Bicep 0.46.1

Apply these standalone rules to Bicep 0.46.1 templates, .bicepparam files, modules, configuration, and Azure Resource Manager (ARM) deployments. Resource-provider API versions, Azure deployment clients, and experimental extensions have separate compatibility and permission requirements.

Toolchain and configuration

• Install the newest Bicep release after reviewing it, the same one on every build path, since Bicep publishes fixes as new releases rather than patching older ones. Take its version from the Bicep releases page rather than memory, or leave a placeholder that fails the build when you can't check it there, and verify the executable actually invoked with az bicep version or bicep --version. Azure CLI manages a separate self-contained installation; PowerShell uses the independently installed CLI on PATH. Use a release binary matching the host OS and architecture, reference build images by a digest an update bot maintains, and let Renovate's bicep manager propose resource API version updates for review. The 0.46.1 in this prompt's title names the release these rules were checked against, not a version to install.
• Pin supported Azure CLI or Az PowerShell versions and deployment actions, taking each version from its release notes rather than memory. Use a client that has the --validation-level option, added in Azure CLI 2.76.0, or -ValidationLevel, added in Az PowerShell 13.4.0, for the controls below; those clients also report when what-if couldn't analyze part of a deployment.
• Protect every applicable bicepconfig.json: the nearest