fix(task): align Azure extension with CLI v1

.github/CODEOWNERS

@@ -0,0 +1,5 @@
+* @metalagman
+
+/.github/ @metalagman
+/tasks/ @metalagman
+/vss-extension.json @metalagman

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,24 @@
+name: Bug report
+description: Report a reproducible Azure DevOps extension defect
+title: "bug: "
+labels: [bug]
+body:
+  - type: textarea
+    id: behavior
+    attributes:
+      label: Observed behavior
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Minimal pipeline and logs
+      description: Remove credentials and private source before posting.
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Extension and task version
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security report
+    url: https://github.com/diffpal/azure-devops/security/advisories/new
+    about: Report vulnerabilities privately.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,9 @@
+## Summary
+
+<!-- What changes, why, and which dp- issue tracks it? -->
+
+## Validation
+
+- [ ] Task tests, packaging, and the staged CLI contract pass.
+- [ ] Input, output, and compatibility changes are documented.
+- [ ] Security and secret-handling impact has been considered.

.github/workflows/ci.yml

@@ -11,9 +11,9 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 20
           cache: npm
@@ -27,6 +27,26 @@ jobs:
       - name: Smoke test task handler
         run: npm run smoke
 
+      - name: Check out DiffPal CLI contract
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          repository: diffpal/diffpal
+          ref: develop
+          path: .tmp/diffpal
+
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        with:
+          go-version-file: .tmp/diffpal/go.mod
+
+      - name: Build staged DiffPal CLI
+        working-directory: .tmp/diffpal
+        run: go build -o "$RUNNER_TEMP/diffpal" ./cmd/diffpal
+
+      - name: Verify CLI v1 contract
+        env:
+          DIFFPAL_BIN: ${{ runner.temp }}/diffpal
+        run: bash scripts/cli-contract-test.sh
+
       - name: Package production extension
         run: npm run package:prod
 

.github/workflows/release.yml

@@ -31,9 +31,9 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 20
           cache: npm
@@ -78,7 +78,7 @@ jobs:
           npm run package:dev
 
       - name: Upload Azure DevOps extension artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: azure-devops-vsix
           path: |
@@ -94,9 +94,9 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 20
           cache: npm
@@ -105,7 +105,7 @@ jobs:
         run: npm ci
 
       - name: Download Azure DevOps extension artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: azure-devops-vsix
           path: dist
@@ -130,7 +130,6 @@ jobs:
               --vsix "$path" \
               --auth-type pat \
               --token "$AZURE_DEVOPS_EXT_PAT" \
-              --no-wait-validation \
               --no-prompt
           }
 

DiffPalReviewDevV1/task.json

@@ -9,8 +9,8 @@
   "author": "DiffPal",
   "version": {
     "Major": 1,
-    "Minor": 6,
-    "Patch": 17
+    "Minor": 7,
+    "Patch": 0
   },
   "minimumAgentVersion": "3.224.0",
   "instanceNameFormat": "DiffPal Review Dev",
@@ -28,8 +28,8 @@
       "type": "string",
       "label": "DiffPal version",
       "required": false,
-      "defaultValue": "0.1.39",
-      "helpMarkDown": "npm version or dist-tag for @diffpal/diffpal."
+      "defaultValue": "1",
+      "helpMarkDown": "npm version or dist-tag for @diffpal/diffpal. Use an exact v1 release for reproducible CI."
     },
     {
       "name": "diffpalPath",

DiffPalReviewV1/task.json

@@ -9,8 +9,8 @@
   "author": "DiffPal",
   "version": {
     "Major": 1,
-    "Minor": 6,
-    "Patch": 17
+    "Minor": 7,
+    "Patch": 0
   },
   "minimumAgentVersion": "3.224.0",
   "instanceNameFormat": "DiffPal Review",
@@ -28,8 +28,8 @@
       "type": "string",
       "label": "DiffPal version",
       "required": false,
-      "defaultValue": "0.1.39",
-      "helpMarkDown": "npm version or dist-tag for @diffpal/diffpal."
+      "defaultValue": "1",
+      "helpMarkDown": "npm version or dist-tag for @diffpal/diffpal. Use an exact v1 release for reproducible CI."
     },
     {
       "name": "diffpalPath",

README.md

@@ -20,9 +20,9 @@ VSIX packaging, and Marketplace release flow.
 
 The task installs `@diffpal/diffpal` by default and runs `diffpal review ado`.
 Bring the provider recipe you want to use; the Azure review flow stays the same.
-By default it installs `@diffpal/diffpal@0.1.37`, the tested CLI release paired
-with this extension. Set `diffpalVersion` only when you need to override that
-default rollout.
+By default it installs `@diffpal/diffpal@1`, keeping the task on the compatible
+CLI v1 line. Set `diffpalVersion` to an exact v1 release when you need fully
+reproducible CI.
 
 ## Behavior
 
@@ -70,7 +70,7 @@ steps:
   - task: DiffPalReview@1
     displayName: DiffPal review
     inputs:
-      diffpalVersion: 0.1.37
+      diffpalVersion: 1.0.0
       profile: ci
       feedback: review
     env:
@@ -194,7 +194,7 @@ VSIX files are written to `dist/`.
 Set versions before tagging:
 
 ```bash
-task release:set-version VERSION=0.1.39 TASK_VERSION=1.6.15
+task release:set-version VERSION=1.0.0 TASK_VERSION=1.7.0
 ```
 
 Publish uses the `release.yml` workflow and requires `AZURE_DEVOPS_EXT_PAT` in the `azure-devops-marketplace` GitHub Environment.

SECURITY.md

@@ -0,0 +1,11 @@
+# Security Policy
+
+Security fixes are provided for the latest released major version.
+
+Do not open a public issue for a suspected vulnerability. Report it through
+[GitHub private vulnerability reporting](https://github.com/diffpal/azure-devops/security/advisories/new)
+with reproduction steps and impact. We aim to acknowledge reports within three
+business days and coordinate remediation and disclosure with the reporter.
+
+Issues in the DiffPal CLI itself should be reported to the
+[core repository](https://github.com/diffpal/diffpal/security/advisories/new).

package.json

@@ -4,7 +4,7 @@
     "url": "https://github.com/diffpal/azure-devops/issues"
   },
   "dependencies": {
-    "azure-pipelines-task-lib": "5.2.10"
+    "azure-pipelines-task-lib": "5.277.0"
   },
   "description": "Azure DevOps extension and pipeline task for DiffPal review",
   "devDependencies": {
@@ -18,9 +18,6 @@
   "homepage": "https://github.com/diffpal/azure-devops#readme",
   "license": "MIT",
   "name": "@diffpal/azure-devops-extension",
-  "overrides": {
-    "uuid": "3.4.0"
-  },
   "private": true,
   "repository": {
     "type": "git",
@@ -34,5 +31,5 @@
     "publish:prod": "npm run build \u0026\u0026 tfx extension publish --manifest-globs vss-extension.json",
     "smoke": "npm run build \u0026\u0026 node scripts/smoke-test.js"
   },
-  "version": "0.1.41"
-}
+  "version": "1.0.0"
+}

scripts/cli-contract-test.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+diffpal_bin="${DIFFPAL_BIN:?DIFFPAL_BIN is required}"
+help="$($diffpal_bin review ado --help)"
+
+for flag in \
+  --base \
+  --head \
+  --profile \
+  --block-on \
+  --gate \
+  --feedback \
+  --summary-overview \
+  --out \
+  --repo \
+  --review-id \
+  --language \
+  --instructions \
+  --instructions-file; do
+  if ! grep -Fq -- "$flag" <<<"$help"; then
+    echo "DiffPal CLI contract is missing $flag" >&2
+    exit 1
+  fi
+done
+
+echo "DiffPal CLI v1 contract passed"

scripts/smoke-test.js

@@ -155,8 +155,9 @@ function testDefaultPinnedVersionIsUsedWhenInputIsUnset() {
     PATH: `${fakeBin}${path.delimiter}${process.env.PATH || ""}`
   });
 
-  assert(read(npmArgv).includes("@diffpal/diffpal@0.1.39"), "default install did not request the pinned DiffPal version");
-  assert(read(diffpalArgv).includes("review\nado"), "default pinned version did not run diffpal review ado");
+  assert(read(npmArgv).includes("@diffpal/diffpal@1"), "default install did not request CLI major 1");
+  assert(read(npmArgv).includes("--ignore-scripts"), "default install did not disable npm lifecycle scripts");
+  assert(read(diffpalArgv).includes("review\nado"), "default CLI v1 did not run diffpal review ado");
 }
 
 function testDebugInputForwardsDebugFlag() {