build: optimize validation workflows

.github/dependabot.yml

@@ -1,8 +1,9 @@
+---
 # Dependabot configuration
 #
 # Grouping policy (aligned with microsoft/hve-core, optimized for fewer PRs):
 #   * One grouped PR per ecosystem per week (Monday 09:00 US/Pacific).
-#     Floor = 7 PRs/week (one per ecosystem) since Dependabot cannot group
+#     Floor = 8 PRs/week (one per ecosystem) since Dependabot cannot group
 #     across ecosystems.
 #   * Each ecosystem uses a single group named after the ecosystem itself,
 #     pattern "*", and update-types ["major", "minor", "patch"] so every
@@ -95,6 +96,33 @@ updates:
           - "patch"
     open-pull-requests-limit: 5
 
+  # Go modules
+  - package-ecosystem: "gomod"
+    directories:
+      - "/blueprints/full-single-node-cluster/tests"
+      - "/src/900-tools-utilities/904-test-utilities"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "US/Pacific"
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "security"
+      - "gomod"
+    groups:
+      gomod:
+        patterns:
+          - "*"
+        update-types:
+          - "major"
+          - "minor"
+          - "patch"
+    open-pull-requests-limit: 5
+
   # pip
   - package-ecosystem: "pip"
     directories:

.github/workflows/bicep-lint.yml

@@ -6,6 +6,8 @@
 #
 # Parameters:
 # - soft-fail: When true, lint violations are reported but do not fail the workflow (default: false)
+# - full-validation: When true, validates every Bicep file in the repository (default: true)
+# - bicep-folders-json: JSON object emitted by matrix-folder-check for scoped validation
 #
 # Usage Examples:
 # ```yaml
@@ -30,6 +32,16 @@ on:  # yamllint disable-line rule:truthy
         required: false
         type: boolean
         default: false
+      full-validation:
+        description: 'Whether to validate every Bicep file in the repository'
+        required: false
+        type: boolean
+        default: true
+      bicep-folders-json:
+        description: 'JSON object of Bicep folders to validate when full-validation is false'
+        required: false
+        type: string
+        default: '{}'
 
 permissions: {}
 
@@ -71,41 +83,17 @@ jobs:
 
       - name: Find and validate Bicep files
         id: bicep-build
-        shell: bash
+        shell: pwsh
+        env:
+          BICEP_FOLDERS_JSON: ${{ inputs.bicep-folders-json }}
+          FULL_VALIDATION: ${{ inputs.full-validation }}
         run: |
-          set -euo pipefail
-          FAILED=0
-          FILES_CHECKED=0
-          FAILURES=""
-
-          while IFS= read -r -d '' file; do
-            if [[ "$file" == *node_modules* ]] || [[ "$file" == *.copilot-tracking* ]]; then
-              continue
-            fi
-            FILES_CHECKED=$((FILES_CHECKED + 1))
-            echo "::group::Validating: $file"
-            if ! az bicep build --file "$file" --stdout > /dev/null 2>&1; then
-              FAILED=$((FAILED + 1))
-              FAILURES="${FAILURES}\n- ${file}"
-              echo "::error file=${file}::Bicep build failed for ${file}"
-              az bicep build --file "$file" --stdout 2>&1 || true
-            fi
-            echo "::endgroup::"
-          done < <(find . -name '*.bicep' -print0)
-
-          echo "files-checked=${FILES_CHECKED}" >> "$GITHUB_OUTPUT"
-          echo "failures=${FAILED}" >> "$GITHUB_OUTPUT"
-
-          SUMMARY="## Bicep Lint Results\n\n- **Files checked:** ${FILES_CHECKED}\n- **Failures:** ${FAILED}"
-          if [ "$FAILED" -gt 0 ]; then
-            SUMMARY="${SUMMARY}\n\n### Failed files\n${FAILURES}"
-          fi
-          echo -e "$SUMMARY" >> "$GITHUB_STEP_SUMMARY"
-          echo -e "$SUMMARY" > bicep-lint-output.txt
-
-          if [ "$FAILED" -gt 0 ]; then
-            echo "BICEP_LINT_FAILED=true" >> "$GITHUB_ENV"
-          fi
+          ./scripts/build/Invoke-BicepLint.ps1 `
+            -Platform github `
+            -FullValidation $env:FULL_VALIDATION `
+            -BicepFoldersJson $env:BICEP_FOLDERS_JSON `
+            -ResultsDir bicep-lint-results `
+            -OutputFile bicep-lint-output.txt
 
       - name: Upload lint results
         if: always()
@@ -117,14 +105,15 @@ jobs:
           if-no-files-found: ignore
 
       - name: Fail on violations
-        if: env.BICEP_LINT_FAILED == 'true'
-        shell: bash
+        if: steps.bicep-build.outputs.failures != '0'
+        shell: pwsh
         env:
           SOFT_FAIL: ${{ inputs.soft-fail }}
         run: |
-          if [ "$SOFT_FAIL" = "true" ]; then
-            echo "::warning::Bicep lint found violations (soft-fail enabled)"
-          else
-            echo "::error::Bicep lint found violations"
+          if ($env:SOFT_FAIL -eq 'true') {
+            Write-Output '::warning::Bicep lint found violations (soft-fail enabled)'
+          }
+          else {
+            Write-Output '::error::Bicep lint found violations'
             exit 1
-          fi
+          }

.github/workflows/docs-automation.yml

@@ -71,20 +71,28 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Run docs health check
-        uses: Azure/powershell@f5b8adcfff1904872c7b98d4012d4914d74b1a82 # v3.0.0
-        with:
-          inlineScript: |
-            Write-Host "PowerShell version: $($PSVersionTable.PSVersion)"
-          azPSVersion: 'latest'
+      - name: Fetch base ref for changed-files scoping
+        if: github.event_name == 'pull_request'
+        shell: bash
+        run: |
+          set -euo pipefail
+          git fetch --no-tags --depth=1 origin "$GITHUB_BASE_REF"
 
       - name: Validate frontmatter consistency
         shell: pwsh
         run: |
           Write-Host "🔍 Validating frontmatter across all markdown files..."
 
-          # Use the dedicated validation script (same as Azure DevOps pipeline)
-          & "./scripts/Validate-MarkdownFrontmatter.ps1" -Paths @('docs', 'src', 'blueprints') -Verbose
+          $frontmatterArgs = @{
+            Paths   = @('docs', 'src', 'blueprints')
+            Verbose = $true
+          }
+          if ($env:GITHUB_EVENT_NAME -eq 'pull_request') {
+            $frontmatterArgs['ChangedFilesOnly'] = $true
+            $frontmatterArgs['BaseBranch']       = "origin/$($env:GITHUB_BASE_REF)"
+          }
+
+          & "./scripts/Validate-MarkdownFrontmatter.ps1" @frontmatterArgs
 
           if ($LASTEXITCODE -ne 0) {
             Write-Host "❌ Frontmatter validation failed" -ForegroundColor Red
@@ -96,7 +104,6 @@ jobs:
   validate-links:
     name: 🔗 Validate Documentation Links
     runs-on: ubuntu-latest
-    needs: validate-frontmatter
     permissions:
       contents: read
     steps:
@@ -107,6 +114,8 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '24'
+          cache: 'npm'
+          cache-dependency-path: '.github/scripts/markdown-link-check/package-lock.json'
 
       - name: Install markdown-link-check
         # Pinned via .github/scripts/markdown-link-check/package-lock.json so the
@@ -142,10 +151,10 @@ jobs:
           # Check all markdown files
           MLC=".github/scripts/markdown-link-check/node_modules/.bin/markdown-link-check"
           find docs src blueprints .github copilot \
-            -name "*.md" -type f | \
-            grep -v node_modules | \
-            xargs -I {} sh -c 'echo "Checking: {}" &&
-              "'"$MLC"'" {} --config .markdown-link-check.json'
+            -type f -name '*.md' \
+            -not -path '*/node_modules/*' \
+            -print0 \
+          | xargs -0 -P "$(nproc)" -n 25 "$MLC" --config .markdown-link-check.json
 
   report-documentation-health:
     name: 📊 Documentation Health Report

.github/workflows/docs-check-bicep.yml

@@ -67,14 +67,6 @@ jobs:
     steps:
       - name: Checkout Code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0  # Full git history for comparison
-
-      - name: Setup PowerShell
-        run: |
-          echo "PowerShell Version: $($PSVersionTable.PSVersion)"
-          echo "PowerShell Edition: $($PSVersionTable.PSEdition)"
-        shell: pwsh
 
       - name: Setup Azure CLI with Bicep
         run: |
@@ -104,27 +96,29 @@ jobs:
           az bicep version
         shell: bash
 
-      - name: Check for changes in Bicep documentation
-        id: docs-check-bicep
+      - name: Check Bicep docs drift
+        id: bicep_docs_drift
+        shell: bash
         run: |
-          # Run the bicep-docs-check.sh script and capture its output
-          docs_changed=$(tail -n 1 $(pwd)/scripts/bicep-docs-check.sh)
-
-          # Check if there are any changes in the Bicep documentation
-          if [ "$docs_changed" = true ]; then
-            echo "Updates are required for Bicep documentation."
-            echo "Please go into the project's scripts directory, run the update-all-bicep-docs.sh script and commit changes."
+          set -euo pipefail
+          # bicep-docs-check.sh writes progress to stdout and ends with `echo $docs_changed` (true|false)
+          docs_changed="$(./scripts/bicep-docs-check.sh | tail -n 1)"
+          echo "changed=${docs_changed}" >> "$GITHUB_OUTPUT"
 
-            echo "::warning::Bicep auto-gen documentation needs to be updated. Please run the scripts/update-all-bicep-docs.sh script and commit the changes."
+      - name: Report Bicep docs drift
+        if: steps.bicep_docs_drift.outputs.changed == 'true'
+        shell: bash
+        run: |
+          echo "Updates are required for Bicep documentation."
+          echo "Please go into the project's scripts directory, run the update-all-bicep-docs.sh script and commit changes."
+          echo "::warning::Bicep auto-gen documentation needs to be updated. Please run the scripts/update-all-bicep-docs.sh script and commit the changes."
 
-            if [[ "${{ env.BREAK_BUILD }}" == "true" ]]; then
-              echo "::error::Bicep auto-gen documentation needs to be updated. Please run the scripts/update-all-bicep-docs.sh script and commit the changes."
-              exit 1
-            fi
-          else
-            echo "No updates detected in the Bicep documentation."
-          fi
+      - name: Fail when Bicep docs are out of date
+        if: steps.bicep_docs_drift.outputs.changed == 'true' && env.BREAK_BUILD == 'true'
         shell: bash
+        run: |
+          echo "::error::Bicep auto-gen documentation needs to be updated. Please run the scripts/update-all-bicep-docs.sh script and commit the changes."
+          exit 1
 
       - name: Check for language path segments in links
         id: link-lang-check

.github/workflows/docs-check-terraform.yml

@@ -78,39 +78,35 @@ jobs:
     steps:
       - name: Checkout Code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0  # Full git history for comparison
-
-      - name: Setup PowerShell
-        run: |
-          echo "PowerShell Version: $($PSVersionTable.PSVersion)"
-          echo "PowerShell Edition: $($PSVersionTable.PSEdition)"
-        shell: pwsh
 
       - name: Install terraform-docs
         run: |
           ./scripts/install-terraform-docs.sh -v "${{ inputs.terraformDocsVersion }}"
         shell: bash
 
-      - name: Check for changes in documentation
+      - name: Check Terraform docs drift
+        id: tf_docs_drift
+        shell: bash
         run: |
-          # Call tf-docs-check.sh script to check for changes
-          ./scripts/tf-docs-check.sh
-          readme_changed=$(tail -n 1 $(pwd)/scripts/tf-docs-check.sh)
+          set -euo pipefail
+          # tf-docs-check.sh writes progress to stdout and ends with `echo $readme_changed` (true|false)
+          readme_changed="$(./scripts/tf-docs-check.sh | tail -n 1)"
+          echo "changed=${readme_changed}" >> "$GITHUB_OUTPUT"
 
-          # Check if there are any changes in the documentation
-          if [ "$readme_changed" = true ]; then
-            echo "Updates are required for documentation."
-            echo "Please go into the project's src directory, run the update-all-terraform-docs.sh script, and commit changes."
-            echo "::warning::Documentation needs to be updated. Please run the update-all-terraform-docs.sh script and commit the changes."
-            if [[ "${{ inputs.break_build }}" == "true" ]]; then
-              echo "::error::Documentation needs to be updated. Please run the update-all-terraform-docs.sh script and commit the changes."
-              exit 1
-            fi
-          else
-            echo "No updates detected in the documentation."
-          fi
+      - name: Report Terraform docs drift
+        if: steps.tf_docs_drift.outputs.changed == 'true'
         shell: bash
+        run: |
+          echo "Updates are required for documentation."
+          echo "Please go into the project's src directory, run the update-all-terraform-docs.sh script, and commit changes."
+          echo "::warning::Documentation needs to be updated. Please run the update-all-terraform-docs.sh script and commit the changes."
+
+      - name: Fail when Terraform docs are out of date
+        if: steps.tf_docs_drift.outputs.changed == 'true' && inputs.break_build == true
+        shell: bash
+        run: |
+          echo "::error::Documentation needs to be updated. Please run the update-all-terraform-docs.sh script and commit the changes."
+          exit 1
 
       - name: Check for language path segments in links
         id: link-lang-check

.github/workflows/docs-lint.yml

@@ -49,6 +49,7 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '24'
+          cache: 'npm'
 
       - name: Install dependencies
         run: npm ci

.github/workflows/matrix-folder-check.yml

@@ -123,6 +123,12 @@ on:  # yamllint disable-line rule:truthy
       changedBicepFolders:
         description: 'JSON matrix of Bicep folders that have changed'
         value: ${{ jobs.map-outputs.outputs.changedBicepFolders }}
+      bicepFullValidationRequired:
+        description: 'Whether Bicep validation must run across all folders'
+        value: ${{ jobs.map-outputs.outputs.bicepFullValidationRequired }}
+      bicepFullValidationReasons:
+        description: 'JSON array of reasons that require full Bicep validation'
+        value: ${{ jobs.map-outputs.outputs.bicepFullValidationReasons }}
       changesInApplications:
         description: 'Whether any Application folders have changed'
         value: ${{ jobs.map-outputs.outputs.changesInApplications }}
@@ -165,6 +171,8 @@ jobs:
       changedTfFolders: ${{ steps.detect.outputs.changedTfFolders }}
       changesInBicepInstall: ${{ steps.detect.outputs.changesInBicepInstall }}
       changedBicepFolders: ${{ steps.detect.outputs.changedBicepFolders }}
+      bicepFullValidationRequired: ${{ steps.detect.outputs.bicepFullValidationRequired }}
+      bicepFullValidationReasons: ${{ steps.detect.outputs.bicepFullValidationReasons }}
       changesInApplications: ${{ steps.detect.outputs.changesInApplications }}
       changedApplicationFolders: ${{ steps.detect.outputs.changedApplicationFolders }}
       changesInFuzzRust: ${{ steps.detect.outputs.changesInFuzzRust }}
@@ -213,8 +221,10 @@ jobs:
           "powershellChanges=$($jsonData.subscription.powershell_changes)" >> $env:GITHUB_OUTPUT
           "changesInTerraformInstall=$($jsonData.terraform.has_changes)" >> $env:GITHUB_OUTPUT
           "changedTfFolders=$($jsonData.terraform.folders | ConvertTo-Json -Compress)" >> $env:GITHUB_OUTPUT
-          "changesInBicepInstall=$($jsonData.bicep.has_changes)" >> $env:GITHUB_OUTPUT
+          "changesInBicepInstall=$($jsonData.bicep.has_changes.ToString().ToLower())" >> $env:GITHUB_OUTPUT
           "changedBicepFolders=$($jsonData.bicep.folders | ConvertTo-Json -Compress)" >> $env:GITHUB_OUTPUT
+          "bicepFullValidationRequired=$($jsonData.bicep.full_validation_required.ToString().ToLower())" >> $env:GITHUB_OUTPUT
+          "bicepFullValidationReasons=$($jsonData.bicep.full_validation_reasons | ConvertTo-Json -Compress)" >> $env:GITHUB_OUTPUT
           "changesInApplications=$($jsonData.applications.has_changes)" >> $env:GITHUB_OUTPUT
           "changedApplicationFolders=$($jsonData.applications.folders | ConvertTo-Json -Compress)" >> $env:GITHUB_OUTPUT
           if ($jsonData.PSObject.Properties.Name -contains 'fuzz') {
@@ -242,6 +252,8 @@ jobs:
           Write-Host "Terraform folders: $($jsonData.terraform.folders | ConvertTo-Json)"
           Write-Host "Bicep changes: $($jsonData.bicep.has_changes)"
           Write-Host "Bicep folders: $($jsonData.bicep.folders | ConvertTo-Json)"
+          Write-Host "Bicep full validation required: $($jsonData.bicep.full_validation_required)"
+          Write-Host "Bicep full validation reasons: $($jsonData.bicep.full_validation_reasons | ConvertTo-Json)"
           Write-Host "Application changes: $($jsonData.applications.has_changes)"
           Write-Host "Application folders: $($jsonData.applications.folders | ConvertTo-Json)"
           if ($jsonData.PSObject.Properties.Name -contains 'fuzz') {
@@ -263,6 +275,8 @@ jobs:
       changedTfFolders: ${{ needs.detect-changes.outputs.changedTfFolders }}
       changesInBicepInstall: ${{ needs.detect-changes.outputs.changesInBicepInstall }}
       changedBicepFolders: ${{ needs.detect-changes.outputs.changedBicepFolders }}
+      bicepFullValidationRequired: ${{ needs.detect-changes.outputs.bicepFullValidationRequired }}
+      bicepFullValidationReasons: ${{ needs.detect-changes.outputs.bicepFullValidationReasons }}
       changesInApplications: ${{ needs.detect-changes.outputs.changesInApplications }}
       changedApplicationFolders: ${{ needs.detect-changes.outputs.changedApplicationFolders }}
       changesInFuzzRust: ${{ needs.detect-changes.outputs.changesInFuzzRust }}