Centralize PowerShell Gallery dependency update exceptions

[MariusStorhaug]

Context and request

MSX repositories cannot use Dependabot to update PowerShell Gallery module pins. The organization-wide Dependency Updates specification requires unsupported ecosystems to use a centrally managed exception and shared update mechanism rather than repository-local automation. Deliver that central mechanism for PowerShell Gallery pins so repositories can remain exact and reproducible without silently aging.

Acceptance criteria

• Custo provides one centrally managed mechanism that detects newer compatible stable versions of a PowerShell Gallery module pin and proposes a reviewable update.
• A consuming repository declares its module, pin location, allowed version range, and required identity without embedding update logic or credentials of its own.
• The mechanism preserves exact pins and module identity, excludes prereleases unless explicitly requested, and fails visibly when the Gallery or configured pin cannot be read.
• Every proposal carries dependencies, powershell, and an accurate update:* label, passes the consuming repository's normal checks, and never bypasses its review or merge policy.
• The Dependency Updates capability has a central exception-register entry and adoption guidance that point to the Custo-owned mechanism.

Constraints and non-goals

• Dependabot currently has no PowerShell Gallery ecosystem; do not represent this as a native Dependabot configuration.
• Do not create another repository-local scheduled workflow as the durable solution.
• Keep the first deliverable limited to PowerShell Gallery module pins; broader package-management support needs separate scope.

---

Technical decisions

• Use the PowerShell Gallery OData feed as the source of published versions. Fetch all pages, sort versions as versions rather than strings, and exclude prereleases by default.
• Adopt the existing Dependency Updates contract: one ordinary pull request per update or permitted group, explicit failure rather than a successful no-op when the check cannot run, and no automated merge for identity-plus-exact pins.
• Define an exception-register schema and a consuming-repository interface before choosing the implementation form (reusable workflow, action, or centrally orchestrated service). The chosen form must leave repositories declarative and keep credentials centrally governed.

Implementation plan

• Add failing contract tests for a declared PowerShell Gallery pin: compatibility bounds, identity preservation, prerelease exclusion, paging, and unavailable-feed failure.
• Define and implement the Custo-owned declaration and exception-register entries for PowerShell Gallery module pins.
• Implement the shared check and pull-request proposal mechanism with least-privilege credentials and the required labels.
• Document consuming-repository adoption and update the Dependency Updates design to identify Custo as the shared mechanism.
• Validate the mechanism against a real compatible pin and confirm that an incompatible proposed update is held by the consuming repository's normal checks.