[alexweininger]

Pull Request Checklist

• I have read and followed the CONTRIBUTING.md guidelines.
• I have read and followed the Guidance for submissions involving paid services.
• My contribution adds a new instruction, prompt, agent, skill, workflow, or canvas extension file in the correct directory.
• The file follows the required naming convention.
• The content is clearly structured and follows the example format.
• I have tested my instructions, prompt, agent, skill, workflow, or canvas extension with GitHub Copilot.
• I have run npm start and verified that README.md is up to date.
• I am targeting the main branch for this pull request.

---

Description

Update the existing Azure Resources Query listing from 0.1.5 to 0.1.6. Activation is limited to explicit Azure inventory browsing rather than incidental diagnostic or deployment lookups; customer documentation is corrected.

Pin source.sha to the full production squash a71d514ad86c5ec7c7a5c49809f7a5a6866b90b2 from microsoft/azure-dev-tools#38. Only ARQ's version and SHA change in plugins/external.json and the regenerated marketplace.

Release: azure-resources-query-v0-1-6-f7a37f9. Both this tag and azure-resources-query-latest resolve to the production SHA above; see the production verification evidence.

---

Type of Contribution

• New instruction file.
• New prompt file.
• New agent file.
• New plugin.
• New skill file.
• New agentic workflow.
• New canvas extension.
• Update to existing instruction, prompt, agent, plugin, skill, workflow, or canvas extension.
• Other (please specify):

---

Additional Notes

Validation:

• npm ci --quiet - passed after the first npm start failed due to missing dependencies.
• npm start - passed; marketplace regenerated and README unchanged.
• npm run plugin:validate - passed (106 local plugins, 78 external entries); existing unrelated license warnings remain.
• The exact changed-entry gate command below passed: Vally lint, isolated Copilot CLI install smoke, version match, and canvas structure. Ref/SHA consistency is not run because the catalog entry pins only a SHA. Existing manifest-location/skills schema warnings are nonblocking.

env -u COPILOT_HOME node ./eng/external-plugin-pr-quality-gates.mjs --plugins-json "$(node -e 'console.log(JSON.stringify(require("./plugins/external.json").filter(p => p.name === "azure-resources-query")))')"

• An initial local gate run inherited COPILOT_HOME and failed its expected install-directory check after CLI install returned success. The command above removes that override so the unchanged gate uses its isolated temporary home.
• git diff --check - passed.
• bash eng/fix-line-endings.sh - invoked, but BSD sed reported incompatible -i syntax; its final success message is not treated as validation. No Markdown files are changed by this PR.

The unchecked new-file checklist items are not applicable to a catalog-only update. No native app acceptance or rollout is claimed; the Copilot check above is an install smoke test, not an interactive acceptance test. No package or licensing files are changed. The reported core first-party license: null owner decision remains unresolved; this update does not assert legal approval.

---

By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.

[github-actions]

🔒 PR Risk Scan Results

Scanned 2 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	0
ℹ️ Info	0

✅ No matching risk patterns were detected in changed files.

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[github-actions]

🚦 Submission status: 🛠️ Requires submitter fixes

Risk tier: merge-risk:high — Privileged execution, automation, or review-policy change
Required to merge: passing submission-gate checks plus 1 approval from reviewers with write access, including a maintainer with admin or maintain permission.

Why this tier

• plugins/external.json is a high-risk path (automation, scripts, MCP config, hooks, or review policy)

Automated checks

Check	Status	Details
Line endings	✅ Passed	Passed · logs
Spelling	✅ Passed	Passed · logs
Generated README consistency	✅ Passed	Passed · logs
Plugin and extension validation	✅ Passed	Passed · logs
Plugin structure	✅ Passed	Passed · logs
Risk scan	✅ Passed	Passed · logs
Contributor reputation	✅ Passed	Passed · logs
Duplicate resource scan	✅ Passed	Passed · logs
PR quality signal	✅ Passed	Passed · logs
Canvas/plugin smoke test	✅ Passed	Passed · logs

Action needed

• Address the changes requested by aaronpowell, then push an update.

Review

• Approvals: 0/1
• Assigned reviewer: not assigned yet — comment /request-review to ask for one
• Review target date: not set
• Still needed: 1 more approval(s); an approval from a maintainer with admin or maintain permission; resolution of changes requested by aaronpowell
• The core-maintainers pool is not staffed yet; an approver with admin or maintain permission is required instead.

Commands

Command	Who	What it does
/rerun-checks	PR author, maintainers	Re-runs failed or incomplete checks and re-evaluates this gate
/request-review	PR author, maintainers	Asks the review rotation to assign a reviewer (adds needs-reviewer)

_{Updated for 6fd75f0 · gate run · This comment is maintained automatically — see submission gate docs.}

[github-actions]

🟡 Contributor Reputation Check: MEDIUM risk

Check	Risk
Profile	MEDIUM
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

[github-actions]

⚠️ External plugin PR checks passed with spec warnings

• Changed entries detected: 1
• Workflow state label: ready-for-review
• Full logs: Download quality gate artifact
• Status legend: ✅ pass · ⚠️ warning · 🛑 fail

Per-plugin quality summary

Plugin	spec compliance (non-blocking)	vally lint	install smoke test	version match	ref/sha consistency	canvas structure	overall	source tree
azure-resources-query	⚠️ warning	✅ pass	✅ pass	✅ pass	⚪ not_run	✅ pass	✅ pass	a71d514ad86c5ec7c7a5c49809f7a5a6866b90b2

Gate output details

azure-resources-query - spec compliance (⚠️ warning)

Agent Plugins v1.0.0 manifest warnings:
- manifest location is ".github/plugin/plugin.json"; expected "plugin.json" at plugin root
- top-level field "skills" is not part of Agent Plugins v1.0.0
- schema validation: manifest must NOT have additional properties

azure-resources-query - vally lint (✅ pass)

✅ azure-resources-query (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

azure-resources-query - install smoke test (✅ pass)

Install smoke test succeeded. Verified /tmp/external-plugin-quality-zHSixO/copilot-home/.copilot/installed-plugins/external-plugin-intake/azure-resources-query/.github/plugin/plugin.json.

azure-resources-query - version match (pass)

- a71d514ad86c5ec7c7a5c49809f7a5a6866b90b2: matched version "0.1.6" at "canvases/azure-resources-query/.github/plugin/plugin.json".

azure-resources-query - ref/sha consistency (not_run)

Ref/SHA consistency gate skipped because one of source.ref or source.sha was not provided.

azure-resources-query - canvas structure (pass)

- a71d514ad86c5ec7c7a5c49809f7a5a6866b90b2: found "canvases/azure-resources-query/com.github.copilot/extensions" with entry point "canvases/azure-resources-query/com.github.copilot/extensions/azure-resources-query/extension.mjs".

- azure-resources-query: spec=warning, vally-lint=pass, install-smoke=pass, version-match=pass, ref-sha-consistency=not_run, canvas-structure=pass, overall=pass

[Copilot]

🔵 Needs a closer look

Organization SAML restrictions blocked verification of the pinned upstream release and manifest, requiring maintainer confirmation.

No open issues 🎉

What changed in this PR

Updates the Azure Resources Query external-plugin listing from 0.1.5 to 0.1.6, keeping the catalog and generated marketplace aligned.

Changes:

• Bumps the plugin version to 0.1.6.
• Pins both entries to commit a71d514ad86c5ec7c7a5c49809f7a5a6866b90b2, with no other metadata changes.

File	Description
plugins/​external.json	Updates the catalog version and pinned source commit.
.github/​plugin/​marketplace.json	Mirrors the updated version and commit in the generated marketplace.

_{Review effort: Max}

[aaronpowell]

Thanks @alexweininger — the catalog edit is clean and the narrower activation boundary is a good fix. Before we bump the pin: 1) The release adds createPublicCanvasUsageMetrics with enabled: true, which runs gh api --hostname github.com user --jq .id and POSTs users' GitHub ID to canvas-metrics-pilot-…azurefd.net/api/events. This isn't disclosed in the PR or README, and the only off switch is AZURE_RESOURCES_QUERY_TEST_MODE=1. Please add a Usage data section, a documented user opt-out, and a note in the PR description. 2) Please confirm the endpoint is production-ready or keep telemetry disabled. 3) @cloud-foundation/azure-resources-query-core has license: null; please resolve that.

[alexweininger]

Thanks for the specific requirements. We are preparing a shared canvas/skill telemetry opt-out (CANVAS_TELEMETRY_DISABLED=1) and a standard public Usage data disclosure covering the default, optional GitHub numeric ID, destination, exclusions, and provider restart/setup requirements. Disabled collection will skip identity lookup and telemetry delivery; the test-mode flag will not be the customer opt-out.

This needs a corrected upstream package and a new production release, not just a description change on the existing 0.1.6 pin. We will update this PR to the verified full production squash SHA once that release is ready, preserving the existing immutable release. Endpoint production-readiness/data-handling evidence and the core package license disposition are being requested separately; neither is confirmed by this update. We will return with release and packaged-test evidence and a response to each requirement before requesting re-review. The requested changes are not yet resolved.

[alexweininger]

The source fixes are now in draft review: shared collector opt-out in coreai-microsoft/canvases-cloud-foundation#448 and standard customer/package disclosures in coreai-microsoft/canvases-cloud-foundation#446. The agreed switch is CANVAS_TELEMETRY_DISABLED=1 in the actual provider startup environment; the implementation tests process disable dominating fixture overrides and covers emitted ARQ providers without identity lookup or delivery. The README inputs now explicitly disclose the numeric GitHub ID and endpoint.

This is not yet a corrected production package or catalog pin. Final source/browser qualification, required source review, endpoint-owner readiness evidence and the core-package license disposition remain outstanding. Installed GUI startup configuration is not inferred from a terminal export. ARQ Awesome Copilot source.sha remains pending production squash merge; I will update the pin and reviewer evidence only after the actual released commit is verified.

[alexweininger]

For

@cloud-foundation/azure-resources-query-core has license: null; please resolve that.

I'll just omit that license property since that's what all the other canvases do.