Merge remote-tracking branch 'origin/dev' into flanakin/1769-mca-reservations

# Conflicts:
#	docs-mslearn/toolkit/changelog.md

Author: flanakin

.github/policies/pulls-03-feedback.yml

@@ -32,6 +32,17 @@ configuration:
                       reviewState: Commented
                   - isActivitySender:
                       issueAuthor: False
+              - and:
+                  - payloadType: Issue_Comment
+                  - isAction:
+                      action: Created
+                  - not:
+                      commentContains:
+                        pattern: '#needs-review'
+                  - isActivitySender:
+                      issueAuthor: False
+                  - isPullRequest
+                  - isOpen
           - not:
               targetsBranch:
                 branch: main

.github/workflows/opendata-ci.yml

@@ -8,7 +8,7 @@ on:
       - 'src/open-data/*.json'
       # Internal operational baselines for the eligibility completeness guard, not
       # reference data; Build-OpenData ignores them, so they shouldn't trigger CI.
-      - '!src/open-data/*.shardcounts.json'
+      - '!src/open-data/*.familycounts.json'
 permissions: 
   contents: write
   pull-requests: write
@@ -45,6 +45,15 @@ jobs:
           git commit -a -m "${{ env.CI_COMMIT_MESSAGE }}"
           git push
         }
+    # Build-OpenData.ps1 -Test calls Test-PowerShell.ps1, which requires Pester 6 (#2254):
+    # the suite uses -AllowNullOrEmptyForEach, which Pester 5 rejects. The ubuntu runner
+    # image ships Pester 5.9.0, so the minimum has to be installed explicitly. This is the
+    # same command Init-Repo.ps1 runs and the one Test-PowerShell.ps1 names in its error.
+    # dev.yml pins the same floor through psmodulecache, which this repo only uses on
+    # Windows runners.
+    - name: Install Pester
+      shell: pwsh
+      run: Install-Module -Name Pester -MinimumVersion 6.0.0 -Scope CurrentUser -Repository PSGallery -Force
     - name: Test Open Data
       id: test
       shell: pwsh

.github/workflows/opendata-commitment-eligibility.yml

@@ -2,20 +2,62 @@ name: Update Commitment Discount Eligibility
 
 on:
   schedule:
-    - cron: '0 6 * * 1'  # Every Monday at 06:00 UTC
+    - cron: '0 6 * * 1' # Every Monday at 06:00 UTC
   workflow_dispatch:
+    inputs:
+      ref:
+        # The scheduled run always uses dev. This input exists so a change to the fetch
+        # script can be exercised end-to-end from its PR branch BEFORE merging, which
+        # matters for a job that only runs weekly and takes ~44 minutes to fail. Only
+        # users with write access can dispatch a workflow, so this does not widen who
+        # can run code in the repo.
+        #
+        # A non-dev ref is TEST-ONLY and is enforced as such by the guard step below:
+        # pushing a data branch built from a feature ref would carry that ref's code
+        # commits into the data PR, so the combination is rejected rather than merely
+        # discouraged.
+        description: 'Branch to check out and run the script from (non-dev requires dry_run)'
+        required: false
+        default: 'dev'
+        type: string
+      dry_run:
+        # Defaults to true so the safe path is also the default one. A real data push is
+        # therefore always an explicit choice, and the scheduled run (where this input is
+        # absent entirely, not false) is unaffected -- see the DRY_RUN env note below.
+        description: 'Fetch and detect changes only; do not push a branch'
+        required: false
+        default: true
+        type: boolean
 
 permissions:
   contents: write
 
 jobs:
   update:
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    # Two full traversals per price type (fetch + verification) measured 44 minutes on
+    # run 31710007476. The headroom absorbs Retry-After backoff on a throttled run.
+    timeout-minutes: 90
     steps:
+      # Fail before the ~44-minute fetch rather than after it, so an invalid input
+      # combination costs seconds instead of most of an hour.
+      - name: Validate dispatch inputs
+        env:
+          DRY_RUN: ${{ github.event.inputs.dry_run }}
+          RUN_REF: ${{ github.event.inputs.ref || 'dev' }}
+        run: |
+          if [ "$RUN_REF" != "dev" ] && [ "$DRY_RUN" != "true" ]; then
+            echo "::error::ref='$RUN_REF' is not 'dev' and dry_run is not true. A push from a" \
+                 "non-dev ref would base the opendata/* branch on that ref, so the data PR" \
+                 "would carry its code commits as well as the data update. Re-run with" \
+                 "dry_run enabled to test a branch, or with ref='dev' to publish data."
+            exit 1
+          fi
+
+      # github.event.inputs is null for the scheduled run, so this falls back to dev.
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: dev
+          ref: ${{ github.event.inputs.ref || 'dev' }}
 
       - name: Fetch eligibility data from Azure Retail Prices API
         shell: pwsh
@@ -25,29 +67,53 @@ jobs:
       # a branch and surface a one-click "create PR" link in the job summary for a
       # maintainer to open. Opening the PR triggers Open Data CI and normal review.
       - name: Push branch and surface PR link if data changed
+        env:
+          # Read as a string and compared as one below. A `type: boolean` input arrives
+          # here as the literal "true"/"false", and in a GitHub `if:` expression the
+          # string "false" is truthy -- comparing in bash sidesteps that trap. For the
+          # SCHEDULED run there is no inputs object at all, so this is empty (not the
+          # "true" default), and the run therefore takes the normal push path.
+          DRY_RUN: ${{ github.event.inputs.dry_run }}
+          RUN_REF: ${{ github.event.inputs.ref || 'dev' }}
         run: |
-          # Check for changes to the CSV or the per-shard baseline (handles both
+          # Check for changes to the CSV or the per-family baseline (handles both
           # modified and newly-created/untracked files). The baseline is checked too
           # so a counts-only update (no eligibility change) is still surfaced.
-          if git diff --quiet --exit-code -- src/open-data/CommitmentDiscountEligibility.csv src/open-data/CommitmentDiscountEligibility.shardcounts.json 2>/dev/null && \
-             ! git ls-files --others --exclude-standard -- src/open-data/ | grep -qE 'CommitmentDiscountEligibility\.(csv|shardcounts\.json)'; then
+          if git diff --quiet --exit-code -- src/open-data/CommitmentDiscountEligibility.csv src/open-data/CommitmentDiscountEligibility.familycounts.json 2>/dev/null && \
+             ! git ls-files --others --exclude-standard -- src/open-data/ | grep -qE 'CommitmentDiscountEligibility\.(csv|familycounts\.json)'; then
             echo "No changes detected"
             exit 0
           fi
 
+          if [ "$DRY_RUN" = "true" ]; then
+            {
+              echo "### Dry run: data changed, nothing pushed"
+              echo ""
+              echo "Ran the fetch against \`${RUN_REF}\` and detected changes, but \`dry_run\` was set, so no branch was pushed."
+              echo ""
+              echo '```'
+              git --no-pager diff --stat -- src/open-data/CommitmentDiscountEligibility.csv src/open-data/CommitmentDiscountEligibility.familycounts.json || true
+              # --stat covers tracked files only, so list any newly created ones too.
+              git ls-files --others --exclude-standard -- src/open-data/ | grep -E 'CommitmentDiscountEligibility\.(csv|familycounts\.json)' | sed 's/^/new file: /' || true
+              echo '```'
+            } >> "$GITHUB_STEP_SUMMARY"
+            echo "Dry run: changes detected, not pushing."
+            exit 0
+          fi
+
           BRANCH="opendata/commitment-eligibility-$(date +%Y%m%d)-${{ github.run_number }}"
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git checkout -b "$BRANCH"
-          git add src/open-data/CommitmentDiscountEligibility.csv src/open-data/CommitmentDiscountEligibility.shardcounts.json
+          git add src/open-data/CommitmentDiscountEligibility.csv src/open-data/CommitmentDiscountEligibility.familycounts.json
           git commit -m "chore: Update commitment discount eligibility data"
           git push origin "$BRANCH"
 
           PR_URL="${{ github.server_url }}/${{ github.repository }}/compare/dev...${BRANCH}?expand=1"
           {
             echo "### Commitment discount eligibility data updated"
             echo ""
-            echo "Pushed branch \`${BRANCH}\`. GitHub Actions cannot open PRs in this repo, so open it manually:"
+            echo "Pushed branch \`${BRANCH}\` (fetched from \`${RUN_REF}\`). GitHub Actions cannot open PRs in this repo, so open it manually:"
             echo ""
             echo "[**Create pull request →**](${PR_URL})"
             echo ""

.gitignore

@@ -384,6 +384,7 @@ env/
 # Auto-generated build artifacts
 src/templates/finops-hub-copilot-studio/knowledge/query-catalog.md
 .gate/
+.copilot-tracking/
 todo/
 done/
 release/scloud-occurrence-report.md

docs-mslearn/toolkit/changelog.md

@@ -3,7 +3,7 @@ title: FinOps toolkit changelog
 description: Review the latest features and enhancements in the FinOps toolkit, including updates to FinOps hubs, Power BI reports, and more.
 author: MSBrett
 ms.author: brettwil
-ms.date: 08/17/2026
+ms.date: 08/26/2026
 ms.topic: reference
 ms.service: finops
 ms.subservice: finops-toolkit
@@ -30,9 +30,11 @@ The following section lists features and enhancements that are currently in deve
 - **Added**
   - Added VNet and private network modes, including opt-in NAT Gateway support for private mode; NAT Gateway incurs additional cost when enabled ([#2163](https://github.com/microsoft/finops-toolkit/pull/2163)).
 - **Changed**
+  - Clarified that the FinOps toolkit exclusively manages the FinOps hub virtual network and documented customer-managed private endpoints as the preferred private-access topology, with virtual network peering as a secondary option ([#2156](https://github.com/microsoft/finops-toolkit/issues/2156)).
   - Replaced redundant `tolower()` comparisons in hub KQL with case-insensitive operators (`has`, `=~`, `!~`) so the engine can use the term index instead of scanning every row ([#2213](https://github.com/microsoft/finops-toolkit/issues/2213)).
   - Replaced whole-term `contains` matches with `has` across hub KQL and the query catalog (resource ID paths, licensing phrases, SKU description terms) and added a per-row operator-equivalence regression harness with unit test coverage ([#2220](https://github.com/microsoft/finops-toolkit/pull/2220)).
 - **Fixed**
+  - Fixed private-network deployments that Azure Policy blocked when `defaultOutboundAccess` was omitted. Private mode subnets now set it to `false`, while an Azure Files private endpoint supports deployment-script storage and the NAT Gateway provides required container egress ([#2258](https://github.com/microsoft/finops-toolkit/issues/2258), [#2259](https://github.com/microsoft/finops-toolkit/pull/2259)).
   - Fixed the `ContractedCost` recompute guard to compare with a null-safe tolerance instead of exact float equality, eliminating millions of no-op rewrites that polluted the `x_SourceValues` audit trail while preserving the null-cost backfill and no longer overwriting an existing cost when the unit price is missing ([#2216](https://github.com/microsoft/finops-toolkit/issues/2216)).
   - Fixed the SQL VMs without Azure Hybrid Benefit recommendation query to join on the SQL VM `virtualMachineResourceId` instead of a case-sensitive VM name match that skipped VMs with uppercase names and dropped duplicate names, and made all Azure Resource Graph join kinds explicit so no query relies on the `innerunique` default ([#2225](https://github.com/microsoft/finops-toolkit/pull/2225)).
   - Switched dimension enrichment in the v1_0/v1_2 ingestion transforms (`PricingUnits`, `Regions`, `ResourceTypes`, `Services`) from `join` to the broadcast-optimized `lookup` operator and deduplicated the `Services` mapping per resource type to prevent cost row fan-out ([#2225](https://github.com/microsoft/finops-toolkit/pull/2225)).
@@ -59,6 +61,11 @@ The following section lists features and enhancements that are currently in deve
 - **Changed**
   - Switched the reservations and benefits workbooks from the retired `ccmstorageprod` isfratioblob.csv to the FinOps toolkit [Instance size flexibility](open-data.md#instance-size-flexibility) open data file ([#2090](https://github.com/microsoft/finops-toolkit/issues/2090)).
 
+### [PowerShell module](powershell/powershell-commands.md)
+
+- **Fixed**
+  - Fixed [Start-FinOpsCostExport](powershell/cost/start-finopscostexport.md) exporting the wrong period for anyone running in a positive UTC offset. `-StartDate` and `-EndDate` are now treated as UTC calendar dates instead of being time zone converted, so the days you request are the days that get exported. Previously, local midnight converted to the previous UTC day, which moved the period back a day and made `-Backfill` run one extra month ([#2255](https://github.com/microsoft/finops-toolkit/issues/2255)).
+
 ### [Open data](open-data.md) updates
 
 **[Instance size flexibility](open-data.md#instance-size-flexibility)**
@@ -70,6 +77,7 @@ The following section lists features and enhancements that are currently in deve
 
 - **Fixed**
   - Fixed the commitment discount eligibility dataset refresh so it is reproducible and complete; retired meters now age out and previously missed meters are included ([#2164](https://github.com/microsoft/finops-toolkit/pull/2164)).
+  - Fixed the weekly commitment discount eligibility refresh timing out before it could publish, which left the dataset unchanged since it first shipped in v14. The refresh now walks each price type directly instead of sharding by service family, and verifies completeness by comparing two independent traversals before writing ([#2251](https://github.com/microsoft/finops-toolkit/pull/2251)).
 
 -->
 

docs-mslearn/toolkit/hubs/deploy.md

@@ -3,7 +3,7 @@ title: How to create and update FinOps hubs
 description: This tutorial helps you create a new or update an existing FinOps hubs instance in Azure or Microsoft Fabric.
 author: flanakin
 ms.author: micflan
-ms.date: 08/13/2026
+ms.date: 08/19/2026
 ms.topic: tutorial
 ms.service: finops
 ms.subservice: finops-toolkit
@@ -84,9 +84,9 @@ Public routing is most common and easiest to use. Resources are reachable from t
 Do you prefer public or private network routing?
 
 - Public routing is most common, easiest to use, and makes resources reachable from the open internet.
-- Private routing is most secure, comes with added cost, and makes resources only reachable from peered networks.
+- Private routing is most secure, comes with added cost, and makes resources reachable through private connectivity.
 
-Public routing doesn't require configuration. If you opt for private routing, work with your network admin to configure peering and routing so the FinOps hubs isolated network is reachable from your network. Before you decide, learn more about the extra configuration steps required in [Configure private networking](private-networking.md).
+Public routing doesn't require configuration. If you opt for private routing, work with your network admin to create private endpoints and DNS in your own virtual network (preferred) or configure virtual network peering and routing (secondary). Before you decide, learn more about the ownership boundaries and configuration steps in [Configure private networking](private-networking.md).
 
 <br>