Simone/local-ci-cd-system
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(§7.5): rinomina Setup-* Install-CIToolchain-* (WinBuild2025/2022/Linux2404)

Browse Source 
- template/Setup-WinBuild2025.ps1  Install-CIToolchain-WinBuild2025.ps1
- template/Setup-WinBuild2022.ps1  Install-CIToolchain-WinBuild2022.ps1
- template/Setup-LinuxBuild2404.sh  Install-CIToolchain-Linux2404.sh

Aggiornati tutti i riferimenti in: Prepare-WinBuild2025/2022, Prepare-LinuxBuild2404,
Deploy-WinBuild2025/2022/LinuxBuild2404, Validate-DeployState, Validate-SetupState,
README.md, TODO.md, docs/WINDOWS-TEMPLATE-SETUP.md, docs/LINUX-TEMPLATE-SETUP.md,
docs/TEST-PLAN-v1.3-to-HEAD.md, gitea/actions/local-ci-build/action.yml.

§7 chiuso (5/5 done).
This commit is contained in:
Simone
2026-05-11 22:48:33 +02:00
parent 6511d47a9a
commit 4758fbc519
17 changed files with 158 additions and 134 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+4 -3
View File
@@ -1,4 +1,4 @@
# Local CI/CD System # Local CI/CD System
Sistema CI/CD self-hosted su Windows per build isolati in VM efimere VMware. Sistema CI/CD self-hosted su Windows per build isolati in VM efimere VMware.
@@ -87,10 +87,10 @@ Variante **Windows Server 2022**: usare i corrispettivi `*WinBuild2022.ps1` e VM
│ ├── autounattend.template.xml # Template XML per installazione Windows unattended │ ├── autounattend.template.xml # Template XML per installazione Windows unattended
│ ├── Deploy-WinBuild2025.ps1 # Deploy VM + install Windows 2025 unattended (HOST) │ ├── Deploy-WinBuild2025.ps1 # Deploy VM + install Windows 2025 unattended (HOST)
│ ├── Prepare-WinBuild2025.ps1 # Provisioning toolchain 2025 via WinRM (HOST-side) │ ├── Prepare-WinBuild2025.ps1 # Provisioning toolchain 2025 via WinRM (HOST-side)
│ ├── Setup-WinBuild2025.ps1 # Toolchain CI 2025 nella VM (GUEST-side) │ ├── Install-CIToolchain-WinBuild2025.ps1 # Toolchain CI 2025 nella VM (GUEST-side)
│ ├── Deploy-WinBuild2022.ps1 # Deploy VM + install Windows 2022 unattended (HOST) │ ├── Deploy-WinBuild2022.ps1 # Deploy VM + install Windows 2022 unattended (HOST)
│ ├── Prepare-WinBuild2022.ps1 # Provisioning toolchain 2022 via WinRM (HOST-side) │ ├── Prepare-WinBuild2022.ps1 # Provisioning toolchain 2022 via WinRM (HOST-side)
│ ├── Setup-WinBuild2022.ps1 # Toolchain CI 2022 nella VM (GUEST-side) │ ├── Install-CIToolchain-WinBuild2022.ps1 # Toolchain CI 2022 nella VM (GUEST-side)
│ ├── Validate-DeployState.ps1 # Validazione stato post-Deploy (2025 e 2022) │ ├── Validate-DeployState.ps1 # Validazione stato post-Deploy (2025 e 2022)
│ └── Validate-SetupState.ps1 # Validazione stato post-Setup (pre-snapshot) │ └── Validate-SetupState.ps1 # Validazione stato post-Setup (pre-snapshot)
│ │
@@ -242,3 +242,4 @@ WinRM usa **HTTPS/5986** con certificato self-signed e Basic auth.
Per ambienti condivisi o di produzione, usare un certificato CA valida e rimuovere `-SkipCACheck`. Per ambienti condivisi o di produzione, usare un certificato CA valida e rimuovere `-SkipCACheck`.
Vedi [docs/BEST-PRACTICES.md](docs/BEST-PRACTICES.md). Vedi [docs/BEST-PRACTICES.md](docs/BEST-PRACTICES.md).
TODO.md
+32 -24
View File
@@ -1,16 +1,17 @@
# TODO — Local CI/CD System # TODO — Local CI/CD System
<!-- Last updated: 2026-05-11 — Sprint 14: §6.4+§6.5 DONE (build-nsis.yml matrix windows+linux via composite action; ExtraGuestEnv chain Invoke-CIJob→Invoke-RemoteBuild, Windows session inject + Linux export prefix) --> <!-- Last updated: 2026-05-11 — Sprint 15: §7.5 DONE (Rinomina Setup-* → Install-CIToolchain-*: WinBuild2025/2022/Linux2404; tutti i riferimenti aggiornati in Prepare/Deploy/docs/README/TODO/action.yml) -->
<!-- Sprint 14: §6.4+§6.5 DONE (build-nsis.yml matrix windows+linux via composite action; ExtraGuestEnv chain Invoke-CIJob→Invoke-RemoteBuild, Windows session inject + Linux export prefix) -->
<!-- Sprint 13: §6.2 Composite Action DONE (gitea/actions/local-ci-build/action.yml — inputs: build-command/artifact-source/submodules/guest-os/use-git-clone) --> <!-- Sprint 13: §6.2 Composite Action DONE (gitea/actions/local-ci-build/action.yml — inputs: build-command/artifact-source/submodules/guest-os/use-git-clone) -->
<!-- Sprint 12: §6.1 Linux Build VM DONE (Deploy/Prepare/Setup/Transport/e2e 4xPASS — nsis7z.dll 2272 KB parity Windows) --> <!-- Sprint 12: §6.1 Linux Build VM DONE (Deploy/Prepare/Setup/Transport/e2e 4xPASS — nsis7z.dll 2272 KB parity Windows) -->
<!-- Sprint 11: §6.6 Tier-2 Toolchain DONE (Pwsh7/NSIS/CMake/Node.js/WiX/gh CLI/Sysinternals/vcpkg — Step 12 in Setup-WinBuild2025) --> <!-- Sprint 11: §6.6 Tier-2 Toolchain DONE (Pwsh7/NSIS/CMake/Node.js/WiX/gh CLI/Sysinternals/vcpkg — Step 12 in Install-CIToolchain-WinBuild2025) -->
> Documento unico di lavoro: roadmap, audit trail dei task completati, e backlog post-v1.0 > Documento unico di lavoro: roadmap, audit trail dei task completati, e backlog post-v1.0
> con priorità e razionale. Le voci aperte sono raggruppate per area e marcate **P0..P3**: > con priorità e razionale. Le voci aperte sono raggruppate per area e marcate **P0..P3**:
> >
> **Doc di setup operativi**: > **Doc di setup operativi**:
> - [docs/HOST-SETUP.md](docs/HOST-SETUP.md) — bootstrap macchina host (Setup-Host.ps1) > - [docs/HOST-SETUP.md](docs/HOST-SETUP.md) — bootstrap macchina host (Setup-Host.ps1)
> - [docs/WINDOWS-TEMPLATE-SETUP.md](docs/WINDOWS-TEMPLATE-SETUP.md) — provisioning template Windows (Deploy + Prepare + Setup-WinBuild2025) > - [docs/WINDOWS-TEMPLATE-SETUP.md](docs/WINDOWS-TEMPLATE-SETUP.md) — provisioning template Windows (Deploy + Prepare + Install-CIToolchain-WinBuild2025)
> - [docs/LINUX-TEMPLATE-SETUP.md](docs/LINUX-TEMPLATE-SETUP.md) — provisioning template Linux Ubuntu 24.04 (implementato) > - [docs/LINUX-TEMPLATE-SETUP.md](docs/LINUX-TEMPLATE-SETUP.md) — provisioning template Linux Ubuntu 24.04 (implementato)
> >
> - **P0** — sicurezza o affidabilità: affrontare prima di estendere il sistema > - **P0** — sicurezza o affidabilità: affrontare prima di estendere il sistema
@@ -21,9 +22,9 @@
--- ---
## Summary ## Summary
_Last updated: 2026-05-11 (post Sprint 14: §6.4+§6.5 DONE — build-nsis.yml matrix windows+linux, ExtraGuestEnv chain in Invoke-CIJob/Invoke-RemoteBuild, job-id-suffix/repo-url/extra-guest-env-json inputs in action.yml; post Sprint 13: §6.2 DONE)_ _Last updated: 2026-05-11 (post Sprint 15: §7.5 DONE — Rinomina Setup-* → Install-CIToolchain-* (WinBuild2025/2022/Linux2404); post Sprint 14: §6.4+§6.5 DONE)_
**Stato generale**: §1, §2, §4, §5 chiusi. §3 completo. §6 quasi chiuso: 6.1-6.2 DONE, 6.3 deferred, 6.4+6.5 DONE, 6.6 DONE. Prossimi: Test Plan validation con VM reali + §7.5 (optional). **Stato generale**: §1, §2, §4, §5, §7 chiusi. §3 completo. §6 chiuso: 6.1-6.2 DONE, 6.3 deferred, 6.4-6.6 DONE. Prossimi: Test Plan validation con VM reali.
| Stato | Area | Done | Open | Note | | Stato | Area | Done | Open | Note |
| ----- | ------------------------------- | ---: | ---: | ------------------------------------------------------------------ | | ----- | ------------------------------- | ---: | ---: | ------------------------------------------------------------------ |
@@ -38,7 +39,7 @@ _Last updated: 2026-05-11 (post Sprint 14: §6.4+§6.5 DONE — build-nsis.yml m
| [x] | §4 Osservabilità & manutenzione | 3 | 0 | 4.1/4.3/4.4 done (4.2 Prometheus, 4.5 Dashboard rimossi) | | [x] | §4 Osservabilità & manutenzione | 3 | 0 | 4.1/4.3/4.4 done (4.2 Prometheus, 4.5 Dashboard rimossi) |
| [x] | §5 Qualità codice & test | 5 | 0 | 5.1/5.2/5.3/5.4/5.5 done | | [x] | §5 Qualità codice & test | 5 | 0 | 5.1/5.2/5.3/5.4/5.5 done |
| [x] | §6 Scalabilità & estensioni | 5 | 0 | 6.1-6.2 done, 6.3 deferred (home lab), 6.4-6.5 done, 6.6 done | | [x] | §6 Scalabilità & estensioni | 5 | 0 | 6.1-6.2 done, 6.3 deferred (home lab), 6.4-6.5 done, 6.6 done |
| [ ] | §7 Refactor Deploy ↔ Setup | 4 | 1 | 7.1/7.2/7.3/7.4 done; 7.5 (rinomina) opzionale | | [x] | §7 Refactor Deploy ↔ Setup | 5 | 0 | 7.1-7.5 done; Setup-* → Install-CIToolchain-* (2026-05-11) |
| [x] | In-VM Git Clone (§3.3) | 4 | 0 | COMPLETATO 2026-05-10 — e2e PASS: 34s/25.7% vs baseline | | [x] | In-VM Git Clone (§3.3) | 4 | 0 | COMPLETATO 2026-05-10 — e2e PASS: 34s/25.7% vs baseline |
| [x] | Linux Build VM (§6.1) | 5 | 0 | Deploy/Prepare/Setup/Transport + doc + e2e PASS nsis7z.dll 2272 KB | | [x] | Linux Build VM (§6.1) | 5 | 0 | Deploy/Prepare/Setup/Transport + doc + e2e PASS nsis7z.dll 2272 KB |
@@ -47,6 +48,7 @@ _Last updated: 2026-05-11 (post Sprint 14: §6.4+§6.5 DONE — build-nsis.yml m
2. **Test Plan** — validazione con VM reali (§2.1 IP race, §3.1 shared cache, §3.6 benchmark, §4.1 JSONL) — prossima priorità 2. **Test Plan** — validazione con VM reali (§2.1 IP race, §3.1 shared cache, §3.6 benchmark, §4.1 JSONL) — prossima priorità
3. **Security** — Rifiori se condizioni cambiano; vedi sezione "Deferred (Home Lab)" 3. **Security** — Rifiori se condizioni cambiano; vedi sezione "Deferred (Home Lab)"
4. **§3.5** — vCPU/RAM tuning per workload (P2, deferred — home lab optimization) 4. **§3.5** — vCPU/RAM tuning per workload (P2, deferred — home lab optimization)
5. **Validate-SetupState.ps1** — update riferimento a `Install-CIToolchain-*` se compare il vecchio nome
--- ---
## Setup & Infrastructure ## Setup & Infrastructure
@@ -119,13 +121,13 @@ _Last updated: 2026-05-11 (post Sprint 14: §6.4+§6.5 DONE — build-nsis.yml m
``` ```
Installa: WinRM config, utente `ci_build`, .NET SDK 10.0, VS Build Tools 2026, Python 3.13.3. Installa: WinRM config, utente `ci_build`, .NET SDK 10.0, VS Build Tools 2026, Python 3.13.3.
Lo script esegue validazione automatica ad ogni passaggio (`Assert-Step`): Lo script esegue validazione automatica ad ogni passaggio (`Assert-Step`):
- Pre-flight: IP ottetti 0-255, TCP/5986 raggiungibile, Setup-WinBuild2025.ps1 presente - Pre-flight: IP ottetti 0-255, TCP/5986 raggiungibile, Install-CIToolchain-WinBuild2025.ps1 presente
- Host WinRM: AllowUnencrypted, TrustedHosts - Host WinRM: AllowUnencrypted, TrustedHosts
- Guest prep: `C:\CI` esiste, file copiato, size match - Guest prep: `C:\CI` esiste, file copiato, size match
- Post-setup remoto (9 check): WinRM, user+admin, UAC, firewall, .NET, Python, MSBuild, CI dirs - Post-setup remoto (9 check): WinRM, user+admin, UAC, firewall, .NET, Python, MSBuild, CI dirs
Se qualsiasi check fallisce → script termina con errore → **non prendere lo snapshot**. Se qualsiasi check fallisce → script termina con errore → **non prendere lo snapshot**.
- [x] Setup completato con successo (VS Build Tools 2026 exit code 0). - [x] Setup completato con successo (VS Build Tools 2026 exit code 0).
- [x] `Setup-WinBuild2025.ps1` ora esegue validazione `Assert-Step` dopo ogni step interno - [x] `Install-CIToolchain-WinBuild2025.ps1` ora esegue validazione `Assert-Step` dopo ogni step interno
(WinRM, Firewall, User, UAC, Dirs, Defender, .NET, Python, VS Build Tools, Toolchain, (WinRM, Firewall, User, UAC, Dirs, Defender, .NET, Python, VS Build Tools, Toolchain,
Cleanup, Final pre-snapshot gate) — throws se qualsiasi check fallisce (2026-05-09) Cleanup, Final pre-snapshot gate) — throws se qualsiasi check fallisce (2026-05-09)
@@ -188,7 +190,7 @@ _Last updated: 2026-05-11 (post Sprint 14: §6.4+§6.5 DONE — build-nsis.yml m
**Azioni**: **Azioni**:
- [x] Generare cert self-signed nel template *prima* dello snapshot (già in Deploy post-install.ps1). - [x] Generare cert self-signed nel template *prima* dello snapshot (già in Deploy post-install.ps1).
- [x] Sostituire `New-PSSession -ComputerName $ip` con `-UseSSL -Port 5986 -Authentication Basic` in `Invoke-RemoteBuild.ps1`, `Get-BuildArtifacts.ps1`, `Prepare-WinBuild2025.ps1`, `Validate-*.ps1`. - [x] Sostituire `New-PSSession -ComputerName $ip` con `-UseSSL -Port 5986 -Authentication Basic` in `Invoke-RemoteBuild.ps1`, `Get-BuildArtifacts.ps1`, `Prepare-WinBuild2025.ps1`, `Validate-*.ps1`.
- [x] Rimuovere `AllowUnencrypted=true` da Deploy post-install.ps1 e Setup-WinBuild2025.ps1 (assertion → false). - [x] Rimuovere `AllowUnencrypted=true` da Deploy post-install.ps1 e Install-CIToolchain-WinBuild2025.ps1 (assertion → false).
- [x] `-SkipCACheck`/`-SkipCNCheck`/`-SkipRevocationCheck` mantenuti nei `New-PSSessionOption` e `New-WSManSessionOption` (cert lab self-signed — documentato inline). - [x] `-SkipCACheck`/`-SkipCNCheck`/`-SkipRevocationCheck` mantenuti nei `New-PSSessionOption` e `New-WSManSessionOption` (cert lab self-signed — documentato inline).
- [x] Regola firewall `WinRM-HTTPS` in Deploy ristretta a `RemoteAddress '192.168.79.0/24'`. - [x] Regola firewall `WinRM-HTTPS` in Deploy ristretta a `RemoteAddress '192.168.79.0/24'`.
- [x] `Wait-VMReady.ps1` usa `New-WSManSessionOption` + `Test-WSMan -Port 5986 -UseSSL`. - [x] `Wait-VMReady.ps1` usa `New-WSManSessionOption` + `Test-WSMan -Port 5986 -UseSSL`.
@@ -530,8 +532,8 @@ Usage dal workflow:
extra-guest-env-json: '{"SIGN_PASS":"${{ secrets.SIGN_PASS }}","CERT_THUMBPRINT":"${{ secrets.CERT_THUMBPRINT }}"}' extra-guest-env-json: '{"SIGN_PASS":"${{ secrets.SIGN_PASS }}","CERT_THUMBPRINT":"${{ secrets.CERT_THUMBPRINT }}"}'
``` ```
### 6.6 [P2] [x] Toolchain Tier-1 + Tier-2 in Setup-WinBuild2025 ### 6.6 [P2] [x] Toolchain Tier-1 + Tier-2 in Install-CIToolchain-WinBuild2025
File: [template/Setup-WinBuild2025.ps1](template/Setup-WinBuild2025.ps1), File: [template/Install-CIToolchain-WinBuild2025.ps1](template/Install-CIToolchain-WinBuild2025.ps1),
[template/Prepare-WinBuild2025.ps1](template/Prepare-WinBuild2025.ps1). [template/Prepare-WinBuild2025.ps1](template/Prepare-WinBuild2025.ps1).
**Status**: COMPLETATO 2026-05-11 — Step 11 (Tier-1: Git + 7-Zip) + Step 12 (Tier-2: 8 tools) implementati. **Status**: COMPLETATO 2026-05-11 — Step 11 (Tier-1: Git + 7-Zip) + Step 12 (Tier-2: 8 tools) implementati.
@@ -598,7 +600,7 @@ OOBE telemetry, WU services disable — entrambi gli script li toccano.
### 7.1 [P1] [x] Spostare base OS hardening da Setup a Deploy ### 7.1 [P1] [x] Spostare base OS hardening da Setup a Deploy
File: [template/Deploy-WinBuild2025.ps1](template/Deploy-WinBuild2025.ps1), File: [template/Deploy-WinBuild2025.ps1](template/Deploy-WinBuild2025.ps1),
[template/Setup-WinBuild2025.ps1](template/Setup-WinBuild2025.ps1). [template/Install-CIToolchain-WinBuild2025.ps1](template/Install-CIToolchain-WinBuild2025.ps1).
- [x] Aggiungere `Set-NetFirewallProfile -Enabled False` (tutti i profili) in Deploy post-install.ps1 - [x] Aggiungere `Set-NetFirewallProfile -Enabled False` (tutti i profili) in Deploy post-install.ps1
- [x] Aggiungere `MaxMemoryPerShellMB=2048`, `IdleTimeOut=7200000`, `MaxProcessesPerShell=25`, `StartupType=Automatic` in Deploy dopo Enable-PSRemoting - [x] Aggiungere `MaxMemoryPerShellMB=2048`, `IdleTimeOut=7200000`, `MaxProcessesPerShell=25`, `StartupType=Automatic` in Deploy dopo Enable-PSRemoting
@@ -613,7 +615,7 @@ File: [template/Deploy-WinBuild2025.ps1](template/Deploy-WinBuild2025.ps1),
### 7.2 [P1] [x] WU lifecycle — strategia B (Deploy: GPO + Manual; Setup: lifecycle) ### 7.2 [P1] [x] WU lifecycle — strategia B (Deploy: GPO + Manual; Setup: lifecycle)
File: [template/Deploy-WinBuild2025.ps1](template/Deploy-WinBuild2025.ps1), File: [template/Deploy-WinBuild2025.ps1](template/Deploy-WinBuild2025.ps1),
[template/Setup-WinBuild2025.ps1](template/Setup-WinBuild2025.ps1). [template/Install-CIToolchain-WinBuild2025.ps1](template/Install-CIToolchain-WinBuild2025.ps1).
Strategia B: Deploy lascia servizi WU `start=demand` (Manual, default Windows) e scrive solo Strategia B: Deploy lascia servizi WU `start=demand` (Manual, default Windows) e scrive solo
GPO `NoAutoUpdate=1` + `DisableWindowsUpdateAccess=1`. Setup Step 6 clears i GPO locks (Step A), GPO `NoAutoUpdate=1` + `DisableWindowsUpdateAccess=1`. Setup Step 6 clears i GPO locks (Step A),
@@ -629,7 +631,7 @@ avvia WU via SchTask SYSTEM, poi Step 6b disabilita servizi permanentemente post
### 7.3 [P2] [x] Update header docs di entrambi gli script ### 7.3 [P2] [x] Update header docs di entrambi gli script
- [x] [template/Deploy-WinBuild2025.ps1](template/Deploy-WinBuild2025.ps1) `.DESCRIPTION`: aggiornato con tutte le hardening voci (firewall, WinRM tuning, WU GPO strategy B, lock screen, SM, OOBE) - [x] [template/Deploy-WinBuild2025.ps1](template/Deploy-WinBuild2025.ps1) `.DESCRIPTION`: aggiornato con tutte le hardening voci (firewall, WinRM tuning, WU GPO strategy B, lock screen, SM, OOBE)
- [x] [template/Setup-WinBuild2025.ps1](template/Setup-WinBuild2025.ps1) `.DESCRIPTION`: Steps 1/3/4b/5b/5c marcati "validation-only — set by Deploy"; step ordering rationale aggiornato - [x] [template/Install-CIToolchain-WinBuild2025.ps1](template/Install-CIToolchain-WinBuild2025.ps1) `.DESCRIPTION`: Steps 1/3/4b/5b/5c marcati "validation-only — set by Deploy"; step ordering rationale aggiornato
- [x] [docs/WINDOWS-TEMPLATE-SETUP.md](docs/WINDOWS-TEMPLATE-SETUP.md): architettura "tre script", VMX path `WinBuild2025.vmx`, Fase C step list + razionale + tabella validazioni aggiornati - [x] [docs/WINDOWS-TEMPLATE-SETUP.md](docs/WINDOWS-TEMPLATE-SETUP.md): architettura "tre script", VMX path `WinBuild2025.vmx`, Fase C step list + razionale + tabella validazioni aggiornati
### 7.4 [P2] [x] Test e2e refactor — COMPLETATO 2026-05-10 ### 7.4 [P2] [x] Test e2e refactor — COMPLETATO 2026-05-10
@@ -645,11 +647,16 @@ avvia WU via SchTask SYSTEM, poi Step 6b disabilita servizi permanentemente post
- Deploy + Setup: autologin Administrator (`AutoAdminLogon=1`) aggiunto in post-install.ps1 e validato in Assert-Step 5c - Deploy + Setup: autologin Administrator (`AutoAdminLogon=1`) aggiunto in post-install.ps1 e validato in Assert-Step 5c
- Nuovi script: `template/Validate-DeployState.ps1`, `template/Validate-SetupState.ps1` - Nuovi script: `template/Validate-DeployState.ps1`, `template/Validate-SetupState.ps1`
### 7.5 [P3] [ ] Rinomina Setup → Setup-CITools (opzionale, futuro) ### 7.5 [P3] [x] Rinomina Setup-* → Install-CIToolchain-* (2026-05-11)
Una volta che Setup fa solo build customization, nome `Setup-WinBuild2025` è impreciso — Rinominati i tre script guest-side:
non setup-a la build VM, **estende** un template OS già pronto con toolchain CI. - `template/Setup-WinBuild2025.ps1` → `template/Install-CIToolchain-WinBuild2025.ps1`
Rinominare in `Setup-CITools.ps1` o `Install-CIToolchain.ps1` rifletterebbe meglio la - `template/Setup-WinBuild2022.ps1` → `template/Install-CIToolchain-WinBuild2022.ps1`
responsabilità ridotta. Tracciare in TODO post-7.1/7.2. - `template/Setup-LinuxBuild2404.sh` → `template/Install-CIToolchain-Linux2404.sh`
Tutti i riferimenti aggiornati in: Prepare-WinBuild2025/2022.ps1, Prepare-LinuxBuild2404.ps1,
Deploy-WinBuild2025/2022.ps1, Deploy-LinuxBuild2404.ps1, README.md, TODO.md,
docs/WINDOWS-TEMPLATE-SETUP.md, docs/LINUX-TEMPLATE-SETUP.md, docs/TEST-PLAN-v1.3-to-HEAD.md,
gitea/actions/local-ci-build/action.yml.
--- ---
@@ -672,7 +679,7 @@ VM avviata → WinRM: git clone --recurse-submodules https://<token>@gitea/...
**Punti chiave:** **Punti chiave:**
- Il PAT **non deve essere nello snapshot** — viene iniettato a runtime come env var via WinRM - Il PAT **non deve essere nello snapshot** — viene iniettato a runtime come env var via WinRM
(`git clone https://Simone:<pat>@gitea.emulab.it/<repo>.git`) e non viene mai persistito (`git clone https://Simone:<pat>@gitea.emulab.it/<repo>.git`) e non viene mai persistito
- Git deve essere installato nel template (`Setup-WinBuild2025.ps1`) — ora è assente per design - Git deve essere installato nel template (`Install-CIToolchain-WinBuild2025.ps1`) — ora è assente per design
- L'implementazione deve essere **non-breaking**: nuovo switch opt-in `-UseGitClone` in `Invoke-CIJob.ps1` - L'implementazione deve essere **non-breaking**: nuovo switch opt-in `-UseGitClone` in `Invoke-CIJob.ps1`
- Si perde il parallelismo parziale (clone host avviene mentre VM boota), ma si elimina - Si perde il parallelismo parziale (clone host avviene mentre VM boota), ma si elimina
tutto l'overhead di zip/transfer (rilevante su repo grandi o con molti submoduli) tutto l'overhead di zip/transfer (rilevante su repo grandi o con molti submoduli)
@@ -682,7 +689,7 @@ VM avviata → WinRM: git clone --recurse-submodules https://<token>@gitea/...
- [x] **Tool prerequisiti nel template** — implementati in §6.6 (Tier-1 Toolchain): - [x] **Tool prerequisiti nel template** — implementati in §6.6 (Tier-1 Toolchain):
- Git for Windows + 7-Zip + gh CLI installati con hash pinning e `Assert-Step` - Git for Windows + 7-Zip + gh CLI installati con hash pinning e `Assert-Step`
- Rimuovere il commento "Git is NOT installed" dal docblock di Setup-WinBuild2025.ps1 - Rimuovere il commento "Git is NOT installed" dal docblock di Install-CIToolchain-WinBuild2025.ps1
una volta applicato §6.6 una volta applicato §6.6
- curl.exe: già presente in Windows Server 2025 — verificare con `where.exe curl` - curl.exe: già presente in Windows Server 2025 — verificare con `where.exe curl`
@@ -721,7 +728,7 @@ Supporto build su Linux aggiunto con le seguenti fasi completate:
- [x] **Template VM Linux** — script di provisioning per Ubuntu Server 24.04 LTS - [x] **Template VM Linux** — script di provisioning per Ubuntu Server 24.04 LTS
- [x] `template/Deploy-LinuxBuild2404.ps1` — crea VM da cloud VMDK, cloud-init, SSH wait - [x] `template/Deploy-LinuxBuild2404.ps1` — crea VM da cloud VMDK, cloud-init, SSH wait
- [x] `template/Setup-LinuxBuild2404.sh` — installa toolchain CI (GCC, Clang, CMake, Python 3, git, 7z), hardening SSH, swap off, timer apt off - [x] `template/Install-CIToolchain-Linux2404.sh` — installa toolchain CI (GCC, Clang, CMake, Python 3, git, 7z), hardening SSH, swap off, timer apt off
- [x] `template/Prepare-LinuxBuild2404.ps1` — SCP script, esegue via SSH, valida, snapshot `BaseClean-Linux` - [x] `template/Prepare-LinuxBuild2404.ps1` — SCP script, esegue via SSH, valida, snapshot `BaseClean-Linux`
- [x] **Invoke-CIJob.ps1 — branch Linux** - [x] **Invoke-CIJob.ps1 — branch Linux**
@@ -762,7 +769,7 @@ per `192.168.79.*` instead of `*`. Attualmente impostato a `*` durante setup tem
**Rifiori se**: Host esposto a LAN / internet. **Rifiori se**: Host esposto a LAN / internet.
### 1.3 [P0] [ ] Pinning hash SHA256 degli installer ### 1.3 [P0] [ ] Pinning hash SHA256 degli installer
File: [template/Setup-WinBuild2025.ps1](template/Setup-WinBuild2025.ps1). File: [template/Install-CIToolchain-WinBuild2025.ps1](template/Install-CIToolchain-WinBuild2025.ps1).
SHA256 hash per dotnet-install.ps1, Python installer, vs_buildtools.exe. SHA256 hash per dotnet-install.ps1, Python installer, vs_buildtools.exe.
@@ -850,3 +857,4 @@ alla successiva.
| Build VM subnet | `192.168.79.0/24` (VMnet8 — NAT, internet access per build) | | Build VM subnet | `192.168.79.0/24` (VMnet8 — NAT, internet access per build) |
| Credential Manager target | `BuildVMGuest` | | Credential Manager target | `BuildVMGuest` |
| Guest username | `ci_build` — configurato e verificato | | Guest username | `ci_build` — configurato e verificato |
docs/LINUX-TEMPLATE-SETUP.md
+8 -7
View File
@@ -11,7 +11,7 @@
| ------------------------------------- | ---------------- | --------------------------------------------------------------------------- | | ------------------------------------- | ---------------- | --------------------------------------------------------------------------- |
| `template/Deploy-LinuxBuild2404.ps1` | **Host** (PS) | Crea VM da cloud image VMDK, genera seed ISO cloud-init, avvia, aspetta SSH | | `template/Deploy-LinuxBuild2404.ps1` | **Host** (PS) | Crea VM da cloud image VMDK, genera seed ISO cloud-init, avvia, aspetta SSH |
| `template/Prepare-LinuxBuild2404.ps1` | **Host** (PS) | Copia + esegue setup via SSH, valida stato, prende snapshot | | `template/Prepare-LinuxBuild2404.ps1` | **Host** (PS) | Copia + esegue setup via SSH, valida stato, prende snapshot |
| `template/Setup-LinuxBuild2404.sh` | **Guest** (Bash) | Installa toolchain CI, dirs, hardening, gate finale | | `template/Install-CIToolchain-Linux2404.sh` | **Guest** (Bash) | Installa toolchain CI, dirs, hardening, gate finale |
| `scripts/_Transport.psm1` | **Host** (PS) | Funzioni SSH-only per il branch Linux (WinRM esistente invariato per ora) | | `scripts/_Transport.psm1` | **Host** (PS) | Funzioni SSH-only per il branch Linux (WinRM esistente invariato per ora) |
Perche tre script separati (non tutto-in-uno): cloud-init copre solo il bootstrap OS Perche tre script separati (non tutto-in-uno): cloud-init copre solo il bootstrap OS
@@ -107,7 +107,7 @@ Non richiede installazione OS parte dal cloud VMDK pre-built.
`ssh_authorized_keys` con contenuto di `ci_linux.pub` `ssh_authorized_keys` con contenuto di `ci_linux.pub`
- Nessun `packages`, nessun `package_update`, nessun `runcmd`: - Nessun `packages`, nessun `package_update`, nessun `runcmd`:
tutto il provisioning (apt, toolchain, SSH hardening, swap) e' delegato a tutto il provisioning (apt, toolchain, SSH hardening, swap) e' delegato a
`Prepare-LinuxBuild2404.ps1` via `Setup-LinuxBuild2404.sh` `Prepare-LinuxBuild2404.ps1` via `Install-CIToolchain-Linux2404.sh`
- Nessun `power_state`: il reboot non e' necessario, cloud-init completa tutto al primo boot - Nessun `power_state`: il reboot non e' necessario, cloud-init completa tutto al primo boot
- [x] **Step 3 Costruisce seed ISO nocloud** via IMAPI2FS COM - [x] **Step 3 Costruisce seed ISO nocloud** via IMAPI2FS COM
@@ -181,18 +181,18 @@ Equivalente di `Prepare-WinBuild2025.ps1` con SSH al posto di WinRM.
``` ```
Solo al primo run; idempotente se gia presente. Solo al primo run; idempotente se gia presente.
- [x] **Step 4 Copia Setup-LinuxBuild2404.sh in VM** - [x] **Step 4 Copia Install-CIToolchain-Linux2404.sh in VM**
```powershell ```powershell
scp -i F:\CI\keys\ci_linux ` scp -i F:\CI\keys\ci_linux `
"$PSScriptRoot\Setup-LinuxBuild2404.sh" ` "$PSScriptRoot\Install-CIToolchain-Linux2404.sh" `
"ci_build@${IP}:/tmp/Setup-LinuxBuild2404.sh" "ci_build@${IP}:/tmp/Install-CIToolchain-Linux2404.sh"
``` ```
Valida: confronta size locale vs remota via `ssh ... stat -c %s /tmp/...` Valida: confronta size locale vs remota via `ssh ... stat -c %s /tmp/...`
- [x] **Step 5 Esegui setup script** nel guest - [x] **Step 5 Esegui setup script** nel guest
```powershell ```powershell
ssh -i F:\CI\keys\ci_linux ci_build@$IP ` ssh -i F:\CI\keys\ci_linux ci_build@$IP `
"chmod +x /tmp/Setup-LinuxBuild2404.sh && sudo /tmp/Setup-LinuxBuild2404.sh" "chmod +x /tmp/Install-CIToolchain-Linux2404.sh && sudo /tmp/Install-CIToolchain-Linux2404.sh"
# Cattura exit code; != 0 => abort con errore leggibile # Cattura exit code; != 0 => abort con errore leggibile
``` ```
Flag opzionali passabili: `--skip-update`, `--dotnet`, `--mingw` Flag opzionali passabili: `--skip-update`, `--dotnet`, `--mingw`
@@ -221,7 +221,7 @@ Equivalente di `Prepare-WinBuild2025.ps1` con SSH al posto di WinRM.
--- ---
## Fase C Setup-LinuxBuild2404.sh ## Fase C Install-CIToolchain-Linux2404.sh
Script guest-side (Bash). Installazione toolchain CI e hardening. Script guest-side (Bash). Installazione toolchain CI e hardening.
Eseguito da Prepare via SSH come `ci_build` con sudo. Eseguito da Prepare via SSH come `ci_build` con sudo.
@@ -424,3 +424,4 @@ Helper `assert_step()`: stampa `[OK] [Step N] desc` su successo, `exit 1` su fal
- [CI-FLOW.md](CI-FLOW.md) flusso pipeline (aggiornare Step 0 prerequisites) - [CI-FLOW.md](CI-FLOW.md) flusso pipeline (aggiornare Step 0 prerequisites)
- [HOST-SETUP.md](HOST-SETUP.md) Setup-Host.ps1 (aggiungere step generazione SSH key) - [HOST-SETUP.md](HOST-SETUP.md) Setup-Host.ps1 (aggiungere step generazione SSH key)
- [TODO.md §6.1](../TODO.md) tracking implementazione - [TODO.md §6.1](../TODO.md) tracking implementazione
docs/TEST-PLAN-v1.3-to-HEAD.md
+7 -6
View File
@@ -1,4 +1,4 @@
# Test Plan: v1.3 → HEAD # Test Plan: v1.3 → HEAD
Complete validation of all features added since v1.3 tag (2026-05-10). Complete validation of all features added since v1.3 tag (2026-05-10).
Organized by sprint area with pre-requisites, test steps, and pass/fail criteria. Organized by sprint area with pre-requisites, test steps, and pass/fail criteria.
@@ -29,7 +29,7 @@ Organized by sprint area with pre-requisites, test steps, and pass/fail criteria
- [x] Gitea available at `http://10.10.20.11:3100` or `https://gitea.emulab.it` - [x] Gitea available at `http://10.10.20.11:3100` or `https://gitea.emulab.it`
- [x] PowerShell ≥5.1, Pester v5 installed (`Install-Module Pester -MinimumVersion 5.0 -Force`) (Pester 5.7.1 installed 2026-05-10) - [x] PowerShell ≥5.1, Pester v5 installed (`Install-Module Pester -MinimumVersion 5.0 -Force`) (Pester 5.7.1 installed 2026-05-10)
- [x] CredentialManager module installed (`Install-Module CredentialManager`) (verified 2026-05-10) - [x] CredentialManager module installed (`Install-Module CredentialManager`) (verified 2026-05-10)
- [x] **[NEW 2026-05-10]** Template includes §6.6 Tier-1 Toolchain: Git for Windows + 7-Zip (Step 11 in Setup-WinBuild2025.ps1) - [x] **[NEW 2026-05-10]** Template includes §6.6 Tier-1 Toolchain: Git for Windows + 7-Zip (Step 11 in Install-CIToolchain-WinBuild2025.ps1)
--- ---
@@ -711,14 +711,14 @@ if (Test-Path 'C:\Program Files\7-Zip\7z.exe') {
## §6.6 Tier-1 Toolchain (Git + 7-Zip) ## §6.6 Tier-1 Toolchain (Git + 7-Zip)
**What changed**: Step 11 added to Setup-WinBuild2025.ps1 to install Git for Windows and **What changed**: Step 11 added to Install-CIToolchain-WinBuild2025.ps1 to install Git for Windows and
7-Zip in the template VM. Critical for §3.3 (In-VM Git clone) and cross-platform builds. 7-Zip in the template VM. Critical for §3.3 (In-VM Git clone) and cross-platform builds.
**Files affected**: **Files affected**:
- `template/Setup-WinBuild2025.ps1` (Step 11: Git + 7-Zip installation) - `template/Install-CIToolchain-WinBuild2025.ps1` (Step 11: Git + 7-Zip installation)
- `runner/config.yaml` (updated GITEA_CI_TEMPLATE_PATH) - `runner/config.yaml` (updated GITEA_CI_TEMPLATE_PATH)
**Test Steps** (run after template is provisioned with Setup-WinBuild2025.ps1): **Test Steps** (run after template is provisioned with Install-CIToolchain-WinBuild2025.ps1):
```powershell ```powershell
# 1. Verify Git is installed and in PATH # 1. Verify Git is installed and in PATH
@@ -751,7 +751,7 @@ Test-Path 'C:\Temp\test-extract\test-7z.txt'
``` ```
**Pass Criteria**: **Pass Criteria**:
- [x] Step 11 executes without errors in Setup-WinBuild2025.ps1 - [x] Step 11 executes without errors in Install-CIToolchain-WinBuild2025.ps1
- [x] Git command available post-setup (machine PATH includes Git) - [x] Git command available post-setup (machine PATH includes Git)
- [x] 7-Zip command available post-setup (C:\Program Files\7-Zip\7z.exe) - [x] 7-Zip command available post-setup (C:\Program Files\7-Zip\7z.exe)
- [x] Final pre-snapshot gate includes git + 7z validation - [x] Final pre-snapshot gate includes git + 7z validation
@@ -840,3 +840,4 @@ After validating new features, run one full end-to-end build to ensure nothing b
# Expected: Build completes successfully, artifact created, JSONL log present, no errors # Expected: Build completes successfully, artifact created, JSONL log present, no errors
``` ```
docs/WINDOWS-TEMPLATE-SETUP.md
+12 -11
View File
@@ -1,4 +1,4 @@
# Windows Template VM Setup # Windows Template VM Setup
Procedura di provisioning della template VM **Windows Server 2025** che alimenta i linked Procedura di provisioning della template VM **Windows Server 2025** che alimenta i linked
clone usati per ogni job CI. Il template viene creato **una volta**; lo snapshot clone usati per ogni job CI. Il template viene creato **una volta**; lo snapshot
@@ -15,18 +15,18 @@ credenziali archiviate, ISO Windows Server presente).
| ----------------------------------- | ------------- | -------------------------------------------------------------------- | | ----------------------------------- | ------------- | -------------------------------------------------------------------- |
| `template/Deploy-WinBuild2025.ps1` | **Host** | Opzionale: crea VM e installa Windows Server 2025 unattended da ISO | | `template/Deploy-WinBuild2025.ps1` | **Host** | Opzionale: crea VM e installa Windows Server 2025 unattended da ISO |
| `template/Prepare-WinBuild2025.ps1` | **Host** | Orchestratore: copia + esegue Setup nel guest via WinRM (2025) | | `template/Prepare-WinBuild2025.ps1` | **Host** | Orchestratore: copia + esegue Setup nel guest via WinRM (2025) |
| `template/Setup-WinBuild2025.ps1` | **Dentro VM** | CI toolchain (user, .NET, Python, VS) + validazione hardening Deploy | | `template/Install-CIToolchain-WinBuild2025.ps1` | **Dentro VM** | CI toolchain (user, .NET, Python, VS) + validazione hardening Deploy |
| `template/Deploy-WinBuild2022.ps1` | **Host** | Opzionale: crea VM e installa Windows Server 2022 unattended da ISO | | `template/Deploy-WinBuild2022.ps1` | **Host** | Opzionale: crea VM e installa Windows Server 2022 unattended da ISO |
| `template/Prepare-WinBuild2022.ps1` | **Host** | Orchestratore: copia + esegue Setup nel guest via WinRM (2022) | | `template/Prepare-WinBuild2022.ps1` | **Host** | Orchestratore: copia + esegue Setup nel guest via WinRM (2022) |
| `template/Setup-WinBuild2022.ps1` | **Dentro VM** | CI toolchain per Windows Server 2022 (stesso flusso del 2025) | | `template/Install-CIToolchain-WinBuild2022.ps1` | **Dentro VM** | CI toolchain per Windows Server 2022 (stesso flusso del 2025) |
| `template/Validate-DeployState.ps1` | **Host** | Valida stato post-Deploy prima di eseguire Prepare (2025 e 2022) | | `template/Validate-DeployState.ps1` | **Host** | Valida stato post-Deploy prima di eseguire Prepare (2025 e 2022) |
| `template/Validate-SetupState.ps1` | **Host** | Valida stato post-Setup (Deploy + Setup) prima dello snapshot | | `template/Validate-SetupState.ps1` | **Host** | Valida stato post-Setup (Deploy + Setup) prima dello snapshot |
**Confine Deploy / Setup** (refactor §7, 2026-05-10): **Confine Deploy / Setup** (refactor §7, 2026-05-10):
- `Deploy-WinBuild2025.ps1` si occupa dell'**OS hardening** (Firewall, WinRM, UAC, Defender, UX tweaks, autologin Administrator, WU GPO locks). Se usato, Setup valida questi come Assert-Step senza re-applicarli. - `Deploy-WinBuild2025.ps1` si occupa dell'**OS hardening** (Firewall, WinRM, UAC, Defender, UX tweaks, autologin Administrator, WU GPO locks). Se usato, Setup valida questi come Assert-Step senza re-applicarli.
- `Setup-WinBuild2025.ps1` si occupa della **CI customization** (utente `ci_build`, cartelle `C:\CI`, toolchain .NET/Python/VS, Windows Update lifecycle, cleanup, final gate). - `Install-CIToolchain-WinBuild2025.ps1` si occupa della **CI customization** (utente `ci_build`, cartelle `C:\CI`, toolchain .NET/Python/VS, Windows Update lifecycle, cleanup, final gate).
`Prepare-WinBuild2025.ps1` apre una WinRM session, copia `Setup-WinBuild2025.ps1` in `Prepare-WinBuild2025.ps1` apre una WinRM session, copia `Install-CIToolchain-WinBuild2025.ps1` in
`C:\CI\`, lo esegue, raccoglie l'exit code, valida lo stato del guest. `C:\CI\`, lo esegue, raccoglie l'exit code, valida lo stato del guest.
--- ---
@@ -114,15 +114,15 @@ cd N:\Code\Workspace\Local-CI-CD-System\template
Ogni step ha validazione `Assert-Step` (throw on failure, `[OK]` su pass): Ogni step ha validazione `Assert-Step` (throw on failure, `[OK]` su pass):
1. **Pre-flight**: script dir presente, `Setup-WinBuild2025.ps1` presente, IP ottetti 0-255, TCP/5986 reachable 1. **Pre-flight**: script dir presente, `Install-CIToolchain-WinBuild2025.ps1` presente, IP ottetti 0-255, TCP/5986 reachable
2. **Configura host WinRM client**: aggiunge `$VMIPAddress` ai `TrustedHosts` (no `AllowUnencrypted` — HTTPS non lo richiede) 2. **Configura host WinRM client**: aggiunge `$VMIPAddress` ai `TrustedHosts` (no `AllowUnencrypted` — HTTPS non lo richiede)
- Salva valore precedente, ripristinato nel `finally` (host posture invariata) - Salva valore precedente, ripristinato nel `finally` (host posture invariata)
3. **Validazione host WinRM**: `TrustedHosts` include IP 3. **Validazione host WinRM**: `TrustedHosts` include IP
4. **Test connettività**: `Test-WSMan -Port 5986 -UseSSL -Authentication Basic` con credenziali admin 4. **Test connettività**: `Test-WSMan -Port 5986 -UseSSL -Authentication Basic` con credenziali admin
5. **Apre PSSession** `-UseSSL -Port 5986` verso la VM 5. **Apre PSSession** `-UseSSL -Port 5986` verso la VM
6. **Crea `C:\CI`** in guest, valida creazione 6. **Crea `C:\CI`** in guest, valida creazione
7. **Copia `Setup-WinBuild2025.ps1`** in `C:\CI\Setup-WinBuild2025.ps1`, valida size match 7. **Copia `Install-CIToolchain-WinBuild2025.ps1`** in `C:\CI\Install-CIToolchain-WinBuild2025.ps1`, valida size match
8. **Esegue `Setup-WinBuild2025.ps1`** dentro la VM (vedi Fase C) 8. **Esegue `Install-CIToolchain-WinBuild2025.ps1`** dentro la VM (vedi Fase C)
9. **Gestisce reboot 3010**: se WU richiede reboot, riavvia VM e suggerisce re-run con `-SkipWindowsUpdate` 9. **Gestisce reboot 3010**: se WU richiede reboot, riavvia VM e suggerisce re-run con `-SkipWindowsUpdate`
10. **Post-setup remote validation** (9 check via singola `Invoke-Command`): 10. **Post-setup remote validation** (9 check via singola `Invoke-Command`):
- WinRM Running - WinRM Running
@@ -145,13 +145,13 @@ Ogni step ha validazione `Assert-Step` (throw on failure, `[OK]` su pass):
| `-BuildPassword` | (prompt) | Password per `ci_build` — mai hard-codare | | `-BuildPassword` | (prompt) | Password per `ci_build` — mai hard-codare |
| `-BuildUsername` | ci_build | Account CI dentro la VM | | `-BuildUsername` | ci_build | Account CI dentro la VM |
| `-DotNetSdkVersion` | 10.0 | Channel .NET SDK | | `-DotNetSdkVersion` | 10.0 | Channel .NET SDK |
| `-SkipWindowsUpdate` | (off) | Pass-through a Setup-WinBuild2025.ps1 | | `-SkipWindowsUpdate` | (off) | Pass-through a Install-CIToolchain-WinBuild2025.ps1 |
| `-StoreCredential` | (off) | Registra `BuildUsername`/`BuildPassword` in Windows Credential Manager | | `-StoreCredential` | (off) | Registra `BuildUsername`/`BuildPassword` in Windows Credential Manager |
| `-CredentialTarget` | BuildVMGuest | Target Credential Manager (deve corrispondere a quanto usato da Invoke-CIJob) | | `-CredentialTarget` | BuildVMGuest | Target Credential Manager (deve corrispondere a quanto usato da Invoke-CIJob) |
--- ---
## Fase C — Cosa fa `Setup-WinBuild2025.ps1` (dentro la VM) ## Fase C — Cosa fa `Install-CIToolchain-WinBuild2025.ps1` (dentro la VM)
Eseguito automaticamente da Prepare in Fase B. Steps 1/2/3/4b/5b/5c sono Eseguito automaticamente da Prepare in Fase B. Steps 1/2/3/4b/5b/5c sono
**validation-only** — verificano che Deploy abbia già applicato l'hardening OS. **validation-only** — verificano che Deploy abbia già applicato l'hardening OS.
@@ -295,7 +295,7 @@ toolchain (.NET, VS Build Tools, Python).
| Sintomo | Diagnosi / Fix | | Sintomo | Diagnosi / Fix |
| ---------------------------------------------- | --------------------------------------------------------------------------------------------------------- | | ---------------------------------------------- | --------------------------------------------------------------------------------------------------------- |
| `Cannot reach $VMIPAddress via WinRM` | VM non avviata, WinRM non abilitato, IP errato — verifica con ipconfig | | `Cannot reach $VMIPAddress via WinRM` | VM non avviata, WinRM non abilitato, IP errato — verifica con ipconfig |
| `Setup-WinBuild2025.ps1 exited with code 3010` | Reboot richiesto post-WU. Re-run con `-SkipWindowsUpdate` | | `Install-CIToolchain-WinBuild2025.ps1 exited with code 3010` | Reboot richiesto post-WU. Re-run con `-SkipWindowsUpdate` |
| `[Defender] Validation failed: GPO key` | Defender riattivato da Windows Update — disabilita via gpedit + reboot | | `[Defender] Validation failed: GPO key` | Defender riattivato da Windows Update — disabilita via gpedit + reboot |
| `VS Build Tools installation timed out` | Network slow o cache corrotta. Re-run con cache pulita (`C:\ProgramData\Microsoft\VisualStudio\Packages`) | | `VS Build Tools installation timed out` | Network slow o cache corrotta. Re-run con cache pulita (`C:\ProgramData\Microsoft\VisualStudio\Packages`) |
| `Python version match` fail | `$PythonVersion` ≠ versione installata. Aggiorna param o reinstalla | | `Python version match` fail | `$PythonVersion` ≠ versione installata. Aggiorna param o reinstalla |
@@ -312,3 +312,4 @@ toolchain (.NET, VS Build Tools, Python).
- **§2.5 [P1]** Snapshot versionato `BaseClean_<yyyyMMdd>` (rollback in caso di refresh rotto) - **§2.5 [P1]** Snapshot versionato `BaseClean_<yyyyMMdd>` (rollback in caso di refresh rotto)
- **§2.6 [P2]** Backup automatico VMDK template pre-snapshot - **§2.6 [P2]** Backup automatico VMDK template pre-snapshot
- **In-VM Git Clone** — installare Git for Windows + 7-Zip nel template per ottimizzare flusso - **In-VM Git Clone** — installare Git for Windows + 7-Zip nel template per ottimizzare flusso
gitea/actions/local-ci-build/action.yml
+3 -2
View File
@@ -1,4 +1,4 @@
# .gitea/actions/local-ci-build/action.yml # .gitea/actions/local-ci-build/action.yml
# #
# Reusable composite action — Local CI/CD System # Reusable composite action — Local CI/CD System
# #
@@ -63,7 +63,7 @@ inputs:
description: > description: >
Set to "true" to clone the repository inside the VM rather than Set to "true" to clone the repository inside the VM rather than
transferring a zip from the host. Requires Git in the template (see transferring a zip from the host. Requires Git in the template (see
Setup-WinBuild2025.ps1 Step 12 / Setup-LinuxBuild2404.sh). Install-CIToolchain-WinBuild2025.ps1 Step 12 / Install-CIToolchain-Linux2404.sh).
Preferred for repositories larger than ~200 MB. Preferred for repositories larger than ~200 MB.
required: false required: false
default: 'false' default: 'false'
@@ -243,3 +243,4 @@ runs:
path: ${{ steps.invoke-ci.outputs.artifact-path }}\*.log path: ${{ steps.invoke-ci.outputs.artifact-path }}\*.log
retention-days: 3 retention-days: 3
if-no-files-found: ignore if-no-files-found: ignore
template/Deploy-LinuxBuild2404.ps1
+3 -2
View File
@@ -1,4 +1,4 @@
#Requires -Version 5.1 #Requires -Version 5.1
<# <#
.SYNOPSIS .SYNOPSIS
Deploys an Ubuntu 24.04 LTS build VM on VMware Workstation using a cloud Deploys an Ubuntu 24.04 LTS build VM on VMware Workstation using a cloud
@@ -24,7 +24,7 @@
both files and creates the $CloudUser account with the SSH public key. both files and creates the $CloudUser account with the SSH public key.
No packages are installed and no runcmd runs: all provisioning (apt, No packages are installed and no runcmd runs: all provisioning (apt,
toolchain, SSH hardening, swap) is handled by Prepare-LinuxBuild2404.ps1 toolchain, SSH hardening, swap) is handled by Prepare-LinuxBuild2404.ps1
via Setup-LinuxBuild2404.sh. Step 9 waits for via Install-CIToolchain-Linux2404.sh. Step 9 waits for
/var/lib/cloud/instance/boot-finished before proceeding. /var/lib/cloud/instance/boot-finished before proceeding.
NIC: NIC:
@@ -676,3 +676,4 @@ Write-Host " Next steps (from template\ dir):"
Write-Host " .\Prepare-LinuxBuild2404.ps1 -VMXPath '$VMXPath' -VMIPAddress $guestIP" Write-Host " .\Prepare-LinuxBuild2404.ps1 -VMXPath '$VMXPath' -VMIPAddress $guestIP"
Write-Host "" Write-Host ""
Write-Host " VM is powered on. cloud-init provisioning complete." -ForegroundColor Green Write-Host " VM is powered on. cloud-init provisioning complete." -ForegroundColor Green
template/Deploy-WinBuild2022.ps1
+8 -7
View File
@@ -1,4 +1,4 @@
#Requires -RunAsAdministrator #Requires -RunAsAdministrator
#Requires -Version 5.1 #Requires -Version 5.1
<# <#
.SYNOPSIS .SYNOPSIS
@@ -39,7 +39,7 @@
- Defender real-time protection off + DisableAntiSpyware=1 GPO - Defender real-time protection off + DisableAntiSpyware=1 GPO
- DiagTrack/Telemetry off - DiagTrack/Telemetry off
- Windows Update GPO locks (NoAutoUpdate=1, DisableWindowsUpdateAccess=1); - Windows Update GPO locks (NoAutoUpdate=1, DisableWindowsUpdateAccess=1);
services remain Manual — Setup-WinBuild2022 Step 6b permanently disables services remain Manual — Install-CIToolchain-WinBuild2022 Step 6b permanently disables
them after applying updates (§7.2 Strategy B) them after applying updates (§7.2 Strategy B)
- Windows Firewall all profiles disabled (VMnet8 NAT lab; Setup Step 1 validates) - Windows Firewall all profiles disabled (VMnet8 NAT lab; Setup Step 1 validates)
- RDP enabled (no NLA, lab only) + firewall rules for RDP/ICMP/WinRM-HTTPS - RDP enabled (no NLA, lab only) + firewall rules for RDP/ICMP/WinRM-HTTPS
@@ -48,7 +48,7 @@
- ICMPv4 inbound allowed - ICMPv4 inbound allowed
- Lock screen disabled, Server Manager (policy + HKLM + task + HKCU + Default hive), - Lock screen disabled, Server Manager (policy + HKLM + task + HKCU + Default hive),
DisableCAD (Policies\System + Winlogon), OOBE/telemetry suppressed; DisableCAD (Policies\System + Winlogon), OOBE/telemetry suppressed;
Setup-WinBuild2022 Step 5b/5c validate all of these Install-CIToolchain-WinBuild2022 Step 5b/5c validate all of these
- Taskbar search bar hidden, Task View button hidden - Taskbar search bar hidden, Task View button hidden
- Windows Terminal set as default terminal (DelegationConsole/Terminal HKCU + Default hive) - Windows Terminal set as default terminal (DelegationConsole/Terminal HKCU + Default hive)
- Azure Arc auto-start, scheduled tasks, and himds service disabled - Azure Arc auto-start, scheduled tasks, and himds service disabled
@@ -580,9 +580,9 @@ reg add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' /v Enab
reg add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f | Out-Null reg add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f | Out-Null
L 'UAC disabled' L 'UAC disabled'
# ── Defender disabled (lab only) — Setup-WinBuild2022 skips Defender step ─ # ── Defender disabled (lab only) — Install-CIToolchain-WinBuild2022 skips Defender step ─
# RTP off + tamper-protect GPO. With Defender fully off, exclusion paths # RTP off + tamper-protect GPO. With Defender fully off, exclusion paths
# become moot (no scanner to exclude from), so Setup-WinBuild2022 has been # become moot (no scanner to exclude from), so Install-CIToolchain-WinBuild2022 has been
# stripped of its Defender step. # stripped of its Defender step.
try { Set-MpPreference -DisableRealtimeMonitoring `$true -ErrorAction Stop; L 'Defender RTP off' } try { Set-MpPreference -DisableRealtimeMonitoring `$true -ErrorAction Stop; L 'Defender RTP off' }
catch { L "Defender RTP off failed: `$(`$_.Exception.Message)" } catch { L "Defender RTP off failed: `$(`$_.Exception.Message)" }
@@ -608,7 +608,7 @@ L 'Windows Update GPO locks set + wuauserv/UsoSvc Manual (Setup Step 6b permanen
# ── Firewall: all profiles disabled + allow RDP + ICMP + WinRM HTTPS ───── # ── Firewall: all profiles disabled + allow RDP + ICMP + WinRM HTTPS ─────
# Disabling all profiles removes any block on subsequent WinRM config and WU # Disabling all profiles removes any block on subsequent WinRM config and WU
# downloads. This VM lives on VMnet8 NAT behind the VMware NAT gateway — no # downloads. This VM lives on VMnet8 NAT behind the VMware NAT gateway — no
# inbound exposure from outside the host. Setup-WinBuild2022 Step 1 validates. # inbound exposure from outside the host. Install-CIToolchain-WinBuild2022 Step 1 validates.
Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled False Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled False
L 'Windows Firewall disabled on all profiles' L 'Windows Firewall disabled on all profiles'
reg add 'HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server' /v fDenyTSConnections /t REG_DWORD /d 0 /f | Out-Null reg add 'HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server' /v fDenyTSConnections /t REG_DWORD /d 0 /f | Out-Null
@@ -650,7 +650,7 @@ reg add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' /v Disa
# OOBE privacy experience suppressed # OOBE privacy experience suppressed
reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\OOBE' /v DisablePrivacyExperience /t REG_DWORD /d 1 /f | Out-Null reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\OOBE' /v DisablePrivacyExperience /t REG_DWORD /d 1 /f | Out-Null
L 'Server Manager + WAC + CAD + OOBE prompts disabled' L 'Server Manager + WAC + CAD + OOBE prompts disabled'
# Supplemental UX hardening validated by Setup-WinBuild2022 Step 5c: # Supplemental UX hardening validated by Install-CIToolchain-WinBuild2022 Step 5c:
# Lock screen: suppress at CI console sessions (no interactive user ever logs in) # Lock screen: suppress at CI console sessions (no interactive user ever logs in)
reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Personalization' /v NoLockScreen /t REG_DWORD /d 1 /f | Out-Null reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Personalization' /v NoLockScreen /t REG_DWORD /d 1 /f | Out-Null
# Server Manager GPO policy key (authoritative path on WS2022; HKLM key above is not always honoured) # Server Manager GPO policy key (authoritative path on WS2022; HKLM key above is not always honoured)
@@ -1114,3 +1114,4 @@ Write-Host " .\Validate-DeployState.ps1 -VMIPAddress $guestIP"
Write-Host " .\Prepare-WinBuild2022.ps1 -VMIPAddress $guestIP [-SkipWindowsUpdate]" Write-Host " .\Prepare-WinBuild2022.ps1 -VMIPAddress $guestIP [-SkipWindowsUpdate]"
Write-Host "" Write-Host ""
Write-Host " VM is powered on with vmxnet3 + DHCP. Snapshot '$SnapshotName' taken." -ForegroundColor Green Write-Host " VM is powered on with vmxnet3 + DHCP. Snapshot '$SnapshotName' taken." -ForegroundColor Green
template/Deploy-WinBuild2025.ps1
+8 -7
View File
@@ -1,4 +1,4 @@
#Requires -RunAsAdministrator #Requires -RunAsAdministrator
#Requires -Version 5.1 #Requires -Version 5.1
<# <#
.SYNOPSIS .SYNOPSIS
@@ -39,7 +39,7 @@
- Defender real-time protection off + DisableAntiSpyware=1 GPO - Defender real-time protection off + DisableAntiSpyware=1 GPO
- DiagTrack/Telemetry off - DiagTrack/Telemetry off
- Windows Update GPO locks (NoAutoUpdate=1, DisableWindowsUpdateAccess=1); - Windows Update GPO locks (NoAutoUpdate=1, DisableWindowsUpdateAccess=1);
services remain Manual — Setup-WinBuild2025 Step 6b permanently disables services remain Manual — Install-CIToolchain-WinBuild2025 Step 6b permanently disables
them after applying updates (§7.2 Strategy B) them after applying updates (§7.2 Strategy B)
- Windows Firewall all profiles disabled (VMnet8 NAT lab; Setup Step 1 validates) - Windows Firewall all profiles disabled (VMnet8 NAT lab; Setup Step 1 validates)
- RDP enabled (no NLA, lab only) + firewall rules for RDP/ICMP/WinRM-HTTPS - RDP enabled (no NLA, lab only) + firewall rules for RDP/ICMP/WinRM-HTTPS
@@ -48,7 +48,7 @@
- ICMPv4 inbound allowed - ICMPv4 inbound allowed
- Lock screen disabled, Server Manager (policy + HKLM + task + HKCU + Default hive), - Lock screen disabled, Server Manager (policy + HKLM + task + HKCU + Default hive),
DisableCAD (Policies\System + Winlogon), OOBE/telemetry suppressed; DisableCAD (Policies\System + Winlogon), OOBE/telemetry suppressed;
Setup-WinBuild2025 Step 5b/5c validate all of these Install-CIToolchain-WinBuild2025 Step 5b/5c validate all of these
- Taskbar search bar hidden, Task View button hidden - Taskbar search bar hidden, Task View button hidden
- Windows Terminal set as default terminal (DelegationConsole/Terminal HKCU + Default hive) - Windows Terminal set as default terminal (DelegationConsole/Terminal HKCU + Default hive)
- Azure Arc auto-start, scheduled tasks, and himds service disabled - Azure Arc auto-start, scheduled tasks, and himds service disabled
@@ -580,9 +580,9 @@ reg add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' /v Enab
reg add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f | Out-Null reg add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f | Out-Null
L 'UAC disabled' L 'UAC disabled'
# ── Defender disabled (lab only) — Setup-WinBuild2025 skips Defender step ─ # ── Defender disabled (lab only) — Install-CIToolchain-WinBuild2025 skips Defender step ─
# RTP off + tamper-protect GPO. With Defender fully off, exclusion paths # RTP off + tamper-protect GPO. With Defender fully off, exclusion paths
# become moot (no scanner to exclude from), so Setup-WinBuild2025 has been # become moot (no scanner to exclude from), so Install-CIToolchain-WinBuild2025 has been
# stripped of its Defender step. # stripped of its Defender step.
try { Set-MpPreference -DisableRealtimeMonitoring `$true -ErrorAction Stop; L 'Defender RTP off' } try { Set-MpPreference -DisableRealtimeMonitoring `$true -ErrorAction Stop; L 'Defender RTP off' }
catch { L "Defender RTP off failed: `$(`$_.Exception.Message)" } catch { L "Defender RTP off failed: `$(`$_.Exception.Message)" }
@@ -608,7 +608,7 @@ L 'Windows Update GPO locks set + wuauserv/UsoSvc Manual (Setup Step 6b permanen
# ── Firewall: all profiles disabled + allow RDP + ICMP + WinRM HTTPS ───── # ── Firewall: all profiles disabled + allow RDP + ICMP + WinRM HTTPS ─────
# Disabling all profiles removes any block on subsequent WinRM config and WU # Disabling all profiles removes any block on subsequent WinRM config and WU
# downloads. This VM lives on VMnet8 NAT behind the VMware NAT gateway — no # downloads. This VM lives on VMnet8 NAT behind the VMware NAT gateway — no
# inbound exposure from outside the host. Setup-WinBuild2025 Step 1 validates. # inbound exposure from outside the host. Install-CIToolchain-WinBuild2025 Step 1 validates.
Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled False Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled False
L 'Windows Firewall disabled on all profiles' L 'Windows Firewall disabled on all profiles'
reg add 'HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server' /v fDenyTSConnections /t REG_DWORD /d 0 /f | Out-Null reg add 'HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server' /v fDenyTSConnections /t REG_DWORD /d 0 /f | Out-Null
@@ -650,7 +650,7 @@ reg add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' /v Disa
# OOBE privacy experience suppressed # OOBE privacy experience suppressed
reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\OOBE' /v DisablePrivacyExperience /t REG_DWORD /d 1 /f | Out-Null reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\OOBE' /v DisablePrivacyExperience /t REG_DWORD /d 1 /f | Out-Null
L 'Server Manager + WAC + CAD + OOBE prompts disabled' L 'Server Manager + WAC + CAD + OOBE prompts disabled'
# Supplemental UX hardening validated by Setup-WinBuild2025 Step 5c: # Supplemental UX hardening validated by Install-CIToolchain-WinBuild2025 Step 5c:
# Lock screen: suppress at CI console sessions (no interactive user ever logs in) # Lock screen: suppress at CI console sessions (no interactive user ever logs in)
reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Personalization' /v NoLockScreen /t REG_DWORD /d 1 /f | Out-Null reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Personalization' /v NoLockScreen /t REG_DWORD /d 1 /f | Out-Null
# Server Manager GPO policy key (authoritative path on WS2025; HKLM key above is not always honoured) # Server Manager GPO policy key (authoritative path on WS2025; HKLM key above is not always honoured)
@@ -1114,3 +1114,4 @@ Write-Host " .\Validate-DeployState.ps1 -VMIPAddress $guestIP"
Write-Host " .\Prepare-WinBuild2025.ps1 -VMIPAddress $guestIP [-SkipWindowsUpdate]" Write-Host " .\Prepare-WinBuild2025.ps1 -VMIPAddress $guestIP [-SkipWindowsUpdate]"
Write-Host "" Write-Host ""
Write-Host " VM is powered on with vmxnet3 + DHCP. Snapshot '$SnapshotName' taken." -ForegroundColor Green Write-Host " VM is powered on with vmxnet3 + DHCP. Snapshot '$SnapshotName' taken." -ForegroundColor Green
template/Setup-LinuxBuild2404.sh → template/Install-CIToolchain-Linux2404.sh
+5 -4
View File
@@ -1,11 +1,11 @@
#!/usr/bin/env bash #!/usr/bin/env bash
# Setup-LinuxBuild2404.sh # Install-CIToolchain-Linux2404.sh
# Guest-side CI toolchain setup for Ubuntu 24.04 LTS build template. # Guest-side CI toolchain setup for Ubuntu 24.04 LTS build template.
# Run as ci_build (passwordless sudo) via: sudo /tmp/Setup-LinuxBuild2404.sh # Run as ci_build (passwordless sudo) via: sudo /tmp/Install-CIToolchain-Linux2404.sh
# Called by: template/Prepare-LinuxBuild2404.ps1 (host-side) # Called by: template/Prepare-LinuxBuild2404.ps1 (host-side)
# #
# Usage: # Usage:
# sudo /tmp/Setup-LinuxBuild2404.sh [--skip-update] [--dotnet] [--mingw] # sudo /tmp/Install-CIToolchain-Linux2404.sh [--skip-update] [--dotnet] [--mingw]
# #
# Options: # Options:
# --skip-update Skip apt update + upgrade (faster re-runs) # --skip-update Skip apt update + upgrade (faster re-runs)
@@ -265,6 +265,7 @@ assert_step "/tmp writable" bash -c 'touch /tmp/.ci_tmpcheck && rm /tmp/.ci_tmpc
assert_step "ci-report-ip.service enabled" systemctl is-enabled ci-report-ip.service assert_step "ci-report-ip.service enabled" systemctl is-enabled ci-report-ip.service
echo "" echo ""
echo "=== Setup-LinuxBuild2404.sh complete ===" echo "=== Install-CIToolchain-Linux2404.sh complete ==="
echo " All steps passed. VM is ready for BaseClean-Linux snapshot." echo " All steps passed. VM is ready for BaseClean-Linux snapshot."
echo " Run Prepare-LinuxBuild2404.ps1 --Step7Shutdown + snapshot from host." echo " Run Prepare-LinuxBuild2404.ps1 --Step7Shutdown + snapshot from host."
template/Setup-WinBuild2022.ps1 → template/Install-CIToolchain-WinBuild2022.ps1
+4 -3
View File
@@ -1,4 +1,4 @@
#Requires -RunAsAdministrator #Requires -RunAsAdministrator
#Requires -Version 5.1 #Requires -Version 5.1
<# <#
.SYNOPSIS .SYNOPSIS
@@ -121,7 +121,7 @@
Invoke via Prepare-WinBuild2022.ps1 from the HOST (recommended), or Invoke via Prepare-WinBuild2022.ps1 from the HOST (recommended), or
run manually from an elevated PowerShell session INSIDE the VM: run manually from an elevated PowerShell session INSIDE the VM:
Set-ExecutionPolicy Bypass -Scope Process -Force Set-ExecutionPolicy Bypass -Scope Process -Force
.\Setup-WinBuild2022.ps1 -BuildPassword 'YourPassword' .\Install-CIToolchain-WinBuild2022.ps1 -BuildPassword 'YourPassword'
#> #>
[CmdletBinding()] [CmdletBinding()]
param( param(
@@ -1715,8 +1715,9 @@ Write-Host "All pre-snapshot checks passed." -ForegroundColor Green
# ── Done ────────────────────────────────────────────────────────────────────── # ── Done ──────────────────────────────────────────────────────────────────────
Write-Host "" Write-Host ""
Write-Host "Setup-WinBuild2022.ps1 complete. All Assert-Step checks passed." -ForegroundColor Green Write-Host "Install-CIToolchain-WinBuild2022.ps1 complete. All Assert-Step checks passed." -ForegroundColor Green
# Full next-steps banner is printed by Prepare-WinBuild2022.ps1 on the host. # Full next-steps banner is printed by Prepare-WinBuild2022.ps1 on the host.
# If running this script standalone (manually inside the VM), follow the steps # If running this script standalone (manually inside the VM), follow the steps
# in docs/WINDOWS-TEMPLATE-SETUP.md (shut down → snapshot BaseClean → power off). # in docs/WINDOWS-TEMPLATE-SETUP.md (shut down → snapshot BaseClean → power off).
Write-Host "" Write-Host ""
template/Setup-WinBuild2025.ps1 → template/Install-CIToolchain-WinBuild2025.ps1
+4 -3
View File
@@ -1,4 +1,4 @@
#Requires -RunAsAdministrator #Requires -RunAsAdministrator
#Requires -Version 5.1 #Requires -Version 5.1
<# <#
.SYNOPSIS .SYNOPSIS
@@ -121,7 +121,7 @@
Invoke via Prepare-WinBuild2025.ps1 from the HOST (recommended), or Invoke via Prepare-WinBuild2025.ps1 from the HOST (recommended), or
run manually from an elevated PowerShell session INSIDE the VM: run manually from an elevated PowerShell session INSIDE the VM:
Set-ExecutionPolicy Bypass -Scope Process -Force Set-ExecutionPolicy Bypass -Scope Process -Force
.\Setup-WinBuild2025.ps1 -BuildPassword 'YourPassword' .\Install-CIToolchain-WinBuild2025.ps1 -BuildPassword 'YourPassword'
#> #>
[CmdletBinding()] [CmdletBinding()]
param( param(
@@ -1715,8 +1715,9 @@ Write-Host "All pre-snapshot checks passed." -ForegroundColor Green
# ── Done ────────────────────────────────────────────────────────────────────── # ── Done ──────────────────────────────────────────────────────────────────────
Write-Host "" Write-Host ""
Write-Host "Setup-WinBuild2025.ps1 complete. All Assert-Step checks passed." -ForegroundColor Green Write-Host "Install-CIToolchain-WinBuild2025.ps1 complete. All Assert-Step checks passed." -ForegroundColor Green
# Full next-steps banner is printed by Prepare-WinBuild2025.ps1 on the host. # Full next-steps banner is printed by Prepare-WinBuild2025.ps1 on the host.
# If running this script standalone (manually inside the VM), follow the steps # If running this script standalone (manually inside the VM), follow the steps
# in docs/WINDOWS-TEMPLATE-SETUP.md (shut down → snapshot BaseClean → power off). # in docs/WINDOWS-TEMPLATE-SETUP.md (shut down → snapshot BaseClean → power off).
Write-Host "" Write-Host ""
template/Prepare-LinuxBuild2404.ps1
+17 -16
View File
@@ -1,7 +1,7 @@
#Requires -Version 5.1 #Requires -Version 5.1
<# <#
.SYNOPSIS .SYNOPSIS
HOST-side script: delivers and runs Setup-LinuxBuild2404.sh inside the Linux template VM. HOST-side script: delivers and runs Install-CIToolchain-Linux2404.sh inside the Linux template VM.
.DESCRIPTION .DESCRIPTION
Automates provisioning of the Ubuntu 24.04 template VM from the host machine via SSH/SCP: Automates provisioning of the Ubuntu 24.04 template VM from the host machine via SSH/SCP:
@@ -9,8 +9,8 @@
IPv4 address valid, TCP/22 reachable IPv4 address valid, TCP/22 reachable
2. Auto power-on + guest IP detection via vmrun getGuestIPAddress (when -VMXPath provided) 2. Auto power-on + guest IP detection via vmrun getGuestIPAddress (when -VMXPath provided)
3. Add host key to known_hosts (idempotent, uses StrictHostKeyChecking=accept-new) 3. Add host key to known_hosts (idempotent, uses StrictHostKeyChecking=accept-new)
4. Copy Setup-LinuxBuild2404.sh to /tmp on guest via scp + validate file size 4. Copy Install-CIToolchain-Linux2404.sh to /tmp on guest via scp + validate file size
5. Execute Setup-LinuxBuild2404.sh via SSH (stdout/stderr streamed to host console) 5. Execute Install-CIToolchain-Linux2404.sh via SSH (stdout/stderr streamed to host console)
6. Post-setup remote validation batch check (user, sudo, tools, CI dirs, swap, sshd) 6. Post-setup remote validation batch check (user, sudo, tools, CI dirs, swap, sshd)
7. Graceful shutdown + vmrun snapshot (when -TakeSnapshot or -VMXPath provided) 7. Graceful shutdown + vmrun snapshot (when -TakeSnapshot or -VMXPath provided)
Final: print summary Final: print summary
@@ -56,13 +56,13 @@
Must match the snapshot name used in New-BuildVM.ps1. Must match the snapshot name used in New-BuildVM.ps1.
.PARAMETER SkipUpdate .PARAMETER SkipUpdate
Pass --skip-update to Setup-LinuxBuild2404.sh (skips apt-get upgrade). Pass --skip-update to Install-CIToolchain-Linux2404.sh (skips apt-get upgrade).
.PARAMETER InstallDotNet .PARAMETER InstallDotNet
Pass --dotnet to Setup-LinuxBuild2404.sh (installs .NET SDK). Pass --dotnet to Install-CIToolchain-Linux2404.sh (installs .NET SDK).
.PARAMETER NoMingw .PARAMETER NoMingw
Pass --no-mingw to Setup-LinuxBuild2404.sh (skips MinGW cross-compiler). Pass --no-mingw to Install-CIToolchain-Linux2404.sh (skips MinGW cross-compiler).
MinGW is installed by default; use this only to skip it. MinGW is installed by default; use this only to skip it.
.PARAMETER TakeSnapshot .PARAMETER TakeSnapshot
@@ -278,26 +278,26 @@ if ($LASTEXITCODE -ne 0) {
} }
Write-Host " [OK] SSH connectivity confirmed, host key added." Write-Host " [OK] SSH connectivity confirmed, host key added."
# ── Step 5 — Copy Setup-LinuxBuild2404.sh into VM ──────────────────────────── # ── Step 5 — Copy Install-CIToolchain-Linux2404.sh into VM ────────────────────────────
Write-Host "[Prepare] Step 5 — Copying Setup-LinuxBuild2404.sh to guest..." Write-Host "[Prepare] Step 5 — Copying Install-CIToolchain-Linux2404.sh to guest..."
$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path $scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
$setupScript = Join-Path $scriptDir 'Setup-LinuxBuild2404.sh' $setupScript = Join-Path $scriptDir 'Install-CIToolchain-Linux2404.sh'
$guestScript = '/tmp/Setup-LinuxBuild2404.sh' $guestScript = '/tmp/Install-CIToolchain-Linux2404.sh'
if (-not (Test-Path $setupScript -PathType Leaf)) { if (-not (Test-Path $setupScript -PathType Leaf)) {
throw "[Prepare Step 5] Setup-LinuxBuild2404.sh not found alongside this script: $setupScript" throw "[Prepare Step 5] Install-CIToolchain-Linux2404.sh not found alongside this script: $setupScript"
} }
# Strip UTF-8 BOM and normalize CRLF→LF before copying. # Strip UTF-8 BOM and normalize CRLF→LF before copying.
# PS 5.1 / VS Code on Windows may save .sh files with BOM or CRLF; both break bash. # PS 5.1 / VS Code on Windows may save .sh files with BOM or CRLF; both break bash.
$shBytes = [System.IO.File]::ReadAllBytes($setupScript) $shBytes = [System.IO.File]::ReadAllBytes($setupScript)
if ($shBytes.Length -ge 3 -and $shBytes[0] -eq 0xEF -and $shBytes[1] -eq 0xBB -and $shBytes[2] -eq 0xBF) { if ($shBytes.Length -ge 3 -and $shBytes[0] -eq 0xEF -and $shBytes[1] -eq 0xBB -and $shBytes[2] -eq 0xBF) {
Write-Host " [WARN] UTF-8 BOM detected in Setup-LinuxBuild2404.sh — stripping before copy" Write-Host " [WARN] UTF-8 BOM detected in Install-CIToolchain-Linux2404.sh — stripping before copy"
$shBytes = $shBytes[3..($shBytes.Length - 1)] $shBytes = $shBytes[3..($shBytes.Length - 1)]
} }
$shText = [System.Text.Encoding]::UTF8.GetString($shBytes) -replace "`r`n", "`n" -replace "`r", "`n" $shText = [System.Text.Encoding]::UTF8.GetString($shBytes) -replace "`r`n", "`n" -replace "`r", "`n"
$tmpScript = Join-Path $env:TEMP 'Setup-LinuxBuild2404-ci.sh' $tmpScript = Join-Path $env:TEMP 'Install-CIToolchain-Linux2404-ci.sh'
[System.IO.File]::WriteAllText($tmpScript, $shText, [System.Text.UTF8Encoding]::new($false)) [System.IO.File]::WriteAllText($tmpScript, $shText, [System.Text.UTF8Encoding]::new($false))
$setupScript = $tmpScript $setupScript = $tmpScript
@@ -322,7 +322,7 @@ Assert-Step 'FileCopy' "guest script size matches local ($localSize bytes, remot
} }
# ── Step 6 — Execute setup script ──────────────────────────────────────────── # ── Step 6 — Execute setup script ────────────────────────────────────────────
Write-Host "[Prepare] Step 6 — Running Setup-LinuxBuild2404.sh in guest (may take several minutes)..." Write-Host "[Prepare] Step 6 — Running Install-CIToolchain-Linux2404.sh in guest (may take several minutes)..."
$setupFlags = [System.Collections.Generic.List[string]]::new() $setupFlags = [System.Collections.Generic.List[string]]::new()
if ($SkipUpdate) { $setupFlags.Add('--skip-update') } if ($SkipUpdate) { $setupFlags.Add('--skip-update') }
@@ -340,7 +340,7 @@ $setupExitCode = $LASTEXITCODE
Write-Host "------------------------------------------------------------" Write-Host "------------------------------------------------------------"
if ($setupExitCode -ne 0) { if ($setupExitCode -ne 0) {
throw "[Prepare Step 6] Setup-LinuxBuild2404.sh exited $setupExitCode — see output above." throw "[Prepare Step 6] Install-CIToolchain-Linux2404.sh exited $setupExitCode — see output above."
} }
Write-Host "[Prepare] Setup script completed (exit 0)." -ForegroundColor Green Write-Host "[Prepare] Setup script completed (exit 0)." -ForegroundColor Green
@@ -435,3 +435,4 @@ if ($TakeSnapshot -or $VMXPath -ne '') {
} else { } else {
Write-Host " Snapshot: not taken — run manually then use -SnapshotName '$SnapshotName'" Write-Host " Snapshot: not taken — run manually then use -SnapshotName '$SnapshotName'"
} }
template/Prepare-WinBuild2022.ps1
+20 -18
View File
@@ -1,7 +1,7 @@
#Requires -Version 5.1 #Requires -Version 5.1
<# <#
.SYNOPSIS .SYNOPSIS
HOST-side script: delivers and runs Setup-WinBuild2022.ps1 inside the template VM. HOST-side script: delivers and runs Install-CIToolchain-WinBuild2022.ps1 inside the template VM.
.DESCRIPTION .DESCRIPTION
Automates the template VM provisioning from the host machine: Automates the template VM provisioning from the host machine:
@@ -12,8 +12,8 @@
(PS 5.1 Test-WSMan has no -SessionOption, so PSSession is used as the connectivity probe) (PS 5.1 Test-WSMan has no -SessionOption, so PSSession is used as the connectivity probe)
5. PSSession open — step 4 and 5 are now merged 5. PSSession open — step 4 and 5 are now merged
6. Ensures C:\CI exists on guest; validates creation 6. Ensures C:\CI exists on guest; validates creation
7. Copies Setup-WinBuild2022.ps1 into the VM; validates file present + size match 7. Copies Install-CIToolchain-WinBuild2022.ps1 into the VM; validates file present + size match
8. Runs Setup-WinBuild2022.ps1 inside the VM with the given parameters 8. Runs Install-CIToolchain-WinBuild2022.ps1 inside the VM with the given parameters
(Setup performs per-step validation internally — aborts on any failure) (Setup performs per-step validation internally — aborts on any failure)
9. Handles the reboot-required case (exit 3010) and optionally re-runs 9. Handles the reboot-required case (exit 3010) and optionally re-runs
10. Post-setup remote validation: 9 guest-state checks via a single Invoke-Command 10. Post-setup remote validation: 9 guest-state checks via a single Invoke-Command
@@ -68,13 +68,13 @@
.PARAMETER BuildUsername .PARAMETER BuildUsername
Local username for the CI build account inside the VM. Default: ci_build. Local username for the CI build account inside the VM. Default: ci_build.
Passed through to Setup-WinBuild2022.ps1 and used in post-setup validation. Passed through to Install-CIToolchain-WinBuild2022.ps1 and used in post-setup validation.
.PARAMETER DotNetSdkVersion .PARAMETER DotNetSdkVersion
.NET SDK channel to install in the VM. Default: 10.0 (matches host SDK). .NET SDK channel to install in the VM. Default: 10.0 (matches host SDK).
.PARAMETER SkipWindowsUpdate .PARAMETER SkipWindowsUpdate
Pass through to Setup-WinBuild2022.ps1 to skip the Windows Update step. Pass through to Install-CIToolchain-WinBuild2022.ps1 to skip the Windows Update step.
.PARAMETER SnapshotName .PARAMETER SnapshotName
Name of the snapshot to create. Default: BaseClean (case-sensitive — used by New-BuildVM.ps1). Name of the snapshot to create. Default: BaseClean (case-sensitive — used by New-BuildVM.ps1).
@@ -132,7 +132,7 @@ param(
[string] $DotNetSdkVersion = '10.0', [string] $DotNetSdkVersion = '10.0',
# Tier-2 Toolchain version pins — forwarded as-is to Setup-WinBuild2022.ps1 # Tier-2 Toolchain version pins — forwarded as-is to Install-CIToolchain-WinBuild2022.ps1
[string] $Pwsh7Version = '7.6.1', [string] $Pwsh7Version = '7.6.1',
[string] $NSISVersion = '3.12', [string] $NSISVersion = '3.12',
[string] $CMakeVersion = '3.31.6', [string] $CMakeVersion = '3.31.6',
@@ -141,7 +141,7 @@ param(
[string] $GhCliVersion = '2.92.0', [string] $GhCliVersion = '2.92.0',
[string] $VcpkgRef = '', [string] $VcpkgRef = '',
# Skip Tier-2 Toolchain — forwarded to Setup-WinBuild2022.ps1 -SkipTier2 # Skip Tier-2 Toolchain — forwarded to Install-CIToolchain-WinBuild2022.ps1 -SkipTier2
[switch] $SkipTier2, [switch] $SkipTier2,
[switch] $SkipWindowsUpdate, [switch] $SkipWindowsUpdate,
@@ -231,8 +231,8 @@ $scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
# Pre-flight validation # Pre-flight validation
Assert-Step 'PreFlight' 'script directory resolved' { Test-Path $scriptDir -PathType Container } Assert-Step 'PreFlight' 'script directory resolved' { Test-Path $scriptDir -PathType Container }
Assert-Step 'PreFlight' 'Setup-WinBuild2022.ps1 present alongside this script' { Assert-Step 'PreFlight' 'Install-CIToolchain-WinBuild2022.ps1 present alongside this script' {
Test-Path (Join-Path $scriptDir 'Setup-WinBuild2022.ps1') -PathType Leaf Test-Path (Join-Path $scriptDir 'Install-CIToolchain-WinBuild2022.ps1') -PathType Leaf
} }
Assert-Step 'PreFlight' "VMIPAddress octets in 0..255" { Assert-Step 'PreFlight' "VMIPAddress octets in 0..255" {
$parts = $VMIPAddress.Split('.') | ForEach-Object { [int]$_ } $parts = $VMIPAddress.Split('.') | ForEach-Object { [int]$_ }
@@ -330,9 +330,9 @@ Error: $_
} }
try { try {
# ── Copy Setup-WinBuild2022.ps1 into the VM ─────────────────────────────── # ── Copy Install-CIToolchain-WinBuild2022.ps1 into the VM ───────────────────────────────
$setupScript = Join-Path $scriptDir 'Setup-WinBuild2022.ps1' $setupScript = Join-Path $scriptDir 'Install-CIToolchain-WinBuild2022.ps1'
$guestScriptPath = 'C:\CI\Setup-WinBuild2022.ps1' $guestScriptPath = 'C:\CI\Install-CIToolchain-WinBuild2022.ps1'
Write-Host "[Prepare] Ensuring C:\CI exists on guest..." Write-Host "[Prepare] Ensuring C:\CI exists on guest..."
Invoke-Command -Session $session -ScriptBlock { Invoke-Command -Session $session -ScriptBlock {
@@ -344,7 +344,7 @@ try {
Invoke-Command -Session $session -ScriptBlock { Test-Path 'C:\CI' -PathType Container } Invoke-Command -Session $session -ScriptBlock { Test-Path 'C:\CI' -PathType Container }
} }
Write-Host "[Prepare] Copying Setup-WinBuild2022.ps1 -> guest $guestScriptPath (UTF-8 BOM)..." Write-Host "[Prepare] Copying Install-CIToolchain-WinBuild2022.ps1 -> guest $guestScriptPath (UTF-8 BOM)..."
# Do NOT use Copy-Item -ToSession: it binary-copies the file. # Do NOT use Copy-Item -ToSession: it binary-copies the file.
# If the source file has no UTF-8 BOM, PowerShell 5.1 on the guest reads it as # If the source file has no UTF-8 BOM, PowerShell 5.1 on the guest reads it as
# Windows-1252, misinterpreting multi-byte UTF-8 sequences (e.g. em dash U+2014 # Windows-1252, misinterpreting multi-byte UTF-8 sequences (e.g. em dash U+2014
@@ -374,7 +374,7 @@ try {
[int64]$remoteSize -ge ([int64]$hostSize - 6) -and [int64]$remoteSize -le ([int64]$hostSize + 6) [int64]$remoteSize -ge ([int64]$hostSize - 6) -and [int64]$remoteSize -le ([int64]$hostSize + 6)
} }
# ── Build argument list for Setup-WinBuild2022.ps1 ─────────────────────── # ── Build argument list for Install-CIToolchain-WinBuild2022.ps1 ───────────────────────
$setupArgs = @{ $setupArgs = @{
BuildPassword = $BuildPassword BuildPassword = $BuildPassword
BuildUsername = $BuildUsername BuildUsername = $BuildUsername
@@ -392,7 +392,7 @@ try {
if ($SkipCleanup) { $setupArgs['SkipCleanup'] = $true } if ($SkipCleanup) { $setupArgs['SkipCleanup'] = $true }
if ($SkipTier2) { $setupArgs['SkipTier2'] = $true } if ($SkipTier2) { $setupArgs['SkipTier2'] = $true }
# ── Run Setup-WinBuild2022.ps1 inside the VM ────────────────────────────── # ── Run Install-CIToolchain-WinBuild2022.ps1 inside the VM ──────────────────────────────
# Setup may return exit 3010 (ERROR_SUCCESS_REBOOT_REQUIRED) when Windows # Setup may return exit 3010 (ERROR_SUCCESS_REBOOT_REQUIRED) when Windows
# Update applied patches that need a reboot. We loop: reboot guest, wait for # Update applied patches that need a reboot. We loop: reboot guest, wait for
# WinRM, reopen session, re-invoke Setup. Steps 1-5 are idempotent (~30 s); # WinRM, reopen session, re-invoke Setup. Steps 1-5 are idempotent (~30 s);
@@ -441,7 +441,7 @@ try {
return $false return $false
} }
Write-Host "[Prepare] Running Setup-WinBuild2022.ps1 inside VM (this will take a while)..." Write-Host "[Prepare] Running Install-CIToolchain-WinBuild2022.ps1 inside VM (this will take a while)..."
for ($iter = 1; $iter -le $maxWuIterations; $iter++) { for ($iter = 1; $iter -le $maxWuIterations; $iter++) {
Write-Host "[Prepare] Setup iteration $iter/$maxWuIterations" Write-Host "[Prepare] Setup iteration $iter/$maxWuIterations"
@@ -466,7 +466,7 @@ try {
if ($result -eq 0) { break } if ($result -eq 0) { break }
if ($result -ne 3010) { if ($result -ne 3010) {
throw "Setup-WinBuild2022.ps1 exited with code $result" throw "Install-CIToolchain-WinBuild2022.ps1 exited with code $result"
} }
# exit 3010 (or transport error treated as 3010) → WU needs reboot. # exit 3010 (or transport error treated as 3010) → WU needs reboot.
@@ -721,3 +721,5 @@ finally {
} }
Write-Host "[Prepare] Host TrustedHosts restored." Write-Host "[Prepare] Host TrustedHosts restored."
} }
template/Prepare-WinBuild2025.ps1
+20 -18
View File
@@ -1,7 +1,7 @@
#Requires -Version 5.1 #Requires -Version 5.1
<# <#
.SYNOPSIS .SYNOPSIS
HOST-side script: delivers and runs Setup-WinBuild2025.ps1 inside the template VM. HOST-side script: delivers and runs Install-CIToolchain-WinBuild2025.ps1 inside the template VM.
.DESCRIPTION .DESCRIPTION
Automates the template VM provisioning from the host machine: Automates the template VM provisioning from the host machine:
@@ -12,8 +12,8 @@
(PS 5.1 Test-WSMan has no -SessionOption, so PSSession is used as the connectivity probe) (PS 5.1 Test-WSMan has no -SessionOption, so PSSession is used as the connectivity probe)
5. PSSession open — step 4 and 5 are now merged 5. PSSession open — step 4 and 5 are now merged
6. Ensures C:\CI exists on guest; validates creation 6. Ensures C:\CI exists on guest; validates creation
7. Copies Setup-WinBuild2025.ps1 into the VM; validates file present + size match 7. Copies Install-CIToolchain-WinBuild2025.ps1 into the VM; validates file present + size match
8. Runs Setup-WinBuild2025.ps1 inside the VM with the given parameters 8. Runs Install-CIToolchain-WinBuild2025.ps1 inside the VM with the given parameters
(Setup performs per-step validation internally — aborts on any failure) (Setup performs per-step validation internally — aborts on any failure)
9. Handles the reboot-required case (exit 3010) and optionally re-runs 9. Handles the reboot-required case (exit 3010) and optionally re-runs
10. Post-setup remote validation: 9 guest-state checks via a single Invoke-Command 10. Post-setup remote validation: 9 guest-state checks via a single Invoke-Command
@@ -68,13 +68,13 @@
.PARAMETER BuildUsername .PARAMETER BuildUsername
Local username for the CI build account inside the VM. Default: ci_build. Local username for the CI build account inside the VM. Default: ci_build.
Passed through to Setup-WinBuild2025.ps1 and used in post-setup validation. Passed through to Install-CIToolchain-WinBuild2025.ps1 and used in post-setup validation.
.PARAMETER DotNetSdkVersion .PARAMETER DotNetSdkVersion
.NET SDK channel to install in the VM. Default: 10.0 (matches host SDK). .NET SDK channel to install in the VM. Default: 10.0 (matches host SDK).
.PARAMETER SkipWindowsUpdate .PARAMETER SkipWindowsUpdate
Pass through to Setup-WinBuild2025.ps1 to skip the Windows Update step. Pass through to Install-CIToolchain-WinBuild2025.ps1 to skip the Windows Update step.
.PARAMETER SnapshotName .PARAMETER SnapshotName
Name of the snapshot to create. Default: BaseClean (case-sensitive — used by New-BuildVM.ps1). Name of the snapshot to create. Default: BaseClean (case-sensitive — used by New-BuildVM.ps1).
@@ -132,7 +132,7 @@ param(
[string] $DotNetSdkVersion = '10.0', [string] $DotNetSdkVersion = '10.0',
# Tier-2 Toolchain version pins — forwarded as-is to Setup-WinBuild2025.ps1 # Tier-2 Toolchain version pins — forwarded as-is to Install-CIToolchain-WinBuild2025.ps1
[string] $Pwsh7Version = '7.6.1', [string] $Pwsh7Version = '7.6.1',
[string] $NSISVersion = '3.12', [string] $NSISVersion = '3.12',
[string] $CMakeVersion = '3.31.6', [string] $CMakeVersion = '3.31.6',
@@ -141,7 +141,7 @@ param(
[string] $GhCliVersion = '2.92.0', [string] $GhCliVersion = '2.92.0',
[string] $VcpkgRef = '', [string] $VcpkgRef = '',
# Skip Tier-2 Toolchain — forwarded to Setup-WinBuild2025.ps1 -SkipTier2 # Skip Tier-2 Toolchain — forwarded to Install-CIToolchain-WinBuild2025.ps1 -SkipTier2
[switch] $SkipTier2, [switch] $SkipTier2,
[switch] $SkipWindowsUpdate, [switch] $SkipWindowsUpdate,
@@ -231,8 +231,8 @@ $scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
# Pre-flight validation # Pre-flight validation
Assert-Step 'PreFlight' 'script directory resolved' { Test-Path $scriptDir -PathType Container } Assert-Step 'PreFlight' 'script directory resolved' { Test-Path $scriptDir -PathType Container }
Assert-Step 'PreFlight' 'Setup-WinBuild2025.ps1 present alongside this script' { Assert-Step 'PreFlight' 'Install-CIToolchain-WinBuild2025.ps1 present alongside this script' {
Test-Path (Join-Path $scriptDir 'Setup-WinBuild2025.ps1') -PathType Leaf Test-Path (Join-Path $scriptDir 'Install-CIToolchain-WinBuild2025.ps1') -PathType Leaf
} }
Assert-Step 'PreFlight' "VMIPAddress octets in 0..255" { Assert-Step 'PreFlight' "VMIPAddress octets in 0..255" {
$parts = $VMIPAddress.Split('.') | ForEach-Object { [int]$_ } $parts = $VMIPAddress.Split('.') | ForEach-Object { [int]$_ }
@@ -330,9 +330,9 @@ Error: $_
} }
try { try {
# ── Copy Setup-WinBuild2025.ps1 into the VM ─────────────────────────────── # ── Copy Install-CIToolchain-WinBuild2025.ps1 into the VM ───────────────────────────────
$setupScript = Join-Path $scriptDir 'Setup-WinBuild2025.ps1' $setupScript = Join-Path $scriptDir 'Install-CIToolchain-WinBuild2025.ps1'
$guestScriptPath = 'C:\CI\Setup-WinBuild2025.ps1' $guestScriptPath = 'C:\CI\Install-CIToolchain-WinBuild2025.ps1'
Write-Host "[Prepare] Ensuring C:\CI exists on guest..." Write-Host "[Prepare] Ensuring C:\CI exists on guest..."
Invoke-Command -Session $session -ScriptBlock { Invoke-Command -Session $session -ScriptBlock {
@@ -344,7 +344,7 @@ try {
Invoke-Command -Session $session -ScriptBlock { Test-Path 'C:\CI' -PathType Container } Invoke-Command -Session $session -ScriptBlock { Test-Path 'C:\CI' -PathType Container }
} }
Write-Host "[Prepare] Copying Setup-WinBuild2025.ps1 -> guest $guestScriptPath (UTF-8 BOM)..." Write-Host "[Prepare] Copying Install-CIToolchain-WinBuild2025.ps1 -> guest $guestScriptPath (UTF-8 BOM)..."
# Do NOT use Copy-Item -ToSession: it binary-copies the file. # Do NOT use Copy-Item -ToSession: it binary-copies the file.
# If the source file has no UTF-8 BOM, PowerShell 5.1 on the guest reads it as # If the source file has no UTF-8 BOM, PowerShell 5.1 on the guest reads it as
# Windows-1252, misinterpreting multi-byte UTF-8 sequences (e.g. em dash U+2014 # Windows-1252, misinterpreting multi-byte UTF-8 sequences (e.g. em dash U+2014
@@ -374,7 +374,7 @@ try {
[int64]$remoteSize -ge ([int64]$hostSize - 6) -and [int64]$remoteSize -le ([int64]$hostSize + 6) [int64]$remoteSize -ge ([int64]$hostSize - 6) -and [int64]$remoteSize -le ([int64]$hostSize + 6)
} }
# ── Build argument list for Setup-WinBuild2025.ps1 ─────────────────────── # ── Build argument list for Install-CIToolchain-WinBuild2025.ps1 ───────────────────────
$setupArgs = @{ $setupArgs = @{
BuildPassword = $BuildPassword BuildPassword = $BuildPassword
BuildUsername = $BuildUsername BuildUsername = $BuildUsername
@@ -392,7 +392,7 @@ try {
if ($SkipCleanup) { $setupArgs['SkipCleanup'] = $true } if ($SkipCleanup) { $setupArgs['SkipCleanup'] = $true }
if ($SkipTier2) { $setupArgs['SkipTier2'] = $true } if ($SkipTier2) { $setupArgs['SkipTier2'] = $true }
# ── Run Setup-WinBuild2025.ps1 inside the VM ────────────────────────────── # ── Run Install-CIToolchain-WinBuild2025.ps1 inside the VM ──────────────────────────────
# Setup may return exit 3010 (ERROR_SUCCESS_REBOOT_REQUIRED) when Windows # Setup may return exit 3010 (ERROR_SUCCESS_REBOOT_REQUIRED) when Windows
# Update applied patches that need a reboot. We loop: reboot guest, wait for # Update applied patches that need a reboot. We loop: reboot guest, wait for
# WinRM, reopen session, re-invoke Setup. Steps 1-5 are idempotent (~30 s); # WinRM, reopen session, re-invoke Setup. Steps 1-5 are idempotent (~30 s);
@@ -441,7 +441,7 @@ try {
return $false return $false
} }
Write-Host "[Prepare] Running Setup-WinBuild2025.ps1 inside VM (this will take a while)..." Write-Host "[Prepare] Running Install-CIToolchain-WinBuild2025.ps1 inside VM (this will take a while)..."
for ($iter = 1; $iter -le $maxWuIterations; $iter++) { for ($iter = 1; $iter -le $maxWuIterations; $iter++) {
Write-Host "[Prepare] Setup iteration $iter/$maxWuIterations" Write-Host "[Prepare] Setup iteration $iter/$maxWuIterations"
@@ -466,7 +466,7 @@ try {
if ($result -eq 0) { break } if ($result -eq 0) { break }
if ($result -ne 3010) { if ($result -ne 3010) {
throw "Setup-WinBuild2025.ps1 exited with code $result" throw "Install-CIToolchain-WinBuild2025.ps1 exited with code $result"
} }
# exit 3010 (or transport error treated as 3010) → WU needs reboot. # exit 3010 (or transport error treated as 3010) → WU needs reboot.
@@ -721,3 +721,5 @@ finally {
} }
Write-Host "[Prepare] Host TrustedHosts restored." Write-Host "[Prepare] Host TrustedHosts restored."
} }
template/Validate-DeployState.ps1
+2 -2
View File
@@ -5,8 +5,8 @@
.DESCRIPTION .DESCRIPTION
Connects to the VM via WinRM (HTTP/Basic) and runs all checks that Connects to the VM via WinRM (HTTP/Basic) and runs all checks that
Setup-WinBuild2025.ps1 Steps 1/2/3/4b/5b/5c assert as validation-only. Install-CIToolchain-WinBuild2025.ps1 Steps 1/2/3/4b/5b/5c assert as validation-only.
Use this after Deploy completes and before running Prepare/Setup. Use this after Deploy completes and before running Prepare/Install-CIToolchain.
.PARAMETER VMIPAddress .PARAMETER VMIPAddress
IP address of the guest VM on VMnet8 (e.g. 192.168.79.129). IP address of the guest VM on VMnet8 (e.g. 192.168.79.129).
template/Validate-SetupState.ps1
+1 -1
View File
@@ -47,7 +47,7 @@ param(
[string] $PythonVersion = '3.13.3', [string] $PythonVersion = '3.13.3',
[switch] $Remediate, [switch] $Remediate,
# Skip Tier-2 Toolchain checks (mirrors -SkipTier2 in Setup-WinBuild2025.ps1) # Skip Tier-2 Toolchain checks (mirrors -SkipTier2 in Install-CIToolchain-WinBuild2025.ps1)
[switch] $SkipTier2 [switch] $SkipTier2
) )