[sodle-splunk]

Summary\n\n- quote and escape copy/delete PowerShell path arguments\n- default assets to certificate-validated WinRM over HTTPS\n- reject oversized AppLocker XML and document type declarations\n- report nonzero run command and run script exit codes as failures\n\n## Tracking\n\n- PAPP-38250\n- PSAAS-30809\n- PSAAS-31000\n- PSAAS-31340\n- PSAAS-32165\n- PSAAS-32241\n- Parent epic: ESPM-5228\n\n## Quality gate\n\n- compile: passed locally\n- connector lint, format, static analysis, docs, and static tests: passed locally\n- macOS-only local linter cannot install the connector's Linux pykerberos wheel\n- hosted Linux NOTICE generation is blocked on https://github.com/phantomcyber/dev-cicd-tools/pull/250\n\nThis PR remains draft until the shared NOTICE fix is released and hosted pre-commit plus compile pass.\n\nWritten by Codex.

Tracking

• PAPP: PAPP-38250
• PSAAS: PSAAS-30809, PSAAS-31000, PSAAS-31340, PSAAS-32165, PSAAS-32241
• Written by Codex.

Merge strategy: merge commit only; do not squash.

Written by Codex.

Release impact

This PR contains a breaking configuration change and must ship as a major release. WinRM now defaults to HTTPS on port 5986 with certificate verification; existing assets must provide a compatible trusted listener or explicitly override these settings. The corresponding functional commit includes a parseable BREAKING CHANGE: trailer for semantic-release.

Release-impact note added by Codex.

[github-actions]

Merging this PR will release 3.0.0 with the following release notes:

3.0.0 (2026-07-29)

Connector release changes

• Use literal PowerShell path arguments for copy and delete file actions.
• Default WinRM assets to certificate-validated HTTPS connections.
• Reject oversized AppLocker XML and documents containing type declarations.
• Report nonzero run command and run script exit codes as action failures.

[sodle-splunk]

Codex breaking-change review: this PR needs to be redone as a breaking/major release before merge.

Reason: it changes verify_server_cert default from false to true and changes default protocol from http to https. Under the updated connector release guidance, changing secure transport/config defaults in a way that can make existing assets fail where they previously succeeded is a breaking change. If the secure default is intentional, please preserve it but add major-release treatment: a parseable BREAKING CHANGE: trailer (or equivalent breaking Conventional Commit), release notes that call out the behavior change and migration impact, and any required PR description updates. If this should remain a non-major release, preserve the previous runtime default instead and document the opt-in secure setting.

Commented by Codex.

[phantom-jacob]

Fresh review completed against the unchanged current head. The connector changes, release notes, commit history, and required pre-commit, compile, build, and coverage gates are acceptable. The stale or malformed PR description is non-blocking per the review direction.

Approved by Codex.

[splunk-soar-semantic-release]

🎉 This PR is included in version 3.0.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀