diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml new file mode 100644 index 0000000..c1ec8e5 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -0,0 +1,50 @@ +name: Bug report +description: Report a reproducible defect without publishing sensitive deployment data. +title: "[Bug]: " +labels: + - bug +body: + - type: markdown + attributes: + value: | + Do not include disk serials, credentials, internal paths, or unredacted task-sequence logs. Use private vulnerability reporting for security concerns. + - type: textarea + id: behavior + attributes: + label: Observed behavior + description: What happened, and at what task-sequence step? + validations: + required: true + - type: textarea + id: expected + attributes: + label: Expected behavior + description: What did you expect to happen? + validations: + required: true + - type: textarea + id: environment + attributes: + label: Environment + description: Provide redacted ConfigMgr, WinPE, firmware mode, storage-controller, disk count, bus type, sector size, and command parameters. + validations: + required: true + - type: textarea + id: reproduction + attributes: + label: Reproduction steps + description: Include the smallest safe reproduction. State whether Preview or destructive execution was used. + validations: + required: true + - type: textarea + id: validation + attributes: + label: Validation performed + description: Describe disposable-hardware testing and the output of build\Invoke-Validation.ps1, if available. + - type: checkboxes + id: safety + attributes: + label: Safety confirmation + options: + - label: I removed sensitive deployment details and tested destructive behavior only on disposable media. + required: true diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..26c40ff --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,8 @@ +blank_issues_enabled: false +contact_links: + - name: Security vulnerability + url: https://github.com/vartaxe/ConfigMgr-OSD-DiskPartitionLayout/security/advisories/new + about: Report security concerns privately. Do not include sensitive deployment details in a public issue. + - name: Task-sequence integration guide + url: https://github.com/vartaxe/ConfigMgr-OSD-DiskPartitionLayout/blob/main/TASK-SEQUENCE.md + about: Review required step ordering, variables, and rollout checks before requesting support. diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml new file mode 100644 index 0000000..3302443 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.yml @@ -0,0 +1,34 @@ +name: Feature request +description: Propose a safety, compatibility, validation, or documentation improvement. +title: "[Feature]: " +labels: + - enhancement +body: + - type: textarea + id: problem + attributes: + label: Problem + description: Describe the deployment problem or unsupported scenario. + validations: + required: true + - type: textarea + id: proposal + attributes: + label: Proposed behavior + description: Explain how the change remains fail-closed and avoids guessing a target disk. + validations: + required: true + - type: textarea + id: environment + attributes: + label: Target environment + description: Provide redacted ConfigMgr, WinPE, firmware, storage, and operating-system context. + validations: + required: true + - type: textarea + id: validation + attributes: + label: Validation plan + description: Describe synthetic tests and disposable-hardware validation that could establish confidence. + validations: + required: true diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 0000000..834fccf --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,17 @@ +## Summary + +Describe the focused change and the risk or deployment problem it addresses. + +## Safety impact + +- Explain how the fail-closed target-selection and pre-clean guards are preserved. +- Identify any changed support boundary, destructive behavior, or task-sequence requirement. +- Do not include disk serials, credentials, internal paths, or unredacted logs. + +## Validation + +- [ ] `powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\build\Invoke-Validation.ps1` passes. +- [ ] Root and packaged script copies remain byte-identical. +- [ ] New or changed logic has synthetic tests that do not modify hardware. +- [ ] Documentation reflects changed parameters, integration, or compatibility. +- [ ] Destructive behavior was tested only on disposable media, or the untested hardware boundary is stated explicitly. diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e98ac71..11590e0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,8 +16,8 @@ jobs: if (-not (Get-PSRepository -Name PSGallery -ErrorAction SilentlyContinue)) { Register-PSRepository -Default } - Install-Module Pester -RequiredVersion '5.7.1' -Repository PSGallery -Scope CurrentUser -Force + Install-Module Pester -RequiredVersion '6.2.0' -Repository PSGallery -Scope CurrentUser -Force Install-Module PSScriptAnalyzer -RequiredVersion '1.25.0' -Repository PSGallery -Scope CurrentUser -Force - Import-Module Pester -RequiredVersion '5.7.1' -Force + Import-Module Pester -RequiredVersion '6.2.0' -Force Import-Module PSScriptAnalyzer -RequiredVersion '1.25.0' -Force .\build\Invoke-Validation.ps1 diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..bbdea81 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,15 @@ +# Code of Conduct + +## Our standards + +Be respectful, constructive, and specific. Welcome participants with different backgrounds and experience levels. Discuss technical decisions and evidence without personal attacks, harassment, discrimination, or disclosure of another person's private information. + +## Project safety + +This project performs destructive disk operations. Do not encourage unsafe testing, conceal deployment risk, or publish disk serials, credentials, internal logs, or other sensitive deployment details. Use private vulnerability reporting for security concerns. + +## Enforcement + +Project maintainers may edit or remove comments, issues, pull requests, or other contributions that violate these standards, and may temporarily or permanently restrict participation for repeated or serious violations. + +Report conduct concerns privately to [vartaxe@outlook.com](mailto:vartaxe@outlook.com). Maintainers will review reports in good faith and protect reporter privacy where reasonably possible. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..b614986 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,20 @@ +# Contributing + +Contributions that improve safety, compatibility, tests, or documentation are welcome. + +## Before opening an issue + +- Use [private vulnerability reporting](https://github.com/vartaxe/ConfigMgr-OSD-DiskPartitionLayout/security/advisories/new) for security concerns. +- Do not publish disk serials, task-sequence logs, credentials, or internal deployment details. +- Search existing issues and include the exact ConfigMgr, WinPE, firmware, storage-controller, and disk context needed to reproduce the behavior. + +## Pull requests + +1. Create a focused branch from `main`. +2. Keep the root and `Scripts/Invoke-OSDDiskLayout.ps1` copies byte-identical. +3. Preserve the fail-closed safety model. A change must not guess a target disk, weaken identity rechecks, or move a destructive operation ahead of its guards. +4. Add synthetic tests for changed selection, planning, command, or postcondition logic. Tests must not clean or repartition hardware. +5. Run `powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\build\Invoke-Validation.ps1`. +6. Update user-facing documentation when support boundaries, parameters, task-sequence integration, or release behavior change. + +Pull requests should describe the risk addressed, the validation performed, and any remaining hardware-validation boundary. Automated tests do not establish field certification; test destructive behavior only on disposable disks in a controlled ConfigMgr/WinPE pilot. diff --git a/README.md b/README.md index cf85cc8..cd6be40 100644 --- a/README.md +++ b/README.md @@ -11,7 +11,7 @@ Select one approved target disk and create a firmware-appropriate GPT or MBR lay **Current version: 1.0.0.** This README follows `main`; published releases are versioned snapshots. -[Quick start](#quick-start) | [Task-sequence integration](TASK-SEQUENCE.md) | [Compatibility](docs/COMPATIBILITY-MATRIX.md) | [Security](SECURITY.md) +[Quick start](#quick-start) | [Task-sequence integration](TASK-SEQUENCE.md) | [Compatibility](docs/COMPATIBILITY-MATRIX.md) | [Contributing](CONTRIBUTING.md) | [Security](SECURITY.md) [![Release v1.0.0](https://img.shields.io/badge/RELEASE-v1.0.0-155799)](https://github.com/vartaxe/ConfigMgr-OSD-DiskPartitionLayout/releases/tag/v1.0.0) [![CI - main push](https://github.com/vartaxe/ConfigMgr-OSD-DiskPartitionLayout/actions/workflows/ci.yml/badge.svg?branch=main&event=push)](https://github.com/vartaxe/ConfigMgr-OSD-DiskPartitionLayout/actions/workflows/ci.yml?query=branch%3Amain+event%3Apush) diff --git a/Tests/Invoke-OSDDiskLayout.Tests.ps1 b/Tests/Invoke-OSDDiskLayout.Tests.ps1 index 2b7248b..29b6037 100644 --- a/Tests/Invoke-OSDDiskLayout.Tests.ps1 +++ b/Tests/Invoke-OSDDiskLayout.Tests.ps1 @@ -1,5 +1,5 @@ #Requires -Version 5.1 -# Requires Pester 5. These tests import ONLY pure functions from the script AST; +# Requires Pester 6. These tests import ONLY pure functions from the script AST; # they do not run the script entry point or invoke DiskPart. BeforeAll { diff --git a/build/Invoke-Validation.ps1 b/build/Invoke-Validation.ps1 index b713339..bc3faa0 100644 --- a/build/Invoke-Validation.ps1 +++ b/build/Invoke-Validation.ps1 @@ -8,7 +8,7 @@ $Package = Join-Path $Root 'Scripts\Invoke-OSDDiskLayout.ps1' $Test = Join-Path $Root 'Tests\Invoke-OSDDiskLayout.Tests.ps1' $AnalyzerSettings = Join-Path $Root 'PSScriptAnalyzerSettings.psd1' -Import-Module Pester -RequiredVersion '5.7.1' -ErrorAction Stop +Import-Module Pester -RequiredVersion '6.2.0' -ErrorAction Stop Import-Module PSScriptAnalyzer -RequiredVersion '1.25.0' -ErrorAction Stop foreach ($Path in @($Source, $Package, $Test)) {