te-cli

No direct malicious behavior is evidenced in the provided instructions (they are operational CI/CD patterns). However, the workflow carries a significant supply-chain integrity risk: it installs and executes a `te` binary downloaded from a public CDN using an unpinned `latest` preview channel without shown checksum/signature verification. Because the resulting tool is then used with high-privilege service principal credentials to perform deploy/refresh/test actions against Fabric via XMLA/management APIs, a tampered artifact or compromised distribution would yield high-impact CI-to-cloud compromise. Mitigate by pinning to a specific version and verifying integrity (checksum/signature), restricting the service principal’s permissions to only the necessary workspaces/capacities/environments, and ensuring CI logs/test artifacts are guaranteed not to contain secret material.