local-ci-cd-system

Simone/local-ci-cd-system

Fork 0

Commit Graph

Author	SHA1	Message	Date
Simone	7d12dedddd	Sprint 13-14: §6.2 composite action + §6.4 build matrix + §6.5 secret injection §6.2 - New composite action gitea/actions/local-ci-build/action.yml Wraps Invoke-CIJob.ps1 for reuse across repos. Inputs: build-command, artifact-source, submodules, guest-os, use-git-clone, configuration, template-path, snapshot-name, artifact-name, artifact-retention-days. Anti-injection: all params via INPUT_* env vars, never interpolated in shell. §6.4 - Build matrix windows+linux in build-nsis.yml gitea/workflows/build-nsis.yml rewritten with strategy.matrix target: [windows, linux], fail-fast: false, routes to {target}-build runner. Added action inputs: job-id-suffix (matrix disambig for artifact dirs), repo-url (SSH URL override for gitea-ci alias). §6.5 - ExtraGuestEnv secret injection chain New param -ExtraGuestEnv [hashtable] in Invoke-CIJob.ps1 and Invoke-RemoteBuild.ps1. Windows: SetEnvironmentVariable in WinRM session ScriptBlock before build command. Linux: export KEY='val'; prefix before cd && buildcmd (POSIX single-quote escaping). Composite action input extra-guest-env-json (JSON object -> ConvertFrom-Json -> hashtable), never logged. PSScriptAnalyzer fixes: _Common.psm1, Invoke-RetentionPolicy.ps1, Watch-RunnerHealth.ps1 (empty catch, ShouldProcess suppression, etc.) Docs/test: TEST-PLAN-v1.3-to-HEAD.md updated §3.3/§6.1/§5.4 status. TODO.md: §6 fully closed (6.1-6.2 done, 6.3 deferred, 6.4-6.5 done, 6.6 done).	2026-05-11 22:35:36 +02:00
Simone	a3a24199b3	fix: resolve PSScriptAnalyzer ParseError and StrictMode Count issue	2026-05-10 22:50:12 +02:00
Simone	bc894a8058	feat(sprint2): §2.1/2.2/2.3/2.5 — IP lock/lease, scheduled tasks, retention, versioned snapshot §2.1 — IP race with capacity>1 (Invoke-CIJob.ps1) Phases 2-3b (clone+start+IP) now run inside a file-based exclusive mutex (F:\CI\State\vm-start.lock via FileShare.None). Only one job at a time is in the VM-start phase, preventing concurrent vmrun starts from racing for the same DHCP lease. After IP is confirmed unique it is written to an IP lease file (F:\CI\State\ip-leases\<IP>.lease). Lock is released immediately so build phases run fully in parallel. Lease released in finally block. Collision detection: if a lease file already exists for the detected IP, the job fails fast with a clear error rather than silently sharing a WinRM target. §2.5 — Versioned snapshot (Invoke-CIJob.ps1 + runner/config.yaml) $SnapshotName now defaults to GITEA_CI_SNAPSHOT_NAME env var, falling back to 'BaseClean'. config.yaml documents the commented-out variable for snapshot refresh workflow (BaseClean_<yyyyMMdd> naming convention). §2.3 — Artifact/log retention (scripts/Invoke-RetentionPolicy.ps1) Purges per-job subdirs under F:\CI\Artifacts and F:\CI\Logs older than RetentionDays (default 30). Switches to AggressiveRetentionDays (default 7) when F: free space drops below MinFreeGB (default 50 GB). Also removes stale IP lease files older than 12 hours (defensive cleanup for crashed jobs). SupportsShouldProcess (-WhatIf) for dry-run. §2.2 — Scheduled task registration (scripts/Register-CIScheduledTasks.ps1) Registers two tasks under \CI\ task folder as SYSTEM/HighestPrivilege: CI-CleanupOrphans — every 6h + AtStartup, -MaxAgeHours 4 CI-RetentionPolicy — daily 03:00 (+30min random) + AtStartup (+15min random) Idempotent (-Force), SupportsShouldProcess (-WhatIf), validates script paths. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-10 18:36:38 +02:00

Author

SHA1

Message

Date

Simone

7d12dedddd

Sprint 13-14: §6.2 composite action + §6.4 build matrix + §6.5 secret injection

§6.2 - New composite action gitea/actions/local-ci-build/action.yml
  Wraps Invoke-CIJob.ps1 for reuse across repos. Inputs: build-command,
  artifact-source, submodules, guest-os, use-git-clone, configuration,
  template-path, snapshot-name, artifact-name, artifact-retention-days.
  Anti-injection: all params via INPUT_* env vars, never interpolated in shell.

§6.4 - Build matrix windows+linux in build-nsis.yml
  gitea/workflows/build-nsis.yml rewritten with strategy.matrix target:
  [windows, linux], fail-fast: false, routes to {target}-build runner.
  Added action inputs: job-id-suffix (matrix disambig for artifact dirs),
  repo-url (SSH URL override for gitea-ci alias).

§6.5 - ExtraGuestEnv secret injection chain
  New param -ExtraGuestEnv [hashtable] in Invoke-CIJob.ps1 and
  Invoke-RemoteBuild.ps1. Windows: SetEnvironmentVariable in WinRM session
  ScriptBlock before build command. Linux: export KEY='val'; prefix before
  cd && buildcmd (POSIX single-quote escaping). Composite action input
  extra-guest-env-json (JSON object -> ConvertFrom-Json -> hashtable),
  never logged.

PSScriptAnalyzer fixes: _Common.psm1, Invoke-RetentionPolicy.ps1,
  Watch-RunnerHealth.ps1 (empty catch, ShouldProcess suppression, etc.)

Docs/test: TEST-PLAN-v1.3-to-HEAD.md updated §3.3/§6.1/§5.4 status.
  TODO.md: §6 fully closed (6.1-6.2 done, 6.3 deferred, 6.4-6.5 done, 6.6 done).

2026-05-11 22:35:36 +02:00

Simone

a3a24199b3

fix: resolve PSScriptAnalyzer ParseError and StrictMode Count issue

2026-05-10 22:50:12 +02:00

Simone

bc894a8058

feat(sprint2): §2.1/2.2/2.3/2.5 — IP lock/lease, scheduled tasks, retention, versioned snapshot

§2.1 — IP race with capacity>1 (Invoke-CIJob.ps1)
  Phases 2-3b (clone+start+IP) now run inside a file-based exclusive mutex
  (F:\CI\State\vm-start.lock via FileShare.None). Only one job at a time is
  in the VM-start phase, preventing concurrent vmrun starts from racing for
  the same DHCP lease. After IP is confirmed unique it is written to an IP
  lease file (F:\CI\State\ip-leases\<IP>.lease). Lock is released immediately
  so build phases run fully in parallel. Lease released in finally block.
  Collision detection: if a lease file already exists for the detected IP,
  the job fails fast with a clear error rather than silently sharing a WinRM target.

§2.5 — Versioned snapshot (Invoke-CIJob.ps1 + runner/config.yaml)
  $SnapshotName now defaults to GITEA_CI_SNAPSHOT_NAME env var, falling back
  to 'BaseClean'. config.yaml documents the commented-out variable for snapshot
  refresh workflow (BaseClean_<yyyyMMdd> naming convention).

§2.3 — Artifact/log retention (scripts/Invoke-RetentionPolicy.ps1)
  Purges per-job subdirs under F:\CI\Artifacts and F:\CI\Logs older than
  RetentionDays (default 30). Switches to AggressiveRetentionDays (default 7)
  when F: free space drops below MinFreeGB (default 50 GB). Also removes stale
  IP lease files older than 12 hours (defensive cleanup for crashed jobs).
  SupportsShouldProcess (-WhatIf) for dry-run.

§2.2 — Scheduled task registration (scripts/Register-CIScheduledTasks.ps1)
  Registers two tasks under \CI\ task folder as SYSTEM/HighestPrivilege:
    CI-CleanupOrphans  — every 6h + AtStartup, -MaxAgeHours 4
    CI-RetentionPolicy — daily 03:00 (+30min random) + AtStartup (+15min random)
  Idempotent (-Force), SupportsShouldProcess (-WhatIf), validates script paths.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-10 18:36:38 +02:00

3 Commits