Simone/local-ci-cd-system
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(template): promote PS7/NSIS/gh CLI from Tier-2 to Tier-1 (Step 11)

Browse Source
This commit is contained in:
Simone
2026-05-11 20:26:06 +02:00
parent 1bf7c2347b
commit 5c1a197559
2 changed files with 106 additions and 99 deletions
Download Patch File Download Diff File Expand all files Collapse all files
TODO.md
+32 -31
View File
@@ -22,22 +22,22 @@ _Last updated: 2026-05-11 (post Sprint 11: §6.6 Tier-2 Toolchain DONE — Power
**Stato generale**: §1, §2, §4, §5 chiusi. §3 completo. §6.1 Linux Build VM completato con e2e PASS (nsis7z.dll 2272 KB, parità Windows). §6.6 Tier-1+Tier-2 completati nel template (Step 11+12). Prossimi P2: Test Plan + §6.2-6.5.
| Stato | Area | Done | Open | Note |
| ----- | ------------------------------- | ---: | ---: | ------------------------------------------------------------------ |
| [x] | Setup & Infrastructure | 8 | 0 | Gitea + runner + dirs + rete tutti operativi |
| [x] | Template VM (Fasi A→D) | 4 | 0 | Snapshot `BaseClean` preso, credenziali in Credential Manager |
| [x] | Scripts Verification | 3 | 0 | e2e-008/009 SUCCESS, cleanup orfani + retry deleteVM ok |
| [x] | Runner Configuration | 2 | 0 | `config.yaml`, capacity 4, `BuildVMGuest` |
| [ ] | Gitea Workflow Integration | 4 | 1 | manca solo §P3 generalizzazione workflow |
| [x] | §1 Sicurezza & hardening | 3 | 0 | 1.1, 1.4, 1.6 done; 1.2/1.3/1.5/1.7/1.8 deferred (home lab) |
| [x] | §2 Affidabilità & resilienza | 7 | 0 | tutto done (2.1-2.7) |
| [x] | §3 Performance & throughput | 4 | 0 | 3.1/3.2/3.3/3.6 done; 3.4/3.5 deferred — **§3 CHIUSO** |
| [x] | §4 Osservabilità & manutenzione | 3 | 0 | 4.1/4.3/4.4 done (4.2 Prometheus, 4.5 Dashboard rimossi) |
| [x] | §5 Qualità codice & test | 5 | 0 | 5.1/5.2/5.3/5.4/5.5 done |
| Stato | Area | Done | Open | Note |
| ----- | ------------------------------- | ---: | ---: | ------------------------------------------------------------------- |
| [x] | Setup & Infrastructure | 8 | 0 | Gitea + runner + dirs + rete tutti operativi |
| [x] | Template VM (Fasi A→D) | 4 | 0 | Snapshot `BaseClean` preso, credenziali in Credential Manager |
| [x] | Scripts Verification | 3 | 0 | e2e-008/009 SUCCESS, cleanup orfani + retry deleteVM ok |
| [x] | Runner Configuration | 2 | 0 | `config.yaml`, capacity 4, `BuildVMGuest` |
| [ ] | Gitea Workflow Integration | 4 | 1 | manca solo §P3 generalizzazione workflow |
| [x] | §1 Sicurezza & hardening | 3 | 0 | 1.1, 1.4, 1.6 done; 1.2/1.3/1.5/1.7/1.8 deferred (home lab) |
| [x] | §2 Affidabilità & resilienza | 7 | 0 | tutto done (2.1-2.7) |
| [x] | §3 Performance & throughput | 4 | 0 | 3.1/3.2/3.3/3.6 done; 3.4/3.5 deferred — **§3 CHIUSO** |
| [x] | §4 Osservabilità & manutenzione | 3 | 0 | 4.1/4.3/4.4 done (4.2 Prometheus, 4.5 Dashboard rimossi) |
| [x] | §5 Qualità codice & test | 5 | 0 | 5.1/5.2/5.3/5.4/5.5 done |
| [ ] | §6 Scalabilità & estensioni | 2 | 4 | 6.1 (Linux) done, 6.6 Tier-1+Tier-2 done (Step 11+12); 6.2-6.5 TODO |
| [ ] | §7 Refactor Deploy ↔ Setup | 4 | 1 | 7.1/7.2/7.3/7.4 done; 7.5 (rinomina) opzionale |
| [x] | In-VM Git Clone (§3.3) | 4 | 0 | COMPLETATO 2026-05-10 — e2e PASS: 34s/25.7% vs baseline |
| [x] | Linux Build VM (§6.1) | 5 | 0 | Deploy/Prepare/Setup/Transport + doc + e2e PASS nsis7z.dll 2272 KB |
| [ ] | §7 Refactor Deploy ↔ Setup | 4 | 1 | 7.1/7.2/7.3/7.4 done; 7.5 (rinomina) opzionale |
| [x] | In-VM Git Clone (§3.3) | 4 | 0 | COMPLETATO 2026-05-10 — e2e PASS: 34s/25.7% vs baseline |
| [x] | Linux Build VM (§6.1) | 5 | 0 | Deploy/Prepare/Setup/Transport + doc + e2e PASS nsis7z.dll 2272 KB |
**Prossimi passi consigliati** (vedi anche "Suggerimento di sequencing" in fondo):
1. **Test Plan** — eseguire completo `docs/TEST-PLAN-v1.3-to-HEAD.md` (25+ Pester tests, validazione features)
@@ -510,24 +510,25 @@ File: [template/Setup-WinBuild2025.ps1](template/Setup-WinBuild2025.ps1),
Aggiungere tools generici-CI riduce il bisogno di installazione ad-hoc nei workflow e abilita
build più ampi senza toccare il template.
### Tier-1 (implementato)
- [x] **Git for Windows** (v2.54.0.windows.1) — Step 11, self-clone in VM
- [x] **7-Zip** (26.01) — Step 11, universal compression + fallback §3.2
### Tier-1 — Step 11 (implementato)
### Tier-2 (implementato — Step 12)
| Tool | Versione | Razionale |
| ------------------- | ---------------- | ------------------------------------------------------ |
| **Git for Windows** | 2.54.0.windows.1 | Self-clone in VM, submodule fetch, fallback §3.2 |
| **7-Zip** | 26.01 | Unpack/zip universale; usato da Step 12 stesso (vcpkg) |
| **PowerShell 7.x** | 7.4.7 (LTS) | Parallel pipelines, operatori moderni, pwsh in CI |
| **NSIS** | 3.10 | Build installer Windows (es. `nsis-plugin-nsinnounp`) |
| **gh CLI** | 2.67.0 | Upload artifact a release Gitea/GitHub, comment PR |
| Tool | Versione | Razionale |
| ------------------- | ----------------------- | ------------------------------------------------------------------ |
| **Git for Windows** | 2.54.0.windows.1 | [x] Self-clone in VM (alt a host-zip-transfer), submodule fetch |
| **7-Zip** | 26.01 | [x] Universale unpack/zip; molti installer e workflow ne dipendono |
| **PowerShell 7.x** | 7.4.7 (LTS) | [x] Più veloce di 5.1, parallel pipelines, operatori moderni |
| **NSIS** | 3.10 | [x] Test build installer (es. `nsis-plugin-nsinnounp`) |
| **CMake** | 3.31.6 | [x] Build system cross-platform per progetti C/C++ nativi |
| **Node.js LTS** | 22.14.0 | [x] Frontend/Electron pipelines, JS toolchain (npm) |
| **WiX Toolset** | 4.0.5 (dotnet tool) | [x] MSI building da .NET projects |
| **gh CLI** | 2.67.0 | [x] Upload artifact a release Gitea/GitHub, comment PR |
| **Sysinternals** | latest (CDN Microsoft) | [x] Diagnostica process/handle quando build flaky |
| **vcpkg** | HEAD (shallow clone) | [x] Package manager C++ per dipendenze native |
### Tier-2 — Step 12 (implementato)
| Tool | Versione | Razionale |
| ---------------- | ---------------------- | -------------------------------------------------- |
| **CMake** | 3.31.6 | Build system C/C++ cross-platform |
| **Node.js LTS** | 22.14.0 | Frontend/Electron pipelines, npm toolchain |
| **WiX Toolset** | 4.0.5 (dotnet tool) | MSI building da .NET projects |
| **Sysinternals** | latest (CDN Microsoft) | Diagnostica process/handle quando build flaky |
| **vcpkg** | HEAD (shallow clone) | Package manager C++ per dipendenze native |
**Approccio**:
- Pinning hash SHA256 per ogni installer (vedi §1.3)
template/Setup-WinBuild2025.ps1
+74 -68
View File
@@ -53,11 +53,11 @@
Validation: MSBuild.exe exists, executes, PATH, VC dir present
Step 10 — Toolchain cross-check (dotnet, python, msbuild)
Throws on any missing tool
Step 11 — Tier-1 Toolchain (Git for Windows + 7-Zip) — §6.6
Installs to C:\Program Files (Git default) and C:\Program Files\7-Zip
Validation: git and 7z commands resolvable, executables present
Step 12 — Tier-2 Toolchain (PowerShell 7 LTS, NSIS, CMake, Node.js LTS,
WiX v4, gh CLI, Sysinternals Suite, vcpkg) — §6.6
Step 11 — Tier-1 Toolchain (Git, 7-Zip, PowerShell 7 LTS, NSIS, gh CLI) — §6.6
Installs to C:\Program Files\<tool>\ and C:\Program Files (x86)\NSIS
Validation: git, 7z, pwsh, makensis, gh commands resolvable
Step 12 — Tier-2 Toolchain (CMake, Node.js LTS, WiX v4,
Sysinternals Suite, vcpkg) — §6.6
Installs to C:\Program Files\<tool>\ and C:\BuildTools\<tool>\
Validation: each binary resolvable via Get-Command
Cleanup — Disk cleanup: cleanmgr, SoftwareDistribution, CBS, TEMP, Prefetch, DISM
@@ -77,13 +77,13 @@
WU (Step 6) — all prereqs validated; WU runs with Firewall+Defender already off
WU disable (Step 6b) — immediately after WU; snapshot captures WU permanently off
Toolchain (7-9) — .NET/Python/VS last; WU done, no scan on installer payloads
Tier-1 (Step 11) — Git + 7-Zip after base toolchain; enables §3.3 in-VM clone
Tier-2 (Step 12) — Pwsh7/NSIS/CMake/Node/WiX/gh/Sysinternals/vcpkg after Tier-1;
Tier-1 (Step 11) — Git + 7-Zip + PS7 + NSIS + gh CLI after base toolchain
Tier-2 (Step 12) — CMake/Node/WiX/Sysinternals/vcpkg after Tier-1;
Sysinternals extraction requires 7-Zip; vcpkg clone requires Git
NOTE: Step 11 installs Git for Windows + 7-Zip (Tier-1 Toolchain §6.6).
Step 12 installs PowerShell 7 LTS, NSIS, CMake, Node.js LTS, WiX v4, gh CLI,
Sysinternals Suite, and vcpkg (Tier-2 Toolchain §6.6).
NOTE: Step 11 installs Tier-1 Toolchain §6.6: Git, 7-Zip, PowerShell 7 LTS, NSIS, gh CLI.
Step 12 installs Tier-2 Toolchain §6.6: CMake, Node.js LTS, WiX v4,
Sysinternals Suite, vcpkg. Skippable via -SkipTier2.
╔══════════════════════════════════════════════════════════════════════╗
║ NETWORK REQUIREMENT DURING SETUP ║
@@ -180,7 +180,7 @@ param(
# vcpkg revision: git commit SHA or tag. Default '' = shallow HEAD clone.
[string] $VcpkgRef = '',
# Skip Tier-2 Toolchain installation (PowerShell 7, NSIS, CMake, Node.js, WiX, gh CLI, Sysinternals, vcpkg).
# Skip Tier-2 Toolchain installation (CMake, Node.js, WiX, Sysinternals, vcpkg).
# Use when rebuilding the template quickly without internet-heavy downloads, or
# when only Tier-1 tools are needed for a stripped-down template variant.
[switch] $SkipTier2
@@ -1032,11 +1032,11 @@ if (-not $allOk) {
}
Write-Host "All toolchain checks passed." -ForegroundColor Green
# ── Step 11: Tier-1 Toolchain (Git for Windows + 7-Zip) ──────────────────────
# Critical for §3.3 (In-VM Git clone) and cross-platform build support.
# Installed to C:\BuildTools\<tool>\ for clear separation from C:\CI\ (runtime artifacts).
# ── Step 11: Tier-1 Toolchain (Git + 7-Zip + PS7 + NSIS + gh CLI) ─────────────
# Critical for §3.3 (In-VM Git clone), cross-platform build support, and scripting.
# Installed to C:\Program Files\<tool>\ (default) and C:\Program Files (x86)\NSIS.
Write-Step "Installing Tier-1 Toolchain (Git + 7-Zip)"
Write-Step "Installing Tier-1 Toolchain (Git / 7-Zip / PS7 / NSIS / gh CLI)"
# Build tools root directory
$buildToolsRoot = 'C:\BuildTools'
@@ -1150,20 +1150,6 @@ Assert-Step '7-Zip' '7z command resolvable' {
[bool](Get-Command 7z -ErrorAction SilentlyContinue)
}
Write-Host "Tier-1 Toolchain installation complete." -ForegroundColor Green
# ── Step 12: Tier-2 Toolchain ─────────────────────────────────────────────────
if ($SkipTier2) {
Write-Host "`n[Setup] Skipping Tier-2 Toolchain (-SkipTier2 switch set)." -ForegroundColor Yellow
}
else {
Write-Step "Installing Tier-2 Toolchain (Pwsh7 / NSIS / CMake / Node.js / WiX / gh CLI / Sysinternals / vcpkg)"
# BuildTools root may already exist from Step 11 (idempotent).
if (-not (Test-Path $buildToolsRoot)) {
New-Item -ItemType Directory -Path $buildToolsRoot -Force | Out-Null
}
# ── PowerShell 7 LTS ─────────────────────────────────────────────────────────
$pwsh7Exe = 'C:\Program Files\PowerShell\7\pwsh.exe'
if (Test-Path $pwsh7Exe) {
@@ -1235,6 +1221,57 @@ $env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';
Assert-Step 'NSIS' 'makensis.exe present at expected path' { Test-Path $nsisExe -PathType Leaf }
Assert-Step 'NSIS' 'makensis command resolvable via PATH' { [bool](Get-Command makensis -ErrorAction SilentlyContinue) }
# ── GitHub CLI (gh) ───────────────────────────────────────────────────────────
$ghExe = 'C:\Program Files\GitHub CLI\gh.exe'
if (Test-Path $ghExe) {
$ghv = (& $ghExe --version 2>&1 | Select-Object -First 1).ToString()
Write-Host "GitHub CLI already installed: $ghv"
} else {
$ghUrl = "https://github.com/cli/cli/releases/download/v$GhCliVersion/gh_${GhCliVersion}_windows_amd64.msi"
$ghMsi = 'C:\CI\ghcli_installer.msi'
Write-Host "Downloading GitHub CLI $GhCliVersion from GitHub releases..."
try { Invoke-WebRequest -Uri $ghUrl -OutFile $ghMsi -UseBasicParsing }
catch { throw "Failed to download GitHub CLI from '$ghUrl': $_" }
Assert-Hash -FilePath $ghMsi -Label "gh_${GhCliVersion}_windows_amd64.msi" `
-Expected $script:Hashes['GhCli']
Write-Host "Installing GitHub CLI $GhCliVersion..."
$proc = Start-Process -FilePath 'msiexec.exe' -ArgumentList @(
'/i', $ghMsi, '/quiet', '/norestart'
) -Wait -PassThru
Remove-Item $ghMsi -ErrorAction SilentlyContinue
if ($proc -and $proc.ExitCode -notin @(0, 3010)) {
throw "GitHub CLI MSI exited $($proc.ExitCode)."
}
Write-Host "GitHub CLI $GhCliVersion installed."
}
# gh CLI MSI may not update Machine PATH — ensure the install dir is present.
$ghDir = 'C:\Program Files\GitHub CLI'
$machinePath = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine')
if ($machinePath -notlike "*$ghDir*") {
[System.Environment]::SetEnvironmentVariable('PATH', "$machinePath;$ghDir", 'Machine')
}
$env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';' +
[System.Environment]::GetEnvironmentVariable('PATH', 'User')
Assert-Step 'GhCli' 'gh.exe present at expected path' { Test-Path $ghExe -PathType Leaf }
Assert-Step 'GhCli' 'gh command resolvable via PATH' { [bool](Get-Command gh -ErrorAction SilentlyContinue) }
Assert-Step 'GhCli' 'gh --version exits 0' { & gh --version 2>&1 | Out-Null; $LASTEXITCODE -eq 0 }
Write-Host "Tier-1 Toolchain installation complete." -ForegroundColor Green
# ── Step 12: Tier-2 Toolchain ─────────────────────────────────────────────────
if ($SkipTier2) {
Write-Host "`n[Setup] Skipping Tier-2 Toolchain (-SkipTier2 switch set)." -ForegroundColor Yellow
}
else {
Write-Step "Installing Tier-2 Toolchain (CMake / Node.js / WiX / Sysinternals / vcpkg)"
# BuildTools root may already exist from Step 11 (idempotent).
if (-not (Test-Path $buildToolsRoot)) {
New-Item -ItemType Directory -Path $buildToolsRoot -Force | Out-Null
}
# ── CMake ─────────────────────────────────────────────────────────────────────
$cmakeExe = 'C:\Program Files\CMake\bin\cmake.exe'
if (Test-Path $cmakeExe) {
@@ -1342,41 +1379,6 @@ $env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';
Assert-Step 'WiX' 'wix.exe present at expected path' { Test-Path $wixExe -PathType Leaf }
Assert-Step 'WiX' 'wix command resolvable via PATH' { [bool](Get-Command wix -ErrorAction SilentlyContinue) }
# ── GitHub CLI (gh) ───────────────────────────────────────────────────────────
$ghExe = 'C:\Program Files\GitHub CLI\gh.exe'
if (Test-Path $ghExe) {
$ghv = (& $ghExe --version 2>&1 | Select-Object -First 1).ToString()
Write-Host "GitHub CLI already installed: $ghv"
} else {
$ghUrl = "https://github.com/cli/cli/releases/download/v$GhCliVersion/gh_${GhCliVersion}_windows_amd64.msi"
$ghMsi = 'C:\CI\ghcli_installer.msi'
Write-Host "Downloading GitHub CLI $GhCliVersion from GitHub releases..."
try { Invoke-WebRequest -Uri $ghUrl -OutFile $ghMsi -UseBasicParsing }
catch { throw "Failed to download GitHub CLI from '$ghUrl': $_" }
Assert-Hash -FilePath $ghMsi -Label "gh_${GhCliVersion}_windows_amd64.msi" `
-Expected $script:Hashes['GhCli']
Write-Host "Installing GitHub CLI $GhCliVersion..."
$proc = Start-Process -FilePath 'msiexec.exe' -ArgumentList @(
'/i', $ghMsi, '/quiet', '/norestart'
) -Wait -PassThru
Remove-Item $ghMsi -ErrorAction SilentlyContinue
if ($proc -and $proc.ExitCode -notin @(0, 3010)) {
throw "GitHub CLI MSI exited $($proc.ExitCode)."
}
Write-Host "GitHub CLI $GhCliVersion installed."
}
# gh CLI MSI may not update Machine PATH — ensure the install dir is present.
$ghDir = 'C:\Program Files\GitHub CLI'
$machinePath = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine')
if ($machinePath -notlike "*$ghDir*") {
[System.Environment]::SetEnvironmentVariable('PATH', "$machinePath;$ghDir", 'Machine')
}
$env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';' +
[System.Environment]::GetEnvironmentVariable('PATH', 'User')
Assert-Step 'GhCli' 'gh.exe present at expected path' { Test-Path $ghExe -PathType Leaf }
Assert-Step 'GhCli' 'gh command resolvable via PATH' { [bool](Get-Command gh -ErrorAction SilentlyContinue) }
Assert-Step 'GhCli' 'gh --version exits 0' { & gh --version 2>&1 | Out-Null; $LASTEXITCODE -eq 0 }
# ── Sysinternals Suite ────────────────────────────────────────────────────────
# Downloaded as SysinternalsSuite.zip from Microsoft CDN; extracted via 7-Zip.
# 7-Zip ($sevenZipExe) must already be installed (Step 11 Tier-1).
@@ -1647,16 +1649,20 @@ Assert-Step 'Final' 'git command available' {
Assert-Step 'Final' '7z command available' {
[bool](Get-Command 7z -ErrorAction SilentlyContinue)
}
Assert-Step 'Final' 'Tier-1 extras all resolvable (pwsh, makensis, gh)' {
$env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';' +
[System.Environment]::GetEnvironmentVariable('PATH', 'User')
(Get-Command pwsh -ErrorAction SilentlyContinue) -and
(Get-Command makensis -ErrorAction SilentlyContinue) -and
(Get-Command gh -ErrorAction SilentlyContinue)
}
if (-not $SkipTier2) {
Assert-Step 'Final' 'Tier-2 Toolchain all resolvable (pwsh, makensis, cmake, node, wix, gh, sysinternals, vcpkg)' {
Assert-Step 'Final' 'Tier-2 Toolchain all resolvable (cmake, node, wix, sysinternals, vcpkg)' {
$env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';' +
[System.Environment]::GetEnvironmentVariable('PATH', 'User')
(Get-Command pwsh -ErrorAction SilentlyContinue) -and
(Get-Command makensis -ErrorAction SilentlyContinue) -and
(Get-Command cmake -ErrorAction SilentlyContinue) -and
(Get-Command node -ErrorAction SilentlyContinue) -and
(Get-Command wix -ErrorAction SilentlyContinue) -and
(Get-Command gh -ErrorAction SilentlyContinue) -and
(Test-Path 'C:\BuildTools\Sysinternals\PsExec.exe' -PathType Leaf) -and
(Test-Path 'C:\BuildTools\vcpkg\vcpkg.exe' -PathType Leaf)
}