scripts/qa — pre-publication checks

Three scripts that gate what makes it into the public fork and the Marketplace package.

check-leakage.ps1

Forbidden-phrase scan. Run inside the public-fork tree to catch any reference that hints at deployment-side IP — words like marketplace, Tier C, Repo 3, MikeAzureDeploy, the Altien brand, private deploy, deploy package. The public fork must describe what it does, never what is missing or where the missing parts live.

# Scan the public-fork clone:
pwsh scripts/qa/check-leakage.ps1 -Path C:/Data/Projects/MikeOSSAzure

# Scan the source-of-truth tree, skipping internal-only paths
# (docs/migration, infra/, deploy.ps1, Tier-C issues, …):
pwsh scripts/qa/check-leakage.ps1 -SourceMode

Exits 0 when clean, 1 with a per-line list of (file, line, pattern, match) on failure. Run it locally before every migration to the public fork, and as a CI check on the public fork itself.

check-no-tier-c-in-oss.ps1

Path-based check that no Tier C file (Bicep, deploy.ps1, check-azure.ps1, operator install .ps1s, deployment runbooks, Tier C issue docs, the migration directory, etc.) survived migration into the public fork.

pwsh scripts/qa/check-no-tier-c-in-oss.ps1 -Path C:/Data/Projects/MikeOSSAzure

Exits 0 when clean, 1 listing every forbidden path found.

run-ttk.ps1

(Planned — not yet committed.) Compiles infra/main.bicep to marketplace/mainTemplate.json, imports arm-ttk, and runs Test-AzTemplate over the marketplace package. Used pre-submission to Partner Center.

When to run

When	Run
Before every migration of changes from this repo to the public fork	check-leakage.ps1 (-SourceMode) and check-no-tier-c-in-oss.ps1 against the public-fork clone
Before every Marketplace submission	run-ttk.ps1 (when it lands)
As a CI gate on the public fork	both leakage scripts on every PR