[Steve Lee (SteveL-MSFT)]

The PowerShell adapters currently advertise a validate operation that always reports success, bypassing meaningful input validation. Replace it with embedded resource schemas so DSC validates adapted inputs before invoking PowerShell.

Breaking change and migration

Resource property names are now case-sensitive canonical camelCase names, including key, mandatory, and optional properties. Existing configurations using Name, Ensure, or other PowerShell casing must migrate to the exact spelling reported by dsc resource schema -r '<moduleName>/<resourceName>'. Schemas use additionalProperties: false, so incorrectly cased optional names cannot bypass validation.

Single-resource get/set/test/export output uses the same canonical names and omits unset optional null properties unless explicitly nullable. Case-sensitive output consumers must migrate too. Deprecated full-configuration wrapper output is unchanged. The changelog and adapter reference pages describe these changes.

Changes

• Remove validate from all four adapter manifests and generate embedded schemas for discovered class-based and MOF-based resources.
• Describe primitive types, arrays, key/mandatory properties, enums, ValidateSet constraints, explicit nullability, module-defined object properties, and NotConfigurable/readOnly metadata. Match qualified and Attribute-suffixed attributes and honor ValidateSet(..., IgnoreCase = $false).
• Preserve numeric type validation when a nonnumeric value map cannot be represented as a numeric enum, with a warning. Isolate schema-generation exceptions per resource, warning with the resource type and returning a permissive object schema without hiding other resources.
• Include _inDesiredState for test output. Let DSC omit _metadata injection when the closed resource schema rejects it.
• Exclude LCM-only DependsOn and PsDscRunAsCredential from script-based schemas/output without removing legitimate class properties. Walk inherited Windows class properties, including keys.
• Normalize dictionary and object states. Give single-resource export its own object filter schema so partial filters do not require a complete resource instance; exported instances still undergo full resource-schema validation.
• Bump modern/Windows metadata cache versions to 6/4 and update all four reference pages.
• Add regression coverage for malformed metadata, failure isolation, Windows metadata parity, readOnly/class types, case-sensitive attributes, CLI listing, configuration metadata, and filtered/unfiltered export.

External enums and custom representations not resolved from metadata remain validated by PowerShell. Nested member constraints are not inferred yet.

Validation

187 PowerShell/Pester tests passed, with 3 existing skips, through repository-root build.ps1 -SkipBuild -Test -ExcludeRustTests. This covered schema, adapted manifests, adapter config/resource operations, and DSC discovery using the prior successful PR CI macOS binaries with the updated adapter files. No Rust code changed. Windows PowerShell runtime verification remains in CI; local coverage includes the Windows AST metadata reader and MOF-shaped metadata.

Follow-ups

• Cache generated schemas during discovery: Cache generated PowerShell adapter schemas during discovery #1812.
• Nested class schemas and broader class/enum type resolution: Generate nested PowerShell class property schemas with cycle-safe references #1813.
• Author-provided schemas: Support author-provided schemas for PowerShell adapted resources #1814.
• Additional validation attributes, formats, numeric bounds, and regex portability: Extend PowerShell adapter schema generation with validation attributes and type bounds #1811.

[Copilot]

Note

Copilot was unable to run its full agentic suite in this review.

Copilot review overview

5 open issues

• When $schema.type includes 'null' (for example @('string','null')), adding anyOf without a… · New
• Raising ConvertTo-Json depth to 100 can significantly increase serialization time and output… · New
• This performs a linear scan over $AllTypeDefinitions for every DSC property. If a module has many… · New
• This line looks like it is intended to be part of the markdown table, but it no longer starts with… · New
• $isKeyProperty is now set for both Key and Mandatory, but the name implies it tracks only key… · New

What changed in this PR

Updates the PowerShell/Windows PowerShell DSC adapters to remove the standalone validate operation and instead provide embedded JSON schemas for resources, updating cache schema versions and docs accordingly.

Changes:

• Removed validate operation wiring from adapter manifests and the adapter entry script.
• Added embedded schema generation for discovered resources (including enum/ValidateSet handling) and increased cache schema versions.
• Added Pester tests to validate embedded schemas and ensure the removed Validate operation is rejected.

File	Description
docs/​reference/​resources/​Microsoft/​Windows/​WindowsPowerShell/​index.md	Updates documented cache schema version for Windows PowerShell adapter.
docs/​reference/​resources/​Microsoft/​DSC/​PowerShell/​index.md	Updates documented cache schema version for PowerShell adapter.
docs/​reference/​resources/​Microsoft/​Adapter/​WindowsPowerShell/​index.md	Updates cache schema version and clarifies schema-based validation behavior.
docs/​reference/​resources/​Microsoft/​Adapter/​PowerShell/​index.md	Updates cache schema version and clarifies schema-based validation behavior.
adapters/​powershell/​windowspowershell.dsc.resource.json	Replaces validate operation with embedded schema in resource manifest.
adapters/​powershell/​powershell.dsc.resource.json	Replaces validate operation with embedded schema in resource manifest.
adapters/​powershell/​WindowsPowerShell_adapter.dsc.resource.json	Removes validate and adds minimal embedded schema to adapter manifest.
adapters/​powershell/​PowerShell_adapter.dsc.resource.json	Removes validate and adds minimal embedded schema to adapter manifest.
adapters/​powershell/​psDscAdapter/​win_psDscAdapter.psm1	Bumps cache schema version and adds enum/ValidateSet value discovery.
adapters/​powershell/​psDscAdapter/​psDscAdapter.psm1	Bumps cache schema version and adds enum/ValidateSet value discovery.
adapters/​powershell/​psDscAdapter/​powershell.resource.ps1	Removes Validate op, generates per-resource JSON schema, and emits deeper JSON.
adapters/​powershell/​Tests/​schema.tests.ps1	Adds tests validating embedded schemas and removed Validate behavior.
adapters/​powershell/​Tests/​powershellgroup.resource.tests.ps1	Extends existing tests to assert schema presence/shape.
adapters/​powershell/​Tests/​PSAdaptedTestClassResource.dsc.adaptedResource.json	Adjusts adapted resource schema structure.
adapters/​powershell/​Tests/​PSAdapted.tests.ps1	Adds tests ensuring adapted resource schema rejects invalid inputs.

_{Review effort: Lite}

[github-actions]

Code Coverage Report

No Rust files were changed in this PR.

🔵 Full Codebase Coverage

83% (good)

Metric	Value
Total executable lines	21066
Lines covered by tests	17647
Coverage percentage	83%

Full codebase coverage measures all instrumented Rust lines across the project.

[Gijs Reijn (Gijsreyn)]

Steve Lee (@SteveL-MSFT) - are any doc updates needed with this change?

[Steve Lee (SteveL-MSFT)]

Steve Lee (Steve Lee (@SteveL-MSFT)) - are any doc updates needed with this change?

Great question. Added doc update.

[Mikey Lombardi (He/Him) (michaeltlombardi)]

A few high-level thoughts:

1. I think we should probably move the schema generation into the discovery/caching instead of reconstructing on every invocation.

2. The current generation is attribute-unaware, so it can't do useful things like pull the pattern from ValidatePattern into the property definition as the pattern keyword or determine whether the property should accept explicit null values.

3. I pulled the changes locally to verify and noticed that the generated schema for class-based resources completely failed to retrieve schemas for nested classes. It seems to work for enums though.

4. There's no way in the current implementation for a resource author to specify their own schema in the type definition. They either have to maintain the schema by hand in an adapted manifest or let this implementation generate the schema for the resource entirely.

5. We're squashing a lot of type schemas to their simplest representation, which I think is okay for this PR, but could be usefully enhanced. For example, we could generate the minimum and maximum bounds for numeric properties with ([type]$propertyType)::<Min|Max>Value or define the format keyword with a standard defined format where coherent, like:

   --- # datetime
   type: string
   format: date-time
   --- # uri
   type: string
   format: uri

   With access to the resource property attributes we can do even more, like pull ValidatePattern into the pattern keyword, ValidateLength into the minLength and maxLength keywords, and so on.

6. There are some thorny issues for retrieving data for properties as nested classes, but I think we can resolve most or all of them - but not cheaply, which reinforces the benefit of caching the schema generation during discovery.

7. There seems to be some miswiring going on, because while invoking the resource script directly does emit the resource schema, that value remains null in the output data from dsc resource list, at least for me.

   dsc resource list --adapter *PowerShell* |
       ConvertFrom-Json |
       Select-Object -Property type, schema

[Gijs Reijn (Gijsreyn)]

Steve Lee (@SteveL-MSFT) - Thanks for working through the earlier rounds; the canonical names and the plain required array
make the generated schemas much easier to read. A few high-level thoughts before the inline
comments:

1. I know you may still be working through the points from the earlier top-level review (schema
   generation during discovery/caching, attribute awareness, nested classes, author-provided
   schemas, format and numeric bounds, and the schema value being null in
   dsc resource list), so feel free to ignore this if they're already on your list. Several of
   them seem like reasonable follow-ups rather than blockers. If any end up out of scope for this
   PR, a linked issue for each would help us keep track of them.
2. Switching to camelCase names with a case-sensitive required keyword is a breaking change for
   every existing configuration document that uses PowerShell casing (Name, Ensure). I think
   that's the right direction, but the PR description and changelog should say so explicitly, and
   we should think about the error experience (see inline).
3. A single resource with unexpected metadata can currently fail List for every resource behind
   the adapter. I think schema generation needs to fail soft per resource.
4. For MOF-based resources, I think we're going to emit LCM meta-properties like dependsOn and
   psDscRunAsCredential into the resource schema, which don't mean anything for a Microsoft DSC resource
   instance.
5. There are a few cheap wins that move us toward the attribute-aware generation discussed earlier
   (mapping NotConfigurable to readOnly, emitting at least type: object for class-typed
   properties, and matching attribute names consistently).
6. The docs still reference the old cache versions, and there are a couple of test gaps for
   export and for the end-to-end dsc resource list output.