PSAvoidUsingPositionalParameters reports issue with az command when version 2.40.0 of az cli is installed

[FISHMANPET]

Version 2.40.0 of the az cli included this addition that replaced the previous executable with an entry script, az.ps1. Now because it's an "ExternalScript" it triggers the PSAvoidUsingPositionalParameters rule, even though they're not "PowerShell" parameters and az isn't really a "PowerShell" script in the sense that it has named and positional parameters.

Steps to reproduce

Install az cli 2.40.0
Create a file az-test.ps1 with the following line

az account management-group create --name $name --display-name $displayName --parent $parent

Run Invoke-ScriptAnalyzer against it

Invoke-ScriptAnalyzer .\az-test.ps1

Expected behavior

No output, as no issues are detected

Actual behavior

RuleName                            Severity     ScriptName Line  Message
--------                            --------     ---------- ----  -------
PSAvoidUsingPositionalParameters    Information  az-test.ps 1     Cmdlet 'az' has positional parameter. Please use named
                                                 1                parameters instead of positional parameters when calling a
                                                                  command.

Environment data

> $PSVersionTable
Name                           Value
----                           -----
PSVersion                      5.1.22000.832
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.22000.832
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
> (Get-Module -ListAvailable PSScriptAnalyzer).Version | ForEach-Object { $_.ToString() }
1.20.0
1.19.1

I've also tested this with PS 7.2.6 and gotten the same result. This is a weird "bug" because everything is doing what it's supposed to on a surface level, it's just that all this "correct" behavior has intersected to cause overall incorrect behavior. Maybe it just shouldn't check external scripts? Or maybe the az cli is popular enough that an exception can be made directly where PSSA won't test calls to az.ps1?

[bergmeister]

Thanks for calling this out, it might be worth an exception.

[bergmeister]

Opened a PR with a fix and since we are close to releasing a new version, hope to get this out very soon. In the meantime you could suppress az specifically using [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingPositionalParameters', 'az')]

[bergmeister]

@FISHMANPET This fix has been release in 1.21.0 to the PowerShellGallery now: https://github.com/PowerShell/PSScriptAnalyzer/releases/tag/1.21.0