From 5c1a1975594ae8f5ed1cd2b0fa6dd5ca9be0a3f2 Mon Sep 17 00:00:00 2001 From: Simone Date: Mon, 11 May 2026 20:26:06 +0200 Subject: [PATCH] refactor(template): promote PS7/NSIS/gh CLI from Tier-2 to Tier-1 (Step 11) --- TODO.md | 63 +++++++------- template/Setup-WinBuild2025.ps1 | 142 +++++++++++++++++--------------- 2 files changed, 106 insertions(+), 99 deletions(-) diff --git a/TODO.md b/TODO.md index 3da804e..4fa33f2 100644 --- a/TODO.md +++ b/TODO.md @@ -22,22 +22,22 @@ _Last updated: 2026-05-11 (post Sprint 11: §6.6 Tier-2 Toolchain DONE — Power **Stato generale**: §1, §2, §4, §5 chiusi. §3 completo. §6.1 Linux Build VM completato con e2e PASS (nsis7z.dll 2272 KB, parità Windows). §6.6 Tier-1+Tier-2 completati nel template (Step 11+12). Prossimi P2: Test Plan + §6.2-6.5. -| Stato | Area | Done | Open | Note | -| ----- | ------------------------------- | ---: | ---: | ------------------------------------------------------------------ | -| [x] | Setup & Infrastructure | 8 | 0 | Gitea + runner + dirs + rete tutti operativi | -| [x] | Template VM (Fasi A→D) | 4 | 0 | Snapshot `BaseClean` preso, credenziali in Credential Manager | -| [x] | Scripts Verification | 3 | 0 | e2e-008/009 SUCCESS, cleanup orfani + retry deleteVM ok | -| [x] | Runner Configuration | 2 | 0 | `config.yaml`, capacity 4, `BuildVMGuest` | -| [ ] | Gitea Workflow Integration | 4 | 1 | manca solo §P3 generalizzazione workflow | -| [x] | §1 Sicurezza & hardening | 3 | 0 | 1.1, 1.4, 1.6 done; 1.2/1.3/1.5/1.7/1.8 deferred (home lab) | -| [x] | §2 Affidabilità & resilienza | 7 | 0 | tutto done (2.1-2.7) | -| [x] | §3 Performance & throughput | 4 | 0 | 3.1/3.2/3.3/3.6 done; 3.4/3.5 deferred — **§3 CHIUSO** | -| [x] | §4 Osservabilità & manutenzione | 3 | 0 | 4.1/4.3/4.4 done (4.2 Prometheus, 4.5 Dashboard rimossi) | -| [x] | §5 Qualità codice & test | 5 | 0 | 5.1/5.2/5.3/5.4/5.5 done | +| Stato | Area | Done | Open | Note | +| ----- | ------------------------------- | ---: | ---: | ------------------------------------------------------------------- | +| [x] | Setup & Infrastructure | 8 | 0 | Gitea + runner + dirs + rete tutti operativi | +| [x] | Template VM (Fasi A→D) | 4 | 0 | Snapshot `BaseClean` preso, credenziali in Credential Manager | +| [x] | Scripts Verification | 3 | 0 | e2e-008/009 SUCCESS, cleanup orfani + retry deleteVM ok | +| [x] | Runner Configuration | 2 | 0 | `config.yaml`, capacity 4, `BuildVMGuest` | +| [ ] | Gitea Workflow Integration | 4 | 1 | manca solo §P3 generalizzazione workflow | +| [x] | §1 Sicurezza & hardening | 3 | 0 | 1.1, 1.4, 1.6 done; 1.2/1.3/1.5/1.7/1.8 deferred (home lab) | +| [x] | §2 Affidabilità & resilienza | 7 | 0 | tutto done (2.1-2.7) | +| [x] | §3 Performance & throughput | 4 | 0 | 3.1/3.2/3.3/3.6 done; 3.4/3.5 deferred — **§3 CHIUSO** | +| [x] | §4 Osservabilità & manutenzione | 3 | 0 | 4.1/4.3/4.4 done (4.2 Prometheus, 4.5 Dashboard rimossi) | +| [x] | §5 Qualità codice & test | 5 | 0 | 5.1/5.2/5.3/5.4/5.5 done | | [ ] | §6 Scalabilità & estensioni | 2 | 4 | 6.1 (Linux) done, 6.6 Tier-1+Tier-2 done (Step 11+12); 6.2-6.5 TODO | -| [ ] | §7 Refactor Deploy ↔ Setup | 4 | 1 | 7.1/7.2/7.3/7.4 done; 7.5 (rinomina) opzionale | -| [x] | In-VM Git Clone (§3.3) | 4 | 0 | COMPLETATO 2026-05-10 — e2e PASS: 34s/25.7% vs baseline | -| [x] | Linux Build VM (§6.1) | 5 | 0 | Deploy/Prepare/Setup/Transport + doc + e2e PASS nsis7z.dll 2272 KB | +| [ ] | §7 Refactor Deploy ↔ Setup | 4 | 1 | 7.1/7.2/7.3/7.4 done; 7.5 (rinomina) opzionale | +| [x] | In-VM Git Clone (§3.3) | 4 | 0 | COMPLETATO 2026-05-10 — e2e PASS: 34s/25.7% vs baseline | +| [x] | Linux Build VM (§6.1) | 5 | 0 | Deploy/Prepare/Setup/Transport + doc + e2e PASS nsis7z.dll 2272 KB | **Prossimi passi consigliati** (vedi anche "Suggerimento di sequencing" in fondo): 1. **Test Plan** — eseguire completo `docs/TEST-PLAN-v1.3-to-HEAD.md` (25+ Pester tests, validazione features) @@ -510,24 +510,25 @@ File: [template/Setup-WinBuild2025.ps1](template/Setup-WinBuild2025.ps1), Aggiungere tools generici-CI riduce il bisogno di installazione ad-hoc nei workflow e abilita build più ampi senza toccare il template. -### Tier-1 (implementato) -- [x] **Git for Windows** (v2.54.0.windows.1) — Step 11, self-clone in VM -- [x] **7-Zip** (26.01) — Step 11, universal compression + fallback §3.2 +### Tier-1 — Step 11 (implementato) -### Tier-2 (implementato — Step 12) +| Tool | Versione | Razionale | +| ------------------- | ---------------- | ------------------------------------------------------ | +| **Git for Windows** | 2.54.0.windows.1 | Self-clone in VM, submodule fetch, fallback §3.2 | +| **7-Zip** | 26.01 | Unpack/zip universale; usato da Step 12 stesso (vcpkg) | +| **PowerShell 7.x** | 7.4.7 (LTS) | Parallel pipelines, operatori moderni, pwsh in CI | +| **NSIS** | 3.10 | Build installer Windows (es. `nsis-plugin-nsinnounp`) | +| **gh CLI** | 2.67.0 | Upload artifact a release Gitea/GitHub, comment PR | -| Tool | Versione | Razionale | -| ------------------- | ----------------------- | ------------------------------------------------------------------ | -| **Git for Windows** | 2.54.0.windows.1 | [x] Self-clone in VM (alt a host-zip-transfer), submodule fetch | -| **7-Zip** | 26.01 | [x] Universale unpack/zip; molti installer e workflow ne dipendono | -| **PowerShell 7.x** | 7.4.7 (LTS) | [x] Più veloce di 5.1, parallel pipelines, operatori moderni | -| **NSIS** | 3.10 | [x] Test build installer (es. `nsis-plugin-nsinnounp`) | -| **CMake** | 3.31.6 | [x] Build system cross-platform per progetti C/C++ nativi | -| **Node.js LTS** | 22.14.0 | [x] Frontend/Electron pipelines, JS toolchain (npm) | -| **WiX Toolset** | 4.0.5 (dotnet tool) | [x] MSI building da .NET projects | -| **gh CLI** | 2.67.0 | [x] Upload artifact a release Gitea/GitHub, comment PR | -| **Sysinternals** | latest (CDN Microsoft) | [x] Diagnostica process/handle quando build flaky | -| **vcpkg** | HEAD (shallow clone) | [x] Package manager C++ per dipendenze native | +### Tier-2 — Step 12 (implementato) + +| Tool | Versione | Razionale | +| ---------------- | ---------------------- | -------------------------------------------------- | +| **CMake** | 3.31.6 | Build system C/C++ cross-platform | +| **Node.js LTS** | 22.14.0 | Frontend/Electron pipelines, npm toolchain | +| **WiX Toolset** | 4.0.5 (dotnet tool) | MSI building da .NET projects | +| **Sysinternals** | latest (CDN Microsoft) | Diagnostica process/handle quando build flaky | +| **vcpkg** | HEAD (shallow clone) | Package manager C++ per dipendenze native | **Approccio**: - Pinning hash SHA256 per ogni installer (vedi §1.3) diff --git a/template/Setup-WinBuild2025.ps1 b/template/Setup-WinBuild2025.ps1 index 261c58d..7c9c58f 100644 --- a/template/Setup-WinBuild2025.ps1 +++ b/template/Setup-WinBuild2025.ps1 @@ -53,11 +53,11 @@ Validation: MSBuild.exe exists, executes, PATH, VC dir present Step 10 — Toolchain cross-check (dotnet, python, msbuild) Throws on any missing tool - Step 11 — Tier-1 Toolchain (Git for Windows + 7-Zip) — §6.6 - Installs to C:\Program Files (Git default) and C:\Program Files\7-Zip - Validation: git and 7z commands resolvable, executables present - Step 12 — Tier-2 Toolchain (PowerShell 7 LTS, NSIS, CMake, Node.js LTS, - WiX v4, gh CLI, Sysinternals Suite, vcpkg) — §6.6 + Step 11 — Tier-1 Toolchain (Git, 7-Zip, PowerShell 7 LTS, NSIS, gh CLI) — §6.6 + Installs to C:\Program Files\\ and C:\Program Files (x86)\NSIS + Validation: git, 7z, pwsh, makensis, gh commands resolvable + Step 12 — Tier-2 Toolchain (CMake, Node.js LTS, WiX v4, + Sysinternals Suite, vcpkg) — §6.6 Installs to C:\Program Files\\ and C:\BuildTools\\ Validation: each binary resolvable via Get-Command Cleanup — Disk cleanup: cleanmgr, SoftwareDistribution, CBS, TEMP, Prefetch, DISM @@ -77,13 +77,13 @@ WU (Step 6) — all prereqs validated; WU runs with Firewall+Defender already off WU disable (Step 6b) — immediately after WU; snapshot captures WU permanently off Toolchain (7-9) — .NET/Python/VS last; WU done, no scan on installer payloads - Tier-1 (Step 11) — Git + 7-Zip after base toolchain; enables §3.3 in-VM clone - Tier-2 (Step 12) — Pwsh7/NSIS/CMake/Node/WiX/gh/Sysinternals/vcpkg after Tier-1; + Tier-1 (Step 11) — Git + 7-Zip + PS7 + NSIS + gh CLI after base toolchain + Tier-2 (Step 12) — CMake/Node/WiX/Sysinternals/vcpkg after Tier-1; Sysinternals extraction requires 7-Zip; vcpkg clone requires Git - NOTE: Step 11 installs Git for Windows + 7-Zip (Tier-1 Toolchain §6.6). - Step 12 installs PowerShell 7 LTS, NSIS, CMake, Node.js LTS, WiX v4, gh CLI, - Sysinternals Suite, and vcpkg (Tier-2 Toolchain §6.6). + NOTE: Step 11 installs Tier-1 Toolchain §6.6: Git, 7-Zip, PowerShell 7 LTS, NSIS, gh CLI. + Step 12 installs Tier-2 Toolchain §6.6: CMake, Node.js LTS, WiX v4, + Sysinternals Suite, vcpkg. Skippable via -SkipTier2. ╔══════════════════════════════════════════════════════════════════════╗ ║ NETWORK REQUIREMENT DURING SETUP ║ @@ -180,7 +180,7 @@ param( # vcpkg revision: git commit SHA or tag. Default '' = shallow HEAD clone. [string] $VcpkgRef = '', - # Skip Tier-2 Toolchain installation (PowerShell 7, NSIS, CMake, Node.js, WiX, gh CLI, Sysinternals, vcpkg). + # Skip Tier-2 Toolchain installation (CMake, Node.js, WiX, Sysinternals, vcpkg). # Use when rebuilding the template quickly without internet-heavy downloads, or # when only Tier-1 tools are needed for a stripped-down template variant. [switch] $SkipTier2 @@ -1032,11 +1032,11 @@ if (-not $allOk) { } Write-Host "All toolchain checks passed." -ForegroundColor Green -# ── Step 11: Tier-1 Toolchain (Git for Windows + 7-Zip) ────────────────────── -# Critical for §3.3 (In-VM Git clone) and cross-platform build support. -# Installed to C:\BuildTools\\ for clear separation from C:\CI\ (runtime artifacts). +# ── Step 11: Tier-1 Toolchain (Git + 7-Zip + PS7 + NSIS + gh CLI) ───────────── +# Critical for §3.3 (In-VM Git clone), cross-platform build support, and scripting. +# Installed to C:\Program Files\\ (default) and C:\Program Files (x86)\NSIS. -Write-Step "Installing Tier-1 Toolchain (Git + 7-Zip)" +Write-Step "Installing Tier-1 Toolchain (Git / 7-Zip / PS7 / NSIS / gh CLI)" # Build tools root directory $buildToolsRoot = 'C:\BuildTools' @@ -1150,20 +1150,6 @@ Assert-Step '7-Zip' '7z command resolvable' { [bool](Get-Command 7z -ErrorAction SilentlyContinue) } -Write-Host "Tier-1 Toolchain installation complete." -ForegroundColor Green - -# ── Step 12: Tier-2 Toolchain ───────────────────────────────────────────────── -if ($SkipTier2) { - Write-Host "`n[Setup] Skipping Tier-2 Toolchain (-SkipTier2 switch set)." -ForegroundColor Yellow -} -else { -Write-Step "Installing Tier-2 Toolchain (Pwsh7 / NSIS / CMake / Node.js / WiX / gh CLI / Sysinternals / vcpkg)" - -# BuildTools root may already exist from Step 11 (idempotent). -if (-not (Test-Path $buildToolsRoot)) { - New-Item -ItemType Directory -Path $buildToolsRoot -Force | Out-Null -} - # ── PowerShell 7 LTS ───────────────────────────────────────────────────────── $pwsh7Exe = 'C:\Program Files\PowerShell\7\pwsh.exe' if (Test-Path $pwsh7Exe) { @@ -1235,6 +1221,57 @@ $env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + '; Assert-Step 'NSIS' 'makensis.exe present at expected path' { Test-Path $nsisExe -PathType Leaf } Assert-Step 'NSIS' 'makensis command resolvable via PATH' { [bool](Get-Command makensis -ErrorAction SilentlyContinue) } +# ── GitHub CLI (gh) ─────────────────────────────────────────────────────────── +$ghExe = 'C:\Program Files\GitHub CLI\gh.exe' +if (Test-Path $ghExe) { + $ghv = (& $ghExe --version 2>&1 | Select-Object -First 1).ToString() + Write-Host "GitHub CLI already installed: $ghv" +} else { + $ghUrl = "https://github.com/cli/cli/releases/download/v$GhCliVersion/gh_${GhCliVersion}_windows_amd64.msi" + $ghMsi = 'C:\CI\ghcli_installer.msi' + Write-Host "Downloading GitHub CLI $GhCliVersion from GitHub releases..." + try { Invoke-WebRequest -Uri $ghUrl -OutFile $ghMsi -UseBasicParsing } + catch { throw "Failed to download GitHub CLI from '$ghUrl': $_" } + Assert-Hash -FilePath $ghMsi -Label "gh_${GhCliVersion}_windows_amd64.msi" ` + -Expected $script:Hashes['GhCli'] + Write-Host "Installing GitHub CLI $GhCliVersion..." + $proc = Start-Process -FilePath 'msiexec.exe' -ArgumentList @( + '/i', $ghMsi, '/quiet', '/norestart' + ) -Wait -PassThru + Remove-Item $ghMsi -ErrorAction SilentlyContinue + if ($proc -and $proc.ExitCode -notin @(0, 3010)) { + throw "GitHub CLI MSI exited $($proc.ExitCode)." + } + Write-Host "GitHub CLI $GhCliVersion installed." +} +# gh CLI MSI may not update Machine PATH — ensure the install dir is present. +$ghDir = 'C:\Program Files\GitHub CLI' +$machinePath = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') +if ($machinePath -notlike "*$ghDir*") { + [System.Environment]::SetEnvironmentVariable('PATH', "$machinePath;$ghDir", 'Machine') +} +$env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';' + + [System.Environment]::GetEnvironmentVariable('PATH', 'User') +Assert-Step 'GhCli' 'gh.exe present at expected path' { Test-Path $ghExe -PathType Leaf } +Assert-Step 'GhCli' 'gh command resolvable via PATH' { [bool](Get-Command gh -ErrorAction SilentlyContinue) } +Assert-Step 'GhCli' 'gh --version exits 0' { & gh --version 2>&1 | Out-Null; $LASTEXITCODE -eq 0 } + +Write-Host "Tier-1 Toolchain installation complete." -ForegroundColor Green + +# ── Step 12: Tier-2 Toolchain ───────────────────────────────────────────────── +if ($SkipTier2) { + Write-Host "`n[Setup] Skipping Tier-2 Toolchain (-SkipTier2 switch set)." -ForegroundColor Yellow +} +else { +Write-Step "Installing Tier-2 Toolchain (CMake / Node.js / WiX / Sysinternals / vcpkg)" + +# BuildTools root may already exist from Step 11 (idempotent). +if (-not (Test-Path $buildToolsRoot)) { + New-Item -ItemType Directory -Path $buildToolsRoot -Force | Out-Null +} + + + # ── CMake ───────────────────────────────────────────────────────────────────── $cmakeExe = 'C:\Program Files\CMake\bin\cmake.exe' if (Test-Path $cmakeExe) { @@ -1342,41 +1379,6 @@ $env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + '; Assert-Step 'WiX' 'wix.exe present at expected path' { Test-Path $wixExe -PathType Leaf } Assert-Step 'WiX' 'wix command resolvable via PATH' { [bool](Get-Command wix -ErrorAction SilentlyContinue) } -# ── GitHub CLI (gh) ─────────────────────────────────────────────────────────── -$ghExe = 'C:\Program Files\GitHub CLI\gh.exe' -if (Test-Path $ghExe) { - $ghv = (& $ghExe --version 2>&1 | Select-Object -First 1).ToString() - Write-Host "GitHub CLI already installed: $ghv" -} else { - $ghUrl = "https://github.com/cli/cli/releases/download/v$GhCliVersion/gh_${GhCliVersion}_windows_amd64.msi" - $ghMsi = 'C:\CI\ghcli_installer.msi' - Write-Host "Downloading GitHub CLI $GhCliVersion from GitHub releases..." - try { Invoke-WebRequest -Uri $ghUrl -OutFile $ghMsi -UseBasicParsing } - catch { throw "Failed to download GitHub CLI from '$ghUrl': $_" } - Assert-Hash -FilePath $ghMsi -Label "gh_${GhCliVersion}_windows_amd64.msi" ` - -Expected $script:Hashes['GhCli'] - Write-Host "Installing GitHub CLI $GhCliVersion..." - $proc = Start-Process -FilePath 'msiexec.exe' -ArgumentList @( - '/i', $ghMsi, '/quiet', '/norestart' - ) -Wait -PassThru - Remove-Item $ghMsi -ErrorAction SilentlyContinue - if ($proc -and $proc.ExitCode -notin @(0, 3010)) { - throw "GitHub CLI MSI exited $($proc.ExitCode)." - } - Write-Host "GitHub CLI $GhCliVersion installed." -} -# gh CLI MSI may not update Machine PATH — ensure the install dir is present. -$ghDir = 'C:\Program Files\GitHub CLI' -$machinePath = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') -if ($machinePath -notlike "*$ghDir*") { - [System.Environment]::SetEnvironmentVariable('PATH', "$machinePath;$ghDir", 'Machine') -} -$env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';' + - [System.Environment]::GetEnvironmentVariable('PATH', 'User') -Assert-Step 'GhCli' 'gh.exe present at expected path' { Test-Path $ghExe -PathType Leaf } -Assert-Step 'GhCli' 'gh command resolvable via PATH' { [bool](Get-Command gh -ErrorAction SilentlyContinue) } -Assert-Step 'GhCli' 'gh --version exits 0' { & gh --version 2>&1 | Out-Null; $LASTEXITCODE -eq 0 } - # ── Sysinternals Suite ──────────────────────────────────────────────────────── # Downloaded as SysinternalsSuite.zip from Microsoft CDN; extracted via 7-Zip. # 7-Zip ($sevenZipExe) must already be installed (Step 11 Tier-1). @@ -1647,16 +1649,20 @@ Assert-Step 'Final' 'git command available' { Assert-Step 'Final' '7z command available' { [bool](Get-Command 7z -ErrorAction SilentlyContinue) } +Assert-Step 'Final' 'Tier-1 extras all resolvable (pwsh, makensis, gh)' { + $env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';' + + [System.Environment]::GetEnvironmentVariable('PATH', 'User') + (Get-Command pwsh -ErrorAction SilentlyContinue) -and + (Get-Command makensis -ErrorAction SilentlyContinue) -and + (Get-Command gh -ErrorAction SilentlyContinue) +} if (-not $SkipTier2) { - Assert-Step 'Final' 'Tier-2 Toolchain all resolvable (pwsh, makensis, cmake, node, wix, gh, sysinternals, vcpkg)' { + Assert-Step 'Final' 'Tier-2 Toolchain all resolvable (cmake, node, wix, sysinternals, vcpkg)' { $env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';' + [System.Environment]::GetEnvironmentVariable('PATH', 'User') - (Get-Command pwsh -ErrorAction SilentlyContinue) -and - (Get-Command makensis -ErrorAction SilentlyContinue) -and (Get-Command cmake -ErrorAction SilentlyContinue) -and (Get-Command node -ErrorAction SilentlyContinue) -and (Get-Command wix -ErrorAction SilentlyContinue) -and - (Get-Command gh -ErrorAction SilentlyContinue) -and (Test-Path 'C:\BuildTools\Sysinternals\PsExec.exe' -PathType Leaf) -and (Test-Path 'C:\BuildTools\vcpkg\vcpkg.exe' -PathType Leaf) }