Simone/local-ci-cd-system
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refactor documentation and analysis in final master plan, opus47 analysis, and opus47 review of GPT-5.5

Browse Source 
- Updated the final master plan to improve clarity and consistency in the status of various capabilities, including fixes and enhancements made as of 2026-05-12.
- Revised the opus47 analysis to provide a more structured overview of the system's production readiness, including detailed coverage of OWASP Top 10 risks and operational gaps.
- Enhanced the opus47 review of GPT-5.5 by clarifying severity ratings and rationales for various items, while adding new high-severity items that were previously overlooked.
This commit is contained in:
Simone
2026-05-13 00:08:19 +02:00
parent 5d1b47e943
commit 3592dcab78
13 changed files with 350 additions and 343 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+6 -6
View File
@@ -36,7 +36,7 @@ Ogni build gira in una VM **usa e getta** ripristinata dallo snapshot: Windows S
## Requisiti Host ## Requisiti Host
| Componente | Versione / Dettaglio | | Componente | Versione / Dettaglio |
|---|---| | ---------------------- | ----------------------------------------------------------------- |
| OS | Windows 11 | | OS | Windows 11 |
| CPU/RAM | i9-10900X, 64 GB RAM | | CPU/RAM | i9-10900X, 64 GB RAM |
| VMware Workstation Pro | installato, `vmrun.exe` disponibile | | VMware Workstation Pro | installato, `vmrun.exe` disponibile |
@@ -49,7 +49,7 @@ Ogni build gira in una VM **usa e getta** ripristinata dallo snapshot: Windows S
### Windows (snapshot `BaseClean`) ### Windows (snapshot `BaseClean`)
| Componente | Versione | | Componente | Versione |
|---|---| | -------------- | ------------------------------------------------------------------------------ |
| OS | Windows Server 2025 | | OS | Windows Server 2025 |
| VMX | `F:\CI\Templates\WinBuild2025\WinBuild2025.vmx` (env `GITEA_CI_TEMPLATE_PATH`) | | VMX | `F:\CI\Templates\WinBuild2025\WinBuild2025.vmx` (env `GITEA_CI_TEMPLATE_PATH`) |
| VS Build Tools | 2026 (MSBuild 18.5.4 / toolset v145) | | VS Build Tools | 2026 (MSBuild 18.5.4 / toolset v145) |
@@ -63,7 +63,7 @@ Variante **Windows Server 2022**: `*WinBuild2022.ps1` + VMX `F:\CI\Templates\Win
### Linux (snapshot `BaseClean-Linux`) ### Linux (snapshot `BaseClean-Linux`)
| Componente | Versione | | Componente | Versione |
|---|---| | ------------ | ---------------------------------------------------------------------------------------- |
| OS | Ubuntu 24.04 LTS (cloud image) | | OS | Ubuntu 24.04 LTS (cloud image) |
| VMX | `F:\CI\Templates\LinuxBuild2404\LinuxBuild2404.vmx` (env `GITEA_CI_LINUX_TEMPLATE_PATH`) | | VMX | `F:\CI\Templates\LinuxBuild2404\LinuxBuild2404.vmx` (env `GITEA_CI_LINUX_TEMPLATE_PATH`) |
| Toolchain | GCC, G++, Clang, CMake, Ninja, Python 3, Git, 7-Zip | | Toolchain | GCC, G++, Clang, CMake, Ninja, Python 3, Git, 7-Zip |
@@ -218,7 +218,7 @@ nssm start act_runner
Imposta queste variabili d'ambiente nel servizio (`runner/config.yaml`): Imposta queste variabili d'ambiente nel servizio (`runner/config.yaml`):
| Variabile | Valore | | Variabile | Valore |
|---|---| | ------------------------------ | --------------------------------------------------- |
| `GITEA_CI_TEMPLATE_PATH` | `F:\CI\Templates\WinBuild2025\WinBuild2025.vmx` | | `GITEA_CI_TEMPLATE_PATH` | `F:\CI\Templates\WinBuild2025\WinBuild2025.vmx` |
| `GITEA_CI_LINUX_TEMPLATE_PATH` | `F:\CI\Templates\LinuxBuild2404\LinuxBuild2404.vmx` | | `GITEA_CI_LINUX_TEMPLATE_PATH` | `F:\CI\Templates\LinuxBuild2404\LinuxBuild2404.vmx` |
| `GITEA_CI_CLONE_BASE_DIR` | `F:\CI\BuildVMs` | | `GITEA_CI_CLONE_BASE_DIR` | `F:\CI\BuildVMs` |
@@ -284,7 +284,7 @@ La composite action [gitea/actions/local-ci-build/action.yml](gitea/actions/loca
asconde tutta la logica Invoke-CIJob.ps1 e accetta questi input principali: asconde tutta la logica Invoke-CIJob.ps1 e accetta questi input principali:
| Input | Descrizione | | Input | Descrizione |
|---|---| | ----------------- | ------------------------------------------------ |
| `build-command` | Comando di build da eseguire nel guest | | `build-command` | Comando di build da eseguire nel guest |
| `guest-os` | `Windows` (default) o `Linux` | | `guest-os` | `Windows` (default) o `Linux` |
| `artifact-source` | Path artifacts nel guest | | `artifact-source` | Path artifacts nel guest |
@@ -300,7 +300,7 @@ e aggiorna `build-command`, `artifact-source`, `repo-url`.
## Documentazione ## Documentazione
| File | Contenuto | | File | Contenuto |
|---|---| | ---------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
| [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) | Diagramma componenti e flusso dati | | [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) | Diagramma componenti e flusso dati |
| [docs/CI-FLOW.md](docs/CI-FLOW.md) | Descrizione dettagliata di ogni fase del pipeline | | [docs/CI-FLOW.md](docs/CI-FLOW.md) | Descrizione dettagliata di ogni fase del pipeline |
| [docs/HOST-SETUP.md](docs/HOST-SETUP.md) | Bootstrap macchina host (Setup-Host.ps1) | | [docs/HOST-SETUP.md](docs/HOST-SETUP.md) | Bootstrap macchina host (Setup-Host.ps1) |
docs/BEST-PRACTICES.md
+2 -2
View File
@@ -61,7 +61,7 @@ The template VM disables Windows Defender, Windows Firewall, and User Account Co
This is **intentional** — not a bug, not an oversight. Each has tradeoffs: This is **intentional** — not a bug, not an oversight. Each has tradeoffs:
| Feature | Disabled? | Why | Cost if enabled | | Feature | Disabled? | Why | Cost if enabled |
|---------|-----------|-----|-----------------| | --------------------------------------- | --------- | ------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------- |
| **Windows Defender** | Yes | Real-time AV scanning blocks .NET compilation, Python wheels, and npm installs | 5–10 min per build overhead; false positives on dev tools | | **Windows Defender** | Yes | Real-time AV scanning blocks .NET compilation, Python wheels, and npm installs | 5–10 min per build overhead; false positives on dev tools |
| **Windows Firewall** | Yes | Blocks inbound WinRM even with rules; requires Domain/Home profile tuning | Complex rules; fragile across OS updates | | **Windows Firewall** | Yes | Blocks inbound WinRM even with rules; requires Domain/Home profile tuning | Complex rules; fragile across OS updates |
| **UAC (LocalAccountTokenFilterPolicy)** | Yes | Prevents non-elevated WinRM scripts from running builds | Requires built-in Administrator account; WinRM behaves like a user with limited rights | | **UAC (LocalAccountTokenFilterPolicy)** | Yes | Prevents non-elevated WinRM scripts from running builds | Requires built-in Administrator account; WinRM behaves like a user with limited rights |
@@ -369,7 +369,7 @@ cached in the ISO or in `F:\CI\ISO\`).
Priority targets (descending risk): Priority targets (descending risk):
| Installer | Script | Where to pin | | Installer | Script | Where to pin |
|-----------|--------|--------------| | ----------------------- | ----------------------------------------------- | ------------------------------------------------------ |
| Git for Windows `.exe` | `template/Install-CIToolchain-WinBuild2025.ps1` | `-sha256` param or `Get-FileHash` check after download | | Git for Windows `.exe` | `template/Install-CIToolchain-WinBuild2025.ps1` | `-sha256` param or `Get-FileHash` check after download |
| 7-Zip `.msi` / `.exe` | `template/Install-CIToolchain-WinBuild2025.ps1` | same | | 7-Zip `.msi` / `.exe` | `template/Install-CIToolchain-WinBuild2025.ps1` | same |
| Python `.exe` | `template/Install-CIToolchain-WinBuild2025.ps1` | same | | Python `.exe` | `template/Install-CIToolchain-WinBuild2025.ps1` | same |
docs/CI-FLOW.md
+1 -1
View File
@@ -9,7 +9,7 @@
Before any CI job runs, the following must be in place: Before any CI job runs, the following must be in place:
| Component | State | | Component | State |
| ------------------ | ----------------------------------------------------------------------- | | ------------------ | ----------------------------------------------------------------------------- |
| Gitea server | Running, accessible on LAN | | Gitea server | Running, accessible on LAN |
| act_runner | Registered, running as Windows service on host | | act_runner | Registered, running as Windows service on host |
| Template VM (Win) | Provisioned, snapshot "BaseClean" taken, VM powered off | | Template VM (Win) | Provisioned, snapshot "BaseClean" taken, VM powered off |
docs/HOST-SETUP.md
+3 -3
View File
@@ -8,7 +8,7 @@ Eseguire **una volta** prima di qualsiasi provisioning del template VM o esecuzi
## Prerequisiti host ## Prerequisiti host
| Componente | Versione/Note | | Componente | Versione/Note |
| ----------------------- | ----------------------------------------------------------------- | | ------------------ | ----------------------------------------------------------------- |
| OS | Windows 11 (host fisico) o Windows Server 2022+ | | OS | Windows 11 (host fisico) o Windows Server 2022+ |
| VMware Workstation | Pro 17.x — necessario per `vmrun.exe` e supporto linked clone | | VMware Workstation | Pro 17.x — necessario per `vmrun.exe` e supporto linked clone |
| Storage | NVMe dedicato (consigliato `F:\` riservato a CI, ≥ 500 GB libero) | | Storage | NVMe dedicato (consigliato `F:\` riservato a CI, ≥ 500 GB libero) |
@@ -95,7 +95,7 @@ Apri PowerShell **come Administrator**, poi:
## Parametri principali ## Parametri principali
| Parametro | Default | Note | | Parametro | Default | Note |
| ---------------------------- | -------------------------------- | ------------------------------------- | | ------------------------ | ------------------------------------ | ------------------------------------- |
| `-CIRoot` | `F:\CI` | Base directory per tutti i dati CI | | `-CIRoot` | `F:\CI` | Base directory per tutti i dati CI |
| `-GuestCredentialTarget` | `BuildVMGuest` | Target Credential Manager | | `-GuestCredentialTarget` | `BuildVMGuest` | Target Credential Manager |
| `-GuestUsername` | `ci_build` | Account build dentro la VM | | `-GuestUsername` | `ci_build` | Account build dentro la VM |
@@ -189,7 +189,7 @@ Task schedulati (vedi `scripts/Register-CIScheduledTasks.ps1` per il bootstrap):
## Troubleshooting ## Troubleshooting
| Sintomo | Diagnosi / Fix | | Sintomo | Diagnosi / Fix |
| --------------------------------------- | -------------------------------------------------------------------- | | ------------------------------- | ---------------------------------------------------------------- |
| `vmrun.exe NOT found` | Installa VMware Workstation Pro, riesegui | | `vmrun.exe NOT found` | Installa VMware Workstation Pro, riesegui |
| `NSSM not available` | Install manuale da https://nssm.cc, aggiungi a PATH, riesegui | | `NSSM not available` | Install manuale da https://nssm.cc, aggiungi a PATH, riesegui |
| Runner registration `exit != 0` | Verifica token Gitea + URL raggiungibile da host | | Runner registration `exit != 0` | Verifica token Gitea + URL raggiungibile da host |
docs/LINUX-TEMPLATE-SETUP.md
+1 -1
View File
@@ -8,7 +8,7 @@
## Architettura: tre script + modulo transport ## Architettura: tre script + modulo transport
| Script / Modulo | Dove gira | Ruolo | | Script / Modulo | Dove gira | Ruolo |
| ------------------------------------- | ---------------- | --------------------------------------------------------------------------- | | ------------------------------------------- | ---------------- | --------------------------------------------------------------------------- |
| `template/Deploy-LinuxBuild2404.ps1` | **Host** (PS) | Crea VM da cloud image VMDK, genera seed ISO cloud-init, avvia, aspetta SSH | | `template/Deploy-LinuxBuild2404.ps1` | **Host** (PS) | Crea VM da cloud image VMDK, genera seed ISO cloud-init, avvia, aspetta SSH |
| `template/Prepare-LinuxBuild2404.ps1` | **Host** (PS) | Copia + esegue setup via SSH, valida stato, prende snapshot | | `template/Prepare-LinuxBuild2404.ps1` | **Host** (PS) | Copia + esegue setup via SSH, valida stato, prende snapshot |
| `template/Install-CIToolchain-Linux2404.sh` | **Guest** (Bash) | Installa toolchain CI, dirs, hardening, gate finale | | `template/Install-CIToolchain-Linux2404.sh` | **Guest** (Bash) | Installa toolchain CI, dirs, hardening, gate finale |
docs/RUNBOOK.md
+1 -1
View File
@@ -201,7 +201,7 @@ Estimated time: 2-4 hours including Windows Update.
## Quick Reference ## Quick Reference
| Symptom | First command | | Symptom | First command |
| ------------------------------ | ---------------------------------------------------------------------- | | ------------------- | ------------------------------------------------------------------ |
| Runner offline | `Get-Service act_runner`, then `Restart-Service act_runner` | | Runner offline | `Get-Service act_runner`, then `Restart-Service act_runner` |
| Phase 2 clone fails | `Test-Path F:\CI\Templates\WinBuild2025\WinBuild2025.vmx` | | Phase 2 clone fails | `Test-Path F:\CI\Templates\WinBuild2025\WinBuild2025.vmx` |
| Disk full | `Get-PSDrive F \| Select Free`; run `Invoke-RetentionPolicy.ps1` | | Disk full | `Get-PSDrive F \| Select Free`; run `Invoke-RetentionPolicy.ps1` |
docs/WINDOWS-TEMPLATE-SETUP.md
+2 -2
View File
@@ -12,7 +12,7 @@ credenziali archiviate, ISO Windows Server presente).
## Architettura: tre script ## Architettura: tre script
| Script | Dove gira | Scopo | | Script | Dove gira | Scopo |
| ----------------------------------- | ------------- | -------------------------------------------------------------------- | | ----------------------------------------------- | ------------- | -------------------------------------------------------------------- |
| `template/Deploy-WinBuild2025.ps1` | **Host** | Opzionale: crea VM e installa Windows Server 2025 unattended da ISO | | `template/Deploy-WinBuild2025.ps1` | **Host** | Opzionale: crea VM e installa Windows Server 2025 unattended da ISO |
| `template/Prepare-WinBuild2025.ps1` | **Host** | Orchestratore: copia + esegue Setup nel guest via WinRM (2025) | | `template/Prepare-WinBuild2025.ps1` | **Host** | Orchestratore: copia + esegue Setup nel guest via WinRM (2025) |
| `template/Install-CIToolchain-WinBuild2025.ps1` | **Dentro VM** | CI toolchain (user, .NET, Python, VS) + validazione hardening Deploy | | `template/Install-CIToolchain-WinBuild2025.ps1` | **Dentro VM** | CI toolchain (user, .NET, Python, VS) + validazione hardening Deploy |
@@ -293,7 +293,7 @@ toolchain (.NET, VS Build Tools, Python).
## Troubleshooting ## Troubleshooting
| Sintomo | Diagnosi / Fix | | Sintomo | Diagnosi / Fix |
| ---------------------------------------------- | --------------------------------------------------------------------------------------------------------- | | ------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------- |
| `Cannot reach $VMIPAddress via WinRM` | VM non avviata, WinRM non abilitato, IP errato — verifica con ipconfig | | `Cannot reach $VMIPAddress via WinRM` | VM non avviata, WinRM non abilitato, IP errato — verifica con ipconfig |
| `Install-CIToolchain-WinBuild2025.ps1 exited with code 3010` | Reboot richiesto post-WU. Re-run con `-SkipWindowsUpdate` | | `Install-CIToolchain-WinBuild2025.ps1 exited with code 3010` | Reboot richiesto post-WU. Re-run con `-SkipWindowsUpdate` |
| `[Defender] Validation failed: GPO key` | Defender riattivato da Windows Update — disabilita via gpedit + reboot | | `[Defender] Validation failed: GPO key` | Defender riattivato da Windows Update — disabilita via gpedit + reboot |
docs/WORKFLOW-AUTHORING.md
+25 -18
View File
@@ -8,23 +8,30 @@
## Table of Contents ## Table of Contents
1. [System Overview](#1-system-overview) - [Workflow Authoring Reference](#workflow-authoring-reference)
2. [Runner Labels](#2-runner-labels) - [Table of Contents](#table-of-contents)
3. [Shell Requirement](#3-shell-requirement) - [1. System Overview](#1-system-overview)
4. [Environment Variables (Injected by Runner)](#4-environment-variables-injected-by-runner) - [2. Runner Labels](#2-runner-labels)
5. [Invoke-CIJob.ps1 Parameter Reference](#5-invoke-cijobps1-parameter-reference) - [3. Shell Requirement](#3-shell-requirement)
6. [URL Conventions](#6-url-conventions) - [4. Environment Variables (Injected by Runner)](#4-environment-variables-injected-by-runner)
7. [Artifact Path Convention](#7-artifact-path-convention) - [5. Invoke-CIJob.ps1 Parameter Reference](#5-invoke-cijobps1-parameter-reference)
8. [Workflow Patterns](#8-workflow-patterns) - [Mandatory parameters](#mandatory-parameters)
- [Optional parameters](#optional-parameters)
- [6. URL Conventions](#6-url-conventions)
- [Host-clone mode (default, no `-UseGitClone`)](#host-clone-mode-default-no--usegitclone)
- [UseGitClone mode (`-UseGitClone`)](#usegitclone-mode--usegitclone)
- [Quick reference](#quick-reference)
- [7. Artifact Path Convention](#7-artifact-path-convention)
- [8. Workflow Patterns](#8-workflow-patterns)
- [8.1 Windows build (host-clone mode)](#81-windows-build-host-clone-mode) - [8.1 Windows build (host-clone mode)](#81-windows-build-host-clone-mode)
- [8.2 Linux build (host-clone mode)](#82-linux-build-host-clone-mode) - [8.2 Linux build (host-clone mode)](#82-linux-build-host-clone-mode)
- [8.3 Windows build (UseGitClone mode)](#83-windows-build-usegitclone-mode) - [8.3 Windows build (UseGitClone mode)](#83-windows-build-usegitclone-mode)
- [8.4 Linux build (UseGitClone mode)](#84-linux-build-usegitclone-mode) - [8.4 Linux build (UseGitClone mode)](#84-linux-build-usegitclone-mode)
- [8.5 PSScriptAnalyzer lint](#85-psscriptanalyzer-lint) - [8.5 PSScriptAnalyzer lint](#85-psscriptanalyzer-lint)
- [8.6 Matrix build (multiple configs)](#86-matrix-build-multiple-configs) - [8.6 Matrix build (multiple configs)](#86-matrix-build-multiple-configs)
9. [Checkout Step](#9-checkout-step) - [9. Checkout Step](#9-checkout-step)
10. [Timeouts](#10-timeouts) - [10. Timeouts](#10-timeouts)
11. [Common Mistakes](#11-common-mistakes) - [11. Common Mistakes](#11-common-mistakes)
--- ---
@@ -51,7 +58,7 @@ Supported guest OS: Windows Server 2025 / 2022 (WinRM transport), Ubuntu 24.04 (
## 2. Runner Labels ## 2. Runner Labels
| Label | Configured as | Use for | | Label | Configured as | Use for |
| ---------------- | ---------------- | ----------------------------------- | | --------------- | -------------------- | ------------------------------------------ |
| `windows-build` | `windows-build:host` | Windows VM builds, Windows-only tools | | `windows-build` | `windows-build:host` | Windows VM builds, Windows-only tools |
| `linux-build` | `linux-build:host` | Linux VM builds (cross-compile, GCC/Clang) | | `linux-build` | `linux-build:host` | Linux VM builds (cross-compile, GCC/Clang) |
| `dotnet` | `dotnet:host` | Alias for windows-build (legacy) | | `dotnet` | `dotnet:host` | Alias for windows-build (legacy) |
@@ -92,7 +99,7 @@ These variables are automatically available in every job step. Do not redeclare
in the workflow unless you need to override the default. in the workflow unless you need to override the default.
| Variable | Value (default) | Description | | Variable | Value (default) | Description |
| ---------------------------- | ---------------------------------------------------- | --------------------------------------- | | ------------------------------ | --------------------------------------------------- | -------------------------------------- |
| `GITEA_CI_TEMPLATE_PATH` | `F:\CI\Templates\WinBuild2025\WinBuild2025.vmx` | Windows 2025 template VMX path | | `GITEA_CI_TEMPLATE_PATH` | `F:\CI\Templates\WinBuild2025\WinBuild2025.vmx` | Windows 2025 template VMX path |
| `GITEA_CI_LINUX_TEMPLATE_PATH` | `F:\CI\Templates\LinuxBuild2404\LinuxBuild2404.vmx` | Ubuntu 24.04 template VMX path | | `GITEA_CI_LINUX_TEMPLATE_PATH` | `F:\CI\Templates\LinuxBuild2404\LinuxBuild2404.vmx` | Ubuntu 24.04 template VMX path |
| `GITEA_CI_CLONE_BASE_DIR` | `F:\CI\BuildVMs` | Directory for ephemeral VM clones | | `GITEA_CI_CLONE_BASE_DIR` | `F:\CI\BuildVMs` | Directory for ephemeral VM clones |
@@ -112,7 +119,7 @@ Script location (fixed on host): `N:\Code\Workspace\Local-CI-CD-System\scripts\I
### Mandatory parameters ### Mandatory parameters
| Parameter | Type | Description | | Parameter | Type | Description |
| ----------- | ------ | --------------------------------------------------------------- | | ---------- | ------ | ------------------------------------------------------------------ |
| `-JobId` | string | Unique job ID. Use `${{ github.run_id }}` or `run_id-run_attempt`. | | `-JobId` | string | Unique job ID. Use `${{ github.run_id }}` or `run_id-run_attempt`. |
| `-RepoUrl` | string | Git URL of the repository to clone/build. See Section 6. | | `-RepoUrl` | string | Git URL of the repository to clone/build. See Section 6. |
| `-Branch` | string | Branch to build. Use `${{ github.ref_name }}`. | | `-Branch` | string | Branch to build. Use `${{ github.ref_name }}`. |
@@ -120,7 +127,7 @@ Script location (fixed on host): `N:\Code\Workspace\Local-CI-CD-System\scripts\I
### Optional parameters ### Optional parameters
| Parameter | Type | Default | Description | | Parameter | Type | Default | Description |
| ------------------------ | ------ | --------------------------- | -------------------------------------------------------------- | | ------------------------ | ------ | ------------------------------ | ---------------------------------------------------------------- |
| `-Commit` | string | `''` | Specific commit SHA. Use `${{ github.sha }}`. Empty = HEAD. | | `-Commit` | string | `''` | Specific commit SHA. Use `${{ github.sha }}`. Empty = HEAD. |
| `-TemplatePath` | string | `$env:GITEA_CI_TEMPLATE_PATH` | Full path to template VMX. | | `-TemplatePath` | string | `$env:GITEA_CI_TEMPLATE_PATH` | Full path to template VMX. |
| `-SnapshotName` | string | `BaseClean` | Template snapshot name to clone from. | | `-SnapshotName` | string | `BaseClean` | Template snapshot name to clone from. |
@@ -174,7 +181,7 @@ https://gitea.emulab.it/<owner>/<repo>.git
### Quick reference ### Quick reference
| Mode | RepoUrl to use | | Mode | RepoUrl to use |
| ----------------- | ---------------------------------------------------------- | | ----------------- | -------------------------------------------- |
| Default (Windows) | `ssh://gitea-ci/<owner>/<repo>.git` | | Default (Windows) | `ssh://gitea-ci/<owner>/<repo>.git` |
| Default (Linux) | `ssh://gitea-ci/<owner>/<repo>.git` | | Default (Linux) | `ssh://gitea-ci/<owner>/<repo>.git` |
| UseGitClone | `https://gitea.emulab.it/<owner>/<repo>.git` | | UseGitClone | `https://gitea.emulab.it/<owner>/<repo>.git` |
@@ -538,7 +545,7 @@ The CI scripts are at a fixed path on the runner host and do not need a checkout
## 10. Timeouts ## 10. Timeouts
| Build type | Recommended `timeout-minutes` | | Build type | Recommended `timeout-minutes` |
| --------------------------- | ----------------------------- | | -------------------------- | ----------------------------- |
| Windows build (typical) | 90 | | Windows build (typical) | 90 |
| Windows build (large/slow) | 120 | | Windows build (large/slow) | 120 |
| Linux build (typical) | 60 | | Linux build (typical) | 60 |
@@ -554,7 +561,7 @@ the cleanup task `Cleanup-OrphanedBuildVMs.ps1` handles these cases.
## 11. Common Mistakes ## 11. Common Mistakes
| Mistake | Correct approach | | Mistake | Correct approach |
| ------- | ---------------- | | ---------------------------------------------------------------- | -------------------------------------------------------------------------- |
| `shell: pwsh` | Use `shell: powershell` (PS 5.1, not Core) | | `shell: pwsh` | Use `shell: powershell` (PS 5.1, not Core) |
| SSH alias URL with `-UseGitClone` | Use `https://gitea.emulab.it/...` for UseGitClone; SSH alias is host-only | | SSH alias URL with `-UseGitClone` | Use `https://gitea.emulab.it/...` for UseGitClone; SSH alias is host-only |
| HTTPS URL without `-UseGitClone` | SSH alias `ssh://gitea-ci/...` for host-clone mode | | HTTPS URL without `-UseGitClone` | SSH alias `ssh://gitea-ci/...` for host-clone mode |
plans/final-master-plan.md
+1 -1
View File
@@ -25,7 +25,7 @@ Top 3 risks today, in order: (1) the Linux matrix leg builds against the Windows
The optimistic [TODO.md](../TODO.md) and the conservative [docs/TEST-PLAN-v1.3-to-HEAD.md](../docs/TEST-PLAN-v1.3-to-HEAD.md) disagree. The honest state, reconciled against the source files, is below. The optimistic [TODO.md](../TODO.md) and the conservative [docs/TEST-PLAN-v1.3-to-HEAD.md](../docs/TEST-PLAN-v1.3-to-HEAD.md) disagree. The honest state, reconciled against the source files, is below.
| Area | Genuinely Done | Partially Done | Unvalidated / Broken | | Area | Genuinely Done | Partially Done | Unvalidated / Broken |
| -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | | -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- |
| Windows VM lifecycle | Clone, start, IP detect, WinRM HTTPS, build, artifacts, destroy ([scripts/Invoke-CIJob.ps1](../scripts/Invoke-CIJob.ps1), [scripts/New-BuildVM.ps1](../scripts/New-BuildVM.ps1), [scripts/Wait-VMReady.ps1](../scripts/Wait-VMReady.ps1), [scripts/Invoke-RemoteBuild.ps1](../scripts/Invoke-RemoteBuild.ps1), [scripts/Get-BuildArtifacts.ps1](../scripts/Get-BuildArtifacts.ps1), [scripts/Remove-BuildVM.ps1](../scripts/Remove-BuildVM.ps1)) | — | Real 4-way concurrency | | Windows VM lifecycle | Clone, start, IP detect, WinRM HTTPS, build, artifacts, destroy ([scripts/Invoke-CIJob.ps1](../scripts/Invoke-CIJob.ps1), [scripts/New-BuildVM.ps1](../scripts/New-BuildVM.ps1), [scripts/Wait-VMReady.ps1](../scripts/Wait-VMReady.ps1), [scripts/Invoke-RemoteBuild.ps1](../scripts/Invoke-RemoteBuild.ps1), [scripts/Get-BuildArtifacts.ps1](../scripts/Get-BuildArtifacts.ps1), [scripts/Remove-BuildVM.ps1](../scripts/Remove-BuildVM.ps1)) | — | Real 4-way concurrency |
| Linux VM lifecycle | Cloud-init deploy, SSH transport, IP via `guestinfo.ci-ip` ([template/Deploy-LinuxBuild2404.ps1](../template/Deploy-LinuxBuild2404.ps1), [scripts/_Transport.psm1](../scripts/_Transport.psm1)) | Generic validator (Windows-only) ([template/Validate-DeployState.ps1](../template/Validate-DeployState.ps1)) | **FIXED 2026-05-12**: Matrix workflow Linux leg now picks correct template (C1) | | Linux VM lifecycle | Cloud-init deploy, SSH transport, IP via `guestinfo.ci-ip` ([template/Deploy-LinuxBuild2404.ps1](../template/Deploy-LinuxBuild2404.ps1), [scripts/_Transport.psm1](../scripts/_Transport.psm1)) | Generic validator (Windows-only) ([template/Validate-DeployState.ps1](../template/Validate-DeployState.ps1)) | **FIXED 2026-05-12**: Matrix workflow Linux leg now picks correct template (C1) |
| Composite action | Inputs forwarded via env vars, step outputs work, success and failure upload paths ([gitea/actions/local-ci-build/action.yml](../gitea/actions/local-ci-build/action.yml)) | — | **FIXED 2026-05-12**: `outputs:` block corrected (H2); hardcoded `N:\` replaced with env var (H11) | | Composite action | Inputs forwarded via env vars, step outputs work, success and failure upload paths ([gitea/actions/local-ci-build/action.yml](../gitea/actions/local-ci-build/action.yml)) | — | **FIXED 2026-05-12**: `outputs:` block corrected (H2); hardcoded `N:\` replaced with env var (H11) |
plans/opus47-analysis.md
+6 -6
View File
@@ -31,7 +31,7 @@ The rest of this document expands on these and 30+ smaller findings.
The system declares itself "production-ready" in `README.md` line 1. Measured against what a reasonable definition of that phrase requires, here is the state: The system declares itself "production-ready" in `README.md` line 1. Measured against what a reasonable definition of that phrase requires, here is the state:
| Capability | Status | Evidence | | Capability | Status | Evidence |
| --- | --- | --- | | ---------------------------------------------- | ------------ | ---------------------------------------------------------------------------------------- |
| Ephemeral VM lifecycle (clone, start, destroy) | Complete | `scripts/New-BuildVM.ps1`, `Remove-BuildVM.ps1`, `Invoke-CIJob.ps1` | | Ephemeral VM lifecycle (clone, start, destroy) | Complete | `scripts/New-BuildVM.ps1`, `Remove-BuildVM.ps1`, `Invoke-CIJob.ps1` |
| Windows guest (WinRM HTTPS) | Complete | `Invoke-RemoteBuild.ps1`, `Get-BuildArtifacts.ps1` Windows branch | | Windows guest (WinRM HTTPS) | Complete | `Invoke-RemoteBuild.ps1`, `Get-BuildArtifacts.ps1` Windows branch |
| Linux guest (SSH) | Complete | `_Transport.psm1`, Linux branches in build/artifact scripts | | Linux guest (SSH) | Complete | `_Transport.psm1`, Linux branches in build/artifact scripts |
@@ -285,7 +285,7 @@ Currently `[string] $GuestPassword = ''`, which triggers a prompt — fine. But
### 5.7 OWASP Top 10 Coverage (in scope) ### 5.7 OWASP Top 10 Coverage (in scope)
| Risk | Status | | Risk | Status |
| --- | --- | | ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| A01 Broken Access Control | Local host only. Acceptable. | | A01 Broken Access Control | Local host only. Acceptable. |
| A02 Cryptographic Failures | Self-signed TLS for lab use. Acceptable. PAT base64 in command line is the only real concern (§5.2). | | A02 Cryptographic Failures | Self-signed TLS for lab use. Acceptable. PAT base64 in command line is the only real concern (§5.2). |
| A03 Injection | `BuildCommand` is by-design caller-controlled. JSON env injection parses safely via `ConvertFrom-Json`. SSH commands built from string concatenation in `Invoke-RemoteBuild.ps1` Linux branch — `$GuestLinuxWorkDir`, `$CloneBranch`, etc. are not user-supplied in the trigger path but a workflow author could pass `'$(rm -rf /)'` in `submodules` etc. The `single-quote escape` on `ExtraGuestEnv` values is correct; other interpolated strings are not escaped. **MEDIUM** — see §6.7. | | A03 Injection | `BuildCommand` is by-design caller-controlled. JSON env injection parses safely via `ConvertFrom-Json`. SSH commands built from string concatenation in `Invoke-RemoteBuild.ps1` Linux branch — `$GuestLinuxWorkDir`, `$CloneBranch`, etc. are not user-supplied in the trigger path but a workflow author could pass `'$(rm -rf /)'` in `submodules` etc. The `single-quote escape` on `ExtraGuestEnv` values is correct; other interpolated strings are not escaped. **MEDIUM** — see §6.7. |
@@ -371,7 +371,7 @@ If a workflow author somehow gets `$GuestLinuxWorkDir` to contain `' && rm -rf /
## 7. Operational Gaps ## 7. Operational Gaps
| Gap | Severity | Notes | | Gap | Severity | Notes |
| --- | --- | --- | | --------------------------------------------------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
| No documented template-refresh runbook | HIGH | `Backup-CITemplate.ps1` exists, but the procedure (Win KMS reactivation, snapshot rebuild, validation) is not codified. | | No documented template-refresh runbook | HIGH | `Backup-CITemplate.ps1` exists, but the procedure (Win KMS reactivation, snapshot rebuild, validation) is not codified. |
| No automated end-to-end smoke test | HIGH | The "production-ready" claim rests on `e2e-008`/`e2e-009` manual runs. | | No automated end-to-end smoke test | HIGH | The "production-ready" claim rests on `e2e-008`/`e2e-009` manual runs. |
| `capacity: 4` never validated | HIGH | See §6.1. | | `capacity: 4` never validated | HIGH | See §6.1. |
@@ -437,7 +437,7 @@ Four Pester v5 files exist in `tests/`:
Per `TODO.md §5.1`, they all use a fake `vmrun.cmd` driven by `$env:FAKE_VMRUN_EXIT`. What this means in practice: Per `TODO.md §5.1`, they all use a fake `vmrun.cmd` driven by `$env:FAKE_VMRUN_EXIT`. What this means in practice:
| Tested | Not Tested | | Tested | Not Tested |
| --- | --- | | ------------------------------------------------------ | ------------------------------------------------------------------------- |
| Argument construction for `vmrun clone` | Whether `vmrun clone` actually clones | | Argument construction for `vmrun clone` | Whether `vmrun clone` actually clones |
| `Invoke-Vmrun` return shape | Whether `Invoke-Vmrun` works with real `vmrun.exe` | | `Invoke-Vmrun` return shape | Whether `Invoke-Vmrun` works with real `vmrun.exe` |
| Parameter validation regexes | Whether `Test-NetConnection -Port 5986` works | | Parameter validation regexes | Whether `Test-NetConnection -Port 5986` works |
@@ -465,7 +465,7 @@ Estimated test coverage (lines exercised by Pester / lines of production code):
This is the area I am most positive about. The system genuinely has better observability than most paid CI systems give you: This is the area I am most positive about. The system genuinely has better observability than most paid CI systems give you:
| Channel | Purpose | Quality | | Channel | Purpose | Quality |
| --- | --- | --- | | ------------------------------------------------------------- | ------------------------------- | ------- |
| `F:\CI\Logs\$JobId\invoke-ci.log` | Per-job transcript | High | | `F:\CI\Logs\$JobId\invoke-ci.log` | Per-job transcript | High |
| `F:\CI\Logs\$JobId\invoke-ci.jsonl` | Per-job structured phase events | High | | `F:\CI\Logs\$JobId\invoke-ci.jsonl` | Per-job structured phase events | High |
| `F:\CI\Logs\benchmark.jsonl` | Cross-job benchmark trend | High | | `F:\CI\Logs\benchmark.jsonl` | Cross-job benchmark trend | High |
@@ -738,7 +738,7 @@ What stops me from agreeing with the `README.md` claim of "production-ready":
Honest grade: Honest grade:
| Dimension | Grade | | Dimension | Grade |
| --- | --- | | ---------------------- | ------------------------------------ |
| Architecture | A- | | Architecture | A- |
| Code Quality | B+ | | Code Quality | B+ |
| Security (in scope) | B | | Security (in scope) | B |
plans/opus47-review-of-gpt55.md
+1 -1
View File
@@ -242,7 +242,7 @@ The other GPT-5.5 recommendations respect PS 5.1, VMware Workstation single-host
## 7. Priority Validation ## 7. Priority Validation
| GPT-5.5 Severity | Item | My Verdict | Rationale | | GPT-5.5 Severity | Item | My Verdict | Rationale |
| --- | --- | --- | --- | | ---------------- | ------------------------------------ | --------------------------- | -------------------------------------------------------------------------------------------------------------- |
| CRITICAL | Composite action outputs structure | Should be HIGH | Step-level outputs work today; only caller-facing action interface is broken. Latent, not active. | | CRITICAL | Composite action outputs structure | Should be HIGH | Step-level outputs work today; only caller-facing action interface is broken. Latent, not active. |
| CRITICAL | Linux extra guest env secret logging | CRITICAL (concur) | Active leak path. | | CRITICAL | Linux extra guest env secret logging | CRITICAL (concur) | Active leak path. |
| CRITICAL | Linux Mode 2 PAT in SSH command | HIGH-CRITICAL boundary | PAT visibility limited to host argv + guest /proc. Real but bounded. I would put HIGH; CRITICAL is defensible. | | CRITICAL | Linux Mode 2 PAT in SSH command | HIGH-CRITICAL boundary | PAT visibility limited to host argv + guest /proc. Real but bounded. I would put HIGH; CRITICAL is defensible. |