Simone/local-ci-cd-system
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
a5719f2ac6278a7c63cf28f7d275b20065457779
local-ci-cd-system/PLAN.md
T
Simone 68cde01c9d security(sprint1): §1.1/1.3/1.4 — WinRM HTTPS/5986, SHA256 pinning infra, IP regex per-octet 
§1.4 — Replace loose IP ValidatePattern with per-octet regex in 4 scripts
  (Invoke-CIJob, Invoke-RemoteBuild, Get-BuildArtifacts, Wait-VMReady)

§1.1 — Migrate all WinRM connections from HTTP/5985 to HTTPS/5986
  - Deploy post-install.ps1: remove AllowUnencrypted=true; self-signed cert + HTTPS listener
    already present; firewall rule restricted to 192.168.79.0/24
  - Setup-WinBuild2025.ps1: assert AllowUnencrypted=false
  - Prepare-WinBuild2025.ps1: preflight uses TCP/5986; Test-WSMan -UseSSL -Port 5986;
    New-PSSession -UseSSL -Port 5986; host AllowUnencrypted save/restore removed (not needed for HTTPS)
  - Invoke-RemoteBuild, Get-BuildArtifacts: New-PSSession -UseSSL -Port 5986 -Authentication Basic
  - Wait-VMReady: New-WSManSessionOption + Test-WSMan -Port 5986 -UseSSL
  - Validate-DeployState, Validate-SetupState: Invoke-Command -UseSSL -Port 5986,
    AllowUnencrypted check → false; AllowUnencrypted host-side removed from both
  - Docs: PLAN, README, ARCHITECTURE, BEST-PRACTICES, HOST-SETUP, WINDOWS-TEMPLATE-SETUP,
    LINUX-TEMPLATE-SETUP, TODO updated

§1.3 — SHA256 hash pinning infrastructure
  - Assert-Hash function + $script:Hashes hashtable added to Setup-WinBuild2025.ps1
  - Assert-Hash called after dotnet-install.ps1, python installer, vs_buildtools.exe downloads
  - Hashes initialized to '' (warn-skip); must be filled before next snapshot refresh

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-10 14:46:41 +02:00

2.3 KiB
Raw Blame History

Local CI/CD System — Design & Status

Sistema implementato e operativo (2026-05-08)

Hardware

  • Windows 11 host — CPU i9-10900X, 64 GB RAM, NVMe SSD

Hypervisor

  • VMware Workstation Pro
  • Template VM: Windows Server 2025
    • VMX: F:\CI\Templates\WinBuild\CI-WinBuild.vmx
    • Snapshot: BaseClean
    • Toolchain: VS Build Tools 2026 (MSBuild 18.5.4 / v145), .NET SDK 10.0.203, Python 3.13.3

CI System

  • Gitea self-hosted — http://10.10.20.11:3100
  • act_runner v1.0.2 — Windows service su host, label windows-build
  • Build VMs: subnet VMnet8 NAT — 192.168.79.0/24
  • WinRM HTTPS/5986 (Basic auth over HTTPS, self-signed cert, SkipCACheck lab-only)

Architettura implementata

  1. Gitea Actions enqueue job → act_runner lo prende
  2. Invoke-CIJob.ps1 orchestra 6 fasi:
    • Phase 1: git clone repo (con submoduli) su host in C:\Temp\ci-src-<jobid>
    • Phase 2: New-BuildVM.ps1 — linked clone da template snapshot BaseClean
    • Phase 3: vmrun start VM headless
    • Phase 4: Wait-VMReady.ps1 — polling WinRM readiness (~5s)
    • Phase 5: Invoke-RemoteBuild.ps1 — trasferisce sorgente (zip), esegue build via WinRM, raccoglie artifacts.zip
    • Phase 6: Get-BuildArtifacts.ps1 — copia zip in F:\CI\Artifacts\<jobid>\
  3. finally: Remove-BuildVM.ps1 — stop VM + rimozione directory clone

Caso d'uso implementato e testato

  • Repo: Simone/nsis-plugin-nsinnounp (NSIS plugin C++ — MSBuild)
  • Build command: python build_plugin.py --final --dist-dir dist
  • 4 configurazioni parallele: x86-unicode, x64-unicode, cli-x86, cli-x64
  • Artifact: dist/x86-unicode/nsInnoUnp.dll, dist/amd64-unicode/nsInnoUnp.dll, dist/nsInnoUnpCLI.exe, dist/nsInnoUnpCLI64.exe
  • e2e-009: SUCCESS in 02:09, cleanup automatico confermato

Fix critici applicati durante sviluppo

  • TRK0002 Windows quota exhaustion: build_plugin.py divide thread count per numero di build parallele
  • MSBuild detection per VS 2026: fix in build_plugin.py per vswhere con VS 2026 BuildTools
  • Output filter nascondeva errori: filtro cambiato da substring a prefix match
  • --dist-dir: nuovo flag per raccogliere artifact in cartella piatta pre-clean
  • --no-clean / --no-copy: flag CI-friendly per skip cleanup e skip copia verso plugins dir
Reference in New Issue View Git Blame Copy Permalink