0.27.0: harness fixes for PowerShell 7 and Entra accounts, rule corrections from round 10

[fadwen]

Summary

Version 0.27.0. Bumps ModuleVersion, moves the changelog's Unreleased section under the new version and adds the manifest's release notes. No code changes: everything released here was merged in #4, #5 and #6.

What 0.27.0 contains

Runtime harness

• A user-context run started from PowerShell 7 gave the Windows PowerShell 5.1 host PowerShell 7's module path: no Cert: drive, and Get-AuthenticodeSignature and ConvertTo-SecureString failed to load (Harness module path under PowerShell 7, and rule fixes backed by validation round 10 #4).
• -Credential did not find a Microsoft Entra account's session, because Windows names such an account after its display name and not its sign-in name (Harness: -Credential finds a Microsoft Entra account's session #6).
• Under -ErrorAction Stop on 5.1, a refused grant on the run folder lost its message (Harness: -Credential finds a Microsoft Entra account's session #6).

Rules, each backed by validation round 10 (#4)

• IslPowerShell7Syntax: a cmdlet or parameter only PowerShell 7 has, and ForEach-Object -Parallel, are reported as what they are under 5.1, a call that fails while the script carries on. Out-File -Encoding utf8NoBOM, listed in the rule but never matched, is a finding.
• IslInteractiveCall: Get-Credential -Credential handed something that may be a built credential is a warning, not an error.
• IslContextIssue: the drive-letter finding is Information, since the letter cannot say whether it is a mapped drive.

Repair-IntuneScript

• No longer turns return 1; exit 1 into 1; exit 0; exit 1 with no finding left (Harness module path under PowerShell 7, and rule fixes backed by validation round 10 #4).

Documentation

• What Invoke-ScriptAnalyzer -Severity does with the custom rules, the wrapper's cache as it works, and Repair-IntuneScript's fixes by name (Harness module path under PowerShell 7, and rule fixes backed by validation round 10 #4).

Validation kit (not shipped)

• Collect no longer takes another command's output from the guest agent (Validation kit: Collect no longer takes another command's output from the guest agent #5).

Changes in this pull request

• IntuneScriptLab.psd1: ModuleVersion 0.27.0 and a 0.27.0 entry in ReleaseNotes.
• CHANGELOG.md: the Unreleased entries become [0.27.0] - 2026-10-05, a new empty Unreleased section, and the compare links at the foot.

Verification

• Unit and integration suites: 928 pass on PowerShell 7.6.6 (8 skipped: elevation, lab credential). PSScriptAnalyzer (Error and Warning) is clean and the help Markdown validates.
• Build/Publish-Module.ps1 -WhatIf stages the allowlisted package, imports it in a fresh process, verifies it and stops at Publish IntuneScriptLab 0.27.0 -> PSGallery.
• The Gallery currently has 0.26.0.

Releasing

After merge, the tag publishes through release.yml, which re-runs every gate and rejects a tag that disagrees with the manifest:

git tag v0.27.0 && git push origin v0.27.0