feat(sprint2): fix critical and high-priority bugs

C1: composite action selects Linux/Windows template from GITEA_CI_LINUX_TEMPLATE_PATH
    based on resolved guest OS; build-nsis.yml adds belt-and-suspenders guest-os param.
C2: redact ExtraGuestEnv secrets in Invoke-RemoteBuild.ps1 (envPrefix never logged).
H2: composite action outputs block corrected; duplicate artifact-name input removed.
H3: Linux Mode 2 PAT now uses http.extraHeader (mirrors Windows branch, drops GIT_CLONE_URL).
H6: Setup-Host.ps1 directory array updated to canonical layout (adds State, ip-leases, keys,
    Cache\pip, WinBuild2025/2022/LinuxBuild2404; removes obsolete WinBuild).
H7: Backup-CITemplate.ps1 default TemplatePath -> WinBuild2025; -AllTemplates switch added.
H8: Setup-Host.ps1 adds StrictHostKeyChecking=accept-new and Step 8 to replicate SSH config
    to LocalSystem profile for act_runner service account.
H11: runner/config.yaml adds GITEA_CI_SCRIPT_ROOT env var; action.yml uses it in place of
     hardcoded N:\ path.
Also: Invoke-RemoteBuild.ps1 skips 7-Zip/Compress-Archive when artifact source dir does not
     exist (fixes burn-in smoke runs with exit-0 build command and no output).

gitea/actions/local-ci-build/action.yml

@@ -129,6 +129,17 @@ inputs:
       are never echoed to the log.
     required: false
     default: '{}'
+
+  use-shared-cache:
+    description: >
+      Set to "true" to redirect NuGet and pip caches to VMware shared folders
+      on the host (F:\CI\Cache\NuGet and F:\CI\Cache\pip).
+      Requires Set-TemplateSharedFolders.ps1 to have been run on the template
+      and VMware Tools HGFS driver present in the guest.
+    required: false
+    default: 'false'
+
+outputs:
   artifact-path:
     description: >
       Host-side directory where Invoke-CIJob.ps1 placed collected artifacts.
@@ -162,12 +173,13 @@ runs:
         INPUT_JOB_ID_SUFFIX:         ${{ inputs.job-id-suffix }}
         INPUT_REPO_URL:              ${{ inputs.repo-url }}
         INPUT_EXTRA_GUEST_ENV_JSON:  ${{ inputs.extra-guest-env-json }}
+        INPUT_USE_SHARED_CACHE:      ${{ inputs.use-shared-cache }}
       run: |
         #Requires -Version 5.1
         Set-StrictMode -Version Latest
         $ErrorActionPreference = 'Stop'
 
-        $ciScriptsDir = 'N:\Code\Workspace\Local-CI-CD-System\scripts'
+        $ciScriptsDir = $env:GITEA_CI_SCRIPT_ROOT
 
         # Build job ID — append suffix when provided (matrix disambiguation)
         $jobId = '${{ github.run_id }}-${{ github.run_attempt }}'
@@ -199,6 +211,37 @@ runs:
             }
         }
 
+        # Resolve guest OS: honor explicit input; for Auto, infer from RUNNER_LABELS
+        $resolvedGuestOS = $env:INPUT_GUEST_OS
+        if ($resolvedGuestOS -eq 'Auto') {
+            if ($env:RUNNER_LABELS -match 'linux') {
+                $resolvedGuestOS = 'Linux'
+            } else {
+                $resolvedGuestOS = 'Windows'
+            }
+        }
+
+        # Select template path: explicit input overrides OS-based runner env var
+        $resolvedTemplatePath = $env:INPUT_TEMPLATE_PATH
+        if (-not $resolvedTemplatePath) {
+            if ($resolvedGuestOS -eq 'Linux') {
+                $resolvedTemplatePath = $env:GITEA_CI_LINUX_TEMPLATE_PATH
+            } else {
+                $resolvedTemplatePath = $env:GITEA_CI_TEMPLATE_PATH
+            }
+        }
+
+        # Select snapshot name: explicit input > OS-based default
+        # GITEA_CI_SNAPSHOT_NAME applies to Windows (template-refresh override)
+        $resolvedSnapshotName = $env:INPUT_SNAPSHOT_NAME
+        if (-not $resolvedSnapshotName) {
+            if ($resolvedGuestOS -eq 'Linux') {
+                $resolvedSnapshotName = 'BaseClean-Linux'
+            } else {
+                $resolvedSnapshotName = if ($env:GITEA_CI_SNAPSHOT_NAME) { $env:GITEA_CI_SNAPSHOT_NAME } else { 'BaseClean' }
+            }
+        }
+
         # Build parameter hashtable for Invoke-CIJob.ps1
         $params = @{
             JobId               = $jobId
@@ -207,14 +250,15 @@ runs:
             Commit              = '${{ github.sha }}'
             BuildCommand        = $env:INPUT_BUILD_COMMAND
             GuestArtifactSource = $env:INPUT_ARTIFACT_SOURCE
-            GuestOS             = $env:INPUT_GUEST_OS
+            GuestOS             = $resolvedGuestOS
             Configuration       = $env:INPUT_CONFIGURATION
         }
 
         if ($env:INPUT_SUBMODULES    -eq 'true') { $params['Submodules']    = $true }
-        if ($env:INPUT_USE_GIT_CLONE -eq 'true') { $params['UseGitClone']   = $true }
-        if ($env:INPUT_TEMPLATE_PATH)             { $params['TemplatePath']  = $env:INPUT_TEMPLATE_PATH }
-        if ($env:INPUT_SNAPSHOT_NAME)             { $params['SnapshotName']  = $env:INPUT_SNAPSHOT_NAME }
+        if ($env:INPUT_USE_GIT_CLONE    -eq 'true') { $params['UseGitClone']    = $true }
+        if ($env:INPUT_USE_SHARED_CACHE -eq 'true') { $params['UseSharedCache'] = $true }
+        if ($resolvedTemplatePath)                   { $params['TemplatePath']   = $resolvedTemplatePath }
+        if ($resolvedSnapshotName)                { $params['SnapshotName']  = $resolvedSnapshotName }
         if ($extraGuestEnv.Count -gt 0)           { $params['ExtraGuestEnv'] = $extraGuestEnv }
 
         & "$ciScriptsDir\Invoke-CIJob.ps1" @params
@@ -243,4 +287,4 @@ runs:
         path: ${{ steps.invoke-ci.outputs.artifact-path }}\*.log
         retention-days: 3
         if-no-files-found: ignore
-
+

gitea/workflows/build-nsis.yml

@@ -30,6 +30,7 @@ jobs:
           build-command:   'python build_plugin.py --final --dist-dir dist'
           artifact-source: 'dist'
           submodules:      'true'
+          guest-os:        ${{ matrix.target == 'linux' && 'Linux' || 'Windows' }}
           # SSH URL alias configured in host ~/.ssh/config — same for both runners
           repo-url:        'ssh://gitea-ci/Simone/nsis-plugin-nsinnounp.git'
           # Suffix disambiguates artifact dirs: F:\CI\Artifacts\{run_id}-{attempt}-windows