Fixing build - Module Manifest updates by gaelcolas · Pull Request #933 · microsoft/zerotrustassessment

gaelcolas · 2026-02-20T21:52:00Z

@merill : This PR is only to be merged after #934 (will rebase once merged and set to ready)

This fix replaces the broken PowerShellGet/Update-ModuleManifest with @Jaykul's Update-Metadata (from his Metadata module) to update the ModuleManifest during build (RequiredAssemblies, NestedModules, FileList, ModuleVersion, FunctionsToExport, Prerelease...)

Setting minimum version for Graph Auth/Teams to 2.35.1 Adding Clear-ZtRequiredModules for cleanup

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…ResourceGet

…duleManifest

Copilot

Pull request overview

This PR modernizes the build system by replacing the broken PowerShellGet/Update-ModuleManifest cmdlet with the Update-Metadata cmdlet from @Jaykul's Metadata module. This change is necessary to properly update module manifest properties during the build process without corrupting custom PrivateData keys. The PR also updates Microsoft Graph module dependencies, adds a new cleanup function, and changes the default service connection behavior.

Changes:

Replaced Update-ModuleManifest with Update-Metadata throughout build scripts to avoid manifest corruption issues
Updated Microsoft.Graph.Authentication and Microsoft.Graph.Beta.Teams minimum versions to 2.35.0
Added Clear-ZtRequiredModule function to cleanup downloaded module dependencies
Changed default Service parameter from 'Graph' to 'All' in Connect-ZtAssessment
Refactored dependency resolution logic to use Find-PSResource before Save-PSResource for better version control

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
src/powershell/public/Connect-ZtAssessment.ps1	Updated documentation and changed default Service parameter to 'All'; updated Graph module versions
src/powershell/public/Clear-ZtRequiredModule.ps1	New function to remove downloaded module dependencies from cache directories
src/powershell/ZeroTrustAssessment.psd1	Updated Graph module versions in manifest and added Clear-ZtRequiredModule to exports
src/powershell/Initialize-Dependencies.ps1	Refactored module dependency resolution with Find-PSResource approach
build/powershell/Update-PSModuleManifest.ps1	Replaced Update-ModuleManifest with Update-Metadata for safer manifest updates
build/powershell/Set-Version.ps1	Replaced Update-ModuleManifest with Update-Metadata
build/powershell/Resolve-PSDependencies.ps1	Refactored module dependency resolution logic
build/powershell/Install-Prerequisites.ps1	Added Metadata module as build prerequisite
build/common-functions.ps1	Replaced Update-ModuleManifest with Update-Metadata and cleaned up trailing whitespace
build/commands/Set-TestMetadata.ps1	Fixed parameter indentation formatting

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-20T22:02:21Z

src/powershell/public/Connect-ZtAssessment.ps1

+        @{ModuleName = 'Microsoft.Graph.Authentication'; GUID = '883916f2-9184-46ee-b1f8-b6a2fb784cee'; ModuleVersion = '2.35.0'; },
+        @{ModuleName = 'Microsoft.Graph.Beta.Teams'; GUID = 'e264919d-7ae2-4a89-ba8b-524bd93ddc08'; ModuleVersion = '2.35.0'; },


The PR description for #924 mentions setting minimum version for Graph Auth/Teams to 2.35.1, but this PR updates the version to 2.35.0. This inconsistency should be resolved - either update the code to use 2.35.1 as stated in the dependency PR #924, or clarify why 2.35.0 is being used instead.

Copilot · 2026-02-20T22:02:22Z

src/powershell/public/Clear-ZtRequiredModule.ps1

+        if ($isWindows -and (Get-Command -Name Set-Clipboard -ErrorAction SilentlyContinue)) {
+            Set-Clipboard -Value ('&''{0}''' -f $PSCommandPath)
+            Write-Warning -Message '(The command has been copied to your clipboard.)'
+        }
+        return
+    }
+    else
+    {
+        Write-Verbose -Message 'Clearing ZTA required modules from the current session.'
+    }
+
+    # Remove all ZTA-related modules from the current session
+    if ($isWindows) {


The variable name should be $IsWindows (capital I) to match the PowerShell automatic variable and be consistent with the rest of the codebase. The lowercase $isWindows will cause this code to fail as the variable is undefined.

src/powershell/Initialize-Dependencies.ps1

Copilot · 2026-02-20T22:02:22Z

build/powershell/Resolve-PSDependencies.ps1

+                    }
+                    elseif ($moduleSpec.Version) {
+                        # Minimum version inclusive
+                         $findModuleParams['Version'] = '[{0}, )' -f $moduleSpec.Version


There's inconsistent indentation here - this line has an extra space at the beginning compared to the other similar lines (106-116). Should align with the other conditional branches for consistency.

Suggested change

$findModuleParams['Version'] = '[{0}, )' -f $moduleSpec.Version

$findModuleParams['Version'] = '[{0}, )' -f $moduleSpec.Version

Copilot · 2026-02-20T22:02:23Z

src/powershell/Initialize-Dependencies.ps1

+                        Force = $true
+                        Path = $RequiredModulesPath
+                    }
+


When using Save-Module (as opposed to Save-PSResource), the AllowPrerelease parameter should be passed if $AllowPrerelease.IsPresent is true, otherwise prerelease versions won't be saved when requested. Add the AllowPrerelease parameter to $saveModuleCmdParams conditionally based on the $AllowPrerelease parameter.

Suggested change

if ($AllowPrerelease.IsPresent)

{

$saveModuleCmdParams['AllowPrerelease'] = $true

}

build/powershell/Resolve-PSDependencies.ps1

src/powershell/public/Clear-ZtRequiredModule.ps1

build/powershell/Install-Prerequisites.ps1

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

build/powershell/Update-PSModuleManifest.ps1:75

The Install-Module call here fetches and installs required modules from the public PSGallery with -Force, -SkipPublisherCheck, and no explicit version pinning, which creates a strong supply-chain risk. If an attacker compromises or typosquats a required module on PSGallery, this build script will silently install and later execute that malicious code with your build/developer privileges. To mitigate this, pin modules to specific versions (or verified publisher/signature), avoid -SkipPublisherCheck for production/build automation, and consider using a private/curated repository instead of the public gallery for build-time dependencies.

## Install Module Dependencies
foreach ($Module in $ModuleManifest['RequiredModules']) {
    if ($Module -is [hashtable]) { $ModuleName = $Module.ModuleName }
    else { $ModuleName = $Module }
    if ($ModuleName -notin $ModuleManifest.PrivateData.PSData['ExternalModuleDependencies'] -and !(Get-Module $ModuleName -ListAvailable)) {
        Install-Module $ModuleName -Force -SkipPublisherCheck -Repository PSGallery -AcceptLicense
    }

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-20T22:16:13Z

src/powershell/public/Clear-ZtRequiredModule.ps1

+        Write-Warning -Message 'This command cannot be run when the module is loaded.'
+        Write-Warning -Message 'Please close all sessions where ZeroTrustAssessment module is loaded, then run the following...'
+        Write-Warning -Message ('&''{0}''' -f $PSCommandPath)
+        if ($isWindows -and (Get-Command -Name Set-Clipboard -ErrorAction SilentlyContinue)) {


Incorrect casing for the automatic variable. Should use $IsWindows (with capital 'I') instead of $isWindows to match PowerShell's automatic variable naming and be consistent with the rest of the codebase.

Copilot · 2026-02-20T22:16:14Z

build/powershell/Update-PSModuleManifest.ps1

+# if ($paramUpdateModuleManifest.ContainsKey('RequiredAssemblies')) {
+#     if (!$paramUpdateModuleManifest['RequiredAssemblies']) { $paramUpdateModuleManifest.Remove('RequiredAssemblies') }
+#     (Get-Content $ModuleManifestFileInfo.FullName -Raw) -replace "(?s)(#\s*)?RequiredAssemblies\s*=\s*@\([^)]*\)", "# RequiredAssemblies = @()" | Set-Content $ModuleManifestFileInfo.FullName
+# }
+# if ($paramUpdateModuleManifest.ContainsKey('NestedModules') -and !$paramUpdateModuleManifest['NestedModules']) {
+#     $paramUpdateModuleManifest.Remove('NestedModules')
+#     (Get-Content $ModuleManifestFileInfo.FullName -Raw) -replace "(?s)(#\s*)?NestedModules\s*=\s*@\([^)]*\)", "# NestedModules = @()" | Set-Content $ModuleManifestFileInfo.FullName
+# }
+# if ($paramUpdateModuleManifest.ContainsKey('FileList')) {
+#     (Get-Content $ModuleManifestFileInfo.FullName -Raw) -replace "(?s)(#\s*)?FileList\s*=\s*@\([^)]*\)", "# FileList = @()" | Set-Content $ModuleManifestFileInfo.FullName
+# }


Consider removing the commented-out code instead of leaving it in the file. Dead code can cause confusion and reduce maintainability. If the old implementation needs to be referenced, it's available in version control history.

gaelcolas and others added 11 commits February 19, 2026 16:57

Setting default Service to All

0836290

Setting minimum version for Graph Auth/Teams to 2.35.1 Adding Clear-ZtRequiredModules for cleanup

fixing function name

03efde0

Update src/powershell/public/Clear-ZtRequiredModule.ps1

b01876b

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

fixing module version req everywhere

c7c526a

adding CBHelp

b53f1a1

fixing help

918073b

fixing help.

6569f76

improving help

dedb802

Forcing the Save of highest module version available in range with PS…

c292e78

…ResourceGet

updating build to use Metadata module instead of the broken Update-Mo…

1278c43

…duleManifest

updating build to better update module manifest

9670d9e

Copilot AI review requested due to automatic review settings February 20, 2026 21:52

Copilot started reviewing on behalf of gaelcolas February 20, 2026 21:52 View session

Copilot AI reviewed Feb 20, 2026

View reviewed changes

Update src/powershell/public/Clear-ZtRequiredModule.ps1

87d79b3

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings February 20, 2026 22:08

Copilot started reviewing on behalf of gaelcolas February 20, 2026 22:09 View session

gaelcolas and others added 2 commits February 20, 2026 23:10

Update build/powershell/Resolve-PSDependencies.ps1

9ade897

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update src/powershell/Initialize-Dependencies.ps1

b794dfb

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI reviewed Feb 20, 2026

View reviewed changes

gaelcolas closed this Mar 8, 2026

gaelcolas deleted the fix/build branch March 8, 2026 23:42

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fixing build - Module Manifest updates#933

Fixing build - Module Manifest updates#933
gaelcolas wants to merge 14 commits intomainfrom
fix/build

gaelcolas commented Feb 20, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 20, 2026

Uh oh!

Copilot AI Feb 20, 2026

Uh oh!

Uh oh!

Copilot AI Feb 20, 2026

Uh oh!

Copilot AI Feb 20, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 20, 2026

Uh oh!

Copilot AI Feb 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		@{ModuleName = 'Microsoft.Graph.Authentication'; GUID = '883916f2-9184-46ee-b1f8-b6a2fb784cee'; ModuleVersion = '2.35.0'; },
		@{ModuleName = 'Microsoft.Graph.Beta.Teams'; GUID = 'e264919d-7ae2-4a89-ba8b-524bd93ddc08'; ModuleVersion = '2.35.0'; },

	$findModuleParams['Version'] = '[{0}, )' -f $moduleSpec.Version
	$findModuleParams['Version'] = '[{0}, )' -f $moduleSpec.Version

+                    if ($AllowPrerelease.IsPresent)
+                    {
+                        $saveModuleCmdParams['AllowPrerelease'] = $true
+                    }

Conversation

gaelcolas commented Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

gaelcolas commented Feb 20, 2026 •

edited

Loading