Prerequisites

• This issue has an informative and human-readable title.

ScubaGear Version

Users who clone ScubaGear directly from main and run it encounter failures because main is being used as the active development branch. Incomplete, in-progress features are merged into main before they are fully implemented. Released versions (e.g., v1.8.0 on PowerShell Gallery) do not match main. This mismatch causes main to break existing, working functionality while new features are still being developed. It also forces hotfix authors to branch off a broken state, requiring manual workarounds to deliver fixes to customers.

Operating System

Windows 11

PowerShell Version

5.1

M365 Environment and License(s)

All

🐛 Summary

ScubaGear's current branching model treats main as the integration/development branch where all work-in-progress is merged. The PowerShell Gallery release is a snapshot taken at a point in time, and main may be in a partially broken state between releases as new features are actively developed. As a result:

• Cloning main and running Invoke-SCuBA does not reproduce the released product.
• Existing, supported product names (e.g., defender) can stop working on main because in-development features have modified parameters before the implementation is complete.
• Hotfix branches created off main inherit all incomplete, broken code.
• Documentation in main may describe in-development behavior rather than the released version,
  causing confusion for users following the repo directly.

Steps to reproduce

Steps to Reproduce

1. A customer reported Graph API throttling failures with ScubaGear v1.8.0.
2. A hotfix branch (2157-pim-batch-retry-throttling) was created off main.
3. The fix was implemented and the branch was shared with the customer to test.
4. The customer ran:

Invoke-SCuBA -ProductNames aad, defender, exo, powerplatform, sharepoint, teams

1. ScubaGear immediately threw:

Connect-Tenant : Cannot validate argument on parameter 'ProductNames'.
The argument "defender" does not belong to the set
"teams,exo,securitysuite,aad,powerplatform,sharepoint,powerbi"

1. Additional cascading errors followed:

Get-TenantDetail : Cannot validate argument on parameter 'ProductNames'.
The argument "defender" does not belong to the set
"teams,exo,securitysuite,aad,powerplatform,sharepoint,powerbi"

Invoke-ProviderList : Cannot validate argument on parameter 'TenantDetails'.
The argument is null or empty.

1. The run aborted with ERROR: EXIT: Invoke-ProviderList (ERROR).

Root Cause

main contains in-progress work introducing securitysuite as a new product. As part of
that still-incomplete implementation, defender was removed from the [ValidateSet] on
ProductNames parameters in Orchestrator.psm1 (and related modules). Because
securitysuite is not yet fully implemented, the product set on main is in an intermediate,
broken state: defender is gone but securitysuite does not yet fully work as a
replacement.

The hotfix branch inherited this broken intermediate state. Any run including defender (a
valid, shipped product in v1.8.0) fails parameter validation, which cascades into a null
TenantDetails and a complete assessment failure.

Expected behavior

• main should always reflect the latest stable released version of ScubaGear.
• All active development, including incomplete features, should happen in a dev branch (or
  feature branches off dev), not in main.
• Hotfix branches should be created off main (which equals the release) and contain only
  the targeted fix; no incomplete in-development code.
• Users who clone main should be able to run Invoke-SCuBA successfully with the same
  product names supported in the published PowerShell Gallery package.
• Documentation in main should always reflect the released version. In-development
  documentation changes should live in dev and only land in main as part of a release.

Output from Invoke-SCuBA. Product names in yaml are:

ProductNames: ['aad','defender','teams','sharepoint','exo','powerplatform']