Simone/local-ci-cd-system
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Sprint 13-14: §6.2 composite action + §6.4 build matrix + §6.5 secret injection

Browse Source 
§6.2 - New composite action gitea/actions/local-ci-build/action.yml
  Wraps Invoke-CIJob.ps1 for reuse across repos. Inputs: build-command,
  artifact-source, submodules, guest-os, use-git-clone, configuration,
  template-path, snapshot-name, artifact-name, artifact-retention-days.
  Anti-injection: all params via INPUT_* env vars, never interpolated in shell.

§6.4 - Build matrix windows+linux in build-nsis.yml
  gitea/workflows/build-nsis.yml rewritten with strategy.matrix target:
  [windows, linux], fail-fast: false, routes to {target}-build runner.
  Added action inputs: job-id-suffix (matrix disambig for artifact dirs),
  repo-url (SSH URL override for gitea-ci alias).

§6.5 - ExtraGuestEnv secret injection chain
  New param -ExtraGuestEnv [hashtable] in Invoke-CIJob.ps1 and
  Invoke-RemoteBuild.ps1. Windows: SetEnvironmentVariable in WinRM session
  ScriptBlock before build command. Linux: export KEY='val'; prefix before
  cd && buildcmd (POSIX single-quote escaping). Composite action input
  extra-guest-env-json (JSON object -> ConvertFrom-Json -> hashtable),
  never logged.

PSScriptAnalyzer fixes: _Common.psm1, Invoke-RetentionPolicy.ps1,
  Watch-RunnerHealth.ps1 (empty catch, ShouldProcess suppression, etc.)

Docs/test: TEST-PLAN-v1.3-to-HEAD.md updated §3.3/§6.1/§5.4 status.
  TODO.md: §6 fully closed (6.1-6.2 done, 6.3 deferred, 6.4-6.5 done, 6.6 done).
This commit is contained in:
Simone
2026-05-11 22:35:36 +02:00
parent 0f14caad63
commit 7d12dedddd
10 changed files with 431 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files
TODO.md
+79 -52
View File
@@ -1,6 +1,9 @@
# TODO — Local CI/CD System
<!-- Last updated: 2026-05-11 — Sprint 11: §6.6 Tier-2 Toolchain DONE (Pwsh7/NSIS/CMake/Node.js/WiX/gh CLI/Sysinternals/vcpkg — Step 12 in Setup-WinBuild2025) -->
<!-- Last updated: 2026-05-11 — Sprint 14: §6.4+§6.5 DONE (build-nsis.yml matrix windows+linux via composite action; ExtraGuestEnv chain Invoke-CIJob→Invoke-RemoteBuild, Windows session inject + Linux export prefix) -->
<!-- Sprint 13: §6.2 Composite Action DONE (gitea/actions/local-ci-build/action.yml — inputs: build-command/artifact-source/submodules/guest-os/use-git-clone) -->
<!-- Sprint 12: §6.1 Linux Build VM DONE (Deploy/Prepare/Setup/Transport/e2e 4xPASS — nsis7z.dll 2272 KB parity Windows) -->
<!-- Sprint 11: §6.6 Tier-2 Toolchain DONE (Pwsh7/NSIS/CMake/Node.js/WiX/gh CLI/Sysinternals/vcpkg — Step 12 in Setup-WinBuild2025) -->
> Documento unico di lavoro: roadmap, audit trail dei task completati, e backlog post-v1.0
> con priorità e razionale. Le voci aperte sono raggruppate per area e marcate **P0..P3**:
@@ -18,32 +21,32 @@
---
## Summary
_Last updated: 2026-05-11 (post Sprint 11: §6.6 Tier-2 Toolchain DONE — PowerShell 7.6.1, NSIS 3.12, CMake 3.31.6, Node.js 22.14.0, WiX 4.0.5, gh CLI 2.92.0, Sysinternals, vcpkg — Step 12 in Setup-WinBuild2025.ps1)_
_Last updated: 2026-05-11 (post Sprint 14: §6.4+§6.5 DONE — build-nsis.yml matrix windows+linux, ExtraGuestEnv chain in Invoke-CIJob/Invoke-RemoteBuild, job-id-suffix/repo-url/extra-guest-env-json inputs in action.yml; post Sprint 13: §6.2 DONE)_
**Stato generale**: §1, §2, §4, §5 chiusi. §3 completo. §6.1 Linux Build VM completato con e2e PASS (nsis7z.dll 2272 KB, parità Windows). §6.6 Tier-1+Tier-2 completati nel template (Step 11+12). Prossimi P2: Test Plan + §6.2-6.5.
**Stato generale**: §1, §2, §4, §5 chiusi. §3 completo. §6 quasi chiuso: 6.1-6.2 DONE, 6.3 deferred, 6.4+6.5 DONE, 6.6 DONE. Prossimi: Test Plan validation con VM reali + §7.5 (optional).
| Stato | Area | Done | Open | Note |
| ----- | ------------------------------- | ---: | ---: | ------------------------------------------------------------------- |
| [x] | Setup & Infrastructure | 8 | 0 | Gitea + runner + dirs + rete tutti operativi |
| [x] | Template VM (Fasi A→D) | 4 | 0 | Snapshot `BaseClean` preso, credenziali in Credential Manager |
| [x] | Scripts Verification | 3 | 0 | e2e-008/009 SUCCESS, cleanup orfani + retry deleteVM ok |
| [x] | Runner Configuration | 2 | 0 | `config.yaml`, capacity 4, `BuildVMGuest` |
| [ ] | Gitea Workflow Integration | 4 | 1 | manca solo §P3 generalizzazione workflow |
| [x] | §1 Sicurezza & hardening | 3 | 0 | 1.1, 1.4, 1.6 done; 1.2/1.3/1.5/1.7/1.8 deferred (home lab) |
| [x] | §2 Affidabilità & resilienza | 7 | 0 | tutto done (2.1-2.7) |
| [x] | §3 Performance & throughput | 4 | 0 | 3.1/3.2/3.3/3.6 done; 3.4/3.5 deferred — **§3 CHIUSO** |
| [x] | §4 Osservabilità & manutenzione | 3 | 0 | 4.1/4.3/4.4 done (4.2 Prometheus, 4.5 Dashboard rimossi) |
| [x] | §5 Qualità codice & test | 5 | 0 | 5.1/5.2/5.3/5.4/5.5 done |
| [ ] | §6 Scalabilità & estensioni | 2 | 4 | 6.1 (Linux) done, 6.6 Tier-1+Tier-2 done (Step 11+12); 6.2-6.5 TODO |
| [ ] | §7 Refactor Deploy ↔ Setup | 4 | 1 | 7.1/7.2/7.3/7.4 done; 7.5 (rinomina) opzionale |
| [x] | In-VM Git Clone (§3.3) | 4 | 0 | COMPLETATO 2026-05-10 — e2e PASS: 34s/25.7% vs baseline |
| [x] | Linux Build VM (§6.1) | 5 | 0 | Deploy/Prepare/Setup/Transport + doc + e2e PASS nsis7z.dll 2272 KB |
| Stato | Area | Done | Open | Note |
| ----- | ------------------------------- | ---: | ---: | ------------------------------------------------------------------ |
| [x] | Setup & Infrastructure | 8 | 0 | Gitea + runner + dirs + rete tutti operativi |
| [x] | Template VM (Fasi A→D) | 4 | 0 | Snapshot `BaseClean` preso, credenziali in Credential Manager |
| [x] | Scripts Verification | 3 | 0 | e2e-008/009 SUCCESS, cleanup orfani + retry deleteVM ok |
| [x] | Runner Configuration | 2 | 0 | `config.yaml`, capacity 4, `BuildVMGuest` |
| [ ] | Gitea Workflow Integration | 4 | 1 | manca solo §P3 generalizzazione workflow |
| [x] | §1 Sicurezza & hardening | 3 | 0 | 1.1, 1.4, 1.6 done; 1.2/1.3/1.5/1.7/1.8 deferred (home lab) |
| [x] | §2 Affidabilità & resilienza | 7 | 0 | tutto done (2.1-2.7) |
| [x] | §3 Performance & throughput | 4 | 0 | 3.1/3.2/3.3/3.6 done; 3.4/3.5 deferred — **§3 CHIUSO** |
| [x] | §4 Osservabilità & manutenzione | 3 | 0 | 4.1/4.3/4.4 done (4.2 Prometheus, 4.5 Dashboard rimossi) |
| [x] | §5 Qualità codice & test | 5 | 0 | 5.1/5.2/5.3/5.4/5.5 done |
| [x] | §6 Scalabilità & estensioni | 5 | 0 | 6.1-6.2 done, 6.3 deferred (home lab), 6.4-6.5 done, 6.6 done |
| [ ] | §7 Refactor Deploy ↔ Setup | 4 | 1 | 7.1/7.2/7.3/7.4 done; 7.5 (rinomina) opzionale |
| [x] | In-VM Git Clone (§3.3) | 4 | 0 | COMPLETATO 2026-05-10 — e2e PASS: 34s/25.7% vs baseline |
| [x] | Linux Build VM (§6.1) | 5 | 0 | Deploy/Prepare/Setup/Transport + doc + e2e PASS nsis7z.dll 2272 KB |
**Prossimi passi consigliati** (vedi anche "Suggerimento di sequencing" in fondo):
1. **Test Plan** — eseguire completo `docs/TEST-PLAN-v1.3-to-HEAD.md` (25+ Pester tests, validazione features)
2. **Security** — Rifiori se condizioni cambiano; vedi sezione "Deferred (Home Lab)"
3. **§3.5** — vCPU/RAM tuning per workload (P2, deferred — home lab optimization)
4. **§3.4** — Pre-warm pool di cloni (P3, deferred — profiling-dependent optimization)
1. **Test Plan** — eseguire `Invoke-Pester tests\ -Output Detailed` + validare §2.1/§3.1/§3.6 con VM reali
2. **Test Plan** — validazione con VM reali (§2.1 IP race, §3.1 shared cache, §3.6 benchmark, §4.1 JSONL) — prossima priorità
3. **Security** — Rifiori se condizioni cambiano; vedi sezione "Deferred (Home Lab)"
4. **§3.5** — vCPU/RAM tuning per workload (P2, deferred — home lab optimization)
---
## Setup & Infrastructure
@@ -463,21 +466,31 @@ Sostituire WinRM con SSH key-based; `Invoke-Command` non funziona — usare `ssh
Aggiungere `scripts/_Transport.psm1` con due implementazioni (`WinRM`, `SSH`) dietro la
stessa interfaccia. `Invoke-CIJob.ps1` sceglie dal parametro `-GuestOS`.
### 6.2 [P3] [ ] Workflow generico riutilizzabile (composite action)
File: [gitea/workflow-example.yml](gitea/workflow-example.yml).
### 6.2 [P3] [x] Workflow generico riutilizzabile (composite action)
File: [gitea/actions/local-ci-build/action.yml](gitea/actions/local-ci-build/action.yml).
Trasformare in *composite action* Gitea (`.gitea/actions/local-ci-build/action.yml`)
richiamabile da qualsiasi repo:
**Status**: COMPLETATO 2026-05-11 — Composite action implementata.
Inputs: `build-command` (required), `artifact-source`, `submodules`, `guest-os`, `use-git-clone`,
`configuration`, `template-path`, `snapshot-name`, `artifact-name`, `artifact-retention-days`.
Outputs: `artifact-path`, `artifact-name`.
Inputs passati via variabili d'ambiente (no injection). Upload artifact incluso nell'action.
Usage da qualsiasi repo:
```yaml
- uses: ./Simone/local-ci-build@v1
with:
build-command: 'python build_plugin.py --final'
artifact-source: 'dist'
submodules: true
jobs:
build:
runs-on: windows-build # or linux-build
steps:
- uses: actions/checkout@v4
- uses: Simone/local-ci-system/.gitea/actions/local-ci-build@main
with:
build-command: 'python build_plugin.py --final --dist-dir dist'
artifact-source: 'dist'
submodules: 'true'
```
Riduce la duplicazione su nuovi repo e centralizza l'evoluzione del wrapper.
### 6.3 [P3] [ ] Multi-host runner federation
### 6.3 [DEFERRED — home lab, bassissima priorità] Multi-host runner federation
Quando 4 VM in parallelo non bastano, l'opzione naturale è un secondo host Windows con
stesso `Setup-Host.ps1` registrato come secondo runner Gitea (label `windows-build:host-2`).
Già supportato lato Gitea, basta replicare il setup.
@@ -485,20 +498,34 @@ Già supportato lato Gitea, basta replicare il setup.
**Premessa**: prima di scalare orizzontale, profilare se il collo di bottiglia è CPU
(i9-10900X 20T è abbondante) o I/O (NVMe). Se è I/O, una seconda NVMe sullo stesso host basta.
### 6.4 [P3] [ ] Build matrix nel workflow
**Deferred**: in un home lab single-host questa funzionalità non serve. Non pianificare.
### 6.4 [P3] [x] Build matrix nel workflow
File: [gitea/workflows/build-nsis.yml](gitea/workflows/build-nsis.yml).
Attualmente single job. Quando arriverà la VM Linux:
```yaml
strategy:
matrix:
target: [windows, linux]
runs-on: ${{ matrix.target }}-build
```
**Status**: COMPLETATO 2026-05-11 — `build-nsis.yml` riscritto con matrix strategy.
### 6.5 [P3] [ ] Secret injection workflow-level
Per chiavi di firma (Authenticode, GPG), usare i Gitea secrets nel workflow e passarli a
`Invoke-CIJob.ps1` come param + env, mai loggati. Stesso modello di §1.5 per il PAT.
Matrix `target: [windows, linux]`, `runs-on: ${{ matrix.target }}-build`,
`fail-fast: false`. Usa la composite action con `job-id-suffix: ${{ matrix.target }}`
per artifact dir separate e `repo-url: ssh://gitea-ci/Simone/nsis-plugin-nsinnounp.git`.
Artifact separati: `nsis-plugin-nsinnounp-windows-<tag>` e `nsis-plugin-nsinnounp-linux-<tag>`.
### 6.5 [P3] [x] Secret injection workflow-level
**Status**: COMPLETATO 2026-05-11 — `ExtraGuestEnv [hashtable]` aggiunto a:
- `Invoke-CIJob.ps1` (param `-ExtraGuestEnv`, forwarded a Invoke-RemoteBuild)
- `Invoke-RemoteBuild.ps1` (param `-ExtraGuestEnv`, iniettato nei guest):
- **Windows**: `[System.Environment]::SetEnvironmentVariable` nel session ScriptBlock prima del build command
- **Linux**: `export KEY='val'; ` prefisso prima della `cd && buildcmd`
- `action.yml`: input `extra-guest-env-json` (JSON object), parsato via `ConvertFrom-Json`, mai loggato
Usage dal workflow:
```yaml
- uses: Simone/local-ci-system/.gitea/actions/local-ci-build@main
with:
build-command: 'python sign_and_build.py'
extra-guest-env-json: '{"SIGN_PASS":"${{ secrets.SIGN_PASS }}","CERT_THUMBPRINT":"${{ secrets.CERT_THUMBPRINT }}"}'
```
### 6.6 [P2] [x] Toolchain Tier-1 + Tier-2 in Setup-WinBuild2025
File: [template/Setup-WinBuild2025.ps1](template/Setup-WinBuild2025.ps1),
@@ -522,13 +549,13 @@ build più ampi senza toccare il template.
### Tier-2 — Step 12 (implementato)
| Tool | Versione | Razionale |
| ---------------- | ---------------------- | -------------------------------------------------- |
| **CMake** | 3.31.6 | Build system C/C++ cross-platform |
| **Node.js LTS** | 22.14.0 | Frontend/Electron pipelines, npm toolchain |
| **WiX Toolset** | 4.0.5 (dotnet tool) | MSI building da .NET projects |
| **Sysinternals** | latest (CDN Microsoft) | Diagnostica process/handle quando build flaky |
| **vcpkg** | HEAD (shallow clone) | Package manager C++ per dipendenze native |
| Tool | Versione | Razionale |
| ---------------- | ---------------------- | --------------------------------------------- |
| **CMake** | 3.31.6 | Build system C/C++ cross-platform |
| **Node.js LTS** | 22.14.0 | Frontend/Electron pipelines, npm toolchain |
| **WiX Toolset** | 4.0.5 (dotnet tool) | MSI building da .NET projects |
| **Sysinternals** | latest (CDN Microsoft) | Diagnostica process/handle quando build flaky |
| **vcpkg** | HEAD (shallow clone) | Package manager C++ per dipendenze native |
**Approccio**:
- Pinning hash SHA256 per ogni installer (vedi §1.3)