Simone
f373c0c24b
P0 bugs: - Invoke-CIJob.ps1: skip --depth 1 when $Commit specified (shallow clone + checkout specific commit was silently failing) - Get-BuildArtifacts.ps1: check .Length -eq 0 not rounded sizeKB (false fail on artifacts smaller than 50 bytes) - build-nsis.yml: upgrade upload-artifact v3 -> v4 (v3 deprecated) P0 security: - Remove hardcoded default password CIBuild!ChangeMe2026 from all scripts, README, TODO; prompt Read-Host -AsSecureString at runtime instead - Setup-TemplateVM.ps1: replace `net user $u $p /add` (password in argv / audit log 4688) with New-LocalUser + local ConvertTo-SecureString - Prepare-TemplateSetup.ps1: save and restore WSMan AllowUnencrypted + TrustedHosts in finally block (was permanently mutating host WinRM config) - Setup-TemplateVM.ps1: remove duplicate MaxMemoryPerShellMB (winrm set + Set-Item both setting same value) P1 doc (stale Host-Only / VMnet11 era): - Setup-TemplateVM.ps1: rewrite NETWORK REQUIREMENT block + final steps (system uses VMnet8 NAT permanently, not VMnet11 Host-Only) - Invoke-CIJob.ps1 Phase 1 comment: correct network model - ARCHITECTURE.md: remove Git from toolchain list (not installed); clarify zip-transfer rationale (no PAT in VM, not network isolation) - BEST-PRACTICES.md: rewrite Step 8 as NAT topology verification P1 minor: - Invoke-RemoteBuild.ps1: remove wasted first New-Item (created then immediately removed and recreated) - Wait-VMReady.ps1: remove unused $elapsed; simplify try/catch around native command (exit codes don't throw) - Install-Runner.ps1: add deprecation notice pointing to Setup-Host.ps1 P2 operational: - Add scripts/Cleanup-OrphanedBuildVMs.ps1 with -WhatIf support - Get-BuildArtifacts.ps1 -IncludeLogs: add -Recurse (msbuild logs in subdir) - Add gitea/workflows/lint.yml (PSScriptAnalyzer on .ps1 push/PR) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
62 lines
3.2 KiB
Markdown
62 lines
3.2 KiB
Markdown
# FIX-TODO — Local CI/CD System
|
|
|
|
<!-- Generato: 2026-05-09 — review post e2e-009 SUCCESS -->
|
|
<!-- Completato: 2026-05-09 — tutti gli item risolti in commit separato -->
|
|
|
|
Lista di fix prioritizzati emersi dalla review. Tutti i P0/P1/P2 sono stati applicati.
|
|
|
|
---
|
|
|
|
## P0 — Bug funzionali ✅
|
|
|
|
- [x] **Shallow clone vs checkout commit specifico** — `scripts/Invoke-CIJob.ps1`
|
|
Fix: `--depth 1` saltato quando `$Commit` è valorizzato; clone completo + checkout.
|
|
|
|
- [x] **Falso negativo size artifact** — `scripts/Get-BuildArtifacts.ps1`
|
|
Fix: validazione su `.Length -eq 0` (raw byte), non su KB arrotondati.
|
|
|
|
- [x] **`actions/upload-artifact@v3` deprecato** — `gitea/workflows/build-nsis.yml`
|
|
Fix: aggiornato a `@v4`.
|
|
|
|
## P0 — Sicurezza ✅
|
|
|
|
- [x] **Password CI hardcoded committata** — rimossa da tutti i file:
|
|
`Setup-Host.ps1`, `template/Prepare-TemplateSetup.ps1`,
|
|
`template/Setup-TemplateVM.ps1`, `README.md`, `TODO.md`.
|
|
Ora: prompt `Read-Host -AsSecureString` se non passata a runtime.
|
|
|
|
- [x] **Password in argv (`net user`)** — `template/Setup-TemplateVM.ps1`
|
|
Fix: `New-LocalUser` con `ConvertTo-SecureString` locale (nessun argomento esposto).
|
|
|
|
- [x] **`WSMan AllowUnencrypted` modificato senza restore** — `template/Prepare-TemplateSetup.ps1`
|
|
Fix: salva stato precedente, ripristina in `finally`.
|
|
|
|
## P1 — Doc obsolete ✅
|
|
|
|
- [x] `Setup-TemplateVM.ps1`: blocco NETWORK REQUIREMENT e istruzioni finali aggiornati (VMnet8 NAT permanente, no VMnet11).
|
|
- [x] `Setup-TemplateVM.ps1:205`: commento firewall aggiornato (VMnet8 NAT, non VMnet11).
|
|
- [x] `scripts/Invoke-CIJob.ps1:193`: commento Phase 1 aggiornato (NAT, motivo zip = no PAT in VM).
|
|
- [x] `docs/BEST-PRACTICES.md` Step 8: riscritto come "Network Topology Verification" (NAT OK, non host-only).
|
|
- [x] `docs/ARCHITECTURE.md:119`: rimosso "Git" dalla toolchain (non installato di default).
|
|
- [x] `docs/ARCHITECTURE.md:194`: riformulato (NAT per pip/nuget, zip per no-PAT in VM).
|
|
|
|
## P1 — Bug minori ✅
|
|
|
|
- [x] `scripts/Invoke-RemoteBuild.ps1`: primo `New-Item` sprecato rimosso.
|
|
- [x] `scripts/Wait-VMReady.ps1`: `$elapsed` dead code rimosso; try/catch su native command semplificato.
|
|
- [x] `template/Setup-TemplateVM.ps1`: `MaxMemoryPerShellMB` settato una volta sola (rimosso `winrm set` duplicato).
|
|
- [x] `runner/Install-Runner.ps1`: nota deprecazione aggiunta — usare `Setup-Host.ps1`.
|
|
|
|
## P2 — Operativo ✅
|
|
|
|
- [x] `scripts/Cleanup-OrphanedBuildVMs.ps1` creato — con `-WhatIf`, soglia `-MaxAgeHours`, hard stop + deleteVM + rimozione dir.
|
|
- [x] `scripts/Get-BuildArtifacts.ps1 -IncludeLogs`: aggiunto `-Recurse` per catturare log in subdir.
|
|
- [x] `gitea/workflows/lint.yml` creato — PSScriptAnalyzer su push/PR che toccano file `.ps1`.
|
|
|
|
## Rimasto aperto (fuori scope di questo fix)
|
|
|
|
- [ ] `-UseGitClone` in-VM: PAT injection, git in template, e2e-010. Vedi `TODO.md` sezione "In-VM Git Clone".
|
|
- [ ] Verifica SHA256 installer (Python, VS BuildTools, dotnet-install.ps1) — richiede parametri hash per versione.
|
|
- [ ] Validazione IP ottetti 0-255 in `Invoke-CIJob.ps1` (ValidatePattern attuale accetta 999.x.x.x).
|
|
- [ ] Scheduled task per `Cleanup-OrphanedBuildVMs.ps1` — da creare manualmente o via `Setup-Host.ps1`.
|