refactor(template): promote PS7/NSIS/gh CLI from Tier-2 to Tier-1 (Step 11)

TODO.md

@@ -23,7 +23,7 @@ _Last updated: 2026-05-11 (post Sprint 11: §6.6 Tier-2 Toolchain DONE — Power
 **Stato generale**: §1, §2, §4, §5 chiusi. §3 completo. §6.1 Linux Build VM completato con e2e PASS (nsis7z.dll 2272 KB, parità Windows). §6.6 Tier-1+Tier-2 completati nel template (Step 11+12). Prossimi P2: Test Plan + §6.2-6.5.
 
 | Stato | Area                            | Done | Open | Note                                                                |
-| ----- | ------------------------------- | ---: | ---: | ------------------------------------------------------------------ |
+| ----- | ------------------------------- | ---: | ---: | ------------------------------------------------------------------- |
 | [x]   | Setup & Infrastructure          |    8 |    0 | Gitea + runner + dirs + rete tutti operativi                        |
 | [x]   | Template VM (Fasi A→D)          |    4 |    0 | Snapshot `BaseClean` preso, credenziali in Credential Manager       |
 | [x]   | Scripts Verification            |    3 |    0 | e2e-008/009 SUCCESS, cleanup orfani + retry deleteVM ok             |
@@ -510,24 +510,25 @@ File: [template/Setup-WinBuild2025.ps1](template/Setup-WinBuild2025.ps1),
 Aggiungere tools generici-CI riduce il bisogno di installazione ad-hoc nei workflow e abilita
 build più ampi senza toccare il template.
 
-### Tier-1 (implementato)
+### Tier-1 — Step 11 (implementato)
-- [x] **Git for Windows** (v2.54.0.windows.1) — Step 11, self-clone in VM
-- [x] **7-Zip** (26.01) — Step 11, universal compression + fallback §3.2
-
-### Tier-2 (implementato — Step 12)
 
 | Tool                | Versione         | Razionale                                              |
-| ------------------- | ----------------------- | ------------------------------------------------------------------ |
+| ------------------- | ---------------- | ------------------------------------------------------ |
-| **Git for Windows** | 2.54.0.windows.1        | [x] Self-clone in VM (alt a host-zip-transfer), submodule fetch    |
+| **Git for Windows** | 2.54.0.windows.1 | Self-clone in VM, submodule fetch, fallback §3.2       |
-| **7-Zip**           | 26.01                   | [x] Universale unpack/zip; molti installer e workflow ne dipendono |
+| **7-Zip**           | 26.01            | Unpack/zip universale; usato da Step 12 stesso (vcpkg) |
-| **PowerShell 7.x**  | 7.4.7 (LTS)             | [x] Più veloce di 5.1, parallel pipelines, operatori moderni       |
+| **PowerShell 7.x**  | 7.4.7 (LTS)      | Parallel pipelines, operatori moderni, pwsh in CI      |
-| **NSIS**            | 3.10                    | [x] Test build installer (es. `nsis-plugin-nsinnounp`)             |
+| **NSIS**            | 3.10             | Build installer Windows (es. `nsis-plugin-nsinnounp`)  |
-| **CMake**           | 3.31.6                  | [x] Build system cross-platform per progetti C/C++ nativi          |
+| **gh CLI**          | 2.67.0           | Upload artifact a release Gitea/GitHub, comment PR     |
-| **Node.js LTS**     | 22.14.0                 | [x] Frontend/Electron pipelines, JS toolchain (npm)                |
+
-| **WiX Toolset**     | 4.0.5 (dotnet tool)     | [x] MSI building da .NET projects                                  |
+### Tier-2 — Step 12 (implementato)
-| **gh CLI**          | 2.67.0                  | [x] Upload artifact a release Gitea/GitHub, comment PR             |
+
-| **Sysinternals**    | latest (CDN Microsoft)  | [x] Diagnostica process/handle quando build flaky                  |
+| Tool             | Versione               | Razionale                                          |
-| **vcpkg**           | HEAD (shallow clone)    | [x] Package manager C++ per dipendenze native                      |
+| ---------------- | ---------------------- | -------------------------------------------------- |
+| **CMake**        | 3.31.6                 | Build system C/C++ cross-platform                  |
+| **Node.js LTS**  | 22.14.0                | Frontend/Electron pipelines, npm toolchain         |
+| **WiX Toolset**  | 4.0.5 (dotnet tool)    | MSI building da .NET projects                      |
+| **Sysinternals** | latest (CDN Microsoft) | Diagnostica process/handle quando build flaky      |
+| **vcpkg**        | HEAD (shallow clone)   | Package manager C++ per dipendenze native          |
 
 **Approccio**:
 - Pinning hash SHA256 per ogni installer (vedi §1.3)

template/Setup-WinBuild2025.ps1

@@ -53,11 +53,11 @@
                 Validation: MSBuild.exe exists, executes, PATH, VC dir present
       Step 10 — Toolchain cross-check (dotnet, python, msbuild)
                 Throws on any missing tool
-      Step 11 — Tier-1 Toolchain (Git for Windows + 7-Zip) — §6.6
+      Step 11 — Tier-1 Toolchain (Git, 7-Zip, PowerShell 7 LTS, NSIS, gh CLI) — §6.6
-                Installs to C:\Program Files (Git default) and C:\Program Files\7-Zip
+                Installs to C:\Program Files\<tool>\ and C:\Program Files (x86)\NSIS
-                Validation: git and 7z commands resolvable, executables present
+                Validation: git, 7z, pwsh, makensis, gh commands resolvable
-      Step 12 — Tier-2 Toolchain (PowerShell 7 LTS, NSIS, CMake, Node.js LTS,
+      Step 12 — Tier-2 Toolchain (CMake, Node.js LTS, WiX v4,
-                WiX v4, gh CLI, Sysinternals Suite, vcpkg) — §6.6
+                Sysinternals Suite, vcpkg) — §6.6
                 Installs to C:\Program Files\<tool>\ and C:\BuildTools\<tool>\
                 Validation: each binary resolvable via Get-Command
       Cleanup — Disk cleanup: cleanmgr, SoftwareDistribution, CBS, TEMP, Prefetch, DISM
@@ -77,13 +77,13 @@
       WU (Step 6)        — all prereqs validated; WU runs with Firewall+Defender already off
       WU disable (Step 6b) — immediately after WU; snapshot captures WU permanently off
       Toolchain (7-9)    — .NET/Python/VS last; WU done, no scan on installer payloads
-      Tier-1 (Step 11)   — Git + 7-Zip after base toolchain; enables §3.3 in-VM clone
+      Tier-1 (Step 11)   — Git + 7-Zip + PS7 + NSIS + gh CLI after base toolchain
-      Tier-2 (Step 12)   — Pwsh7/NSIS/CMake/Node/WiX/gh/Sysinternals/vcpkg after Tier-1;
+      Tier-2 (Step 12)   — CMake/Node/WiX/Sysinternals/vcpkg after Tier-1;
                            Sysinternals extraction requires 7-Zip; vcpkg clone requires Git
 
-    NOTE: Step 11 installs Git for Windows + 7-Zip (Tier-1 Toolchain §6.6).
+    NOTE: Step 11 installs Tier-1 Toolchain §6.6: Git, 7-Zip, PowerShell 7 LTS, NSIS, gh CLI.
-    Step 12 installs PowerShell 7 LTS, NSIS, CMake, Node.js LTS, WiX v4, gh CLI,
+    Step 12 installs Tier-2 Toolchain §6.6: CMake, Node.js LTS, WiX v4,
-    Sysinternals Suite, and vcpkg (Tier-2 Toolchain §6.6).
+    Sysinternals Suite, vcpkg. Skippable via -SkipTier2.
 
     ╔══════════════════════════════════════════════════════════════════════╗
     ║  NETWORK REQUIREMENT DURING SETUP                                    ║
@@ -180,7 +180,7 @@ param(
     # vcpkg revision: git commit SHA or tag. Default '' = shallow HEAD clone.
     [string] $VcpkgRef = '',
 
-    # Skip Tier-2 Toolchain installation (PowerShell 7, NSIS, CMake, Node.js, WiX, gh CLI, Sysinternals, vcpkg).
+    # Skip Tier-2 Toolchain installation (CMake, Node.js, WiX, Sysinternals, vcpkg).
     # Use when rebuilding the template quickly without internet-heavy downloads, or
     # when only Tier-1 tools are needed for a stripped-down template variant.
     [switch] $SkipTier2
@@ -1032,11 +1032,11 @@ if (-not $allOk) {
 }
 Write-Host "All toolchain checks passed." -ForegroundColor Green
 
-# ── Step 11: Tier-1 Toolchain (Git for Windows + 7-Zip) ──────────────────────
+# ── Step 11: Tier-1 Toolchain (Git + 7-Zip + PS7 + NSIS + gh CLI) ─────────────
-# Critical for §3.3 (In-VM Git clone) and cross-platform build support.
+# Critical for §3.3 (In-VM Git clone), cross-platform build support, and scripting.
-# Installed to C:\BuildTools\<tool>\ for clear separation from C:\CI\ (runtime artifacts).
+# Installed to C:\Program Files\<tool>\ (default) and C:\Program Files (x86)\NSIS.
 
-Write-Step "Installing Tier-1 Toolchain (Git + 7-Zip)"
+Write-Step "Installing Tier-1 Toolchain (Git / 7-Zip / PS7 / NSIS / gh CLI)"
 
 # Build tools root directory
 $buildToolsRoot = 'C:\BuildTools'
@@ -1150,20 +1150,6 @@ Assert-Step '7-Zip' '7z command resolvable' {
     [bool](Get-Command 7z -ErrorAction SilentlyContinue)
 }
 
-Write-Host "Tier-1 Toolchain installation complete." -ForegroundColor Green
-
-# ── Step 12: Tier-2 Toolchain ─────────────────────────────────────────────────
-if ($SkipTier2) {
-    Write-Host "`n[Setup] Skipping Tier-2 Toolchain (-SkipTier2 switch set)." -ForegroundColor Yellow
-}
-else {
-Write-Step "Installing Tier-2 Toolchain (Pwsh7 / NSIS / CMake / Node.js / WiX / gh CLI / Sysinternals / vcpkg)"
-
-# BuildTools root may already exist from Step 11 (idempotent).
-if (-not (Test-Path $buildToolsRoot)) {
-    New-Item -ItemType Directory -Path $buildToolsRoot -Force | Out-Null
-}
-
 # ── PowerShell 7 LTS ─────────────────────────────────────────────────────────
 $pwsh7Exe = 'C:\Program Files\PowerShell\7\pwsh.exe'
 if (Test-Path $pwsh7Exe) {
@@ -1235,6 +1221,57 @@ $env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';
 Assert-Step 'NSIS' 'makensis.exe present at expected path' { Test-Path $nsisExe -PathType Leaf }
 Assert-Step 'NSIS' 'makensis command resolvable via PATH' { [bool](Get-Command makensis -ErrorAction SilentlyContinue) }
 
+# ── GitHub CLI (gh) ───────────────────────────────────────────────────────────
+$ghExe = 'C:\Program Files\GitHub CLI\gh.exe'
+if (Test-Path $ghExe) {
+    $ghv = (& $ghExe --version 2>&1 | Select-Object -First 1).ToString()
+    Write-Host "GitHub CLI already installed: $ghv"
+} else {
+    $ghUrl = "https://github.com/cli/cli/releases/download/v$GhCliVersion/gh_${GhCliVersion}_windows_amd64.msi"
+    $ghMsi = 'C:\CI\ghcli_installer.msi'
+    Write-Host "Downloading GitHub CLI $GhCliVersion from GitHub releases..."
+    try { Invoke-WebRequest -Uri $ghUrl -OutFile $ghMsi -UseBasicParsing }
+    catch { throw "Failed to download GitHub CLI from '$ghUrl': $_" }
+    Assert-Hash -FilePath $ghMsi -Label "gh_${GhCliVersion}_windows_amd64.msi" `
+                -Expected $script:Hashes['GhCli']
+    Write-Host "Installing GitHub CLI $GhCliVersion..."
+    $proc = Start-Process -FilePath 'msiexec.exe' -ArgumentList @(
+        '/i', $ghMsi, '/quiet', '/norestart'
+    ) -Wait -PassThru
+    Remove-Item $ghMsi -ErrorAction SilentlyContinue
+    if ($proc -and $proc.ExitCode -notin @(0, 3010)) {
+        throw "GitHub CLI MSI exited $($proc.ExitCode)."
+    }
+    Write-Host "GitHub CLI $GhCliVersion installed."
+}
+# gh CLI MSI may not update Machine PATH — ensure the install dir is present.
+$ghDir = 'C:\Program Files\GitHub CLI'
+$machinePath = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine')
+if ($machinePath -notlike "*$ghDir*") {
+    [System.Environment]::SetEnvironmentVariable('PATH', "$machinePath;$ghDir", 'Machine')
+}
+$env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';' +
+            [System.Environment]::GetEnvironmentVariable('PATH', 'User')
+Assert-Step 'GhCli' 'gh.exe present at expected path'  { Test-Path $ghExe -PathType Leaf }
+Assert-Step 'GhCli' 'gh command resolvable via PATH'   { [bool](Get-Command gh -ErrorAction SilentlyContinue) }
+Assert-Step 'GhCli' 'gh --version exits 0'             { & gh --version 2>&1 | Out-Null; $LASTEXITCODE -eq 0 }
+
+Write-Host "Tier-1 Toolchain installation complete." -ForegroundColor Green
+
+# ── Step 12: Tier-2 Toolchain ─────────────────────────────────────────────────
+if ($SkipTier2) {
+    Write-Host "`n[Setup] Skipping Tier-2 Toolchain (-SkipTier2 switch set)." -ForegroundColor Yellow
+}
+else {
+Write-Step "Installing Tier-2 Toolchain (CMake / Node.js / WiX / Sysinternals / vcpkg)"
+
+# BuildTools root may already exist from Step 11 (idempotent).
+if (-not (Test-Path $buildToolsRoot)) {
+    New-Item -ItemType Directory -Path $buildToolsRoot -Force | Out-Null
+}
+
+
+
 # ── CMake ─────────────────────────────────────────────────────────────────────
 $cmakeExe = 'C:\Program Files\CMake\bin\cmake.exe'
 if (Test-Path $cmakeExe) {
@@ -1342,41 +1379,6 @@ $env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';
 Assert-Step 'WiX' 'wix.exe present at expected path' { Test-Path $wixExe -PathType Leaf }
 Assert-Step 'WiX' 'wix command resolvable via PATH'  { [bool](Get-Command wix -ErrorAction SilentlyContinue) }
 
-# ── GitHub CLI (gh) ───────────────────────────────────────────────────────────
-$ghExe = 'C:\Program Files\GitHub CLI\gh.exe'
-if (Test-Path $ghExe) {
-    $ghv = (& $ghExe --version 2>&1 | Select-Object -First 1).ToString()
-    Write-Host "GitHub CLI already installed: $ghv"
-} else {
-    $ghUrl = "https://github.com/cli/cli/releases/download/v$GhCliVersion/gh_${GhCliVersion}_windows_amd64.msi"
-    $ghMsi = 'C:\CI\ghcli_installer.msi'
-    Write-Host "Downloading GitHub CLI $GhCliVersion from GitHub releases..."
-    try { Invoke-WebRequest -Uri $ghUrl -OutFile $ghMsi -UseBasicParsing }
-    catch { throw "Failed to download GitHub CLI from '$ghUrl': $_" }
-    Assert-Hash -FilePath $ghMsi -Label "gh_${GhCliVersion}_windows_amd64.msi" `
-                -Expected $script:Hashes['GhCli']
-    Write-Host "Installing GitHub CLI $GhCliVersion..."
-    $proc = Start-Process -FilePath 'msiexec.exe' -ArgumentList @(
-        '/i', $ghMsi, '/quiet', '/norestart'
-    ) -Wait -PassThru
-    Remove-Item $ghMsi -ErrorAction SilentlyContinue
-    if ($proc -and $proc.ExitCode -notin @(0, 3010)) {
-        throw "GitHub CLI MSI exited $($proc.ExitCode)."
-    }
-    Write-Host "GitHub CLI $GhCliVersion installed."
-}
-# gh CLI MSI may not update Machine PATH — ensure the install dir is present.
-$ghDir = 'C:\Program Files\GitHub CLI'
-$machinePath = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine')
-if ($machinePath -notlike "*$ghDir*") {
-    [System.Environment]::SetEnvironmentVariable('PATH', "$machinePath;$ghDir", 'Machine')
-}
-$env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';' +
-            [System.Environment]::GetEnvironmentVariable('PATH', 'User')
-Assert-Step 'GhCli' 'gh.exe present at expected path'  { Test-Path $ghExe -PathType Leaf }
-Assert-Step 'GhCli' 'gh command resolvable via PATH'   { [bool](Get-Command gh -ErrorAction SilentlyContinue) }
-Assert-Step 'GhCli' 'gh --version exits 0'             { & gh --version 2>&1 | Out-Null; $LASTEXITCODE -eq 0 }
-
 # ── Sysinternals Suite ────────────────────────────────────────────────────────
 # Downloaded as SysinternalsSuite.zip from Microsoft CDN; extracted via 7-Zip.
 # 7-Zip ($sevenZipExe) must already be installed (Step 11 Tier-1).
@@ -1647,16 +1649,20 @@ Assert-Step 'Final' 'git command available' {
 Assert-Step 'Final' '7z command available' {
     [bool](Get-Command 7z -ErrorAction SilentlyContinue)
 }
-if (-not $SkipTier2) {
+Assert-Step 'Final' 'Tier-1 extras all resolvable (pwsh, makensis, gh)' {
-    Assert-Step 'Final' 'Tier-2 Toolchain all resolvable (pwsh, makensis, cmake, node, wix, gh, sysinternals, vcpkg)' {
     $env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';' +
                 [System.Environment]::GetEnvironmentVariable('PATH', 'User')
     (Get-Command pwsh     -ErrorAction SilentlyContinue) -and
     (Get-Command makensis -ErrorAction SilentlyContinue) -and
+    (Get-Command gh       -ErrorAction SilentlyContinue)
+}
+if (-not $SkipTier2) {
+    Assert-Step 'Final' 'Tier-2 Toolchain all resolvable (cmake, node, wix, sysinternals, vcpkg)' {
+        $env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';' +
+                    [System.Environment]::GetEnvironmentVariable('PATH', 'User')
         (Get-Command cmake    -ErrorAction SilentlyContinue) -and
         (Get-Command node     -ErrorAction SilentlyContinue) -and
         (Get-Command wix      -ErrorAction SilentlyContinue) -and
-        (Get-Command gh       -ErrorAction SilentlyContinue) -and
         (Test-Path 'C:\BuildTools\Sysinternals\PsExec.exe' -PathType Leaf) -and
         (Test-Path 'C:\BuildTools\vcpkg\vcpkg.exe'         -PathType Leaf)
     }