Implement remediation script catalog and UI integration

.github/workflows/update-catalog.yml

@@ -0,0 +1,103 @@
+name: Update Remediation Script Catalog
+
+# Runs weekly to pull new/updated scripts from JayRHa/EndpointAnalyticsRemediationScripts,
+# regenerate the catalog metadata + content bundle, commit metadata changes,
+# and upload the content bundle to Azure Blob Storage.
+#
+# Distribution strategy:
+#   - script-catalog.json  (metadata only, no PS1 text) ships embedded in the .exe via EmbeddedResource
+#   - script-content-bundle.json (PS1 content) is served from Azure Blob Storage behind Azure CDN
+#   - Clients cache the bundle in LiteDB for 7 days; CDN caches at edge to minimise origin hits
+#   - A monthly Azure Cost Alert on the storage account acts as a DDoS cost guardrail
+#   - No GitHub raw API calls at runtime; avoids the 60 req/hr unauthenticated rate limit
+
+on:
+  schedule:
+    # Every Monday at 02:00 UTC
+    - cron: "0 2 * * 1"
+  workflow_dispatch:
+    inputs:
+      force_refetch:
+        description: "Force re-fetch scripts from JayRHa repo even if no changes detected"
+        required: false
+        default: "false"
+        type: boolean
+
+jobs:
+  update-catalog:
+    runs-on: windows-latest
+    permissions:
+      contents: write   # needed to commit updated script-catalog.json back to the branch
+    env:
+      # Expose optional CDN secrets as env vars so they can be tested in `if:` conditions
+      AZURE_CDN_PROFILE: ${{ secrets.AZURE_CDN_PROFILE }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Fetch scripts from JayRHa/EndpointAnalyticsRemediationScripts
+        shell: pwsh
+        run: |
+          $forceFlag = '${{ inputs.force_refetch }}' -eq 'true'
+          scripts/Fetch-CatalogScripts.ps1 `
+            -DestinationDir src/Intune.Commander.Core/CatalogSource `
+            -Force:$forceFlag
+
+      - name: Build catalog metadata and content bundle
+        shell: pwsh
+        run: |
+          scripts/Build-ScriptCatalog.ps1 `
+            -SourceDir src/Intune.Commander.Core/CatalogSource `
+            -MetadataOutputFile src/Intune.Commander.Core/Assets/script-catalog.json `
+            -ContentBundleOutputFile "${{ runner.temp }}/script-content-bundle.json"
+
+      - name: Commit updated catalog metadata if changed
+        shell: pwsh
+        run: |
+          git config user.name  "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add src/Intune.Commander.Core/CatalogSource `
+                  src/Intune.Commander.Core/Assets/script-catalog.json
+          $status = git status --porcelain
+          if ($status) {
+            git commit -m "chore: update remediation script catalog [skip ci]"
+            git push
+            Write-Host "Committed catalog updates."
+          } else {
+            Write-Host "No catalog changes detected; nothing to commit."
+          }
+
+      - name: Log in to Azure
+        uses: azure/login@v2
+        with:
+          creds: ${{ secrets.AZURE_CREDENTIALS }}
+
+      - name: Upload content bundle to Azure Blob Storage
+        shell: pwsh
+        env:
+          AZURE_STORAGE_ACCOUNT: ${{ secrets.AZURE_STORAGE_ACCOUNT }}
+        run: |
+          az storage blob upload `
+            --account-name $env:AZURE_STORAGE_ACCOUNT `
+            --file "${{ runner.temp }}/script-content-bundle.json" `
+            --container-name intunecommander `
+            --name catalog/script-content-bundle.json `
+            --content-type "application/json" `
+            --overwrite true `
+            --auth-mode login
+          Write-Host "Content bundle uploaded successfully."
+
+      - name: Purge Azure CDN cache for content bundle
+        # Only runs when the optional CDN secrets are configured
+        if: ${{ env.AZURE_CDN_PROFILE != '' }}
+        shell: pwsh
+        run: |
+          az cdn endpoint purge `
+            --resource-group "${{ secrets.AZURE_CDN_RESOURCE_GROUP }}" `
+            --profile-name   "${{ secrets.AZURE_CDN_PROFILE }}" `
+            --name           "${{ secrets.AZURE_CDN_ENDPOINT }}" `
+            --content-paths  "/catalog/script-content-bundle.json"
+          Write-Host "CDN cache purged."