feat(sprint4-6): quality, reliability, perf baseline

Sprint 4 — qualità codice: - scripts/_Common.psm1: New-CISessionOption, Resolve-VmrunPath, Invoke-Vmrun - PSScriptAnalyzerSettings.psd1: project-wide PSSA rules (security + formatting) - Remove-BuildVM.ps1: SupportsShouldProcess (-WhatIf support) - Invoke-RemoteBuild.ps1, Get-BuildArtifacts.ps1: use New-CISessionOption from module - New-BuildVM.ps1: use Resolve-VmrunPath + Invoke-Vmrun from module Sprint 5 — affidabilità: - Backup-CITemplate.ps1: stop runner, timestamped VMDK backup, prune old, restart - Watch-RunnerHealth.ps1: auto-restart act_runner, cooldown 3/h, EventLog + webhook - Register-CIScheduledTasks.ps1: add CI-RunnerHealth task (every 15 min) Sprint 6 — perf baseline: - Set-TemplateSharedFolders.ps1: idempotent VMX editor for NuGet/pip shared folders - Invoke-RemoteBuild.ps1: -UseSharedCache injects NUGET_PACKAGES + PIP_CACHE_DIR in guest - Measure-CIBenchmark.ps1: times clone/start/IP/WinRM/destroy, appends to benchmark.jsonl Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-10 20:08:19 +02:00
parent 1962c977ba
commit 552eb628b7
12 changed files with 966 additions and 98 deletions
@@ -0,0 +1,68 @@
+@{
+    # ── Rules to suppress project-wide ──────────────────────────────────────────
+    ExcludeRules = @(
+        # All CI scripts use Write-Host for structured output captured by act_runner.
+        # Write-Output would interleave with function return values and break callers.
+        'PSAvoidUsingWriteHost'
+    )
+
+    # ── Rule-specific configuration ──────────────────────────────────────────────
+    Rules = @{
+        # Security: never eval arbitrary strings
+        PSAvoidUsingInvokeExpression = @{
+            Enable = $true
+        }
+
+        # All state-changing functions must support -WhatIf / ShouldProcess
+        PSUseShouldProcessForStateChangingFunctions = @{
+            Enable = $true
+        }
+
+        # Credentials must flow as [PSCredential], not plain strings
+        PSUsePSCredentialType = @{
+            Enable = $true
+        }
+
+        # No plain-text passwords in params or variables
+        PSAvoidUsingPlainTextForPassword = @{
+            Enable = $true
+        }
+
+        # ConvertTo-SecureString -AsPlainText only acceptable during template setup;
+        # use Suppress comments there if needed.
+        PSAvoidUsingConvertToSecureStringWithPlainText = @{
+            Enable = $true
+        }
+
+        # No script-scope globals that bleed across module boundaries
+        PSAvoidGlobalVars = @{
+            Enable = $true
+        }
+
+        # Formatting — 4-space indentation, spaces (not tabs)
+        PSUseConsistentIndentation = @{
+            Enable              = $true
+            IndentationSize     = 4
+            PipelineIndentation = 'IncreaseIndentationForFirstPipeline'
+            Kind                = 'space'
+        }
+
+        PSUseConsistentWhitespace = @{
+            Enable                          = $true
+            CheckInnerBrace                 = $true
+            CheckOpenBrace                  = $true
+            CheckOpenParen                  = $true
+            CheckOperator                   = $true
+            CheckPipe                       = $true
+            CheckPipeForRedundantWhitespace = $true
+            CheckSeparator                  = $true
+            CheckParameter                  = $false
+        }
+
+        # Alignment is a style preference; disable to avoid false positives on
+        # the deliberate column-aligned hashtable assignments used in this project.
+        PSAlignAssignmentStatement = @{
+            Enable = $false
+        }
+    }
+}