Stabilize PowerShell CI after Pester 6 release

[MSBrett]

Summary

• Preserve the reviewed PR NAT Gateway for private subnets (fixes #2161) #2163 NAT Gateway/product changes already merged to dev.
• Revert only the unauthorized post-approval test-suite edits from PR NAT Gateway for private subnets (fixes #2161) #2163.
• Pin PR CI to Pester 5.7.1 so CI does not float to Pester 6 and fail legacy Assert-MockCalled / discovery behavior.

Why this is needed

Pester 6.0.0 was published upstream on 2026-07-07 at 00:42:45 PDT. Because .github/workflows/dev.yml cached Pester without a version, the next PR #2163 PowerShell Tests run resolved the new major version and logged Pester v6.0.0 at 2026-07-07 10:06:58 PDT.

That exposed existing test-suite compatibility issues (Assert-MockCalled and empty -ForEach discovery behavior). The product/NAT Gateway code was not the cause. The post-approval test edits in PR #2163 attempted to adapt the suite after final approval, which bypassed review. This PR keeps the reviewed product work, removes only those unauthorized test edits, and pins CI back to the previously passing Pester 5.7.1 runtime.

Requirements traceability

Requirement	Implementation
Do not full-rollback PR #2163	Restored product/docs/template files to match current origin/dev, leaving NAT Gateway work intact.
Remove unauthorized test-suite changes	PR diff now contains only the affected test files plus CI pin.
Fix uncovered Pester CI issue	.github/workflows/dev.yml pins Pester:5.7.1.
Keep scope minimal	No publish.yml change and no unrelated product changes in the final PR diff.

Validation

• pwsh -NoLogo -NoProfile -Command "Invoke-Pester -Output Detailed -Path ./src/powershell/Tests/Unit/*"
• Result: 1888 passed, 0 failed, 4 skipped.
• PR checks are passing, including PowerShell Tests.

[Copilot]

Pull request overview

This PR intends to fully revert the merged commit from PR #2163, removing the FinOps Hub NAT Gateway/private network-mode feature and undoing the associated test-suite changes in order to restore dev to the pre-#2163 state.

Changes:

• Removes NAT Gateway enablement (parameters, UI checkbox, hub type wiring) and deletes NAT Gateway resources/subnet settings from the FinOps Hub template modules.
• Reverts Deploy-Hub.ps1 and Deploy-FinOpsHub away from the -NetworkMode parameter surface back to the prior private-networking switches/flags.
• Updates multiple Pester tests and the docs changelog entry related to the reverted feature.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/templates/finops-hub/modules/Microsoft.FinOpsHubs/Core/infrastructure.bicep	Removes NAT Gateway resources and subnet NAT/defaultOutboundAccess settings (also contains a tagging regression noted in review).
src/templates/finops-hub/modules/hub.bicep	Removes enableNatGateway parameter and stops passing it into newHub().
src/templates/finops-hub/modules/fx/hub-types.bicep	Removes natGateway from hub properties and removes the enableNatGateway function parameter/wiring.
src/templates/finops-hub/main.bicep	Removes enableNatGateway parameter and stops passing it into the hub module.
src/templates/finops-hub/createUiDefinition.json	Removes NAT Gateway checkbox UI, parameter mapping, and resource-type entries for NAT/Public IP.
src/scripts/Deploy-Hub.ps1	Removes -NetworkMode support and simplifies private networking behavior back to -Private.
src/powershell/Public/Deploy-FinOpsHub.ps1	Removes -NetworkMode logic and NAT-related version gating; reverts to -DisablePublicAccess behavior (help text mismatch noted in review).
src/powershell/Tests/Unit/Deploy-FinOpsHub.Tests.ps1	Removes “Network mode” unit-test context and migrates mock assertions to Assert-MockCalled.
src/powershell/Tests/Unit/DocsLinks.Tests.ps1	Simplifies link-validation contexts by removing conditional “else” test blocks.
src/powershell/Tests/Initialize-Tests.ps1	Removes explicit global import of Pester during test initialization.
src/powershell/Tests/Unit/Start-FinOpsCostExport.Tests.ps1	Migrates mock assertions from Should -Invoke to Assert-MockCalled.
src/powershell/Tests/Unit/Save-FinOpsHubTemplate.Tests.ps1	Migrates mock assertions from Should -Invoke to Assert-MockCalled.
src/powershell/Tests/Unit/Register-FinOpsHubProviders.Tests.ps1	Migrates mock assertions from Should -Invoke to Assert-MockCalled.
src/powershell/Tests/Unit/New-FinOpsCostExport.Tests.ps1	Migrates mock assertions from Should -Invoke to Assert-MockCalled.
src/powershell/Tests/Unit/New-Directory.Tests.ps1	Migrates mock assertions from Should -Invoke to Assert-MockCalled.
src/powershell/Tests/Unit/Initialize-FinOpsHubDeployment.Tests.ps1	Migrates mock assertions from Should -Invoke to Assert-MockCalled.
src/powershell/Tests/Unit/Get-FinOpsToolkitVersion.Tests.ps1	Migrates mock assertions from Should -Invoke to Assert-MockCalled.
src/powershell/Tests/Unit/Get-FinOpsCostExport.Tests.ps1	Migrates mock assertions from Should -Invoke to Assert-MockCalled.
src/powershell/Tests/Integration/CostExports.Tests.ps1	Migrates mock assertions from Should -Invoke to Assert-MockCalled.
docs-mslearn/toolkit/changelog.md	Removes the unreleased FinOps hubs entry referencing PR #2163 and updates ms.date (ms.date value noted in review).

Comments suppressed due to low confidence (2)

src/powershell/Public/Deploy-FinOpsHub.ps1:92

• The comment-based help documents a ".PARAMETER EnablePublicAccess", but the function does not define an EnablePublicAccess parameter (it uses -DisablePublicAccess). This makes Get-Help output misleading for users.

    .PARAMETER EnablePublicAccess
    Optional. Enable public access to the data lake.  Default: true.

    .PARAMETER VirtualNetworkAddressPrefix
    Optional. Address space for the workload. A /26 is required for the workload. Default: "10.20.30.0/26".

docs-mslearn/toolkit/changelog.md:7

• docs-mslearn/toolkit/changelog.md body content was modified in this PR, but ms.date was changed to an older date. Repo guidance (AGENTS.md) expects ms.date to be set to today's date when body content changes to avoid CI conflicts.

ms.author: brettwil
ms.date: 07/07/2026
ms.topic: reference

[MSBrett]

This is a valid issue in the pre-#2163 state, but this PR is intentionally a full revert of the corrupted squash merge commit 3ed33c3. I am not mixing a separate VNet tag fix into this rollback PR; it should be handled as a separate, reviewed fix after repository state is restored.