fix: post-release review defects, performance, NTFSSecurity migration guide, and CI upkeep

.github/workflows/build.yml

@@ -42,7 +42,7 @@ jobs:
       module-version: ${{ steps.calculate-version.outputs.module-version }}
     steps:
       - name: Check out full repository history
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -69,7 +69,7 @@ jobs:
           ./build.ps1 -ResolveDependency -Tasks pack
 
       - name: Upload Sampler output
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: sampler-output
           path: output/
@@ -93,10 +93,10 @@ jobs:
             artifact-suffix: powershell-5.1
     steps:
       - name: Check out source
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Download Sampler output
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: sampler-output
           path: output
@@ -151,7 +151,7 @@ jobs:
 
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: test-results-${{ matrix.artifact-suffix }}
           path: |
@@ -176,12 +176,12 @@ jobs:
       pull-requests: write
     steps:
       - name: Check out full repository history
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Download Sampler output
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: sampler-output
           path: output
@@ -228,3 +228,64 @@ jobs:
         run: |
           $ErrorActionPreference = 'Stop'
           ./build.ps1 -Tasks Create_ChangeLog_GitHub_PR
+
+      # Create_ChangeLog_GitHub_PR catches everything that happens after it
+      # creates the changelog branch and only writes the error to the build log,
+      # and Invoke-Build still exits zero. The v0.2.0 release pushed
+      # updateChangelogAfterv0.2.0, opened no pull request, and reported the step
+      # above as successful. Ask GitHub instead of trusting that conclusion. Only
+      # a stable release tag owes a pull request: UpdateChangelogOnPrerelease is
+      # false in build.yaml, so a pre-release build of main returns before the
+      # task creates a branch.
+      - name: Verify the changelog pull request exists
+        if: startsWith(github.ref, 'refs/tags/')
+        shell: pwsh
+        env:
+          GitHubToken: ${{ secrets.GitHubToken }}
+          Repository: ${{ github.repository }}
+          RepositoryOwner: ${{ github.repository_owner }}
+          ChangelogBranch: updateChangelogAfter${{ github.ref_name }}
+        run: |
+          $ErrorActionPreference = 'Stop'
+
+          $header = @{
+              Accept                 = 'application/vnd.github+json'
+              Authorization          = "Bearer $env:GitHubToken"
+              'X-GitHub-Api-Version' = '2022-11-28'
+          }
+
+          $head = '{0}:{1}' -f $env:RepositoryOwner, $env:ChangelogBranch
+          $pullRequestUri = 'https://api.github.com/repos/{0}/pulls?state=all&head={1}' -f $env:Repository, $head
+
+          try {
+              # Counted through the pipeline on purpose: '@(Invoke-RestMethod ...)'
+              # wraps the empty array of a no-match response into one element and
+              # would report a pull request that does not exist.
+              $pullRequest = @(
+                  Invoke-RestMethod -Uri $pullRequestUri -Headers $header |
+                      Where-Object -FilterScript { $null -ne $_.number }
+              )
+          }
+          catch {
+              throw ("Could not read the pull requests of '{0}': {1}" -f $env:Repository, $_.Exception.Message)
+          }
+
+          if ($pullRequest.Count -eq 0) {
+              $branchUri = 'https://api.github.com/repos/{0}/branches/{1}' -f $env:Repository, $env:ChangelogBranch
+              $branchState = 'was never pushed, so the task stopped before it opened one'
+
+              try {
+                  $null = Invoke-RestMethod -Uri $branchUri -Headers $header
+                  $branchState = 'was pushed, so the task stopped at the pull request itself'
+              }
+              catch {
+                  # A missing branch is one of the two reported states, not an error.
+              }
+
+              throw (
+                  "No pull request exists from '{0}'. That branch {1}. The step above reports a refused pull request only as 'Error trying to create ChangeLog Pull Request' in its log. Confirm that the GitHubToken secret grants pull-request write access to '{2}'." -f
+                      $env:ChangelogBranch, $branchState, $env:Repository
+              )
+          }
+
+          '::notice::Changelog pull request #{0} is {1} for {2}.' -f $pullRequest[0].number, $pullRequest[0].state, $env:ChangelogBranch