68cde01c9d
security(sprint1): §1.1/1.3/1.4 — WinRM HTTPS/5986, SHA256 pinning infra, IP regex per-octet
...
§1.4 — Replace loose IP ValidatePattern with per-octet regex in 4 scripts
(Invoke-CIJob, Invoke-RemoteBuild, Get-BuildArtifacts, Wait-VMReady)
§1.1 — Migrate all WinRM connections from HTTP/5985 to HTTPS/5986
- Deploy post-install.ps1: remove AllowUnencrypted=true; self-signed cert + HTTPS listener
already present; firewall rule restricted to 192.168.79.0/24
- Setup-WinBuild2025.ps1: assert AllowUnencrypted=false
- Prepare-WinBuild2025.ps1: preflight uses TCP/5986; Test-WSMan -UseSSL -Port 5986;
New-PSSession -UseSSL -Port 5986; host AllowUnencrypted save/restore removed (not needed for HTTPS)
- Invoke-RemoteBuild, Get-BuildArtifacts: New-PSSession -UseSSL -Port 5986 -Authentication Basic
- Wait-VMReady: New-WSManSessionOption + Test-WSMan -Port 5986 -UseSSL
- Validate-DeployState, Validate-SetupState: Invoke-Command -UseSSL -Port 5986,
AllowUnencrypted check → false; AllowUnencrypted host-side removed from both
- Docs: PLAN, README, ARCHITECTURE, BEST-PRACTICES, HOST-SETUP, WINDOWS-TEMPLATE-SETUP,
LINUX-TEMPLATE-SETUP, TODO updated
§1.3 — SHA256 hash pinning infrastructure
- Assert-Hash function + $script:Hashes hashtable added to Setup-WinBuild2025.ps1
- Assert-Hash called after dotnet-install.ps1, python installer, vs_buildtools.exe downloads
- Hashes initialized to '' (warn-skip); must be filled before next snapshot refresh
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-05-10 14:46:41 +02:00
41611d46a7
fix(template): §7.4 Validate-SetupState -Remediate flag + Setup/Deploy tweaks
2026-05-10 14:26:35 +02:00
7d6ae42fcf
fix(template): §7.4 e2e fixes + autologin + validation scripts
...
Fix emerged during §7.4 e2e test run (2026-05-10):
- Deploy: set UsoSvc to Manual explicitly (Server 2025 default = Automatic)
- Setup cleanup: re-apply Set-Service Disabled on wuauserv/UsoSvc after DISM
StartComponentCleanup (WaaSMedicSvc resets StartType during component store cleanup)
- Deploy + Setup: add Administrator autologin (AutoAdminLogon, DefaultUserName,
DefaultPassword, DefaultDomainName) in post-install.ps1; Assert-Step 5c validates it
- Add Validate-DeployState.ps1: standalone host-side check of all Deploy-set state
- Add Validate-SetupState.ps1: standalone host-side check of full post-Setup state
- Mark §7.4, §7.1 and §7.2 e2e validation items as complete in TODO.md
- Update docs: WINDOWS-TEMPLATE-SETUP.md (arch table, validation scripts section,
autologin in confine Deploy/Setup); TEST-7.4-e2e.md checklist marked done
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-05-10 11:30:11 +02:00
57e4a9713e
docs: add §7.4 e2e test runbook for Deploy↔Setup refactor validation
...
Step-by-step guide to validate §7 refactor on a real VM:
Deploy stand-alone, state verification, Prepare with/without -SkipWindowsUpdate,
snapshot promotion. Includes expected values table and checklist.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-05-10 07:19:27 +02:00
260e275b89
refactor(template): §7 — move OS hardening to Deploy, Setup becomes validation-only
...
§7.1 — Setup Steps 1/3/4b/5b/5c converted to Assert-Step only:
- Deploy post-install.ps1 now owns: Firewall (all profiles disabled),
WinRM MaxMemory=2048MB/IdleTimeout=2h/MaxProcesses=25/StartupType=Automatic,
lock screen (NoLockScreen), SM GPO policy key + scheduled task disable,
DisableCAD in Winlogon, OOBE non-policy key.
- Setup no longer re-applies these — validates them, throws if Deploy missed any.
§7.2 — WU lifecycle Strategy B:
- Deploy: replaces sc.exe disable with GPO locks only (NoAutoUpdate=1,
DisableWindowsUpdateAccess=1); services remain Manual (Windows default).
- Setup Step 6 Step A already clears these locks before COM API; Step 6b
permanently disables services post-update. No Setup changes needed.
§7.3 — Docs updated:
- Deploy .DESCRIPTION reflects full hardening ownership.
- Setup .DESCRIPTION marks validation-only steps, updates step ordering rationale.
- WINDOWS-TEMPLATE-SETUP.md: three-script architecture table, CI-WinBuild.vmx
path, Fase C step list + rationale + validation table updated.
TODO: §7.1/7.2/7.3 marked done. §7.4 e2e pending (requires new VM snapshot).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-05-10 01:27:29 +02:00
889bd9e41b
fix(refs): update residual Prepare-TemplateSetup references in host files
...
Setup-Host.ps1 and docs/HOST-SETUP.md still referenced the old name
Prepare-TemplateSetup.ps1; update to Prepare-WinBuild2025.ps1.
2026-05-10 01:01:19 +02:00
644258f59c
refactor(template): rename Setup-TemplateVM.ps1 -> Setup-WinBuild2025.ps1
...
- git mv Setup-TemplateVM.ps1 Setup-WinBuild2025.ps1
- git mv Prepare-TemplateSetup.ps1 -> Prepare-WinBuild2025.ps1 (name already in place)
- Updated all references across the workspace:
template/Prepare-WinBuild2025.ps1 (script copy, assertions, comments)
template/Setup-WinBuild2025.ps1 (self-references in docblock and final message)
README.md (directory tree)
TODO.md (all inline links and task descriptions)
docs/WINDOWS-TEMPLATE-SETUP.md (table, step descriptions, phase header, troubleshooting)
docs/LINUX-TEMPLATE-SETUP.md (Windows equivalent reference)
2026-05-09 23:28:36 +02:00
44f4c3ce7e
docs: add host setup and template provisioning guides
...
- HOST-SETUP.md: bootstrap macchina host (Setup-Host.ps1)
- WINDOWS-TEMPLATE-SETUP.md: provisioning template Windows con Prepare + Setup-TemplateVM
- LINUX-TEMPLATE-SETUP.md: bozza TODO template Linux (non implementato)
2026-05-09 21:15:32 +02:00
f373c0c24b
fix: apply all FIX-TODO items (P0/P1/P2)
...
P0 bugs:
- Invoke-CIJob.ps1: skip --depth 1 when $Commit specified (shallow clone
+ checkout specific commit was silently failing)
- Get-BuildArtifacts.ps1: check .Length -eq 0 not rounded sizeKB (false
fail on artifacts smaller than 50 bytes)
- build-nsis.yml: upgrade upload-artifact v3 -> v4 (v3 deprecated)
P0 security:
- Remove hardcoded default password CIBuild!ChangeMe2026 from all scripts,
README, TODO; prompt Read-Host -AsSecureString at runtime instead
- Setup-TemplateVM.ps1: replace `net user $u $p /add` (password in argv /
audit log 4688) with New-LocalUser + local ConvertTo-SecureString
- Prepare-TemplateSetup.ps1: save and restore WSMan AllowUnencrypted +
TrustedHosts in finally block (was permanently mutating host WinRM config)
- Setup-TemplateVM.ps1: remove duplicate MaxMemoryPerShellMB (winrm set
+ Set-Item both setting same value)
P1 doc (stale Host-Only / VMnet11 era):
- Setup-TemplateVM.ps1: rewrite NETWORK REQUIREMENT block + final steps
(system uses VMnet8 NAT permanently, not VMnet11 Host-Only)
- Invoke-CIJob.ps1 Phase 1 comment: correct network model
- ARCHITECTURE.md: remove Git from toolchain list (not installed); clarify
zip-transfer rationale (no PAT in VM, not network isolation)
- BEST-PRACTICES.md: rewrite Step 8 as NAT topology verification
P1 minor:
- Invoke-RemoteBuild.ps1: remove wasted first New-Item (created then
immediately removed and recreated)
- Wait-VMReady.ps1: remove unused $elapsed; simplify try/catch around
native command (exit codes don't throw)
- Install-Runner.ps1: add deprecation notice pointing to Setup-Host.ps1
P2 operational:
- Add scripts/Cleanup-OrphanedBuildVMs.ps1 with -WhatIf support
- Get-BuildArtifacts.ps1 -IncludeLogs: add -Recurse (msbuild logs in subdir)
- Add gitea/workflows/lint.yml (PSScriptAnalyzer on .ps1 push/PR)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-05-09 00:39:52 +02:00
6ba8cca70a
docs: fix stale references across all documentation
...
- ARCHITECTURE.md: fix WinRM subnet (192.168.1179), VM box shows VS 2026/Python 3.13/unzip+python build instead of .NET SDK 8/git clone/dotnet build
- BEST-PRACTICES.md: fix VMnet11/192.168.11 VMnet8 NAT/192.168.79
- CI-FLOW.md: Step 3 workflow YAML updated to actual Invoke-CIJob.ps1 params (Submodules, BuildCommand, GuestArtifactSource); note that -VMIPAddress is auto-detected
- OPTIMIZATION.md: BaseClean tier updated to VS BuildTools 2026, .NET SDK 10.0.203, Python 3.13.3
- gitea/workflow-example.yml: remove BUILD_VM_IP (auto-detected), replace -VMIPAddress/-Configuration with -Submodules/-BuildCommand/-GuestArtifactSource
2026-05-08 23:36:57 +02:00
dd238121b3
chore: initial commit local CI/CD system (e2e verified, production-ready)
...
Sistema CI locale basato su VMware Workstation + Gitea Actions + act_runner.
Testato e2e con nsis-plugin-nsinnounp (MSBuild + Python, 4 configurazioni parallele).
- scripts/: Invoke-CIJob, Invoke-RemoteBuild, New/Remove-BuildVM, Wait-VMReady, Get-BuildArtifacts
- runner/: act_runner config (windows-build label, capacity 4)
- gitea/workflows/: build-nsis.yml (template per progetti MSBuild/Python)
- template/: script di provisioning template VM (VS BuildTools 2026, .NET SDK 10, Python 3.13)
- docs/: ARCHITECTURE, CI-FLOW, OPTIMIZATION, BEST-PRACTICES, Setup-GiteaSSH
Verificato: e2e-009 SUCCESS in 02:09, cleanup automatico VM confermato.
2026-05-08 23:25:50 +02:00
Simone