Simone/local-ci-cd-system
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
229 Commits 1 Branch 7 Tags
facf3670b23fbc6da92760cd2b793905843aa84b
Commit Graph

19 Commits

Author SHA1 Message Date
Simone 425d8bc4f3 docs: align documentation with session fixes 
Reconcile docs with the end-to-end pipeline fixes:
- upload/download-artifact @v4 -> @v3 (Gitea GHES) in WORKFLOW-AUTHORING
  and workflow-example.yml; add Common Mistakes rows (v4, action ref
  form + DEFAULT_ACTIONS_URL, public action repo).
- BEST-PRACTICES / README / HOST-SETUP: guest credential must live in
  the LocalSystem vault with a host-qualified username; document
  Set-CIGuestCredential.ps1 / Test-CIGuestWinRM.ps1 and auth=ntlm.
- README / AGENTS / HOST-SETUP: production venv install is NON-editable
  (LocalSystem); no CI workflow may install into it.
- HOST-SETUP: add DEFAULT_ACTIONS_URL=github + full-URL uses: + public
  repo + @main requirements discovered during validation.
- Correct stale repo name local-ci-system -> local-ci-cd-system.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-17 16:09:15 +02:00
Simone 451a61c6a1 test: bump coverage gate from 80%% to 90%%
Lint / python (push) Failing after 22s
Details
Lint / pssa (push) Successful in 25s
Details 
Update --cov-fail-under in lint workflow + docs (AGENTS, README, ARCHITECTURE). Note: A5 closeout reported 80.10%% so this run will likely fail until additional tests are added.
 2026-05-14 23:04:56 +02:00
Simone 137287176e docs: rename branch references to feature/python-rewrite-and-linux-migration 
Update active docs (PhaseA/B checklists, README) after rename of feature/python-rewrite-phase-a -> feature/python-rewrite-and-linux-migration. Historical A1-A5 closeouts left untouched as they document state at the time of writing.
 2026-05-14 18:34:04 +02:00
Simone 4d9c6d07ba docs(a5): document Python orchestrator in AGENTS.md, ARCHITECTURE.md, README.md 
AGENTS.md: new 'Python development' section (venv paths, install/lint/typecheck/test commands, conventions, full PS->Python sub-command mapping, list of PS scripts that stay PowerShell, link to phase closeouts). README.md: expand 'Python orchestrator' with examples for all 10 sub-commands (wait-ready, vm new/remove/cleanup, build run, artifacts collect, monitor disk/runner, report job, job), local validation gates with 80% coverage gate, link to test_agents_errors.py. docs/ARCHITECTURE.md: new 'Python orchestrator (Phase A)' section with package layout tree, VmBackend Protocol contract, load_backend(config) factory, Phase C ESXi extension recipe, transport selection note, and CI validation gates.
 2026-05-14 18:34:04 +02:00
Simone bd31a3f2f3 Phase A1: bootstrap Python ci_orchestrator package 
- pyproject.toml (hatchling) with ruff/mypy/pytest dev deps
- src/ci_orchestrator/: config, credentials, backends (Protocol + WorkstationVmrunBackend), transport (WinRM via pypsrp, SSH via paramiko)
- CLI entry point with PoC 'wait-ready' subcommand (Windows + Linux guests)
- tests/python/: 35 unit tests, 83% coverage, all backends/transport mocked
- gitea/workflows/lint.yml: new 'python' job (ruff + mypy --strict + pytest --cov-fail-under=70)
- config.example.toml + README setup section + .gitignore Python entries

Neutral VmBackend Protocol prepared for Phase C ESXi extension.
See plans/implementation-plan-A-B.md step A1.
 2026-05-14 18:34:02 +02:00
Simone 3592dcab78 Refactor documentation and analysis in final master plan, opus47 analysis, and opus47 review of GPT-5.5 
- Updated the final master plan to improve clarity and consistency in the status of various capabilities, including fixes and enhancements made as of 2026-05-12.
- Revised the opus47 analysis to provide a more structured overview of the system's production readiness, including detailed coverage of OWASP Top 10 risks and operational gaps.
- Enhanced the opus47 review of GPT-5.5 by clarifying severity ratings and rationales for various items, while adding new high-severity items that were previously overlooked.
 2026-05-13 00:08:19 +02:00
Simone 5d1b47e943 feat(workflow): rinomina build-nsis.yml -> build-nsInnoUnp.yml, aggiunge job release 
- Rinominato gitea/workflows/build-nsis.yml in build-nsInnoUnp.yml
- Aggiunto job release: scarica artifact Windows+Linux, crea release Gitea
  via API REST, comprime e uploada gli asset come zip (richiede secret GITEA_TOKEN)
- Aggiornati tutti i riferimenti in README.md, TODO.md, plans/*.md
 2026-05-12 23:37:00 +02:00
Simone 075d1c5dcf docs(readme): sync con stato attuale (Linux support, burn-in, transport, action.yml) 
- Stato: aggiornato (Windows+Linux e2e PASS, burn-in 4 job concorrenti PASS)
- Panoramica: diagram aggiornato con Linux/SSH path e dual runner label
- Template VM: aggiunta sezione LinuxBuild2404 (BaseClean-Linux, SSH, ci_build)
- Struttura: aggiunti _Transport.psm1, Test-CapacityBurnIn, Start-BurnInTest-Linux,
  Get-CIJobSummary, template Linux (Deploy/Prepare/Install-CIToolchain), actions/
- Setup rapido: separato in 1a Windows / 1b Linux con Prepare-LinuxBuild2404 -TakeSnapshot
- act_runner: tabella env vars completa (LINUX_TEMPLATE_PATH, SSH_KEY_PATH, ...)
  + labels windows-build:host e linux-build:host
- Uso build manuale: aggiunto esempio Linux guest + note -UseGitClone/-SkipArtifact
- Workflow: composite action documentata con tabella input; matrix Windows+Linux
- Docs: LINUX-TEMPLATE-SETUP.md non piu' 'non implementato'
 2026-05-12 23:23:50 +02:00
Simone 4758fbc519 refactor(§7.5): rinomina Setup-* Install-CIToolchain-* (WinBuild2025/2022/Linux2404) 
- template/Setup-WinBuild2025.ps1  Install-CIToolchain-WinBuild2025.ps1
- template/Setup-WinBuild2022.ps1  Install-CIToolchain-WinBuild2022.ps1
- template/Setup-LinuxBuild2404.sh  Install-CIToolchain-Linux2404.sh

Aggiornati tutti i riferimenti in: Prepare-WinBuild2025/2022, Prepare-LinuxBuild2404,
Deploy-WinBuild2025/2022/LinuxBuild2404, Validate-DeployState, Validate-SetupState,
README.md, TODO.md, docs/WINDOWS-TEMPLATE-SETUP.md, docs/LINUX-TEMPLATE-SETUP.md,
docs/TEST-PLAN-v1.3-to-HEAD.md, gitea/actions/local-ci-build/action.yml.

§7 chiuso (5/5 done).
 2026-05-11 22:48:33 +02:00
Simone f64880129a docs: add Deploy step + 2022 variant to Setup rapido and WINDOWS-TEMPLATE-SETUP 2026-05-10 23:18:04 +02:00
Simone 90a4396443 feat: enhance documentation and scripts for in-VM Git cloning and template setup 
- Updated README.md to reflect the new in-VM git clone feature with `-UseGitClone`.
- Modified Setup-Host.ps1 to correct VMX path references.
- Revised various documentation files (ARCHITECTURE.md, CI-FLOW.md, HOST-SETUP.md, WINDOWS-TEMPLATE-SETUP.md) to include updated paths and features.
- Added Setup-GiteaSSH.md for SSH configuration instructions.
- Archived outdated documentation and updated README.md for clarity on current resources.
 2026-05-10 23:03:56 +02:00
Simone 914072fdd8 refactor(config): Update VMX path from CI-WinBuild to WinBuild2025 
Replace all references to CI-WinBuild.vmx with WinBuild2025.vmx.
Update template path: F:\CI\Templates\WinBuild\ → F:\CI\Templates\WinBuild2025\

Files affected:
- runner/config.yaml: GITEA_CI_TEMPLATE_PATH env var
- docs: HOST-SETUP.md, WINDOWS-TEMPLATE-SETUP.md, TEST-PLAN, RUNBOOK
- scripts: Measure-CIBenchmark, Set-TemplateSharedFolders, Test-NsinnounpBuild
- TODO.md, Setup-Host.ps1, README.md

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-10 20:46:36 +02:00
Simone 68cde01c9d security(sprint1): §1.1/1.3/1.4 — WinRM HTTPS/5986, SHA256 pinning infra, IP regex per-octet 
§1.4 — Replace loose IP ValidatePattern with per-octet regex in 4 scripts
  (Invoke-CIJob, Invoke-RemoteBuild, Get-BuildArtifacts, Wait-VMReady)

§1.1 — Migrate all WinRM connections from HTTP/5985 to HTTPS/5986
  - Deploy post-install.ps1: remove AllowUnencrypted=true; self-signed cert + HTTPS listener
    already present; firewall rule restricted to 192.168.79.0/24
  - Setup-WinBuild2025.ps1: assert AllowUnencrypted=false
  - Prepare-WinBuild2025.ps1: preflight uses TCP/5986; Test-WSMan -UseSSL -Port 5986;
    New-PSSession -UseSSL -Port 5986; host AllowUnencrypted save/restore removed (not needed for HTTPS)
  - Invoke-RemoteBuild, Get-BuildArtifacts: New-PSSession -UseSSL -Port 5986 -Authentication Basic
  - Wait-VMReady: New-WSManSessionOption + Test-WSMan -Port 5986 -UseSSL
  - Validate-DeployState, Validate-SetupState: Invoke-Command -UseSSL -Port 5986,
    AllowUnencrypted check → false; AllowUnencrypted host-side removed from both
  - Docs: PLAN, README, ARCHITECTURE, BEST-PRACTICES, HOST-SETUP, WINDOWS-TEMPLATE-SETUP,
    LINUX-TEMPLATE-SETUP, TODO updated

§1.3 — SHA256 hash pinning infrastructure
  - Assert-Hash function + $script:Hashes hashtable added to Setup-WinBuild2025.ps1
  - Assert-Hash called after dotnet-install.ps1, python installer, vs_buildtools.exe downloads
  - Hashes initialized to '' (warn-skip); must be filled before next snapshot refresh

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-10 14:46:41 +02:00
Simone 644258f59c refactor(template): rename Setup-TemplateVM.ps1 -> Setup-WinBuild2025.ps1 
- git mv Setup-TemplateVM.ps1 Setup-WinBuild2025.ps1
- git mv Prepare-TemplateSetup.ps1 -> Prepare-WinBuild2025.ps1 (name already in place)
- Updated all references across the workspace:
    template/Prepare-WinBuild2025.ps1 (script copy, assertions, comments)
    template/Setup-WinBuild2025.ps1 (self-references in docblock and final message)
    README.md (directory tree)
    TODO.md (all inline links and task descriptions)
    docs/WINDOWS-TEMPLATE-SETUP.md (table, step descriptions, phase header, troubleshooting)
    docs/LINUX-TEMPLATE-SETUP.md (Windows equivalent reference)
 2026-05-09 23:28:36 +02:00
Simone f373c0c24b fix: apply all FIX-TODO items (P0/P1/P2) 
P0 bugs:
- Invoke-CIJob.ps1: skip --depth 1 when $Commit specified (shallow clone
  + checkout specific commit was silently failing)
- Get-BuildArtifacts.ps1: check .Length -eq 0 not rounded sizeKB (false
  fail on artifacts smaller than 50 bytes)
- build-nsis.yml: upgrade upload-artifact v3 -> v4 (v3 deprecated)

P0 security:
- Remove hardcoded default password CIBuild!ChangeMe2026 from all scripts,
  README, TODO; prompt Read-Host -AsSecureString at runtime instead
- Setup-TemplateVM.ps1: replace `net user $u $p /add` (password in argv /
  audit log 4688) with New-LocalUser + local ConvertTo-SecureString
- Prepare-TemplateSetup.ps1: save and restore WSMan AllowUnencrypted +
  TrustedHosts in finally block (was permanently mutating host WinRM config)
- Setup-TemplateVM.ps1: remove duplicate MaxMemoryPerShellMB (winrm set
  + Set-Item both setting same value)

P1 doc (stale Host-Only / VMnet11 era):
- Setup-TemplateVM.ps1: rewrite NETWORK REQUIREMENT block + final steps
  (system uses VMnet8 NAT permanently, not VMnet11 Host-Only)
- Invoke-CIJob.ps1 Phase 1 comment: correct network model
- ARCHITECTURE.md: remove Git from toolchain list (not installed); clarify
  zip-transfer rationale (no PAT in VM, not network isolation)
- BEST-PRACTICES.md: rewrite Step 8 as NAT topology verification

P1 minor:
- Invoke-RemoteBuild.ps1: remove wasted first New-Item (created then
  immediately removed and recreated)
- Wait-VMReady.ps1: remove unused $elapsed; simplify try/catch around
  native command (exit codes don't throw)
- Install-Runner.ps1: add deprecation notice pointing to Setup-Host.ps1

P2 operational:
- Add scripts/Cleanup-OrphanedBuildVMs.ps1 with -WhatIf support
- Get-BuildArtifacts.ps1 -IncludeLogs: add -Recurse (msbuild logs in subdir)
- Add gitea/workflows/lint.yml (PSScriptAnalyzer on .ps1 push/PR)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-09 00:39:52 +02:00
Simone 71f1aa2e3b feat: add Setup-Host.ps1 host bootstrap script (dirs, credentials, act_runner service) 2026-05-09 00:11:33 +02:00
Simone a05855ddfe docs: restore README tree after root duplicate removal 2026-05-09 00:08:17 +02:00
Simone 2f6add1fab feat: populate root Setup-TemplateVM.ps1 (convenience copy of template/Setup-TemplateVM.ps1) 2026-05-09 00:05:49 +02:00
Simone 968f01e398 docs: add README.md 2026-05-08 23:42:24 +02:00