Converge website module updates

.github/scripts/check-module-submodules.sh

@@ -14,9 +14,7 @@ no_tag_baselines=(
 )
 
 # Keep docs-only exceptions narrow and remove them after the next module release.
-docs_only_exceptions=(
-  "AtlassianPS.Configuration:555e8a3300a12e03b1d9c494a874fe21fe9bbccf"
-)
+docs_only_exceptions=()
 
 has_no_tag_baseline() {
   local module="$1"

.github/workflows/pages.yml

@@ -7,32 +7,30 @@ on:
     branches: [master]
   workflow_dispatch:
 
-permissions:
-  contents: read
-  pages: write
-  id-token: write
-
 concurrency:
   group: pages-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
   build:
+    permissions:
+      contents: read
+      pages: read
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           submodules: recursive
 
       - name: Setup Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1
         with:
           ruby-version: "3.3"
           bundler-cache: true
 
       - name: Setup Pages
-        uses: actions/configure-pages@v6
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6
 
       - name: Check module submodules
         run: bash .github/scripts/check-module-submodules.sh
@@ -44,10 +42,13 @@ jobs:
 
       - name: Upload artifact
         if: github.ref == 'refs/heads/master'
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
 
   deploy:
     if: github.ref == 'refs/heads/master'
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
@@ -56,4 +57,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5

.github/workflows/update-submodule.yml

@@ -14,12 +14,19 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
+concurrency:
+  group: update-submodule-${{ github.event.client_payload.module || inputs.module }}
+  cancel-in-progress: true
+
 jobs:
   update:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           submodules: recursive
           token: ${{ secrets.PAT_TOKEN }}
@@ -31,30 +38,63 @@ jobs:
 
       - name: Update submodule
         id: update
+        env:
+          MODULE: ${{ github.event.client_payload.module || inputs.module }}
+          VERSION: ${{ github.event.client_payload.version || inputs.version }}
         run: |
-          MODULE="${{ github.event.client_payload.module || inputs.module }}"
-          VERSION="${{ github.event.client_payload.version || inputs.version }}"
+          case "$MODULE" in
+            AtlassianPS.Configuration|ConfluencePS|JiraAgilePS|JiraPS) ;;
+            *)
+              echo "::error::Unsupported module: $MODULE"
+              exit 1
+              ;;
+          esac
+
           echo "module=$MODULE" >> "$GITHUB_OUTPUT"
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-
+
+          current_commits=("$(git rev-parse "HEAD:modules/$MODULE")")
+          rolling_branch="update-$MODULE"
+          rolling_ref="refs/remotes/origin/$rolling_branch"
+
+          if git ls-remote --exit-code --heads origin "$rolling_branch" >/dev/null; then
+            git fetch --no-tags origin "refs/heads/$rolling_branch:$rolling_ref"
+            current_commits+=("$(git rev-parse "$rolling_ref:modules/$MODULE")")
+          fi
+
           cd "modules/$MODULE"
           git fetch origin --tags
+          tag_ref="refs/tags/$VERSION"
+          if ! git show-ref --verify --quiet "$tag_ref"; then
+            echo "::error::Release tag $VERSION does not exist for $MODULE."
+            exit 1
+          fi
+          target_commit=$(git rev-parse --verify "$tag_ref^{commit}")
+
+          for current_commit in "${current_commits[@]}"; do
+            if ! git merge-base --is-ancestor "$current_commit" "$target_commit"; then
+              echo "::error::Refusing to replace a current $MODULE release with older or unrelated tag $VERSION."
+              exit 1
+            fi
+          done
+
           # The runner checkout may normalize tracked files differently from the
           # submodule commit. The worktree is disposable; always select the
           # released tag instead of treating those generated changes as user work.
-          git checkout --force "$VERSION"
+          git checkout --force "$target_commit"
           cd ../..
           git add "modules/$MODULE"
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
         with:
           token: ${{ secrets.PAT_TOKEN }}
+          add-paths: "modules/${{ steps.update.outputs.module }}"
           commit-message: "Update ${{ steps.update.outputs.module }} to ${{ steps.update.outputs.version }}"
           title: "Update ${{ steps.update.outputs.module }} to ${{ steps.update.outputs.version }}"
           body: |
             Automated update of ${{ steps.update.outputs.module }} submodule to ${{ steps.update.outputs.version }}.
 
             Triggered by: ${{ github.event_name }}
-          branch: "update-${{ steps.update.outputs.module }}-${{ steps.update.outputs.version }}"
+          branch: "update-${{ steps.update.outputs.module }}"
           delete-branch: true

docs/Contributing/module-documentation.md

@@ -9,6 +9,8 @@ The public documentation under `/docs/<Module>/` should describe the module vers
 
 The website consumes module documentation through Git submodules in `modules/`.
 For normal updates, each module submodule should point at the latest released module tag.
+Automated releases reuse one `update-<Module>` branch and pull request per module.
+A later release refreshes that pull request instead of opening a version-specific stack.
 
 This keeps cmdlet documentation, examples, parameters, and behavior notes aligned with the package users get from `Install-Module`.
 The website must not publish documentation from a module branch that contains unreleased or breaking changes as the main module documentation.