline-Examples/azure-devops/Step.3_apply-updates-schedule-audit.yml

@@ -102,7 +102,7 @@ variables:
   # the version actually installed and to the latest on PSGallery, and emits a warning
   # log if the YAML appears stale - prompting you to refresh via
   # Copy-AzLocalPipelineExample -Update. See Automation-Pipeline-Examples/README.md section 5.
-  GENERATED_AGAINST_MODULE_VERSION: '0.8.3'
+  GENERATED_AGAINST_MODULE_VERSION: '0.8.4'
   # Resolution order for the module version pin (leave all unset to install the latest,
   # which is the default "fix-forward" behaviour): queue-time parameter > pipeline variable
   # 'REQUIRED_MODULE_VERSION' overridden at queue time > empty (latest).
@@ -168,6 +168,22 @@ stages:
               Write-Host "##vso[task.logissue type=warning]AzLocal.UpdateManagement v$latest is available on PSGallery; this run installed v$installed."
           }
 
+          # v0.8.4 - one-line version banner uploaded to the build run
+          # Summary so the YAML version (GENERATED_AGAINST_MODULE_VERSION),
+          # the module version actually loaded on the agent, the PSGallery
+          # latest, and the REQUIRED_MODULE_VERSION pin status are visible
+          # at the top of every run summary without scrolling the agent
+          # log. Same data is also echoed to the console above.
+          $pin       = if ($env:REQUIRED_MODULE_VERSION) { "pinned to v$($env:REQUIRED_MODULE_VERSION)" } else { 'latest (fix-forward)' }
+          $latestStr = if ($latest) { "v$latest" } else { '(PSGallery lookup failed)' }
+          $verdict   = if ($installed -lt $generated) { 'YAML newer than module - check REQUIRED_MODULE_VERSION' }
+                       elseif ($installed -gt $generated) { 'YAML older than module - run Copy-AzLocalPipelineExample -Update' }
+                       elseif ($latest -and ($latest -gt $installed)) { 'newer module available on PSGallery' }
+                       else { 'in sync' }
+          $bannerPath = Join-Path $env:BUILD_ARTIFACTSTAGINGDIRECTORY 'module-version-banner.md'
+          "_Pipeline YAML v$generated | Module v$installed installed ($pin) | PSGallery latest $latestStr | $verdict_" | Out-File -FilePath $bannerPath -Encoding utf8
+          Write-Host "##vso[task.uploadsummary]$bannerPath"
+
     - task: AzureCLI@2
       displayName: 'Collect Fleet Connectivity Data'
       name: collect

AzLocal.UpdateManagement/Automation-Pipeline-Examples/azure-devops/Step.4_fleet-connectivity-status.yml

@@ -63,7 +63,7 @@ variables:
   # the version actually installed and to the latest on PSGallery, and emits a warning
   # log if the YAML appears stale - prompting you to refresh via
   # Copy-AzLocalPipelineExample -Update. See Automation-Pipeline-Examples/README.md section 5.
-  GENERATED_AGAINST_MODULE_VERSION: '0.8.3'
+  GENERATED_AGAINST_MODULE_VERSION: '0.8.4'
   # Resolution order for the module version pin (leave all unset to install the latest,
   # which is the default "fix-forward" behaviour): queue-time parameter > pipeline variable
   # 'REQUIRED_MODULE_VERSION' overridden at queue time > empty (latest).
@@ -125,6 +125,22 @@ stages:
                     Write-Host "##vso[task.logissue type=warning]$msg"
                 }
 
+                # v0.8.4 - one-line version banner uploaded to the build run
+                # Summary so the YAML version (GENERATED_AGAINST_MODULE_VERSION),
+                # the module version actually loaded on the agent, the PSGallery
+                # latest, and the REQUIRED_MODULE_VERSION pin status are visible
+                # at the top of every run summary without scrolling the agent
+                # log. Same data is also echoed to the console above.
+                $pin       = if ($env:REQUIRED_MODULE_VERSION) { "pinned to v$($env:REQUIRED_MODULE_VERSION)" } else { 'latest (fix-forward)' }
+                $latestStr = if ($latest) { "v$latest" } else { '(PSGallery lookup failed)' }
+                $verdict   = if ($installed -lt $generated) { 'YAML newer than module - check REQUIRED_MODULE_VERSION' }
+                             elseif ($installed -gt $generated) { 'YAML older than module - run Copy-AzLocalPipelineExample -Update' }
+                             elseif ($latest -and ($latest -gt $installed)) { 'newer module available on PSGallery' }
+                             else { 'in sync' }
+                $bannerPath = Join-Path $env:BUILD_ARTIFACTSTAGINGDIRECTORY 'module-version-banner.md'
+                "_Pipeline YAML v$generated | Module v$installed installed ($pin) | PSGallery latest $latestStr | $verdict_" | Out-File -FilePath $bannerPath -Encoding utf8
+                Write-Host "##vso[task.uploadsummary]$bannerPath"
+
           - task: AzureCLI@2
             displayName: 'Run readiness + blocking health checks'
             inputs: