# Powershell Pin Audit

> Audits coordinated PowerShell version pins across workflows, .gitmodules, README.md, and the checked-out upstream PowerShell target framework.

- Skill: `devolutions/powershell-pin-audit` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add devolutions/powershell-pin-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/devolutions/powershell-pin-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: devolutions (https://skillmd.com/u/devolutions)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/devolutions/powershell-pin-audit

---


# powershell pin audit

Use this skill when updating the pinned PowerShell version, reviewing a PowerShell release bump, or checking that the repository's coordinated PowerShell pins still agree.

The audit checks the primary `.github/workflows/powershell-sdk.yml` workflow, the secondary `.github/workflows/powershell-cli.yml` workflow, `.gitmodules`, the README "Current pins" table, and `pwsh-src/PowerShell.Common.props` when the submodule is available.

## Prerequisites

- PowerShell 7 (`pwsh`).
- Initialize `pwsh-src/` before release-bump validation if you need target-framework verification.

## Usage

Run the default audit from the repository root:

```powershell
pwsh .\.agents\skills\powershell-pin-audit\scripts\Test-PowerShellPins.ps1
```

Require the `pwsh-src/` submodule and fail if `PowerShell.Common.props` is unavailable:

```powershell
pwsh .\.agents\skills\powershell-pin-audit\scripts\Test-PowerShellPins.ps1 -RequireSubmodule
```

Audit a different checkout:

```powershell
pwsh .\.agents\skills\powershell-pin-audit\scripts\Test-PowerShellPins.ps1 -RepositoryRoot D:\dev\pwsh-distro
```

## Checks

- `POWERSHELL_VERSION`, `POWERSHELL_RELEASE_TAG`, `POWERSHELL_UPSTREAM_TAG`, and `POWERSHELL_SOURCE_REF` are present in both PowerShell workflows.
- The two workflows use the same PowerShell pin values.
- `POWERSHELL_RELEASE_TAG` is `v$POWERSHELL_VERSION`.
- `POWERSHELL_UPSTREAM_TAG` is `upstream/$POWERSHELL_RELEASE_TAG`.
- `POWERSHELL_SOURCE_REF` is `downstream/$POWERSHELL_RELEASE_TAG`.
- The CLI workflow SDK package ID, version, and revision match the SDK workflow defaults.
- `.gitmodules` tracks the same downstream branch as `POWERSHELL_SOURCE_REF`.
- README "Current pins" records the same upstream release, downstream source ref, upstream base tag, and target framework.
- If `pwsh-src/PowerShell.Common.props` exists, README's target framework matches its `<TargetFramework>` value.