microsoft
diff --git a/‎.cspell.json‎
Lines changed: 1 addition & 0 deletions b/‎.cspell.json‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎.github/workflows/adr-consistency-validation.yml‎
Lines changed: 160 additions & 0 deletions b/‎.github/workflows/adr-consistency-validation.yml‎
Lines changed: 160 additions & 0 deletions
diff --git a/‎.github/workflows/pr-validation.yml‎
Lines changed: 12 additions & 0 deletions b/‎.github/workflows/pr-validation.yml‎
Lines changed: 12 additions & 0 deletions
diff --git a/‎.markdownlint-cli2.jsonc‎
Lines changed: 1 addition & 0 deletions b/‎.markdownlint-cli2.jsonc‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎.vscode/settings.json‎
Lines changed: 4 additions & 0 deletions b/‎.vscode/settings.json‎
Lines changed: 4 additions & 0 deletions
diff --git a/‎package.json‎
Lines changed: 1 addition & 0 deletions b/‎package.json‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎scripts/linting/Invoke-PSScriptAnalyzer.ps1‎
Lines changed: 45 additions & 3 deletions b/‎scripts/linting/Invoke-PSScriptAnalyzer.ps1‎
Lines changed: 45 additions & 3 deletions
@@ -80,6 +80,7 @@
     "skillmd",
     "smol",
     "subcat",
+    "uncited",
     "vally",
     "whiteboarding",
     "ˈpræksɪs",
 
@@ -0,0 +1,160 @@
+name: ADR Consistency Validation
+
+on:
+  workflow_call:
+    inputs:
+      soft-fail:
+        description: 'Whether to continue on ADR consistency violations'
+        required: false
+        type: boolean
+        default: false
+      changed-files-only:
+        description: 'Only run validation when ADR markdown files changed'
+        required: false
+        type: boolean
+        default: false
+      upload-sarif:
+        description: 'Whether to upload SARIF results to Security tab'
+        required: false
+        type: boolean
+        default: false
+      upload-artifact:
+        description: 'Whether to upload validation results as artifact'
+        required: false
+        type: boolean
+        default: true
+
+permissions:
+  contents: read
+
+jobs:
+  detect-changes:
+    name: Detect ADR Changes
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      has-adr-changes: ${{ steps.detect.outputs.has-adr-changes }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Check ADR changes
+        id: detect
+        shell: pwsh
+        run: |
+          if ('${{ inputs.changed-files-only }}' -ne 'true') {
+            'has-adr-changes=true' >> $env:GITHUB_OUTPUT
+            Write-Output 'ADR validation requested for all configured ADR files.'
+          } else {
+            $baseRef = if ($env:GITHUB_BASE_REF) { $env:GITHUB_BASE_REF } else { 'main' }
+            $changed = @(git diff --name-only --diff-filter=ACMR "origin/$baseRef...HEAD" -- docs/planning/adrs |
+              Where-Object { $_ -match '^docs/planning/adrs/.+\.md$' })
+
+            if ($changed.Count -gt 0) {
+              'has-adr-changes=true' >> $env:GITHUB_OUTPUT
+              Write-Output "Detected $($changed.Count) changed ADR file(s)"
+              $changed | ForEach-Object { Write-Output "- $_" }
+            } else {
+              'has-adr-changes=false' >> $env:GITHUB_OUTPUT
+              Write-Output 'No ADR markdown changes detected under docs/planning/adrs'
+            }
+          }
+
+  report-skipped:
+    name: Report Skipped ADR Validation
+    runs-on: ubuntu-latest
+    needs: detect-changes
+    if: inputs.changed-files-only && needs.detect-changes.outputs.has-adr-changes != 'true'
+    permissions:
+      contents: read
+    steps:
+      - name: Report skipped validation
+        shell: pwsh
+        run: |
+          @(
+            '## ADR Consistency Validation',
+            '',
+            'No ADR markdown changes detected under docs/planning/adrs. Validation skipped.'
+          ) -join "`n" >> $env:GITHUB_STEP_SUMMARY
+
+  validate:
+    name: Validate ADR Consistency
+    runs-on: ubuntu-latest
+    needs: detect-changes
+    if: needs.detect-changes.outputs.has-adr-changes == 'true'
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Run ADR consistency validation
+        shell: pwsh
+        continue-on-error: ${{ inputs.soft-fail }}
+        run: |
+          New-Item -ItemType Directory -Force -Path logs | Out-Null
+          $baseBranch = if ($env:GITHUB_BASE_REF) { "origin/$env:GITHUB_BASE_REF" } else { 'origin/main' }
+          $params = @{
+            Paths = @('docs/planning/adrs')
+            BaseBranch = $baseBranch
+            OutputPath = 'logs/adr-consistency-results.json'
+          }
+
+          if ('${{ inputs.changed-files-only }}' -eq 'true') {
+            $params['ChangedFilesOnly'] = $true
+          }
+
+          if ('${{ inputs.upload-sarif }}' -eq 'true') {
+            $params['SarifOutputPath'] = 'logs/adr-consistency-results.sarif'
+          }
+
+          & scripts/linting/Validate-AdrConsistency.ps1 @params
+
+      - name: Upload SARIF handoff
+        if: inputs.upload-sarif && always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: adr-consistency-sarif
+          path: logs/adr-consistency-results.sarif
+          retention-days: 1
+          if-no-files-found: ignore
+
+      - name: Upload validation report
+        if: inputs.upload-artifact && always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: adr-consistency-results
+          path: |
+            logs/adr-consistency-results.json
+            logs/adr-consistency-results.sarif
+          retention-days: 90
+          if-no-files-found: ignore
+
+  upload-sarif:
+    name: Upload ADR SARIF
+    runs-on: ubuntu-latest
+    needs: validate
+    if: inputs.upload-sarif && always() && needs.validate.result != 'skipped'
+    permissions:
+      contents: read
+      security-events: write  # Required for SARIF upload to Security tab
+    steps:
+      - name: Download SARIF handoff
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v6.0.0
+        with:
+          name: adr-consistency-sarif
+          path: logs
+
+      - name: Upload SARIF to Security tab
+        uses: github/codeql-action/upload-sarif@ce729e4d353d580e6cacd6a8cf2921b72e5e310a # v3.27.0
+        with:
+          sarif_file: logs/adr-consistency-results.sarif
+          category: adr-consistency
+        continue-on-error: true
@@ -196,6 +196,18 @@ jobs:
       skip-footer-validation: false
       warnings-as-errors: true
 
+  adr-consistency-validation:
+    name: ADR Consistency Validation
+    uses: ./.github/workflows/adr-consistency-validation.yml
+    permissions:
+      contents: read
+      security-events: write  # Required for SARIF upload to Security tab
+    with:
+      soft-fail: false
+      changed-files-only: true
+      upload-sarif: true
+      upload-artifact: false
+
   ai-artifact-validation:
     name: AI Artifact Validation
     uses: ./.github/workflows/ai-artifact-validation.yml
 
@@ -6,6 +6,7 @@
     "logs/**",
     "venv/**",
     "scripts/tests/Fixtures/**",
+    "scripts/tests/linting/fixtures/**",
     "extension/README.md",
     "extension/README.*.md",
     "extension/CHANGELOG.md",
 
@@ -18,6 +18,10 @@
     ],
     "./scripts/linting/schemas/docs-frontmatter.schema.json": [
       "docs/**/*.md"
+    ],
+    "./scripts/linting/schemas/adr-config.schema.json": [
+      "**/.adr-config.yml",
+      "**/.adr-config.yaml"
     ]
   },
   "json.schemas": [
 
@@ -14,6 +14,7 @@
     "lint:links": "pwsh -NoProfile -Command \"& scripts/linting/Invoke-LinkLanguageCheck.ps1 -ExcludePaths 'scripts/tests/**'\"",
     "lint:md-links": "pwsh -File scripts/linting/Markdown-Link-Check.ps1",
     "lint:frontmatter": "pwsh -NoProfile -Command \"& './scripts/linting/Validate-MarkdownFrontmatter.ps1' -WarningsAsErrors -EnableSchemaValidation\"",
+    "lint:adr-consistency": "pwsh -NoProfile -File scripts/linting/Validate-AdrConsistency.ps1 -Paths docs/planning/adrs",
     "lint:collections-metadata": "pwsh -NoProfile -Command \"./scripts/collections/Validate-Collections.ps1 -OutputPath logs/collection-validation-results.json\"",
     "lint:marketplace": "pwsh -File scripts/plugins/Validate-Marketplace.ps1 -OutputPath logs/marketplace-validation-results.json",
     "lint:version-consistency": "pwsh -NoProfile -Command \"./scripts/security/Test-ActionVersionConsistency.ps1 -FailOnMismatch -Format Json -OutputPath logs/action-version-consistency-results.json\"",
 
@@ -32,6 +32,45 @@ Import-Module (Join-Path $PSScriptRoot "../lib/Modules/CIHelpers.psm1") -Force
 
 #region Functions
 
+function Invoke-ScriptAnalyzerIsolated {
+    [CmdletBinding()]
+    [OutputType([System.Object[]])]
+    [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseUsingScopeModifierInNewRunspaces', '', Justification = 'Variables are passed into the Start-Job script block via param() and -ArgumentList, so the $using: modifier does not apply.')]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Path,
+
+        [Parameter(Mandatory = $true)]
+        [string]$SettingsPath
+    )
+
+    # Analyze each file in its own child process so every file compiles into a
+    # fresh dynamic assembly. On Linux/CoreCLR a process permits only one dynamic
+    # module per dynamic assembly, so analyzing multiple module files in a shared
+    # runspace throws "more than one dynamic module" on the second .psm1 file.
+    $job = Start-Job -ScriptBlock {
+        param($FilePath, $ConfigPath)
+        Import-Module PSScriptAnalyzer -RequiredVersion 1.25.0
+        Invoke-ScriptAnalyzer -Path $FilePath -Settings $ConfigPath | ForEach-Object {
+            [pscustomobject]@{
+                RuleName = $_.RuleName
+                Message  = $_.Message
+                Severity = $_.Severity.ToString()
+                Line     = $_.Line
+                Column   = $_.Column
+            }
+        }
+    } -ArgumentList $Path, $SettingsPath
+
+    try {
+        $null = Wait-Job -Job $job
+        return @(Receive-Job -Job $job)
+    }
+    finally {
+        Remove-Job -Job $job -Force
+    }
+}
+
 function Invoke-PSScriptAnalyzerCore {
     [CmdletBinding()]
     [OutputType([void])]
@@ -85,12 +124,15 @@ function Invoke-PSScriptAnalyzerCore {
     $allResults = @()
     $hasErrors = $false
 
+    $resolvedConfigPath = (Resolve-Path -LiteralPath $ConfigPath).Path
+
     foreach ($file in $filesToAnalyze) {
         $filePath = if ($file -is [System.IO.FileInfo]) { $file.FullName } else { $file }
         Write-Host "`n📄 Analyzing: $filePath" -ForegroundColor Cyan
-        
-        $results = Invoke-ScriptAnalyzer -Path $filePath -Settings $ConfigPath
-        
+
+        $resolvedFilePath = (Resolve-Path -LiteralPath $filePath).Path
+        $results = @(Invoke-ScriptAnalyzerIsolated -Path $resolvedFilePath -SettingsPath $resolvedConfigPath)
+
         if ($results) {
             $allResults += $results