feat!: publish as IntuneGraphKit, with a tag-driven Gallery release

[juandresrodca]

Implements #5, with one change of plan the issue could not have known about.

The name was taken

IntuneGraph on the PowerShell Gallery already exists: an unrelated module by another author (five versions, the latest January 2025) that uploads, assigns and removes Intune apps. So the README's first command, Install-Module IntuneGraph, has not been failing. It has been installing that module, write cmdlets included, on the strength of a README that promises read-only.

A Gallery package name has to equal the module name, so publishing under the project name was never available. The module is now IntuneGraphKit. The cmdlet names, the graph.json format, the MCP server name (intunegraph), the repository, the site and the report title keep the IntuneGraph name. The reasoning is recorded in docs/discoverability.md, and the README install block carries a one-line note naming the other package.

What is in here

• Rename: src/IntuneGraph becomes src/IntuneGraphKit (done with git mv, so history follows). Every import, test path, launcher, fixture generator, .gitignore rule, doc and the site install snippet are updated.
• Manifest:
  • CompatiblePSEditions = Desktop, Core, plus the PSEdition_Desktop and PSEdition_Core tags.
  • IconUri pointing at the new docs/img/icon.png, drawn by tools/icon/New-IntuneGraphIcon.ps1 in the viewer's palette.
  • Description now matches the repository description.
  • A freshly generated GUID replaces the hand-typed placeholder. First publish is the last point where changing it is free.
• build.ps1 -Task Publish: calls Publish-PSResource and reads the key from PSGALLERY_API_KEY only. There is no parameter for it, so no default value and nothing in shell history.
• .github/workflows/release.yml: on a v* tag it re-runs the full CI matrix as a reusable workflow, checks the tag equals ModuleVersion, and only then publishes. The tag reaches the script through env, never interpolated into it.
• CI: adds a Windows PowerShell 5.1 leg. CONTRIBUTING already said 5.1 was covered, but every leg ran pwsh, and 5.1 is the manifest's floor.
• Tests: one new Pester check that the metadata the Gallery listing shows is present, since a published version's listing cannot be corrected in place.
• CHANGELOG (Unreleased), CONTRIBUTING (Releasing), SECURITY and docs/mcp.md are updated.

Verification

On Windows PowerShell 5.1:

• ./build.ps1: PSScriptAnalyzer clean, 38/38 tests passing (37 existing plus the new metadata check).
• In a clean process with src on PSModulePath, Import-Module IntuneGraphKit resolves by name. It exports all 10 commands, and Export-IntuneGraph -DemoData → Get-IntuneTarget → Show-IntuneGraph runs end to end (DEV-FIN-01 -> SG-Finance -> SG-AllStaff).
• Both workflow files parse as YAML.
• No remaining references to the old module name or path (searched outside the generated fixture data).

Not verified locally:

• PowerShell 7: not installed on the machine this was built on. The CI legs on this PR cover it.
• The new 5.1 CI leg: it runs for the first time on this PR.
• The release workflow and the Gallery publish: they only run on a tag push.

Before the first release

1. Add the Gallery API key as the PSGALLERY_API_KEY repository secret (gh secret set PSGALLERY_API_KEY prompts for it).
2. Choose the version. I would ship 0.3.0 rather than 0.2.0, since the rename changes Import-Module for anyone running from a clone. Move the Unreleased entries under it, set ModuleVersion to match, and tag the merge commit.

Until that first publish, the README's PSGallery badge reads "not found", and the IconUri resolves only once this is on main.

Refs #5. It closes once Install-Module IntuneGraphKit works from a clean machine.