Simone/local-ci-cd-system
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
53b7ff05fdd3129554a426870ea184692dc360a2
local-ci-cd-system/FIX-TODO.md
T
Simone f373c0c24b fix: apply all FIX-TODO items (P0/P1/P2) 
P0 bugs:
- Invoke-CIJob.ps1: skip --depth 1 when $Commit specified (shallow clone
  + checkout specific commit was silently failing)
- Get-BuildArtifacts.ps1: check .Length -eq 0 not rounded sizeKB (false
  fail on artifacts smaller than 50 bytes)
- build-nsis.yml: upgrade upload-artifact v3 -> v4 (v3 deprecated)

P0 security:
- Remove hardcoded default password CIBuild!ChangeMe2026 from all scripts,
  README, TODO; prompt Read-Host -AsSecureString at runtime instead
- Setup-TemplateVM.ps1: replace `net user $u $p /add` (password in argv /
  audit log 4688) with New-LocalUser + local ConvertTo-SecureString
- Prepare-TemplateSetup.ps1: save and restore WSMan AllowUnencrypted +
  TrustedHosts in finally block (was permanently mutating host WinRM config)
- Setup-TemplateVM.ps1: remove duplicate MaxMemoryPerShellMB (winrm set
  + Set-Item both setting same value)

P1 doc (stale Host-Only / VMnet11 era):
- Setup-TemplateVM.ps1: rewrite NETWORK REQUIREMENT block + final steps
  (system uses VMnet8 NAT permanently, not VMnet11 Host-Only)
- Invoke-CIJob.ps1 Phase 1 comment: correct network model
- ARCHITECTURE.md: remove Git from toolchain list (not installed); clarify
  zip-transfer rationale (no PAT in VM, not network isolation)
- BEST-PRACTICES.md: rewrite Step 8 as NAT topology verification

P1 minor:
- Invoke-RemoteBuild.ps1: remove wasted first New-Item (created then
  immediately removed and recreated)
- Wait-VMReady.ps1: remove unused $elapsed; simplify try/catch around
  native command (exit codes don't throw)
- Install-Runner.ps1: add deprecation notice pointing to Setup-Host.ps1

P2 operational:
- Add scripts/Cleanup-OrphanedBuildVMs.ps1 with -WhatIf support
- Get-BuildArtifacts.ps1 -IncludeLogs: add -Recurse (msbuild logs in subdir)
- Add gitea/workflows/lint.yml (PSScriptAnalyzer on .ps1 push/PR)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-09 00:39:52 +02:00

3.2 KiB
Raw Blame History

FIX-TODO — Local CI/CD System

Lista di fix prioritizzati emersi dalla review. Tutti i P0/P1/P2 sono stati applicati.

P0 — Bug funzionali ✅

  • Shallow clone vs checkout commit specifico — scripts/Invoke-CIJob.ps1 Fix: --depth 1 saltato quando $Commit è valorizzato; clone completo + checkout.

  • Falso negativo size artifact — scripts/Get-BuildArtifacts.ps1 Fix: validazione su .Length -eq 0 (raw byte), non su KB arrotondati.

  • actions/upload-artifact@v3 deprecato — gitea/workflows/build-nsis.yml Fix: aggiornato a @v4.

P0 — Sicurezza ✅

  • Password CI hardcoded committata — rimossa da tutti i file: Setup-Host.ps1, template/Prepare-TemplateSetup.ps1, template/Setup-TemplateVM.ps1, README.md, TODO.md. Ora: prompt Read-Host -AsSecureString se non passata a runtime.

  • Password in argv (net user) — template/Setup-TemplateVM.ps1 Fix: New-LocalUser con ConvertTo-SecureString locale (nessun argomento esposto).

  • WSMan AllowUnencrypted modificato senza restore — template/Prepare-TemplateSetup.ps1 Fix: salva stato precedente, ripristina in finally.

P1 — Doc obsolete ✅

  • Setup-TemplateVM.ps1: blocco NETWORK REQUIREMENT e istruzioni finali aggiornati (VMnet8 NAT permanente, no VMnet11).
  • Setup-TemplateVM.ps1:205: commento firewall aggiornato (VMnet8 NAT, non VMnet11).
  • scripts/Invoke-CIJob.ps1:193: commento Phase 1 aggiornato (NAT, motivo zip = no PAT in VM).
  • docs/BEST-PRACTICES.md Step 8: riscritto come "Network Topology Verification" (NAT OK, non host-only).
  • docs/ARCHITECTURE.md:119: rimosso "Git" dalla toolchain (non installato di default).
  • docs/ARCHITECTURE.md:194: riformulato (NAT per pip/nuget, zip per no-PAT in VM).

P1 — Bug minori ✅

  • scripts/Invoke-RemoteBuild.ps1: primo New-Item sprecato rimosso.
  • scripts/Wait-VMReady.ps1: $elapsed dead code rimosso; try/catch su native command semplificato.
  • template/Setup-TemplateVM.ps1: MaxMemoryPerShellMB settato una volta sola (rimosso winrm set duplicato).
  • runner/Install-Runner.ps1: nota deprecazione aggiunta — usare Setup-Host.ps1.

P2 — Operativo ✅

  • scripts/Cleanup-OrphanedBuildVMs.ps1 creato — con -WhatIf, soglia -MaxAgeHours, hard stop + deleteVM + rimozione dir.
  • scripts/Get-BuildArtifacts.ps1 -IncludeLogs: aggiunto -Recurse per catturare log in subdir.
  • gitea/workflows/lint.yml creato — PSScriptAnalyzer su push/PR che toccano file .ps1.

Rimasto aperto (fuori scope di questo fix)

  • -UseGitClone in-VM: PAT injection, git in template, e2e-010. Vedi TODO.md sezione "In-VM Git Clone".
  • Verifica SHA256 installer (Python, VS BuildTools, dotnet-install.ps1) — richiede parametri hash per versione.
  • Validazione IP ottetti 0-255 in Invoke-CIJob.ps1 (ValidatePattern attuale accetta 999.x.x.x).
  • Scheduled task per Cleanup-OrphanedBuildVMs.ps1 — da creare manualmente o via Setup-Host.ps1.
Reference in New Issue View Git Blame Copy Permalink