Simone/local-ci-cd-system
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
103 Commits 1 Branch 7 Tags
987b36ff3f2aa126647a80d08c5eb74d03a6de7a
Commit Graph

5 Commits

Author SHA1 Message Date
Simone 987b36ff3f feat(template): §6.6 Tier-2 toolchain PS7/NSIS/CMake/Node.js/WiX/gh CLI/Sysinternals/vcpkg 
Step 12 in Setup-WinBuild2025.ps1 installs all 8 Tier-2 tools:
  - PowerShell 7.4.7 LTS (pwsh.exe)
  - NSIS 3.10 (makensis.exe)
  - CMake 3.31.6 (cmake.exe)
  - Node.js 22.14.0 LTS (node.exe + npm)
  - WiX 4.0.5 via dotnet tool (wix.exe, C:\BuildTools\Wix\)
  - GitHub CLI 2.67.0 (gh.exe)
  - Sysinternals Suite (C:\BuildTools\Sysinternals\, extracted via 7-Zip)
  - vcpkg HEAD shallow clone + bootstrap (C:\BuildTools\vcpkg\)

All tools added to Machine PATH; idempotent (binary-presence check).
Hash entries in \ ready for SHA256 pinning.
knownTempFiles extended; Final gate Assert-Step added for all 8 binaries.

Prepare-WinBuild2025.ps1: 7 new params + pass-through to Setup.
Validate-SetupState.ps1: Tier-2 checks in both main + re-run scriptblocks.
TODO.md: §6.6 [~] -> [x], Sprint 11 summary.
 2026-05-11 20:04:50 +02:00
Simone d732e182ce test(validation): Add Git + 7-Zip checks to Validate-SetupState 
§6.6 Tier-1 Toolchain (Git for Windows, 7-Zip) now included in final
state validation. Checks:
- 'Git for Windows (git.exe in PATH)'
- '7-Zip (7z.exe in PATH)'

Added to both initial validation pass and re-validation pass (post-remediation).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-10 21:01:46 +02:00
Simone 68cde01c9d security(sprint1): §1.1/1.3/1.4 — WinRM HTTPS/5986, SHA256 pinning infra, IP regex per-octet 
§1.4 — Replace loose IP ValidatePattern with per-octet regex in 4 scripts
  (Invoke-CIJob, Invoke-RemoteBuild, Get-BuildArtifacts, Wait-VMReady)

§1.1 — Migrate all WinRM connections from HTTP/5985 to HTTPS/5986
  - Deploy post-install.ps1: remove AllowUnencrypted=true; self-signed cert + HTTPS listener
    already present; firewall rule restricted to 192.168.79.0/24
  - Setup-WinBuild2025.ps1: assert AllowUnencrypted=false
  - Prepare-WinBuild2025.ps1: preflight uses TCP/5986; Test-WSMan -UseSSL -Port 5986;
    New-PSSession -UseSSL -Port 5986; host AllowUnencrypted save/restore removed (not needed for HTTPS)
  - Invoke-RemoteBuild, Get-BuildArtifacts: New-PSSession -UseSSL -Port 5986 -Authentication Basic
  - Wait-VMReady: New-WSManSessionOption + Test-WSMan -Port 5986 -UseSSL
  - Validate-DeployState, Validate-SetupState: Invoke-Command -UseSSL -Port 5986,
    AllowUnencrypted check → false; AllowUnencrypted host-side removed from both
  - Docs: PLAN, README, ARCHITECTURE, BEST-PRACTICES, HOST-SETUP, WINDOWS-TEMPLATE-SETUP,
    LINUX-TEMPLATE-SETUP, TODO updated

§1.3 — SHA256 hash pinning infrastructure
  - Assert-Hash function + $script:Hashes hashtable added to Setup-WinBuild2025.ps1
  - Assert-Hash called after dotnet-install.ps1, python installer, vs_buildtools.exe downloads
  - Hashes initialized to '' (warn-skip); must be filled before next snapshot refresh

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-10 14:46:41 +02:00
Simone 41611d46a7 fix(template): §7.4 Validate-SetupState -Remediate flag + Setup/Deploy tweaks 2026-05-10 14:26:35 +02:00
Simone 7d6ae42fcf fix(template): §7.4 e2e fixes + autologin + validation scripts 
Fix emerged during §7.4 e2e test run (2026-05-10):
- Deploy: set UsoSvc to Manual explicitly (Server 2025 default = Automatic)
- Setup cleanup: re-apply Set-Service Disabled on wuauserv/UsoSvc after DISM
  StartComponentCleanup (WaaSMedicSvc resets StartType during component store cleanup)
- Deploy + Setup: add Administrator autologin (AutoAdminLogon, DefaultUserName,
  DefaultPassword, DefaultDomainName) in post-install.ps1; Assert-Step 5c validates it
- Add Validate-DeployState.ps1: standalone host-side check of all Deploy-set state
- Add Validate-SetupState.ps1: standalone host-side check of full post-Setup state
- Mark §7.4, §7.1 and §7.2 e2e validation items as complete in TODO.md
- Update docs: WINDOWS-TEMPLATE-SETUP.md (arch table, validation scripts section,
  autologin in confine Deploy/Setup); TEST-7.4-e2e.md checklist marked done

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-10 11:30:11 +02:00