# §7.4 — E2e test refactor Deploy↔Setup

Valida che il refactor §7 (2026-05-10) funzioni su VM reale:
Deploy possiede OS hardening → Setup valida senza re-applicare.

**Non toccare l'existing template** (`CI-WinBuild.vmx` + snapshot `BaseClean`).
Usare VM separata per i test.

---

## Prerequisiti

- `F:\CI\ISO\26100.1742.240906-0331.ge_release_svc_refresh_SERVER_VOL_x64FRE_en-us.iso` presente
- `F:\CI\ISO\VMware-tools-windows.iso` presente
- VMware Workstation aperto, sufficiente spazio su `F:\CI\Templates\WinBuildTest\`

---

## Step 1 — Deploy su VM test

```powershell
cd N:\Code\Workspace\Local-CI-CD-System\template

.\Deploy-WinBuild2025.ps1 `
    -WinISO   'F:\CI\ISO\26100.1742.240906-0331.ge_release_svc_refresh_SERVER_VOL_x64FRE_en-us.iso' `
    -ToolsISO 'F:\CI\ISO\VMware-tools-windows.iso' `
    -VMXPath  'F:\CI\Templates\WinBuildTest\CI-WinBuild-test.vmx' `
    -VMName   'WinBuild2025-test' `
    -ProductKey 'TVRH6-WHNXV-R9WG3-9XRFY-MY832'
```

Durata attesa: 30–90 min. Exit 0 = OK, snapshot `PostInstall` preso automaticamente.

Se timeout su `install_complete.flag`: aumentare `-GuestPollMaxMinutes 120`.

---

## Step 2 — Verifica stato Deploy (§7.1 + §7.2)

Sostituire `192.168.79.xxx` con IP reale della VM test (`ipconfig` dentro la VM).

```powershell
$ip   = '192.168.79.xxx'
$cred = Get-Credential   # Administrator / WinBuild!
$so   = New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck

Invoke-Command -ComputerName $ip -Credential $cred `
    -Authentication Basic -SessionOption $so -ScriptBlock {

    "=== §7.1 Firewall ==="
    Get-NetFirewallProfile | Select-Object Name, Enabled

    "=== §7.2 WU services ==="
    Get-Service wuauserv, UsoSvc | Select-Object Name, StartType, Status

    "=== §7.2 WU GPO ==="
    $au = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU'
    $wu = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate'
    [PSCustomObject]@{
        NoAutoUpdate              = (Get-ItemProperty $au  -EA SilentlyContinue).NoAutoUpdate
        DisableWindowsUpdateAccess = (Get-ItemProperty $wu -EA SilentlyContinue).DisableWindowsUpdateAccess
    }

    "=== §7.1 WinRM limits ==="
    [PSCustomObject]@{
        MaxMemoryPerShellMB = (Get-Item WSMan:\localhost\Shell\MaxMemoryPerShellMB).Value
        IdleTimeOut         = (Get-Item WSMan:\localhost\Shell\IdleTimeOut).Value
    }

    "=== §7.1 UAC ==="
    Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' |
        Select-Object EnableLUA, LocalAccountTokenFilterPolicy
}
```

**Atteso**:
| Check | Valore atteso |
|---|---|
| Firewall tutti profili | `Enabled=False` |
| `wuauserv` StartType | `Manual` |
| `UsoSvc` StartType | `Manual` |
| `NoAutoUpdate` | `1` |
| `DisableWindowsUpdateAccess` | `1` |
| `MaxMemoryPerShellMB` | `>= 2048` |
| `EnableLUA` | `0` |

---

## Step 3 — Prepare -SkipWindowsUpdate (Assert-Step validation)

```powershell
.\Prepare-WinBuild2025.ps1 `
    -VMIPAddress 192.168.79.xxx `
    -SkipWindowsUpdate
```

**Cosa verificare nel log**:
- Step 1 (Firewall): solo `[OK]` — nessun `Set-NetFirewallProfile`
- Step 3 (WinRM): solo `[OK]` — nessun `Enable-PSRemoting` né `winrm set`
- Step 4b (UAC): solo `[OK]` — nessun `Set-ItemProperty EnableLUA`
- Step 5b (Explorer): solo `[OK]`
- Step 5c (CIUX): solo `[OK]`
- Step 4 (user `ci_build`): crea utente — operativo, non validation
- Step 5 (CI dirs): crea `C:\CI\{build,output,scripts}` — operativo
- Step 6: `[Setup] Skipping Windows Update` — corretto con `-SkipWindowsUpdate`
- Step 6b: disabilita wuauserv/UsoSvc — deve girare sempre
- Step 7-10: .NET, Python, VS Build Tools installati
- Final gate: tutti e 7 i check `[OK]`
- Exit code: `0`

Se un Assert-Step fallisce con `[FAIL]` su Step 1/3/4b/5b/5c → Deploy non ha applicato
quel setting → debug Deploy post-install.ps1 (controllare log nella VM).

---

## Step 4 — Prepare senza -Skip (WU lifecycle §7.2)

> Solo se Step 3 è passato. La VM deve avere internet (VMnet8 NAT).

```powershell
.\Prepare-WinBuild2025.ps1 -VMIPAddress 192.168.79.xxx
```

**Atteso**:
- Step 6 Step A: rimuove `DisableWindowsUpdateAccess` e `NoAutoUpdate` GPO keys
- Step 6 Step D: avvia wuauserv/UsoSvc/bits/cryptsvc (già Manual → solo Start)
- Step 6: WU gira via SchTask SYSTEM, ResultCode ∈ {0, 2, 3}
- Step 6b: `wuauserv StartType=Disabled`, `UsoSvc StartType=Disabled`, GPO keys re-scritti
- Final gate `Windows Update permanently disabled` → `[OK]`
- Exit code: `0` (o `3010` se WU richiede reboot — ripetere con `-SkipWindowsUpdate`)

---

## Step 5 — Snapshot e promozione (opzionale)

Se tutti i check di Step 3 e 4 passano:

```powershell
# Spegni VM test
& 'C:\Program Files (x86)\VMware\VMware Workstation\vmrun.exe' `
    -T ws stop 'F:\CI\Templates\WinBuildTest\CI-WinBuild-test.vmx' soft

# Snapshot versionato
& 'C:\Program Files (x86)\VMware\VMware Workstation\vmrun.exe' `
    -T ws snapshot 'F:\CI\Templates\WinBuildTest\CI-WinBuild-test.vmx' `
    "BaseClean_$(Get-Date -Format yyyyMMdd)"
```

Per promuovere a produzione (rimpiazza template esistente):
1. Copia `F:\CI\Templates\WinBuildTest\` → `F:\CI\Templates\WinBuild\` (backup prima)
2. Aggiorna `GITEA_CI_TEMPLATE_PATH` in `runner/config.yaml` se path cambia
3. Aggiorna `GITEA_CI_SNAPSHOT_NAME` se usi nome versionato (vedi TODO §2.5)

---

## Checklist §7.4

- [ ] Step 1: Deploy exit 0, snapshot `PostInstall` presente
- [ ] Step 2: Firewall=False, wuauserv=Manual, NoAutoUpdate=1, MaxMemory≥2048, UAC=0
- [ ] Step 3: Prepare `-SkipWindowsUpdate` exit 0, nessun Set in Step 1/3/4b/5b/5c
- [ ] Step 4: Prepare senza `-Skip` exit 0, wuauserv=Disabled post-Step 6b