feat(template): §6.6 Tier-2 toolchain PS7/NSIS/CMake/Node.js/WiX/gh CLI/Sysinternals/vcpkg
Step 12 in Setup-WinBuild2025.ps1 installs all 8 Tier-2 tools: - PowerShell 7.4.7 LTS (pwsh.exe) - NSIS 3.10 (makensis.exe) - CMake 3.31.6 (cmake.exe) - Node.js 22.14.0 LTS (node.exe + npm) - WiX 4.0.5 via dotnet tool (wix.exe, C:\BuildTools\Wix\) - GitHub CLI 2.67.0 (gh.exe) - Sysinternals Suite (C:\BuildTools\Sysinternals\, extracted via 7-Zip) - vcpkg HEAD shallow clone + bootstrap (C:\BuildTools\vcpkg\) All tools added to Machine PATH; idempotent (binary-presence check). Hash entries in \ ready for SHA256 pinning. knownTempFiles extended; Final gate Assert-Step added for all 8 binaries. Prepare-WinBuild2025.ps1: 7 new params + pass-through to Setup. Validate-SetupState.ps1: Tier-2 checks in both main + re-run scriptblocks. TODO.md: §6.6 [~] -> [x], Sprint 11 summary.
This commit is contained in:
Simone
@@ -132,6 +132,15 @@ param(
|
||||
|
||||
[string] $DotNetSdkVersion = '10.0',
|
||||
|
||||
# Tier-2 Toolchain version pins — forwarded as-is to Setup-WinBuild2025.ps1
|
||||
[string] $Pwsh7Version = '7.4.7',
|
||||
[string] $NSISVersion = '3.10',
|
||||
[string] $CMakeVersion = '3.31.6',
|
||||
[string] $NodeJSVersion = '22.14.0',
|
||||
[string] $WiXVersion = '4.0.5',
|
||||
[string] $GhCliVersion = '2.67.0',
|
||||
[string] $VcpkgRef = '',
|
||||
|
||||
[switch] $SkipWindowsUpdate,
|
||||
|
||||
# Skip disk cleanup inside the VM (cleanmgr + DISM + cache clear) — speeds up re-runs
|
||||
@@ -367,6 +376,13 @@ try {
|
||||
BuildUsername = $BuildUsername
|
||||
DotNetSdkVersion = $DotNetSdkVersion
|
||||
AdminPassword = $AdminPassword
|
||||
Pwsh7Version = $Pwsh7Version
|
||||
NSISVersion = $NSISVersion
|
||||
CMakeVersion = $CMakeVersion
|
||||
NodeJSVersion = $NodeJSVersion
|
||||
WiXVersion = $WiXVersion
|
||||
GhCliVersion = $GhCliVersion
|
||||
VcpkgRef = $VcpkgRef
|
||||
}
|
||||
if ($SkipWindowsUpdate) { $setupArgs['SkipWindowsUpdate'] = $true }
|
||||
if ($SkipCleanup) { $setupArgs['SkipCleanup'] = $true }
|
||||
|
||||
@@ -56,10 +56,14 @@
|
||||
Step 11 — Tier-1 Toolchain (Git for Windows + 7-Zip) — §6.6
|
||||
Installs to C:\Program Files (Git default) and C:\Program Files\7-Zip
|
||||
Validation: git and 7z commands resolvable, executables present
|
||||
Step 12 — Tier-2 Toolchain (PowerShell 7 LTS, NSIS, CMake, Node.js LTS,
|
||||
WiX v4, gh CLI, Sysinternals Suite, vcpkg) — §6.6
|
||||
Installs to C:\Program Files\<tool>\ and C:\BuildTools\<tool>\
|
||||
Validation: each binary resolvable via Get-Command
|
||||
Cleanup — Disk cleanup: cleanmgr, SoftwareDistribution, CBS, TEMP, Prefetch, DISM
|
||||
wuauserv already Disabled (Step 6b) — not restarted after cache clear
|
||||
Validation: wuauserv StartType Disabled
|
||||
Final — Pre-snapshot gate: 9 cross-cutting checks across all steps
|
||||
Final — Pre-snapshot gate: 11 cross-cutting checks across all steps
|
||||
Throws if any check fails — prevents snapshot of broken state
|
||||
|
||||
Step ordering rationale:
|
||||
@@ -74,9 +78,12 @@
|
||||
WU disable (Step 6b) — immediately after WU; snapshot captures WU permanently off
|
||||
Toolchain (7-9) — .NET/Python/VS last; WU done, no scan on installer payloads
|
||||
Tier-1 (Step 11) — Git + 7-Zip after base toolchain; enables §3.3 in-VM clone
|
||||
Tier-2 (Step 12) — Pwsh7/NSIS/CMake/Node/WiX/gh/Sysinternals/vcpkg after Tier-1;
|
||||
Sysinternals extraction requires 7-Zip; vcpkg clone requires Git
|
||||
|
||||
NOTE: Step 11 installs Git for Windows + 7-Zip (Tier-1 Toolchain §6.6).
|
||||
This enables §3.3 (In-VM Git clone) and cross-platform build support.
|
||||
Step 12 installs PowerShell 7 LTS, NSIS, CMake, Node.js LTS, WiX v4, gh CLI,
|
||||
Sysinternals Suite, and vcpkg (Tier-2 Toolchain §6.6).
|
||||
|
||||
╔══════════════════════════════════════════════════════════════════════╗
|
||||
║ NETWORK REQUIREMENT DURING SETUP ║
|
||||
@@ -147,7 +154,31 @@ param(
|
||||
[string] $GitVersion = '2.54.0.windows.1',
|
||||
|
||||
# 7-Zip version (latest stable)
|
||||
[string] $SevenZipVersion = '26.01'
|
||||
[string] $SevenZipVersion = '26.01',
|
||||
|
||||
# ── Tier-2 Toolchain versions (§6.6) ──────────────────────────────────────
|
||||
# Update these defaults when upgrading pinned tool versions.
|
||||
|
||||
# PowerShell 7 LTS (pwsh.exe — modern PS for CI scripts + parallel pipelines)
|
||||
[string] $Pwsh7Version = '7.4.7',
|
||||
|
||||
# NSIS (makensis.exe — Windows installer builds)
|
||||
[string] $NSISVersion = '3.10',
|
||||
|
||||
# CMake (cmake.exe — C/C++ cross-platform build system)
|
||||
[string] $CMakeVersion = '3.31.6',
|
||||
|
||||
# Node.js LTS (node.exe + npm — frontend/Electron/JS tool pipelines)
|
||||
[string] $NodeJSVersion = '22.14.0',
|
||||
|
||||
# WiX Toolset v4 installed via dotnet tool (wix.exe — MSI package building)
|
||||
[string] $WiXVersion = '4.0.5',
|
||||
|
||||
# GitHub CLI (gh.exe — artifact upload, PR/release/workflow operations)
|
||||
[string] $GhCliVersion = '2.67.0',
|
||||
|
||||
# vcpkg revision: git commit SHA or tag. Default '' = shallow HEAD clone.
|
||||
[string] $VcpkgRef = ''
|
||||
)
|
||||
|
||||
Set-StrictMode -Version Latest
|
||||
@@ -217,6 +248,21 @@ $script:Hashes = @{
|
||||
# 7-Zip MSI installer from https://www.7-zip.org/download.html
|
||||
# Update $script:Hashes['SevenZip'] when $SevenZipVersion changes.
|
||||
'SevenZip' = ''
|
||||
|
||||
# Tier-2 Toolchain installer hashes — fill in when pinning supply chain (see BEST-PRACTICES.md §1.3)
|
||||
# PowerShell-<ver>-win-x64.msi from https://github.com/PowerShell/PowerShell/releases
|
||||
'Pwsh7' = ''
|
||||
# nsis-<ver>-setup.exe from https://prdownloads.sourceforge.net/nsis/
|
||||
'NSIS' = ''
|
||||
# cmake-<ver>-windows-x86_64.msi from https://github.com/Kitware/CMake/releases
|
||||
'CMake' = ''
|
||||
# node-v<ver>-x64.msi from https://nodejs.org/dist/v<ver>/
|
||||
'NodeJS' = ''
|
||||
# gh_<ver>_windows_amd64.msi from https://github.com/cli/cli/releases
|
||||
'GhCli' = ''
|
||||
# WiX: installed via 'dotnet tool install wix' — integrity via NuGet package signing
|
||||
# Sysinternals: downloaded from Microsoft CDN — no stable hash (updated continuously)
|
||||
# vcpkg: cloned from GitHub via TLS; pin integrity with $VcpkgRef (commit SHA)
|
||||
}
|
||||
|
||||
# ── Pre-flight: remove temp files from any previous partial run ───────────────
|
||||
@@ -225,7 +271,10 @@ $script:Hashes = @{
|
||||
$knownTempFiles = @(
|
||||
'C:\CI\wu_worker.ps1', 'C:\CI\wu_result.txt', 'C:\CI\wu_reboot.txt', 'C:\CI\wu_log.txt',
|
||||
'C:\CI\vs_worker.ps1', 'C:\CI\vs_result.txt', 'C:\CI\vs_BuildTools.exe',
|
||||
'C:\CI\python_installer.exe', 'C:\CI\git_installer.exe', 'C:\CI\7zip_installer.msi'
|
||||
'C:\CI\python_installer.exe', 'C:\CI\git_installer.exe', 'C:\CI\7zip_installer.msi',
|
||||
# Tier-2 Toolchain installer temp files
|
||||
'C:\CI\pwsh_installer.msi', 'C:\CI\nsis_installer.exe', 'C:\CI\cmake_installer.msi',
|
||||
'C:\CI\nodejs_installer.msi', 'C:\CI\ghcli_installer.msi', 'C:\CI\sysinternals.zip'
|
||||
)
|
||||
foreach ($f in $knownTempFiles) {
|
||||
if (Test-Path $f) {
|
||||
@@ -1098,6 +1147,315 @@ Assert-Step '7-Zip' '7z command resolvable' {
|
||||
|
||||
Write-Host "Tier-1 Toolchain installation complete." -ForegroundColor Green
|
||||
|
||||
# ── Step 12: Tier-2 Toolchain ─────────────────────────────────────────────────
|
||||
Write-Step "Installing Tier-2 Toolchain (Pwsh7 / NSIS / CMake / Node.js / WiX / gh CLI / Sysinternals / vcpkg)"
|
||||
|
||||
# BuildTools root may already exist from Step 11 (idempotent).
|
||||
if (-not (Test-Path $buildToolsRoot)) {
|
||||
New-Item -ItemType Directory -Path $buildToolsRoot -Force | Out-Null
|
||||
}
|
||||
|
||||
# ── PowerShell 7 LTS ─────────────────────────────────────────────────────────
|
||||
$pwsh7Exe = 'C:\Program Files\PowerShell\7\pwsh.exe'
|
||||
if (Test-Path $pwsh7Exe) {
|
||||
$v = & $pwsh7Exe -NoProfile -Command '$PSVersionTable.PSVersion.ToString()' 2>&1 | Select-Object -First 1
|
||||
Write-Host "PowerShell 7 already installed: $v"
|
||||
} else {
|
||||
$pwsh7Url = "https://github.com/PowerShell/PowerShell/releases/download/v$Pwsh7Version/PowerShell-$Pwsh7Version-win-x64.msi"
|
||||
$pwsh7Msi = 'C:\CI\pwsh_installer.msi'
|
||||
Write-Host "Downloading PowerShell $Pwsh7Version from GitHub releases..."
|
||||
try { Invoke-WebRequest -Uri $pwsh7Url -OutFile $pwsh7Msi -UseBasicParsing }
|
||||
catch { throw "Failed to download PowerShell from '$pwsh7Url': $_" }
|
||||
Assert-Hash -FilePath $pwsh7Msi -Label "PowerShell-$Pwsh7Version-win-x64.msi" `
|
||||
-Expected $script:Hashes['Pwsh7']
|
||||
Write-Host "Installing PowerShell $Pwsh7Version (quiet, no PSRemoting, no manifest)..."
|
||||
$proc = Start-Process -FilePath 'msiexec.exe' -ArgumentList @(
|
||||
'/i', $pwsh7Msi, '/quiet', '/norestart',
|
||||
'ADD_EXPLORER_CONTEXT_MENU_OPENPOWERSHELL=0',
|
||||
'ADD_FILE_CONTEXT_MENU_RUNPOWERSHELL=0',
|
||||
'ENABLE_PSREMOTING=0',
|
||||
'REGISTER_MANIFEST=0'
|
||||
) -Wait -PassThru
|
||||
Remove-Item $pwsh7Msi -ErrorAction SilentlyContinue
|
||||
if ($proc -and $proc.ExitCode -notin @(0, 3010)) {
|
||||
throw "PowerShell 7 MSI exited $($proc.ExitCode)."
|
||||
}
|
||||
Write-Host "PowerShell $Pwsh7Version installed."
|
||||
}
|
||||
$pwsh7Dir = 'C:\Program Files\PowerShell\7'
|
||||
$machinePath = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine')
|
||||
if ($machinePath -notlike "*$pwsh7Dir*") {
|
||||
[System.Environment]::SetEnvironmentVariable('PATH', "$machinePath;$pwsh7Dir", 'Machine')
|
||||
}
|
||||
$env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';' +
|
||||
[System.Environment]::GetEnvironmentVariable('PATH', 'User')
|
||||
Assert-Step 'Pwsh7' 'pwsh.exe present at expected path' { Test-Path $pwsh7Exe -PathType Leaf }
|
||||
Assert-Step 'Pwsh7' 'pwsh command resolvable via PATH' { [bool](Get-Command pwsh -ErrorAction SilentlyContinue) }
|
||||
Assert-Step 'Pwsh7' "pwsh major version matches $($Pwsh7Version.Split('.')[0])" {
|
||||
$v = (& $pwsh7Exe -NoProfile -Command '$PSVersionTable.PSVersion.Major' 2>&1 | Select-Object -First 1).ToString().Trim()
|
||||
$v -eq $Pwsh7Version.Split('.')[0]
|
||||
}
|
||||
|
||||
# ── NSIS ─────────────────────────────────────────────────────────────────────
|
||||
$nsisExe = 'C:\Program Files (x86)\NSIS\makensis.exe'
|
||||
if (Test-Path $nsisExe) {
|
||||
Write-Host "NSIS already installed."
|
||||
} else {
|
||||
$nsisUrl = "https://prdownloads.sourceforge.net/nsis/nsis-$NSISVersion-setup.exe"
|
||||
$nsisInstaller = 'C:\CI\nsis_installer.exe'
|
||||
Write-Host "Downloading NSIS $NSISVersion from SourceForge..."
|
||||
try { Invoke-WebRequest -Uri $nsisUrl -OutFile $nsisInstaller -UseBasicParsing }
|
||||
catch { throw "Failed to download NSIS from '$nsisUrl': $_" }
|
||||
Assert-Hash -FilePath $nsisInstaller -Label "nsis-$NSISVersion-setup.exe" `
|
||||
-Expected $script:Hashes['NSIS']
|
||||
Write-Host "Installing NSIS $NSISVersion (silent /S)..."
|
||||
$proc = Start-Process -FilePath $nsisInstaller -ArgumentList '/S' -Wait -PassThru
|
||||
Remove-Item $nsisInstaller -ErrorAction SilentlyContinue
|
||||
if ($proc -and $proc.ExitCode -ne 0) {
|
||||
throw "NSIS installer exited $($proc.ExitCode)."
|
||||
}
|
||||
Write-Host "NSIS $NSISVersion installed."
|
||||
}
|
||||
$nsisDir = 'C:\Program Files (x86)\NSIS'
|
||||
$machinePath = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine')
|
||||
if ($machinePath -notlike "*$nsisDir*") {
|
||||
[System.Environment]::SetEnvironmentVariable('PATH', "$machinePath;$nsisDir", 'Machine')
|
||||
}
|
||||
$env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';' +
|
||||
[System.Environment]::GetEnvironmentVariable('PATH', 'User')
|
||||
Assert-Step 'NSIS' 'makensis.exe present at expected path' { Test-Path $nsisExe -PathType Leaf }
|
||||
Assert-Step 'NSIS' 'makensis command resolvable via PATH' { [bool](Get-Command makensis -ErrorAction SilentlyContinue) }
|
||||
|
||||
# ── CMake ─────────────────────────────────────────────────────────────────────
|
||||
$cmakeExe = 'C:\Program Files\CMake\bin\cmake.exe'
|
||||
if (Test-Path $cmakeExe) {
|
||||
$cv = (cmake --version 2>&1 | Select-Object -First 1).ToString()
|
||||
Write-Host "CMake already installed: $cv"
|
||||
} else {
|
||||
$cmakeUrl = "https://github.com/Kitware/CMake/releases/download/v$CMakeVersion/cmake-$CMakeVersion-windows-x86_64.msi"
|
||||
$cmakeMsi = 'C:\CI\cmake_installer.msi'
|
||||
Write-Host "Downloading CMake $CMakeVersion from GitHub releases..."
|
||||
try { Invoke-WebRequest -Uri $cmakeUrl -OutFile $cmakeMsi -UseBasicParsing }
|
||||
catch { throw "Failed to download CMake from '$cmakeUrl': $_" }
|
||||
Assert-Hash -FilePath $cmakeMsi -Label "cmake-$CMakeVersion-windows-x86_64.msi" `
|
||||
-Expected $script:Hashes['CMake']
|
||||
Write-Host "Installing CMake $CMakeVersion (ADD_CMAKE_TO_PATH=System)..."
|
||||
$proc = Start-Process -FilePath 'msiexec.exe' -ArgumentList @(
|
||||
'/i', $cmakeMsi, '/quiet', '/norestart', 'ADD_CMAKE_TO_PATH=System'
|
||||
) -Wait -PassThru
|
||||
Remove-Item $cmakeMsi -ErrorAction SilentlyContinue
|
||||
if ($proc -and $proc.ExitCode -notin @(0, 3010)) {
|
||||
throw "CMake MSI exited $($proc.ExitCode)."
|
||||
}
|
||||
Write-Host "CMake $CMakeVersion installed."
|
||||
}
|
||||
$cmakeDir = 'C:\Program Files\CMake\bin'
|
||||
$machinePath = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine')
|
||||
if ($machinePath -notlike "*$cmakeDir*") {
|
||||
[System.Environment]::SetEnvironmentVariable('PATH', "$machinePath;$cmakeDir", 'Machine')
|
||||
}
|
||||
$env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';' +
|
||||
[System.Environment]::GetEnvironmentVariable('PATH', 'User')
|
||||
Assert-Step 'CMake' 'cmake.exe present at expected path' { Test-Path $cmakeExe -PathType Leaf }
|
||||
Assert-Step 'CMake' 'cmake command resolvable via PATH' { [bool](Get-Command cmake -ErrorAction SilentlyContinue) }
|
||||
Assert-Step 'CMake' "cmake major version matches $($CMakeVersion.Split('.')[0])" {
|
||||
$v = (cmake --version 2>&1 | Select-Object -First 1).ToString()
|
||||
$v -match "cmake version $([regex]::Escape($CMakeVersion.Split('.')[0]))\."
|
||||
}
|
||||
|
||||
# ── Node.js LTS ───────────────────────────────────────────────────────────────
|
||||
$nodeExe = 'C:\Program Files\nodejs\node.exe'
|
||||
if (Test-Path $nodeExe) {
|
||||
$nv = (node --version 2>&1 | Select-Object -First 1).ToString()
|
||||
Write-Host "Node.js already installed: $nv"
|
||||
} else {
|
||||
$nodeUrl = "https://nodejs.org/dist/v$NodeJSVersion/node-v$NodeJSVersion-x64.msi"
|
||||
$nodeMsi = 'C:\CI\nodejs_installer.msi'
|
||||
Write-Host "Downloading Node.js $NodeJSVersion from nodejs.org..."
|
||||
try { Invoke-WebRequest -Uri $nodeUrl -OutFile $nodeMsi -UseBasicParsing }
|
||||
catch { throw "Failed to download Node.js from '$nodeUrl': $_" }
|
||||
Assert-Hash -FilePath $nodeMsi -Label "node-v$NodeJSVersion-x64.msi" `
|
||||
-Expected $script:Hashes['NodeJS']
|
||||
Write-Host "Installing Node.js $NodeJSVersion..."
|
||||
$proc = Start-Process -FilePath 'msiexec.exe' -ArgumentList @(
|
||||
'/i', $nodeMsi, '/quiet', '/norestart'
|
||||
) -Wait -PassThru
|
||||
Remove-Item $nodeMsi -ErrorAction SilentlyContinue
|
||||
if ($proc -and $proc.ExitCode -notin @(0, 3010)) {
|
||||
throw "Node.js MSI exited $($proc.ExitCode)."
|
||||
}
|
||||
Write-Host "Node.js $NodeJSVersion installed."
|
||||
}
|
||||
$nodeDir = 'C:\Program Files\nodejs'
|
||||
$machinePath = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine')
|
||||
if ($machinePath -notlike "*$nodeDir*") {
|
||||
[System.Environment]::SetEnvironmentVariable('PATH', "$machinePath;$nodeDir", 'Machine')
|
||||
}
|
||||
$env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';' +
|
||||
[System.Environment]::GetEnvironmentVariable('PATH', 'User')
|
||||
Assert-Step 'NodeJS' 'node.exe present at expected path' { Test-Path $nodeExe -PathType Leaf }
|
||||
Assert-Step 'NodeJS' 'node command resolvable via PATH' { [bool](Get-Command node -ErrorAction SilentlyContinue) }
|
||||
Assert-Step 'NodeJS' "node.js major version matches $($NodeJSVersion.Split('.')[0])" {
|
||||
$v = (node --version 2>&1 | Select-Object -First 1).ToString().TrimStart('v')
|
||||
$v.Split('.')[0] -eq $NodeJSVersion.Split('.')[0]
|
||||
}
|
||||
|
||||
# ── WiX Toolset v4 (via dotnet tool) ─────────────────────────────────────────
|
||||
# Requires .NET SDK (installed in Step 7). Installed to a dedicated tool-path on
|
||||
# Machine PATH so all users (ci_build, SYSTEM) can invoke wix.exe.
|
||||
$wixToolsDir = 'C:\BuildTools\Wix'
|
||||
$wixExe = Join-Path $wixToolsDir 'wix.exe'
|
||||
if (Test-Path $wixExe) {
|
||||
Write-Host "WiX Toolset already installed."
|
||||
} else {
|
||||
if (-not (Test-Path $wixToolsDir)) {
|
||||
New-Item -ItemType Directory -Path $wixToolsDir -Force | Out-Null
|
||||
}
|
||||
$dotnetBin = (Get-Command dotnet -ErrorAction SilentlyContinue)
|
||||
if (-not $dotnetBin) { throw "dotnet not found in PATH — Step 7 (DotNet SDK) must complete first." }
|
||||
Write-Host "Installing WiX Toolset $WiXVersion via 'dotnet tool install wix --tool-path $wixToolsDir'..."
|
||||
$proc = Start-Process -FilePath $dotnetBin.Source -ArgumentList @(
|
||||
'tool', 'install', 'wix',
|
||||
'--version', $WiXVersion,
|
||||
'--tool-path', $wixToolsDir
|
||||
) -Wait -PassThru
|
||||
if ($proc -and $proc.ExitCode -ne 0) {
|
||||
throw "WiX dotnet tool install exited $($proc.ExitCode)."
|
||||
}
|
||||
Write-Host "WiX Toolset $WiXVersion installed."
|
||||
}
|
||||
$machinePath = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine')
|
||||
if ($machinePath -notlike "*$wixToolsDir*") {
|
||||
[System.Environment]::SetEnvironmentVariable('PATH', "$machinePath;$wixToolsDir", 'Machine')
|
||||
}
|
||||
$env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';' +
|
||||
[System.Environment]::GetEnvironmentVariable('PATH', 'User')
|
||||
Assert-Step 'WiX' 'wix.exe present at expected path' { Test-Path $wixExe -PathType Leaf }
|
||||
Assert-Step 'WiX' 'wix command resolvable via PATH' { [bool](Get-Command wix -ErrorAction SilentlyContinue) }
|
||||
|
||||
# ── GitHub CLI (gh) ───────────────────────────────────────────────────────────
|
||||
$ghExe = 'C:\Program Files\GitHub CLI\gh.exe'
|
||||
if (Test-Path $ghExe) {
|
||||
$ghv = (& $ghExe --version 2>&1 | Select-Object -First 1).ToString()
|
||||
Write-Host "GitHub CLI already installed: $ghv"
|
||||
} else {
|
||||
$ghUrl = "https://github.com/cli/cli/releases/download/v$GhCliVersion/gh_${GhCliVersion}_windows_amd64.msi"
|
||||
$ghMsi = 'C:\CI\ghcli_installer.msi'
|
||||
Write-Host "Downloading GitHub CLI $GhCliVersion from GitHub releases..."
|
||||
try { Invoke-WebRequest -Uri $ghUrl -OutFile $ghMsi -UseBasicParsing }
|
||||
catch { throw "Failed to download GitHub CLI from '$ghUrl': $_" }
|
||||
Assert-Hash -FilePath $ghMsi -Label "gh_${GhCliVersion}_windows_amd64.msi" `
|
||||
-Expected $script:Hashes['GhCli']
|
||||
Write-Host "Installing GitHub CLI $GhCliVersion..."
|
||||
$proc = Start-Process -FilePath 'msiexec.exe' -ArgumentList @(
|
||||
'/i', $ghMsi, '/quiet', '/norestart'
|
||||
) -Wait -PassThru
|
||||
Remove-Item $ghMsi -ErrorAction SilentlyContinue
|
||||
if ($proc -and $proc.ExitCode -notin @(0, 3010)) {
|
||||
throw "GitHub CLI MSI exited $($proc.ExitCode)."
|
||||
}
|
||||
Write-Host "GitHub CLI $GhCliVersion installed."
|
||||
}
|
||||
# gh CLI MSI may not update Machine PATH — ensure the install dir is present.
|
||||
$ghDir = 'C:\Program Files\GitHub CLI'
|
||||
$machinePath = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine')
|
||||
if ($machinePath -notlike "*$ghDir*") {
|
||||
[System.Environment]::SetEnvironmentVariable('PATH', "$machinePath;$ghDir", 'Machine')
|
||||
}
|
||||
$env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';' +
|
||||
[System.Environment]::GetEnvironmentVariable('PATH', 'User')
|
||||
Assert-Step 'GhCli' 'gh.exe present at expected path' { Test-Path $ghExe -PathType Leaf }
|
||||
Assert-Step 'GhCli' 'gh command resolvable via PATH' { [bool](Get-Command gh -ErrorAction SilentlyContinue) }
|
||||
Assert-Step 'GhCli' 'gh --version exits 0' { & gh --version 2>&1 | Out-Null; $LASTEXITCODE -eq 0 }
|
||||
|
||||
# ── Sysinternals Suite ────────────────────────────────────────────────────────
|
||||
# Downloaded as SysinternalsSuite.zip from Microsoft CDN; extracted via 7-Zip.
|
||||
# 7-Zip ($sevenZipExe) must already be installed (Step 11 Tier-1).
|
||||
$sysDir = 'C:\BuildTools\Sysinternals'
|
||||
$sysPsExec = Join-Path $sysDir 'PsExec.exe'
|
||||
if ((Test-Path $sysDir) -and (Test-Path $sysPsExec)) {
|
||||
Write-Host "Sysinternals Suite already installed."
|
||||
} else {
|
||||
$sysZipUrl = 'https://download.sysinternals.com/files/SysinternalsSuite.zip'
|
||||
$sysZip = 'C:\CI\sysinternals.zip'
|
||||
Write-Host "Downloading Sysinternals Suite from Microsoft CDN..."
|
||||
try { Invoke-WebRequest -Uri $sysZipUrl -OutFile $sysZip -UseBasicParsing }
|
||||
catch { throw "Failed to download Sysinternals Suite: $_" }
|
||||
if (-not (Test-Path $sysDir)) {
|
||||
New-Item -ItemType Directory -Path $sysDir -Force | Out-Null
|
||||
}
|
||||
Write-Host "Extracting Sysinternals to $sysDir via 7-Zip..."
|
||||
if (-not (Test-Path $sevenZipExe)) {
|
||||
throw "7-Zip not found at '$sevenZipExe' — Step 11 (Tier-1) must complete first."
|
||||
}
|
||||
& $sevenZipExe x $sysZip "-o$sysDir" -y 2>&1 | Write-Host
|
||||
if ($LASTEXITCODE -ne 0) { throw "Sysinternals extraction failed (7z exit $LASTEXITCODE)." }
|
||||
Remove-Item $sysZip -ErrorAction SilentlyContinue
|
||||
Write-Host "Sysinternals Suite extracted."
|
||||
}
|
||||
$machinePath = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine')
|
||||
if ($machinePath -notlike "*$sysDir*") {
|
||||
[System.Environment]::SetEnvironmentVariable('PATH', "$machinePath;$sysDir", 'Machine')
|
||||
}
|
||||
$env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';' +
|
||||
[System.Environment]::GetEnvironmentVariable('PATH', 'User')
|
||||
Assert-Step 'Sysinternals' 'PsExec.exe present in Sysinternals directory' { Test-Path $sysPsExec -PathType Leaf }
|
||||
Assert-Step 'Sysinternals' 'procexp.exe present in Sysinternals directory' { Test-Path (Join-Path $sysDir 'procexp.exe') -PathType Leaf }
|
||||
Assert-Step 'Sysinternals' 'Sysinternals directory on Machine PATH' {
|
||||
[System.Environment]::GetEnvironmentVariable('PATH', 'Machine') -like "*$sysDir*"
|
||||
}
|
||||
|
||||
# ── vcpkg ─────────────────────────────────────────────────────────────────────
|
||||
# Cloned from GitHub and bootstrapped. Requires Git (Step 11 Tier-1).
|
||||
# $VcpkgRef = '' → shallow --depth 1 clone of HEAD (fastest for template provisioning).
|
||||
# $VcpkgRef = '<sha/tag>' → full clone then checkout (supply-chain-pinned builds).
|
||||
$vcpkgDir = 'C:\BuildTools\vcpkg'
|
||||
$vcpkgExe = Join-Path $vcpkgDir 'vcpkg.exe'
|
||||
if (Test-Path $vcpkgExe) {
|
||||
$vvpkg = (& $vcpkgExe version 2>&1 | Select-Object -First 1).ToString()
|
||||
Write-Host "vcpkg already installed: $vvpkg"
|
||||
} else {
|
||||
$gitBin = (Get-Command git -ErrorAction SilentlyContinue)
|
||||
if (-not $gitBin) { throw "git not found in PATH — Step 11 (Tier-1) must complete first." }
|
||||
if (Test-Path $vcpkgDir) { Remove-Item $vcpkgDir -Recurse -Force }
|
||||
Write-Host "Cloning vcpkg from GitHub..."
|
||||
$cloneArgs = @('clone', 'https://github.com/microsoft/vcpkg.git', $vcpkgDir)
|
||||
if ($VcpkgRef -eq '') {
|
||||
$cloneArgs += '--depth'
|
||||
$cloneArgs += '1'
|
||||
}
|
||||
& $gitBin.Source @cloneArgs 2>&1 | Write-Host
|
||||
if ($LASTEXITCODE -ne 0) { throw "vcpkg git clone failed (exit $LASTEXITCODE)." }
|
||||
if ($VcpkgRef -ne '') {
|
||||
Write-Host "Checking out vcpkg ref: $VcpkgRef"
|
||||
& $gitBin.Source -C $vcpkgDir checkout $VcpkgRef 2>&1 | Write-Host
|
||||
if ($LASTEXITCODE -ne 0) { throw "vcpkg checkout '$VcpkgRef' failed (exit $LASTEXITCODE)." }
|
||||
}
|
||||
Write-Host "Bootstrapping vcpkg (-disableMetrics)..."
|
||||
$bootstrapBat = Join-Path $vcpkgDir 'bootstrap-vcpkg.bat'
|
||||
$proc = Start-Process -FilePath 'cmd.exe' `
|
||||
-ArgumentList "/c `"$bootstrapBat`" -disableMetrics" `
|
||||
-WorkingDirectory $vcpkgDir -Wait -PassThru
|
||||
if ($proc -and $proc.ExitCode -ne 0) {
|
||||
throw "vcpkg bootstrap exited $($proc.ExitCode)."
|
||||
}
|
||||
Write-Host "vcpkg bootstrapped."
|
||||
}
|
||||
$machinePath = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine')
|
||||
if ($machinePath -notlike "*$vcpkgDir*") {
|
||||
[System.Environment]::SetEnvironmentVariable('PATH', "$machinePath;$vcpkgDir", 'Machine')
|
||||
}
|
||||
$env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';' +
|
||||
[System.Environment]::GetEnvironmentVariable('PATH', 'User')
|
||||
Assert-Step 'vcpkg' 'vcpkg.exe present at expected path' { Test-Path $vcpkgExe -PathType Leaf }
|
||||
Assert-Step 'vcpkg' 'vcpkg command resolvable via PATH' { [bool](Get-Command vcpkg -ErrorAction SilentlyContinue) }
|
||||
Assert-Step 'vcpkg' 'vcpkg version exits 0' {
|
||||
& vcpkg version 2>&1 | Out-Null
|
||||
$LASTEXITCODE -eq 0
|
||||
}
|
||||
|
||||
Write-Host "Tier-2 Toolchain installation complete." -ForegroundColor Green
|
||||
|
||||
# ── Cleanup ───────────────────────────────────────────────────────────────────
|
||||
if ($SkipCleanup) {
|
||||
Write-Host "`n[Setup] Skipping disk cleanup (-SkipCleanup switch set)." -ForegroundColor Yellow
|
||||
@@ -1265,7 +1623,13 @@ Assert-Step 'Final' 'no leftover installer scripts in C:\CI' {
|
||||
-not (Test-Path 'C:\CI\wu_worker.ps1') -and
|
||||
-not (Test-Path 'C:\CI\vs_worker.ps1') -and
|
||||
-not (Test-Path 'C:\CI\git_installer.exe') -and
|
||||
-not (Test-Path 'C:\CI\7zip_installer.msi')
|
||||
-not (Test-Path 'C:\CI\7zip_installer.msi') -and
|
||||
-not (Test-Path 'C:\CI\pwsh_installer.msi') -and
|
||||
-not (Test-Path 'C:\CI\nsis_installer.exe') -and
|
||||
-not (Test-Path 'C:\CI\cmake_installer.msi') -and
|
||||
-not (Test-Path 'C:\CI\nodejs_installer.msi') -and
|
||||
-not (Test-Path 'C:\CI\ghcli_installer.msi') -and
|
||||
-not (Test-Path 'C:\CI\sysinternals.zip')
|
||||
}
|
||||
Assert-Step 'Final' 'git command available' {
|
||||
[bool](Get-Command git -ErrorAction SilentlyContinue)
|
||||
@@ -1273,6 +1637,18 @@ Assert-Step 'Final' 'git command available' {
|
||||
Assert-Step 'Final' '7z command available' {
|
||||
[bool](Get-Command 7z -ErrorAction SilentlyContinue)
|
||||
}
|
||||
Assert-Step 'Final' 'Tier-2 Toolchain all resolvable (pwsh, makensis, cmake, node, wix, gh, sysinternals, vcpkg)' {
|
||||
$env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';' +
|
||||
[System.Environment]::GetEnvironmentVariable('PATH', 'User')
|
||||
(Get-Command pwsh -ErrorAction SilentlyContinue) -and
|
||||
(Get-Command makensis -ErrorAction SilentlyContinue) -and
|
||||
(Get-Command cmake -ErrorAction SilentlyContinue) -and
|
||||
(Get-Command node -ErrorAction SilentlyContinue) -and
|
||||
(Get-Command wix -ErrorAction SilentlyContinue) -and
|
||||
(Get-Command gh -ErrorAction SilentlyContinue) -and
|
||||
(Test-Path 'C:\BuildTools\Sysinternals\PsExec.exe' -PathType Leaf) -and
|
||||
(Test-Path 'C:\BuildTools\vcpkg\vcpkg.exe' -PathType Leaf)
|
||||
}
|
||||
|
||||
Write-Host "All pre-snapshot checks passed." -ForegroundColor Green
|
||||
|
||||
|
||||
@@ -228,6 +228,32 @@ try {
|
||||
Get-Command 7z -ErrorAction SilentlyContinue
|
||||
}
|
||||
|
||||
# Tier-2 Toolchain (§6.6)
|
||||
Chk 'PowerShell 7 (pwsh.exe in PATH)' {
|
||||
Get-Command pwsh -ErrorAction SilentlyContinue
|
||||
}
|
||||
Chk 'NSIS (makensis.exe in PATH)' {
|
||||
Get-Command makensis -ErrorAction SilentlyContinue
|
||||
}
|
||||
Chk 'CMake (cmake.exe in PATH)' {
|
||||
Get-Command cmake -ErrorAction SilentlyContinue
|
||||
}
|
||||
Chk 'Node.js (node.exe in PATH)' {
|
||||
Get-Command node -ErrorAction SilentlyContinue
|
||||
}
|
||||
Chk 'WiX Toolset (wix.exe in PATH)' {
|
||||
Get-Command wix -ErrorAction SilentlyContinue
|
||||
}
|
||||
Chk 'GitHub CLI (gh.exe in PATH)' {
|
||||
Get-Command gh -ErrorAction SilentlyContinue
|
||||
}
|
||||
Chk 'Sysinternals PsExec.exe present' {
|
||||
Test-Path 'C:\BuildTools\Sysinternals\PsExec.exe' -PathType Leaf
|
||||
}
|
||||
Chk 'vcpkg.exe present' {
|
||||
Test-Path 'C:\BuildTools\vcpkg\vcpkg.exe' -PathType Leaf
|
||||
}
|
||||
|
||||
# No leftover installer files in C:\CI root
|
||||
Chk 'no leftover installer scripts in C:\CI' {
|
||||
$leftovers = Get-ChildItem 'C:\CI' -File -EA SilentlyContinue |
|
||||
@@ -347,6 +373,14 @@ try {
|
||||
Chk 'MSBuild.exe present' { $msb=Get-Command msbuild -EA SilentlyContinue; $msb -and (Test-Path $msb.Source) }
|
||||
Chk 'Git for Windows (git.exe in PATH)' { Get-Command git -ErrorAction SilentlyContinue }
|
||||
Chk '7-Zip (7z.exe in PATH)' { Get-Command 7z -ErrorAction SilentlyContinue }
|
||||
Chk 'PowerShell 7 (pwsh.exe in PATH)' { Get-Command pwsh -ErrorAction SilentlyContinue }
|
||||
Chk 'NSIS (makensis.exe in PATH)' { Get-Command makensis -ErrorAction SilentlyContinue }
|
||||
Chk 'CMake (cmake.exe in PATH)' { Get-Command cmake -ErrorAction SilentlyContinue }
|
||||
Chk 'Node.js (node.exe in PATH)' { Get-Command node -ErrorAction SilentlyContinue }
|
||||
Chk 'WiX Toolset (wix.exe in PATH)' { Get-Command wix -ErrorAction SilentlyContinue }
|
||||
Chk 'GitHub CLI (gh.exe in PATH)' { Get-Command gh -ErrorAction SilentlyContinue }
|
||||
Chk 'Sysinternals PsExec.exe present' { Test-Path 'C:\BuildTools\Sysinternals\PsExec.exe' -PathType Leaf }
|
||||
Chk 'vcpkg.exe present' { Test-Path 'C:\BuildTools\vcpkg\vcpkg.exe' -PathType Leaf }
|
||||
Chk 'no leftover installer scripts in C:\CI' { $l=Get-ChildItem 'C:\CI' -File -EA SilentlyContinue | Where-Object { $_.Name -match 'wu_worker|wu_result|vs_buildtools|dotnet-install' }; $l.Count -eq 0 }
|
||||
return $results.ToArray()
|
||||
} -ArgumentList $BuildUsername, $DotNetChannel, $PythonVersion
|
||||
|
||||
Reference in New Issue
Block a user