Simone
7d6ae42fcf
Fix emerged during §7.4 e2e test run (2026-05-10): - Deploy: set UsoSvc to Manual explicitly (Server 2025 default = Automatic) - Setup cleanup: re-apply Set-Service Disabled on wuauserv/UsoSvc after DISM StartComponentCleanup (WaaSMedicSvc resets StartType during component store cleanup) - Deploy + Setup: add Administrator autologin (AutoAdminLogon, DefaultUserName, DefaultPassword, DefaultDomainName) in post-install.ps1; Assert-Step 5c validates it - Add Validate-DeployState.ps1: standalone host-side check of all Deploy-set state - Add Validate-SetupState.ps1: standalone host-side check of full post-Setup state - Mark §7.4, §7.1 and §7.2 e2e validation items as complete in TODO.md - Update docs: WINDOWS-TEMPLATE-SETUP.md (arch table, validation scripts section, autologin in confine Deploy/Setup); TEST-7.4-e2e.md checklist marked done Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
170 lines
6.2 KiB
Markdown
170 lines
6.2 KiB
Markdown
# §7.4 — E2e test refactor Deploy↔Setup
|
||
|
||
Valida che il refactor §7 (2026-05-10) funzioni su VM reale:
|
||
Deploy possiede OS hardening → Setup valida senza re-applicare.
|
||
|
||
**Non toccare l'existing template** (`CI-WinBuild.vmx` + snapshot `BaseClean`).
|
||
Usare VM separata per i test.
|
||
|
||
---
|
||
|
||
## Prerequisiti
|
||
|
||
- `F:\CI\ISO\26100.1742.240906-0331.ge_release_svc_refresh_SERVER_VOL_x64FRE_en-us.iso` presente
|
||
- `F:\CI\ISO\VMware-tools-windows.iso` presente
|
||
- VMware Workstation aperto, sufficiente spazio su `F:\CI\Templates\WinBuildTest\`
|
||
|
||
---
|
||
|
||
## Step 1 — Deploy su VM test
|
||
|
||
```powershell
|
||
cd N:\Code\Workspace\Local-CI-CD-System\template
|
||
|
||
.\Deploy-WinBuild2025.ps1 `
|
||
-WinISO 'F:\CI\ISO\26100.1742.240906-0331.ge_release_svc_refresh_SERVER_VOL_x64FRE_en-us.iso' `
|
||
-ToolsISO 'F:\CI\ISO\VMware-tools-windows.iso' `
|
||
-VMXPath 'F:\CI\Templates\WinBuildTest\CI-WinBuild-test.vmx' `
|
||
-VMName 'WinBuild2025-test' `
|
||
-ProductKey 'TVRH6-WHNXV-R9WG3-9XRFY-MY832'
|
||
```
|
||
|
||
Durata attesa: 30–90 min. Exit 0 = OK, snapshot `PostInstall` preso automaticamente.
|
||
|
||
Se timeout su `install_complete.flag`: aumentare `-GuestPollMaxMinutes 120`.
|
||
|
||
---
|
||
|
||
## Step 2 — Verifica stato Deploy (§7.1 + §7.2)
|
||
|
||
Sostituire `192.168.79.xxx` con IP reale della VM test (`ipconfig` dentro la VM).
|
||
|
||
```powershell
|
||
$ip = '192.168.79.xxx'
|
||
$cred = Get-Credential # Administrator / WinBuild!
|
||
$so = New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck
|
||
|
||
Invoke-Command -ComputerName $ip -Credential $cred `
|
||
-Authentication Basic -SessionOption $so -ScriptBlock {
|
||
|
||
"=== §7.1 Firewall ==="
|
||
Get-NetFirewallProfile | Select-Object Name, Enabled
|
||
|
||
"=== §7.2 WU services ==="
|
||
Get-Service wuauserv, UsoSvc | Select-Object Name, StartType, Status
|
||
|
||
"=== §7.2 WU GPO ==="
|
||
$au = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU'
|
||
$wu = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate'
|
||
[PSCustomObject]@{
|
||
NoAutoUpdate = (Get-ItemProperty $au -EA SilentlyContinue).NoAutoUpdate
|
||
DisableWindowsUpdateAccess = (Get-ItemProperty $wu -EA SilentlyContinue).DisableWindowsUpdateAccess
|
||
}
|
||
|
||
"=== §7.1 WinRM limits ==="
|
||
[PSCustomObject]@{
|
||
MaxMemoryPerShellMB = (Get-Item WSMan:\localhost\Shell\MaxMemoryPerShellMB).Value
|
||
IdleTimeOut = (Get-Item WSMan:\localhost\Shell\IdleTimeOut).Value
|
||
}
|
||
|
||
"=== §7.1 UAC ==="
|
||
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' |
|
||
Select-Object EnableLUA, LocalAccountTokenFilterPolicy
|
||
}
|
||
```
|
||
|
||
**Atteso**:
|
||
| Check | Valore atteso |
|
||
|---|---|
|
||
| Firewall tutti profili | `Enabled=False` |
|
||
| `wuauserv` StartType | `Manual` |
|
||
| `UsoSvc` StartType | `Manual` |
|
||
| `NoAutoUpdate` | `1` |
|
||
| `DisableWindowsUpdateAccess` | `1` |
|
||
| `MaxMemoryPerShellMB` | `>= 2048` |
|
||
| `EnableLUA` | `0` |
|
||
|
||
---
|
||
|
||
## Step 3 — Prepare -SkipWindowsUpdate (Assert-Step validation)
|
||
|
||
```powershell
|
||
.\Prepare-WinBuild2025.ps1 `
|
||
-VMIPAddress 192.168.79.xxx `
|
||
-SkipWindowsUpdate
|
||
```
|
||
|
||
**Cosa verificare nel log**:
|
||
- Step 1 (Firewall): solo `[OK]` — nessun `Set-NetFirewallProfile`
|
||
- Step 3 (WinRM): solo `[OK]` — nessun `Enable-PSRemoting` né `winrm set`
|
||
- Step 4b (UAC): solo `[OK]` — nessun `Set-ItemProperty EnableLUA`
|
||
- Step 5b (Explorer): solo `[OK]`
|
||
- Step 5c (CIUX): solo `[OK]`
|
||
- Step 4 (user `ci_build`): crea utente — operativo, non validation
|
||
- Step 5 (CI dirs): crea `C:\CI\{build,output,scripts}` — operativo
|
||
- Step 6: `[Setup] Skipping Windows Update` — corretto con `-SkipWindowsUpdate`
|
||
- Step 6b: disabilita wuauserv/UsoSvc — deve girare sempre
|
||
- Step 7-10: .NET, Python, VS Build Tools installati
|
||
- Final gate: tutti e 7 i check `[OK]`
|
||
- Exit code: `0`
|
||
|
||
Se un Assert-Step fallisce con `[FAIL]` su Step 1/3/4b/5b/5c → Deploy non ha applicato
|
||
quel setting → debug Deploy post-install.ps1 (controllare log nella VM).
|
||
|
||
---
|
||
|
||
## Step 4 — Prepare senza -Skip (WU lifecycle §7.2)
|
||
|
||
> Solo se Step 3 è passato. La VM deve avere internet (VMnet8 NAT).
|
||
|
||
```powershell
|
||
.\Prepare-WinBuild2025.ps1 -VMIPAddress 192.168.79.xxx
|
||
```
|
||
|
||
**Atteso**:
|
||
- Step 6 Step A: rimuove `DisableWindowsUpdateAccess` e `NoAutoUpdate` GPO keys
|
||
- Step 6 Step D: avvia wuauserv/UsoSvc/bits/cryptsvc (già Manual → solo Start)
|
||
- Step 6: WU gira via SchTask SYSTEM, ResultCode ∈ {0, 2, 3}
|
||
- Step 6b: `wuauserv StartType=Disabled`, `UsoSvc StartType=Disabled`, GPO keys re-scritti
|
||
- Final gate `Windows Update permanently disabled` → `[OK]`
|
||
- Exit code: `0` (o `3010` se WU richiede reboot — ripetere con `-SkipWindowsUpdate`)
|
||
|
||
---
|
||
|
||
## Step 5 — Snapshot e promozione (opzionale)
|
||
|
||
Se tutti i check di Step 3 e 4 passano:
|
||
|
||
```powershell
|
||
# Spegni VM test
|
||
& 'C:\Program Files (x86)\VMware\VMware Workstation\vmrun.exe' `
|
||
-T ws stop 'F:\CI\Templates\WinBuildTest\CI-WinBuild-test.vmx' soft
|
||
|
||
# Snapshot versionato
|
||
& 'C:\Program Files (x86)\VMware\VMware Workstation\vmrun.exe' `
|
||
-T ws snapshot 'F:\CI\Templates\WinBuildTest\CI-WinBuild-test.vmx' `
|
||
"BaseClean_$(Get-Date -Format yyyyMMdd)"
|
||
```
|
||
|
||
Per promuovere a produzione (rimpiazza template esistente):
|
||
1. Copia `F:\CI\Templates\WinBuildTest\` → `F:\CI\Templates\WinBuild\` (backup prima)
|
||
2. Aggiorna `GITEA_CI_TEMPLATE_PATH` in `runner/config.yaml` se path cambia
|
||
3. Aggiorna `GITEA_CI_SNAPSHOT_NAME` se usi nome versionato (vedi TODO §2.5)
|
||
|
||
---
|
||
|
||
## Checklist §7.4 — COMPLETATA 2026-05-10
|
||
|
||
- [x] Step 1: Deploy exit 0, snapshot `PostInstall` presente
|
||
- [x] Step 2: Firewall=False, wuauserv=Manual, NoAutoUpdate=1, MaxMemory≥2048, UAC=0
|
||
(UsoSvc era Automatic — fix applicato in Deploy; corretto manualmente sulla VM test)
|
||
- [x] Step 3: Prepare `-SkipWindowsUpdate` exit 0, nessun Set in Step 1/3/4b/5b/5c
|
||
- [x] Step 4: Prepare senza `-Skip` exit 0 (WU: 0 update, ResultCode=0), wuauserv=Disabled post-Step 6b
|
||
- [x] Snapshot `BaseClean` preso con successo
|
||
|
||
**Fix applicati durante il test**:
|
||
- Deploy: `UsoSvc` esplicitamente a `Manual` (era omesso, default Server 2025 = Automatic)
|
||
- Setup cleanup: ri-applica `Disabled` su wuauserv/UsoSvc dopo DISM (WaaSMedicSvc resets StartType)
|
||
- Deploy + Setup 5c: autologin Administrator (`AutoAdminLogon=1`, `DefaultUserName`, `DefaultPassword`, `DefaultDomainName`)
|
||
- Nuovi: `Validate-DeployState.ps1`, `Validate-SetupState.ps1`
|