chore: make dev container setup work without npm registry access

.changes/unreleased/fixed-20260826-112432.yaml

@@ -0,0 +1,6 @@
+kind: fixed
+body: Fix dev container creation by removing the unused Node.js toolchain, installing changie from its upstream release, dropping the stale Yarn apt source that broke apt-get update, and reporting package installation failures instead of skipping them silently
+time: 2026-08-26T11:24:32+03:00
+custom:
+    Author: ayeshurun
+    AuthorLink: https://github.com/ayeshurun

.changes/v1.7.0.md

@@ -0,0 +1,22 @@
+## [v1.7.0](https://pypi.org/project/ms-fabric-cli/v1.7.0) - August 18, 2026
+
+### 🆕 New Items Support
+
+* Supports Digital Twin Builder Flow item by [v-alexmoraru](https://github.com/v-alexmoraru)
+
+### ✨ New Functionality
+
+* Adds support for environment definitions by [v-alexmoraru](https://github.com/v-alexmoraru)
+* Return the job instance ID as a structured field in the JSON output of ``job run`` and ``job start`` commands by [shirasassoon](https://github.com/shirasassoon)
+* Support creating SQLDatabase with optional parameters. Support `creationMode` of type `New`, `Restore` and `RestoreDeletedDatabase`. by [aviatco](https://github.com/aviatco)
+* Adds the `--bulk_publish` flag to the `deploy` command to opt into experimental bulk publish by [ayeshurun](https://github.com/ayeshurun)
+* Add new 'bulk-export' command for exporting workspace or folder items by [ohadedry](https://github.com/ohadedry)
+
+### 🔧 Bug Fix
+
+* Wraps long text on multiple lines by [v-alexmoraru](https://github.com/v-alexmoraru)
+* Restrict file and directory permissions on auth, config, context, and log paths to prevent local credential exposure on multi-user systems by [iemejia](https://github.com/iemejia)
+* Clean up temporary file after table maintenance job execution by [iemejia](https://github.com/iemejia)
+* Enforce owner-only permissions on local files on POSIX by [aviatcohen](https://github.com/aviatcohen)
+* Handle HTTP 429 responses missing the Retry-After header instead of failing with an unexpected error by [ayeshurun](https://github.com/ayeshurun)
+

.devcontainer/devcontainer.json

@@ -5,8 +5,7 @@
 	// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
 	"image": "mcr.microsoft.com/devcontainers/python:1-3.12-bullseye",
 	"features": {
-		"ghcr.io/devcontainers/features/azure-cli:1": {},
-		"ghcr.io/devcontainers/features/node:2": {}
+		"ghcr.io/devcontainers/features/azure-cli:1": {}
 	},
 	// Features to add to the dev container. More info: https://containers.dev/features.
 	// "features": {},

.devcontainer/local.env.example

@@ -0,0 +1,44 @@
+# Optional local overrides for the dev container setup script.
+#
+# Copy this file to `.devcontainer/local.env` and edit it. That path is
+# git-ignored, which helps prevent private mirror URLs from being committed by
+# accident. It is not a secrets store: the file is plaintext, readable by
+# anything in the workspace, and `git add -f` still overrides the ignore rule.
+# Prefer short-lived or credential-free mirror URLs.
+#
+#     cp .devcontainer/local.env.example .devcontainer/local.env
+#
+# scripts/install_dev_container_dependencies.sh reads this file before any
+# packages are installed. Lines are parsed as plain `KEY=value` data and are
+# never executed as shell, so this file cannot run commands. Only the keys
+# listed below are applied; anything else is reported and ignored. Surrounding
+# single or double quotes are stripped, and leading/trailing spaces around the
+# key and value are ignored.
+#
+# This is useful on corporate networks that block public package registries.
+# Note that pypi.org may be reachable while files.pythonhosted.org is blocked,
+# which makes pip resolve dependencies and then fail during download.
+
+# Route pip through an internal mirror instead of PyPI.
+# PIP_INDEX_URL=https://your-mirror.example.com/pypi/simple/
+# PIP_EXTRA_INDEX_URL=
+# PIP_TRUSTED_HOST=
+
+# Raise pip's per-request timeout and retry count. Useful when an internal
+# mirror is reachable but intermittently slow; pip defaults to 15s and 5 tries.
+# PIP_TIMEOUT=60
+# PIP_RETRIES=10
+
+# Route apt through an internal proxy. These three are forwarded explicitly
+# through sudo, which otherwise discards them.
+#
+# Use the lowercase names. apt honours only lowercase proxy variables, so
+# setting HTTP_PROXY alone leaves pip and curl working while apt silently
+# gets no proxy at all. The uppercase names are accepted here for pip and
+# curl, but set the lowercase ones too if apt needs the proxy.
+# http_proxy=http://your-proxy.example.com:8080
+# https_proxy=http://your-proxy.example.com:8080
+# no_proxy=localhost,127.0.0.1,.internal.example.com
+
+# Install a different changie release than the version pinned in the script.
+# CHANGIE_VERSION=1.26.0

.github/dependabot.yml

@@ -10,3 +10,12 @@ updates:
    directory: "/"
    schedule:
      interval: weekly
+ - package-ecosystem: "github-actions"
+   directory: "/"
+   groups:
+     github-actions:
+       patterns: ["*"]
+   schedule:
+     interval: "weekly"
+   cooldown:
+     default-days: 7

.github/hooks/hooks.json

@@ -0,0 +1,15 @@
+{
+  "version": 1,
+  "hooks": {
+    "sessionStart": [
+      {
+        "type": "command",
+        "bash": "b=\"${HOME:-${USERPROFILE:-}}/.copilot/hooks\"; s=\"$b/.last-copilot-toolkit-plugin-update.$(date -u +%Y%m%d)\"; if mkdir -p \"$b\" 2>/dev/null && ( set -C; : > \"$s\" ) 2>/dev/null; then copilot plugin install https://dev.azure.com/msdata/A365/_git/copilot-toolkit 2>/dev/null || echo 'Plugin already installed or unavailable' >&2; fi",
+        "powershell": "try { $b = Join-Path $HOME '.copilot/hooks'; New-Item -ItemType Directory -Force -Path $b -ErrorAction Stop | Out-Null; $s = Join-Path $b ('.last-copilot-toolkit-plugin-update.' + [DateTime]::UtcNow.ToString('yyyyMMdd')); $fs = [System.IO.File]::Open($s, [System.IO.FileMode]::CreateNew); $fs.Close(); copilot plugin install https://dev.azure.com/msdata/A365/_git/copilot-toolkit 2>$null; if ($LASTEXITCODE -ne 0) { Write-Host 'Plugin already installed or unavailable' -ForegroundColor Yellow } } catch { }; exit 0",
+        "cwd": ".",
+        "timeoutSec": 120,
+        "comment": "Install/update Copilot Toolkit plugins at most once per day (daily stamp guard) to avoid Azure DevOps throttling"
+      }
+    ]
+  }
+}

.github/workflows/ai-issue-triage.yml

@@ -30,11 +30,11 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Resolve issue details
         id: issue
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const issueNumber = context.payload.issue?.number || ${{ inputs.issue_number || 0 }};
@@ -88,7 +88,7 @@ jobs:
 
       - name: Run AI assessment
         id: ai-assessment
-        uses: github/[email protected]
+        uses: github/ai-assessment-comment-labeler@e3bedc38cfffa9179fe4cee8f7ecc93bffb3fee7 # v1.0.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           issue_number: ${{ steps.issue.outputs.number }}
@@ -105,7 +105,7 @@ jobs:
 
       - name: Post-process triage results
         if: steps.ai-assessment.outputs.ai_assessments != ''
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           ASSESSMENT_OUTPUT: ${{ steps.ai-assessment.outputs.ai_assessments }}
           SUPPRESS_LABELS: ${{ env.SUPPRESS_LABELS }}
@@ -219,7 +219,7 @@ jobs:
 
       - name: Generate triage summary
         if: always() && steps.ai-assessment.outputs.ai_assessments != ''
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           ASSESSMENT_OUTPUT: ${{ steps.ai-assessment.outputs.ai_assessments }}
           LABEL_DECISIONS: ${{ env.LABEL_DECISIONS }}
@@ -272,7 +272,7 @@ jobs:
 
       - name: Upload triage report
         if: always() && steps.ai-assessment.outputs.ai_assessments != ''
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: triage-report-issue-${{ steps.issue.outputs.number }}
           path: triage-reports/

.github/workflows/changelog-existence.yml

@@ -31,13 +31,13 @@ jobs:
       HEAD_SHA: ${{ github.event.pull_request.head.sha }}
     steps:
       - name: ⤵️ Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0  # Required to access full commit history
 
       - name: ✔️ Check for changelog changes
         id: changelog_check
-        uses: actions/github-script@v6
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const { execSync } = require('child_process');
@@ -51,7 +51,7 @@ jobs:
 
       - name: 🚧 Setup Node
         if: steps.changelog_check.outputs.exists == 'true'
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '20'
 

.github/workflows/create-release.yml

@@ -18,7 +18,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0  # Required to access full commit history for validation
 

.github/workflows/documentation.yml

@@ -12,11 +12,11 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout repository
-              uses: actions/checkout@v4
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   ref: main
             - name: Install Python
-              uses: actions/setup-python@v5
+              uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
               with:
                   python-version: "3.10"
             - name: Install Requirements

.github/workflows/fab-build.yml

@@ -21,10 +21,10 @@ jobs:
     name: Lint Code
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python 3.12
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"  # Use any stable Python version for linting
 
@@ -34,7 +34,7 @@ jobs:
           pip install tox
 
       - name: Cache Tox environments
-        uses: actions/cache@v3
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .tox
           key: ${{ runner.os }}-tox-lint-${{ hashFiles('**/tox.toml') }}
@@ -50,10 +50,10 @@ jobs:
     name: Type Check Code
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python 3.12
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"  # Use any stable Python version for type checking
 
@@ -63,7 +63,7 @@ jobs:
           pip install tox
 
       - name: Cache Tox environments
-        uses: actions/cache@v3
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .tox
           key: ${{ runner.os }}-tox-type-${{ hashFiles('**/tox.toml') }}
@@ -89,10 +89,10 @@ jobs:
           - python-version: "3.13"
             tox-env: "py313"
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -102,7 +102,7 @@ jobs:
           pip install tox
 
       - name: Cache Tox environments
-        uses: actions/cache@v3
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .tox
           key: ${{ runner.os }}-tox-${{ matrix.tox-env }}-${{ hashFiles('**/tox.toml') }}
@@ -115,7 +115,7 @@ jobs:
 
       # Upload the coverage report as an artifact
       - name: Upload coverage artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: coverage-html-report-${{ matrix.python-version }}
           path: coverage_html
@@ -127,10 +127,10 @@ jobs:
     needs:
       - test  # Ensure all test jobs complete successfully
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python 3.12
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"