refactor(template): promote PS7/NSIS/gh CLI from Tier-2 to Tier-1 (Step 11)

This commit is contained in:
Simone
2026-05-11 20:26:06 +02:00
parent 1bf7c2347b
commit 5c1a197559
2 changed files with 106 additions and 99 deletions
+74 -68
View File
@@ -53,11 +53,11 @@
Validation: MSBuild.exe exists, executes, PATH, VC dir present
Step 10 — Toolchain cross-check (dotnet, python, msbuild)
Throws on any missing tool
Step 11 — Tier-1 Toolchain (Git for Windows + 7-Zip) — §6.6
Installs to C:\Program Files (Git default) and C:\Program Files\7-Zip
Validation: git and 7z commands resolvable, executables present
Step 12 — Tier-2 Toolchain (PowerShell 7 LTS, NSIS, CMake, Node.js LTS,
WiX v4, gh CLI, Sysinternals Suite, vcpkg) — §6.6
Step 11 — Tier-1 Toolchain (Git, 7-Zip, PowerShell 7 LTS, NSIS, gh CLI) — §6.6
Installs to C:\Program Files\<tool>\ and C:\Program Files (x86)\NSIS
Validation: git, 7z, pwsh, makensis, gh commands resolvable
Step 12 — Tier-2 Toolchain (CMake, Node.js LTS, WiX v4,
Sysinternals Suite, vcpkg) — §6.6
Installs to C:\Program Files\<tool>\ and C:\BuildTools\<tool>\
Validation: each binary resolvable via Get-Command
Cleanup — Disk cleanup: cleanmgr, SoftwareDistribution, CBS, TEMP, Prefetch, DISM
@@ -77,13 +77,13 @@
WU (Step 6) — all prereqs validated; WU runs with Firewall+Defender already off
WU disable (Step 6b) — immediately after WU; snapshot captures WU permanently off
Toolchain (7-9) — .NET/Python/VS last; WU done, no scan on installer payloads
Tier-1 (Step 11) — Git + 7-Zip after base toolchain; enables §3.3 in-VM clone
Tier-2 (Step 12) — Pwsh7/NSIS/CMake/Node/WiX/gh/Sysinternals/vcpkg after Tier-1;
Tier-1 (Step 11) — Git + 7-Zip + PS7 + NSIS + gh CLI after base toolchain
Tier-2 (Step 12) — CMake/Node/WiX/Sysinternals/vcpkg after Tier-1;
Sysinternals extraction requires 7-Zip; vcpkg clone requires Git
NOTE: Step 11 installs Git for Windows + 7-Zip (Tier-1 Toolchain §6.6).
Step 12 installs PowerShell 7 LTS, NSIS, CMake, Node.js LTS, WiX v4, gh CLI,
Sysinternals Suite, and vcpkg (Tier-2 Toolchain §6.6).
NOTE: Step 11 installs Tier-1 Toolchain §6.6: Git, 7-Zip, PowerShell 7 LTS, NSIS, gh CLI.
Step 12 installs Tier-2 Toolchain §6.6: CMake, Node.js LTS, WiX v4,
Sysinternals Suite, vcpkg. Skippable via -SkipTier2.
╔══════════════════════════════════════════════════════════════════════╗
║ NETWORK REQUIREMENT DURING SETUP ║
@@ -180,7 +180,7 @@ param(
# vcpkg revision: git commit SHA or tag. Default '' = shallow HEAD clone.
[string] $VcpkgRef = '',
# Skip Tier-2 Toolchain installation (PowerShell 7, NSIS, CMake, Node.js, WiX, gh CLI, Sysinternals, vcpkg).
# Skip Tier-2 Toolchain installation (CMake, Node.js, WiX, Sysinternals, vcpkg).
# Use when rebuilding the template quickly without internet-heavy downloads, or
# when only Tier-1 tools are needed for a stripped-down template variant.
[switch] $SkipTier2
@@ -1032,11 +1032,11 @@ if (-not $allOk) {
}
Write-Host "All toolchain checks passed." -ForegroundColor Green
# ── Step 11: Tier-1 Toolchain (Git for Windows + 7-Zip) ──────────────────────
# Critical for §3.3 (In-VM Git clone) and cross-platform build support.
# Installed to C:\BuildTools\<tool>\ for clear separation from C:\CI\ (runtime artifacts).
# ── Step 11: Tier-1 Toolchain (Git + 7-Zip + PS7 + NSIS + gh CLI) ─────────────
# Critical for §3.3 (In-VM Git clone), cross-platform build support, and scripting.
# Installed to C:\Program Files\<tool>\ (default) and C:\Program Files (x86)\NSIS.
Write-Step "Installing Tier-1 Toolchain (Git + 7-Zip)"
Write-Step "Installing Tier-1 Toolchain (Git / 7-Zip / PS7 / NSIS / gh CLI)"
# Build tools root directory
$buildToolsRoot = 'C:\BuildTools'
@@ -1150,20 +1150,6 @@ Assert-Step '7-Zip' '7z command resolvable' {
[bool](Get-Command 7z -ErrorAction SilentlyContinue)
}
Write-Host "Tier-1 Toolchain installation complete." -ForegroundColor Green
# ── Step 12: Tier-2 Toolchain ─────────────────────────────────────────────────
if ($SkipTier2) {
Write-Host "`n[Setup] Skipping Tier-2 Toolchain (-SkipTier2 switch set)." -ForegroundColor Yellow
}
else {
Write-Step "Installing Tier-2 Toolchain (Pwsh7 / NSIS / CMake / Node.js / WiX / gh CLI / Sysinternals / vcpkg)"
# BuildTools root may already exist from Step 11 (idempotent).
if (-not (Test-Path $buildToolsRoot)) {
New-Item -ItemType Directory -Path $buildToolsRoot -Force | Out-Null
}
# ── PowerShell 7 LTS ─────────────────────────────────────────────────────────
$pwsh7Exe = 'C:\Program Files\PowerShell\7\pwsh.exe'
if (Test-Path $pwsh7Exe) {
@@ -1235,6 +1221,57 @@ $env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';
Assert-Step 'NSIS' 'makensis.exe present at expected path' { Test-Path $nsisExe -PathType Leaf }
Assert-Step 'NSIS' 'makensis command resolvable via PATH' { [bool](Get-Command makensis -ErrorAction SilentlyContinue) }
# ── GitHub CLI (gh) ───────────────────────────────────────────────────────────
$ghExe = 'C:\Program Files\GitHub CLI\gh.exe'
if (Test-Path $ghExe) {
$ghv = (& $ghExe --version 2>&1 | Select-Object -First 1).ToString()
Write-Host "GitHub CLI already installed: $ghv"
} else {
$ghUrl = "https://github.com/cli/cli/releases/download/v$GhCliVersion/gh_${GhCliVersion}_windows_amd64.msi"
$ghMsi = 'C:\CI\ghcli_installer.msi'
Write-Host "Downloading GitHub CLI $GhCliVersion from GitHub releases..."
try { Invoke-WebRequest -Uri $ghUrl -OutFile $ghMsi -UseBasicParsing }
catch { throw "Failed to download GitHub CLI from '$ghUrl': $_" }
Assert-Hash -FilePath $ghMsi -Label "gh_${GhCliVersion}_windows_amd64.msi" `
-Expected $script:Hashes['GhCli']
Write-Host "Installing GitHub CLI $GhCliVersion..."
$proc = Start-Process -FilePath 'msiexec.exe' -ArgumentList @(
'/i', $ghMsi, '/quiet', '/norestart'
) -Wait -PassThru
Remove-Item $ghMsi -ErrorAction SilentlyContinue
if ($proc -and $proc.ExitCode -notin @(0, 3010)) {
throw "GitHub CLI MSI exited $($proc.ExitCode)."
}
Write-Host "GitHub CLI $GhCliVersion installed."
}
# gh CLI MSI may not update Machine PATH — ensure the install dir is present.
$ghDir = 'C:\Program Files\GitHub CLI'
$machinePath = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine')
if ($machinePath -notlike "*$ghDir*") {
[System.Environment]::SetEnvironmentVariable('PATH', "$machinePath;$ghDir", 'Machine')
}
$env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';' +
[System.Environment]::GetEnvironmentVariable('PATH', 'User')
Assert-Step 'GhCli' 'gh.exe present at expected path' { Test-Path $ghExe -PathType Leaf }
Assert-Step 'GhCli' 'gh command resolvable via PATH' { [bool](Get-Command gh -ErrorAction SilentlyContinue) }
Assert-Step 'GhCli' 'gh --version exits 0' { & gh --version 2>&1 | Out-Null; $LASTEXITCODE -eq 0 }
Write-Host "Tier-1 Toolchain installation complete." -ForegroundColor Green
# ── Step 12: Tier-2 Toolchain ─────────────────────────────────────────────────
if ($SkipTier2) {
Write-Host "`n[Setup] Skipping Tier-2 Toolchain (-SkipTier2 switch set)." -ForegroundColor Yellow
}
else {
Write-Step "Installing Tier-2 Toolchain (CMake / Node.js / WiX / Sysinternals / vcpkg)"
# BuildTools root may already exist from Step 11 (idempotent).
if (-not (Test-Path $buildToolsRoot)) {
New-Item -ItemType Directory -Path $buildToolsRoot -Force | Out-Null
}
# ── CMake ─────────────────────────────────────────────────────────────────────
$cmakeExe = 'C:\Program Files\CMake\bin\cmake.exe'
if (Test-Path $cmakeExe) {
@@ -1342,41 +1379,6 @@ $env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';
Assert-Step 'WiX' 'wix.exe present at expected path' { Test-Path $wixExe -PathType Leaf }
Assert-Step 'WiX' 'wix command resolvable via PATH' { [bool](Get-Command wix -ErrorAction SilentlyContinue) }
# ── GitHub CLI (gh) ───────────────────────────────────────────────────────────
$ghExe = 'C:\Program Files\GitHub CLI\gh.exe'
if (Test-Path $ghExe) {
$ghv = (& $ghExe --version 2>&1 | Select-Object -First 1).ToString()
Write-Host "GitHub CLI already installed: $ghv"
} else {
$ghUrl = "https://github.com/cli/cli/releases/download/v$GhCliVersion/gh_${GhCliVersion}_windows_amd64.msi"
$ghMsi = 'C:\CI\ghcli_installer.msi'
Write-Host "Downloading GitHub CLI $GhCliVersion from GitHub releases..."
try { Invoke-WebRequest -Uri $ghUrl -OutFile $ghMsi -UseBasicParsing }
catch { throw "Failed to download GitHub CLI from '$ghUrl': $_" }
Assert-Hash -FilePath $ghMsi -Label "gh_${GhCliVersion}_windows_amd64.msi" `
-Expected $script:Hashes['GhCli']
Write-Host "Installing GitHub CLI $GhCliVersion..."
$proc = Start-Process -FilePath 'msiexec.exe' -ArgumentList @(
'/i', $ghMsi, '/quiet', '/norestart'
) -Wait -PassThru
Remove-Item $ghMsi -ErrorAction SilentlyContinue
if ($proc -and $proc.ExitCode -notin @(0, 3010)) {
throw "GitHub CLI MSI exited $($proc.ExitCode)."
}
Write-Host "GitHub CLI $GhCliVersion installed."
}
# gh CLI MSI may not update Machine PATH — ensure the install dir is present.
$ghDir = 'C:\Program Files\GitHub CLI'
$machinePath = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine')
if ($machinePath -notlike "*$ghDir*") {
[System.Environment]::SetEnvironmentVariable('PATH', "$machinePath;$ghDir", 'Machine')
}
$env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';' +
[System.Environment]::GetEnvironmentVariable('PATH', 'User')
Assert-Step 'GhCli' 'gh.exe present at expected path' { Test-Path $ghExe -PathType Leaf }
Assert-Step 'GhCli' 'gh command resolvable via PATH' { [bool](Get-Command gh -ErrorAction SilentlyContinue) }
Assert-Step 'GhCli' 'gh --version exits 0' { & gh --version 2>&1 | Out-Null; $LASTEXITCODE -eq 0 }
# ── Sysinternals Suite ────────────────────────────────────────────────────────
# Downloaded as SysinternalsSuite.zip from Microsoft CDN; extracted via 7-Zip.
# 7-Zip ($sevenZipExe) must already be installed (Step 11 Tier-1).
@@ -1647,16 +1649,20 @@ Assert-Step 'Final' 'git command available' {
Assert-Step 'Final' '7z command available' {
[bool](Get-Command 7z -ErrorAction SilentlyContinue)
}
Assert-Step 'Final' 'Tier-1 extras all resolvable (pwsh, makensis, gh)' {
$env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';' +
[System.Environment]::GetEnvironmentVariable('PATH', 'User')
(Get-Command pwsh -ErrorAction SilentlyContinue) -and
(Get-Command makensis -ErrorAction SilentlyContinue) -and
(Get-Command gh -ErrorAction SilentlyContinue)
}
if (-not $SkipTier2) {
Assert-Step 'Final' 'Tier-2 Toolchain all resolvable (pwsh, makensis, cmake, node, wix, gh, sysinternals, vcpkg)' {
Assert-Step 'Final' 'Tier-2 Toolchain all resolvable (cmake, node, wix, sysinternals, vcpkg)' {
$env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';' +
[System.Environment]::GetEnvironmentVariable('PATH', 'User')
(Get-Command pwsh -ErrorAction SilentlyContinue) -and
(Get-Command makensis -ErrorAction SilentlyContinue) -and
(Get-Command cmake -ErrorAction SilentlyContinue) -and
(Get-Command node -ErrorAction SilentlyContinue) -and
(Get-Command wix -ErrorAction SilentlyContinue) -and
(Get-Command gh -ErrorAction SilentlyContinue) -and
(Test-Path 'C:\BuildTools\Sysinternals\PsExec.exe' -PathType Leaf) -and
(Test-Path 'C:\BuildTools\vcpkg\vcpkg.exe' -PathType Leaf)
}