Azure Verified Modules — Tools

Source for the Avm.Authoring PowerShell module: a single, cross-platform PowerShell 7 tool that consolidates the scripts and CI helpers used by authors of Azure Verified Modules (Bicep and Terraform).

One avm CLI, two ecosystems, no Docker / make / porch required for the wired verbs.

Install

Install Avm.Authoring from Microsoft Artifact Registry (MAR). PowerShell 7.4+ and Microsoft.PowerShell.PSResourceGet 1.2.0 or later are required. If needed, upgrade PSResourceGet using the version bundled with PowerShell:

Install-PSResource -Name Microsoft.PowerShell.PSResourceGet `
    -Version 1.2.0 `
    -Repository PSGallery `
    -Scope CurrentUser

Start a new PowerShell session after upgrading. Register MAR once; it is not registered by default:

Import-Module Microsoft.PowerShell.PSResourceGet -MinimumVersion 1.2.0
Register-PSResourceRepository -Name MAR `
    -Uri 'https://mcr.microsoft.com' `
    -ApiVersion ContainerRegistry `
    -Trusted
Install-PSResource -Name avm.authoring `
    -Repository MAR `
    -Scope CurrentUser

Use lowercase avm.authoring for the registry lookup. MAR downloads are public and need no Azure sign-in. Then import it and confirm it loaded:

Import-Module Avm.Authoring
avm version

To update from MAR, run the following, then start a new PowerShell session. The built-in avm update / avm upgrade commands still use PowerShell Gallery.

Install-PSResource -Name avm.authoring `
    -Repository MAR `
    -Scope CurrentUser `
    -Reinstall

Heads-up. The Terraform authoring chain is wired and usable today; the Bicep facade is still in active development. To run the latest in-development build, import it from a clone — see CONTRIBUTING.md.

For Bicep modules with main.bicep, avm pre-commit writes the compiled main.json; avm pr-check reports missing or stale output without rewriting it. Metadata-only proposed modules do not require compiled JSON. The Bicep avm docs migration uses a tracked, repository-selected Scriban template and adjacent Notes sidecars. It remains experimental until all registry READMEs pass an independent raw-byte comparison, apart from eight historically missing JSON-example comment lines in the checked-in Key Vault README. The existing registry generator and CI stay in place.

Managed prerequisites

avm pre-commit and avm pr-check resolve their applicable tools before the first step, including Pester for metadata validation. Standalone commands use the same resolver. Missing binary and PowerShell packages are downloaded into the AVM cache at their configured versions, with checksum verification; no user or system PowerShell module installation is needed. AVM_OFFLINE=1 and AVM_NO_AUTO_INSTALL=1 remain effective. Use avm tool list to inspect availability or avm tool install Pester to populate a prerequisite explicitly.

An optional repository-root .avm/tool-version-overrides.json selects versions of known tools without replacing their download definitions:

{
  "terraform": "1.16.5",
  "Pester": "5.7.1"
}

Names are case-sensitive. For Bicep monorepos, only the recognized repository root file applies to every module; nested module files are ignored. Selected overrides emit a warning with the file and packaged/selected versions, even when the versions match.

Overrides disable pinned checksum verification for the named tools. They use a separate unverified cache and never replace verified default entries. Untouched tools and dependencies remain pinned. Review this file as an executable-toolchain change before running commands with privileged access. After loading an overridden PowerShell module, use a fresh PowerShell session when returning to the default version.

CI diagnostics

AVM logs use plain text by default in GitHub Actions. The reusable Terraform workflow also disables forced terminal colour and limits the full secrets and variables contexts to the environment-preparation steps, rather than attaching them to every step. GitHub still renders and masks those necessary step inputs; the tooling does not print the context payloads.

Failed gauntlet steps narrate the error headline. The final result, workflow annotation, step summary and typed exception retain the diagnostic, while the terminating PowerShell error shows only the command summary instead of replaying the entire failure again. Local interactive colour and explicit CLICOLOR_FORCE remain available; NO_COLOR takes precedence.

PR checks and integration pair the selected General test subscription with the standard ARM_CLIENT_ID and ARM_TENANT_ID; ARM_*_OVERRIDE inputs apply only to e2e. A provider's explicit subscription or TF_VAR_* input can select a different target. InvalidAuthenticationTokenTenant is an identity/target mismatch, not a logging failure: check those inputs and the configured pool without switching accounts or granting access. Updating the reusable workflow ref does not update a separately pinned Gallery authoring runtime.

Verify the signature

Every .ps1, .psm1 and .psd1 in a released build is Authenticode-signed by Microsoft. To check what you installed:

Get-ChildItem (Get-Module Avm.Authoring -ListAvailable).ModuleBase -Recurse -Include *.ps1, *.psm1, *.psd1 |
    Get-AuthenticodeSignature |
    Group-Object Status, { $_.SignerCertificate.Subject }

Expect a single group with status Valid and a Microsoft Corporation subject. Anything reporting NotSigned, HashMismatch or UnknownError means the file has been modified or came from somewhere other than the signed release.

The release .zip attached to each GitHub Release ships alongside a SHA256SUMS file:

(Get-FileHash ./Avm.Authoring-0.2.0.zip -Algorithm SHA256).Hash.ToLowerInvariant()
Get-Content ./SHA256SUMS

Learn more

• Cmdlet reference — generated user documentation for every public cmdlet and parameter.
• CONTRIBUTING.md — run the module from source, plus the build / test / lint dev loop.
• docs/quality-spec.md — purpose, architecture, and mandatory engineering practices.

License

MIT.