[AddsOrgUnitsAndGroups] Add completion anchor to stop composite-level DependsOn exploding the node MOF (MI RESULT 27)

[raandree]

Pull Request (PR) description

Fixes #XXX. Follow-up to #248 / #249 (same symptom class, different root cause).

AddsDomainPrincipals is typically ordered after AddsOrgUnitsAndGroups with a
composite-level dependency:

AddsDomainPrincipals:
  DependsOn:
    - "[AddsDomain]AddsDomain"
    - "[AddsOrgUnitsAndGroups]AddsOrgUnitsAndGroups"

Root cause. Both entries are composite references, and DSC applies two
multiplicative expansions when the composites are expanded into a root
configuration:

1. Reference expansion — a composite reference in DependsOn expands to a
   reference to every resource that composite generated (~5 for AddsDomain
   • ~557 OUs/groups for AddsOrgUnitsAndGroups = 562).
2. Composite propagation — a DependsOn placed on a consuming composite
   is copied onto every resource that composite emits (~130 ADUser
   • ~96 _MemberOf Script + … ≈ 230).

The two multiply: ≈ 230 × 562 ≈ 129,000 fully-qualified DependsOn strings
≈ 16 MB. On a real DC (~130 users, ~200 groups, ~350 OUs) each MSFT_ADUser
MOF block was 73,360 bytes, of which 72,770 (99.2 %) was a 562-entry
DependsOn array; the node MOF was 17.8 MB. That compiles (below the
50 MB ValidateInstanceText limit addressed by #248/#249) but cannot be
pushed — Start-DscConfiguration fails with MOF file size exceeded max size limit. / MI RESULT 27 (MI_RESULT_SERVER_LIMITS_EXCEEDED), the hard ~10 MB
LCM push limit that MaxEnvelopeSizeKb does not affect (see Microsoft365DSC #357).

The AddsDomainPrincipals composite itself is fine — each _MemberOf script
depends only on its own [ADUser]; the bloat is entirely the propagated
composite-level DependsOn.

Fix. AddsOrgUnitsAndGroups now publishes a single, always-in-desired-state
completion anchor — a Script resource AddsOrgUnitsAndGroupsComplete whose
DependsOn lists every OU and group the composite creates. Consumers order
after the whole composite with one non-expanding reference:

AddsDomainPrincipals:
  DependsOn:
    - "[Script]AddsOrgUnitsAndGroupsComplete::[AddsOrgUnitsAndGroups]AddsOrgUnitsAndGroups"

That single reference propagates to AddsDomainPrincipals's ~230 resources as
1 edge each instead of 562, so ordering is preserved (users find their
Path OU; _MemberOf scripts find their target groups) while the node MOF
stays small. No cycle: AddsDomainPrincipals → anchor → OUs/groups; nothing
points back. [AddsDomain]AddsDomain becomes redundant in the consumer because
the anchor is transitively after AddsDomain via the existing
AddsOrgUnitsAndGroups.DependsOn. The anchor is inert (TestScript = { $true },
empty SetScript) — it never performs work; it is purely an ordering gate — and
is skipped when neither OUs nor groups are defined, so existing consumers that
don't reference it are unaffected.

Measured (real DC): node MOF 17.8 MB → < 2 MB; sample MSFT_ADUser
DependsOn 562 entries → 1; push no longer returns MI RESULT 27.

The matching consumer-side change (pointing AddsDomainPrincipals.DependsOn
at the anchor) lives in the DSC configuration-data repo (e.g. ProjectDagger),
not in this module.

Added

• AddsOrgUnitsAndGroups: always-in-desired-state AddsOrgUnitsAndGroupsComplete
  completion anchor that depends on every OU and group the composite creates, so
  consuming composites (e.g. AddsDomainPrincipals) can order after the whole
  composite with a single cross-composite reference instead of a composite-wide
  DependsOn. The composite-wide form expands to every member resource and, when
  placed on a consuming composite, is propagated to every resource that composite
  emits — an O(consumers × members) explosion that bloated the node MOF past the
  hard ~10 MB LCM push limit (MI RESULT 27). The anchor is inert and is skipped
  when no OUs or groups are defined. [fix #XXX]

Task list

• The PR represents a single logical change. i.e. Cosmetic updates should go in different PRs.
• Added an entry under the Unreleased section of in the CHANGELOG.md as per format.
• Local clean build passes without issue or fail tests (build.ps1 -ResolveDependency).
• Resource documentation added/updated in README.md.
• Resource parameter descriptions added/updated in README.md, schema.mof
  and comment-based help.
• Comment-based help added/updated.
• Localization strings added/updated in all localization files as appropriate.
• Examples appropriately added/updated.
• Unit tests added/updated. See DSC Resource Testing Guidelines.
• Integration tests added/updated (where possible). See DSC Resource Testing Guidelines.
• New/changed code adheres to DSC Resource Style Guidelines and Best Practices.

<!-- Reviewable:start -->
- - -
This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/dsccommunity/CommonTasks/251)
<!-- Reviewable:end -->

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 0c7b8235-6c13-4166-9777-0c9f42e72e81

📥 Commits

Reviewing files that changed from the base of the PR and between 943faff and c8a6cc7.

📒 Files selected for processing (3)

• doc/AddsDomainPrincipals.adoc
• doc/AddsOrgUnitsAndGroups.adoc
• source/DSCResources/AddsOrgUnitsAndGroups/AddsOrgUnitsAndGroups.schema.psm1

✅ Files skipped from review due to trivial changes (2)

• doc/AddsDomainPrincipals.adoc
• doc/AddsOrgUnitsAndGroups.adoc

🚧 Files skipped from review as they are similar to previous changes (1)

• source/DSCResources/AddsOrgUnitsAndGroups/AddsOrgUnitsAndGroups.schema.psm1

---

Walkthrough

Adds a conditional completion-anchor Script resource to AddsOrgUnitsAndGroups, derives its dependencies from OU and group resources, and documents the anchor as the preferred cross-composite ordering target in the composite docs and changelog.

Changes

Completion anchor resource

Layer / File(s)	Summary
Completion anchor resource source/DSCResources/AddsOrgUnitsAndGroups/AddsOrgUnitsAndGroups.schema.psm1	Adds AddsOrgUnitsAndGroupsComplete with aggregated DependsOn, TestScript = { $true }, empty SetScript, and constant GetScript output when OUs or groups are defined.

Documentation updates

Layer / File(s)	Summary
Ordering guidance and changelog doc/AddsOrgUnitsAndGroups.adoc, doc/AddsDomainPrincipals.adoc, CHANGELOG.md	Adds ordering notes that reference AddsOrgUnitsAndGroupsComplete as the dependency target and records the change in the unreleased changelog.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• AddsOrgUnitsAndGroups: composite-level DependsOn on AddsDomainPrincipals explodes the node MOF past the ~10 MB LCM push limit (MI RESULT 27) #250: Describes the same completion-anchor pattern for ordering AddsDomainPrincipals against AddsOrgUnitsAndGroups.
• AddsOrgUnitsAndGroups: quadratic DependsOn produces a node MOF larger than the 50 MB limit #248: Addresses the AddsOrgUnitsAndGroups dependency-expansion issue by introducing the completion anchor.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the added completion anchor to prevent composite-level DependsOn expansion and MOF bloat.
Description check	✅ Passed	The description is directly related to the same completion-anchor fix and its motivation, so it matches the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}