Release v4.4.0: assignment intelligence, drift snapshots, and CI gates

[ugurkocde]

Summary

IntuneAssignmentChecker 4.4.0 turns assignment discovery into a reusable automation surface: one beta-only Graph transport, canonical records, broader Windows Update coverage, safe filter evaluation, explainable effective targeting, deterministic snapshots/drift comparison, and enforceable release gates.

Included issues

• Closes [FEATURE] v4.4: Centralize Microsoft Graph beta transport #136 — route all Graph traffic through a beta-only transport with automatic paging, bounded retry/backoff, nextLink validation, and structured errors.
• Closes [FEATURE] v4.4: Canonical assignment records and object output #137 — emit schema-versioned IntuneAssignmentChecker.AssignmentRecord objects through non-interactive -PassThru contracts.
• Closes [FEATURE] v4.4: Add Windows Update assignment coverage #138 — cover Feature Update, Quality Update, Driver Update, and Quality Update policy assignments.
• Closes [FEATURE] v4.4: Safely evaluate Intune assignment filters #139 — safely evaluate documented managed-device assignment-filter rules without executing tenant-provided text.
• Closes [FEATURE] v4.4: Add effective user/device targeting analysis #140 — explain effective user/device targeting with group membership, exclusion precedence, filters, reason chains, CSV, and -PassThru.
• Closes [FEATURE] v4.4: Add assignment snapshots and drift comparison #141 — export deterministic tenant assignment snapshots and compare stable Added/Removed/Changed drift, with explicit failed/skipped coverage safeguards.
• Closes [CHORE] v4.4: Harden CI and prepare the 4.4.0 release #142 — make analyzer, cross-platform Pester, package/export, and pre-publish checks real release gates; update official actions to immutable current-runtime revisions.

Release and compatibility

• Module version and release notes are updated to 4.4.0.
• The project remains a PowerShell module requiring PowerShell 7 and Microsoft.Graph.Authentication.
• Existing console/CSV/HTML behavior remains available; the new typed output is additive.
• All implemented Graph URLs are normalized to /beta.

Verification

• Pester: 356 passed, 0 failed, including package/import/export validation.
• PSScriptAnalyzer: 103 files, 0 Error/ParseError diagnostics.
• Workflow syntax: actionlint 1.7.12 passed all three workflows.
• GitHub action revisions were resolved against official tags and pinned by full commit SHA.
• Every issue was reviewed iteratively with Claude Opus 5; all actionable findings were resolved and every issue reached PASS.
• Read-only Lokka calls explicitly used graphApiVersion: beta to verify live collection/assignment shapes, beta nextLink paging, managed-device/filter fields, typed group membership paths, Windows Update resources, and structured 400/403 behavior. Throttling and transient 5xx conditions are not safely inducible on demand, so their contracts are exercised with deterministic fixtures and bounded retry tests.

CI expectations

This PR should run Pester on Ubuntu, Windows, and macOS, a separate package/export validation job, and the hard-failing PSScriptAnalyzer gate. The publishing workflow repeats those gates and requires a matching version tag before PowerShell Gallery publication.

[github-actions]

PSScriptAnalyzer Results

Errors: 0 · Warnings: 225

Open workflow run