sync: upstream microsoft/power-platform-skills 2026-06-09

Upstream range: 2923950..9258fd9 (5 commits)
Affected plugins: model-apps (v2.1->2.2), power-pages (setup-auth), canvas-apps (configure-canvas-mcp)
Merge strategy: direct-copy (96), intelligent-merge (0), deferred (0)

Clean sync: zero overlap between upstream changes and Equinor-divergent files.
Updated review records for the three affected reviewed plugins.

Author: Hjaf

.github/workflows/validate-plugin-names.yml

@@ -0,0 +1,26 @@
+name: validate-repository-metadata
+
+on:
+    pull_request:
+        branches:
+            - main
+    workflow_dispatch:
+
+jobs:
+    validate-repository-metadata:
+        name: validate-repository-metadata
+        runs-on: ubuntu-latest
+        steps:
+            - name: checkout
+              uses: actions/checkout@v4
+
+            - name: setup-node
+              uses: actions/setup-node@v4
+              with:
+                  node-version: 20
+
+            - name: validate-kebab-case-plugin-names
+              run: node scripts/validate-plugin-names.js
+
+            - name: validate-skill-descriptions
+              run: node scripts/validate-skill-descriptions.js

.github/workflows/validate-repository-metadata.yml

@@ -1,6 +1,6 @@
 {
   "pluginName": "canvas-apps",
-  "reviewDate": "2026-05-22",
+  "reviewDate": "2026-06-09",
   "reviewer": "GitHub Copilot",
   "publicationStatus": "defer",
   "ownership": {
@@ -128,6 +128,11 @@
     "GitHub Copilot marketplace manifest is missing."
   ],
   "evidence": [
+    {
+      "type": "external-source",
+      "reference": "https://github.com/microsoft/power-platform-skills/compare/2923950..9258fd9",
+      "summary": "Re-reviewed after upstream sync 2026-06-09 (commit 08287fe). configure-canvas-mcp skill bumped to 2.1.0, adding optional auth_flow ('broker'|'browser') and login_hint parameters to the canvas-authoring MCP connect tool. Defaults are unchanged (first signed-in user, default auth flow); parameters are opt-in only when the user states a preference. No new scripts, dependencies, or production interaction. Blockers unchanged."
+    },
     {
       "type": "file",
       "reference": "plugins/canvas-apps/README.md",
@@ -139,5 +144,5 @@
       "summary": "Registers Canvas Authoring MCP through dnx, prerelease package, and NuGet source."
     }
   ],
-  "notes": "Initial review record only. This record intentionally defers publication until detailed review evidence exists."
+  "notes": "Initial review record only. This record intentionally defers publication until detailed review evidence exists. Upstream sync 2026-06-09 added optional auth_flow/login_hint parameters to the Canvas Authoring MCP connect tool (configure-canvas-mcp v2.1.0); broker remains the default and browser sign-in is opt-in, so MCP governance posture is unchanged."
 }

docs/equinor-alignment/reviews/canvas-apps.json

@@ -1,13 +1,13 @@
 {
   "pluginName": "model-apps",
-  "reviewDate": "2026-05-22",
+  "reviewDate": "2026-06-09",
   "reviewer": "GitHub Copilot",
   "publicationStatus": "defer",
   "ownership": {
     "owner": "not assigned",
     "supportChannel": "not assigned",
     "upstreamSource": "microsoft/power-platform-skills/plugins/model-apps",
-    "upstreamVersion": "2.1.0"
+    "upstreamVersion": "2.2.0"
   },
   "scope": {
     "summary": "Builds and deploys Power Apps model-driven app generative pages, creates Dataverse entities when needed, creates model-driven apps, generates React and Fluent UI code, deploys via PAC CLI, and verifies in browser.",
@@ -152,6 +152,11 @@
     "GitHub Copilot marketplace manifest is missing."
   ],
   "evidence": [
+    {
+      "type": "external-source",
+      "reference": "https://github.com/microsoft/power-platform-skills/compare/2923950..9258fd9",
+      "summary": "Re-reviewed after upstream sync 2026-06-09 (v2.1->v2.2, commits c63949d and ff0d191). Adds an automated eval suite (run-layer-1/2 TAP runners + 10 fixtures), new local-dev tooling scripts (capture-fixture.js using node:child_process spawnSync to run eval runners; generate-page-manifest.js writing local package.json/genpage.d.ts), supported-dependencies.md, docs/architecture.md, samples 11 (kanban DnD) and 12 (dialog/overlay confinement), and rules 16-18 confining portalled Fluent surfaces. No new production-system interaction: new scripts are local dev/eval tooling. Blockers unchanged."
+    },
     {
       "type": "file",
       "reference": "plugins/model-apps/README.md",
@@ -168,5 +173,5 @@
       "summary": "Contains Node.js scripts that require security and behavior review before publication."
     }
   ],
-  "notes": "Initial review record only. This record intentionally defers publication until detailed review evidence exists."
+  "notes": "Initial review record only. This record intentionally defers publication until detailed review evidence exists. Upstream v2.2.0 synced 2026-06-09 adds an automated eval suite, two new local-dev scripts (capture-fixture.js, generate-page-manifest.js), supported-dependencies guidance, and dialog/overlay confinement rules. The new scripts are local dev/eval tooling with no new production interaction, but enlarge the script surface that still requires formal review before publication."
 }

docs/equinor-alignment/reviews/model-apps.json

@@ -1,6 +1,6 @@
 {
   "pluginName": "power-pages",
-  "reviewDate": "2026-05-27",
+  "reviewDate": "2026-06-09",
   "reviewer": "GitHub Copilot",
   "publicationStatus": "defer",
   "ownership": {
@@ -188,6 +188,11 @@
     "GitHub Copilot marketplace manifest is missing."
   ],
   "evidence": [
+    {
+      "type": "external-source",
+      "reference": "https://github.com/microsoft/power-platform-skills/compare/2923950..9258fd9",
+      "summary": "Re-reviewed after upstream sync 2026-06-09 (commit b4c46e9). setup-auth expanded to multi-provider authentication and SPA flows; adds check-solution-installed.js (reads dev env URL from `pac env who`, enforces HTTPS origin, rejects embedded userinfo credentials) and render-auth-report.js (local HTML report rendering, no network) plus auth-report.html asset and updated authentication-reference.md. create-site SKILL updated. No new production interaction beyond previously reviewed dev-environment Dataverse scope. Blockers unchanged."
+    },
     {
       "type": "external-source",
       "reference": "https://github.com/microsoft/power-platform-skills/compare/3b2009f..2923950",
@@ -209,5 +214,5 @@
       "summary": "Contains many Node.js scripts that require security and behavior review before publication."
     }
   ],
-  "notes": "Initial review record only. Upstream v2.0.0 synced 2026-05-27 adds significant ALM and security capabilities (10 new ALM skills, 4 security skills, 45 lib helpers, 6 reference docs). This record intentionally defers publication until detailed review evidence exists. The expanded surface area — especially ALM pipeline management, deployment automation, firewall rules, and security scanning — increases the review scope considerably."
+  "notes": "Initial review record only. Upstream v2.0.0 synced 2026-05-27 adds significant ALM and security capabilities (10 new ALM skills, 4 security skills, 45 lib helpers, 6 reference docs). The 2026-06-09 sync (commit b4c46e9) expands setup-auth to multi-provider authentication and SPA flows and adds a Dataverse dev-environment solution check and a local auth-report renderer. This record intentionally defers publication until detailed review evidence exists. The expanded surface area — especially ALM pipeline management, deployment automation, firewall rules, security scanning, and now multi-provider auth — increases the review scope considerably."
 }