[dhensby]

Adds a Bicep template that provisions a Windows VM with SQL Server Developer edition, under contrib/azure-sql-vm, plus a pointer to it from CONTRIBUTING.md.

Why

CONTRIBUTING.md documents npm run test-msnodesqlv8, but the dev container cannot run it usefully. Two gaps:

• On Windows node-mssql defaults to the SQL Server Native Client 11.0 ODBC driver rather than ODBC Driver 17 for SQL Server (lib/msnodesqlv8/connection-pool.js). That is the path Windows users actually hit, and CI only exercises it in test-windows — the Linux job's msnodesqlv8 step is commented out. A contributor changing that driver currently has no local way to check their work.
• Behaviour that depends on the engine edition (CLR, user-defined types) can't be reproduced against an Azure SQL Edge substitute, which reports EngineEdition 9 and has no CLR.

This template was used to verify the GHSA-rc93-2r6p-hc2q patch against real SQL Server 2016/2017/2019/2022. It has been deployed successfully, but it is not exercised by CI and both files say so.

Design choices

• RDP only by default. The expected workflow is to RDP in and run the suites on the VM against localhost, which needs no exposed SQL port. exposeSqlPort is opt-in and also flips the SQL VM connectivity type to PUBLIC.
• Two separate passwords. sqlAdminPassword is distinct from adminPassword because the SQL one is written to test/.mssql.json in cleartext and crosses the wire — it should not also unlock RDP as administrator.
• allowedSourceIp defaults to empty, which produces no inbound rules at all, so a bare deploy exposes nothing.
• No npm impact. contrib/ is outside the files allowlist in package.json; npm pack --dry-run lists zero entries from it.

The parts that are easy to get wrong

The README documents three things found the hard way:

• The Microsoft.SqlVirtualMachine resource is not optional — deploy the marketplace image as a plain VM and sa is disabled, NT AUTHORITY\SYSTEM is not a sysadmin, and the only sysadmin is that disabled sa, so there is no route to a login short of single-user-mode recovery.
• The image ships only ODBC Driver 17, so sqlncli.msi must be installed before the msnodesqlv8 suite will connect.
• The two drivers need different TLS settings. tedious needs encrypt: true + trustServerCertificate: true; msnodesqlv8 needs encrypt: false, because its connection string is built from only Driver, Server, Database, Uid, Pwd, Trusted_Connection and Encrypt — trustServerCertificate is silently dropped, so an encrypted connection cannot trust the VM's self-signed certificate at all. This mirrors what the two CI jobs do.

The README also warns that setting driver in test/.mssql.json does not work as an override: test/msnodesqlv8/msnodesqlv8.js overwrites it with 'msnodesqlv8', which connection-pool.js treats as "unspecified" and replaces with the platform default. Only a full connectionString survives.

Verification

• az bicep build compiles clean.
• The README parameter table was checked mechanically against the compiled ARM parameters: 11/11 present, no extras, every default agreeing.
• All three JSON samples parse; all relative links resolve.
• npm run lint passes (StandardJS doesn't cover .bicep/.md, so nothing here is linted by it).

🤖 Generated with Claude Code

[github-actions]

🎉 This PR is included in version 12.7.5 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀