local-ci-cd-system/docs/TEST-7.4-e2e.md

§7.4 — E2e test refactor Deploy↔Setup

Valida che il refactor §7 (2026-05-10) funzioni su VM reale: Deploy possiede OS hardening → Setup valida senza re-applicare.

Non toccare l'existing template (CI-WinBuild.vmx + snapshot BaseClean). Usare VM separata per i test.

---

Prerequisiti

• F:\CI\ISO\26100.1742.240906-0331.ge_release_svc_refresh_SERVER_VOL_x64FRE_en-us.iso presente
• F:\CI\ISO\VMware-tools-windows.iso presente
• VMware Workstation aperto, sufficiente spazio su F:\CI\Templates\WinBuildTest\

---

Step 1 — Deploy su VM test

cd N:\Code\Workspace\Local-CI-CD-System\template

.\Deploy-WinBuild2025.ps1 `
    -WinISO   'F:\CI\ISO\26100.1742.240906-0331.ge_release_svc_refresh_SERVER_VOL_x64FRE_en-us.iso' `
    -ToolsISO 'F:\CI\ISO\VMware-tools-windows.iso' `
    -VMXPath  'F:\CI\Templates\WinBuildTest\CI-WinBuild-test.vmx' `
    -VMName   'WinBuild2025-test' `
    -ProductKey 'TVRH6-WHNXV-R9WG3-9XRFY-MY832'

Durata attesa: 30–90 min. Exit 0 = OK, snapshot PostInstall preso automaticamente.

Se timeout su install_complete.flag: aumentare -GuestPollMaxMinutes 120.

---

Step 2 — Verifica stato Deploy (§7.1 + §7.2)

Sostituire 192.168.79.xxx con IP reale della VM test (ipconfig dentro la VM).

$ip   = '192.168.79.xxx'
$cred = Get-Credential   # Administrator / WinBuild!
$so   = New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck

Invoke-Command -ComputerName $ip -Credential $cred `
    -Authentication Basic -SessionOption $so -ScriptBlock {

    "=== §7.1 Firewall ==="
    Get-NetFirewallProfile | Select-Object Name, Enabled

    "=== §7.2 WU services ==="
    Get-Service wuauserv, UsoSvc | Select-Object Name, StartType, Status

    "=== §7.2 WU GPO ==="
    $au = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU'
    $wu = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate'
    [PSCustomObject]@{
        NoAutoUpdate              = (Get-ItemProperty $au  -EA SilentlyContinue).NoAutoUpdate
        DisableWindowsUpdateAccess = (Get-ItemProperty $wu -EA SilentlyContinue).DisableWindowsUpdateAccess
    }

    "=== §7.1 WinRM limits ==="
    [PSCustomObject]@{
        MaxMemoryPerShellMB = (Get-Item WSMan:\localhost\Shell\MaxMemoryPerShellMB).Value
        IdleTimeOut         = (Get-Item WSMan:\localhost\Shell\IdleTimeOut).Value
    }

    "=== §7.1 UAC ==="
    Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' |
        Select-Object EnableLUA, LocalAccountTokenFilterPolicy
}

Atteso:

Check	Valore atteso
Firewall tutti profili	Enabled=False
wuauserv StartType	Manual
UsoSvc StartType	Manual
NoAutoUpdate	1
DisableWindowsUpdateAccess	1
MaxMemoryPerShellMB	>= 2048
EnableLUA	0

---

Step 3 — Prepare -SkipWindowsUpdate (Assert-Step validation)

.\Prepare-WinBuild2025.ps1 `
    -VMIPAddress 192.168.79.xxx `
    -SkipWindowsUpdate

Cosa verificare nel log:

• Step 1 (Firewall): solo [OK] — nessun Set-NetFirewallProfile
• Step 3 (WinRM): solo [OK] — nessun Enable-PSRemoting né winrm set
• Step 4b (UAC): solo [OK] — nessun Set-ItemProperty EnableLUA
• Step 5b (Explorer): solo [OK]
• Step 5c (CIUX): solo [OK]
• Step 4 (user ci_build): crea utente — operativo, non validation
• Step 5 (CI dirs): crea C:\CI\{build,output,scripts} — operativo
• Step 6: [Setup] Skipping Windows Update — corretto con -SkipWindowsUpdate
• Step 6b: disabilita wuauserv/UsoSvc — deve girare sempre
• Step 7-10: .NET, Python, VS Build Tools installati
• Final gate: tutti e 7 i check [OK]
• Exit code: 0

Se un Assert-Step fallisce con [FAIL] su Step 1/3/4b/5b/5c → Deploy non ha applicato quel setting → debug Deploy post-install.ps1 (controllare log nella VM).

---

Step 4 — Prepare senza -Skip (WU lifecycle §7.2)

Solo se Step 3 è passato. La VM deve avere internet (VMnet8 NAT).

.\Prepare-WinBuild2025.ps1 -VMIPAddress 192.168.79.xxx

Atteso:

• Step 6 Step A: rimuove DisableWindowsUpdateAccess e NoAutoUpdate GPO keys
• Step 6 Step D: avvia wuauserv/UsoSvc/bits/cryptsvc (già Manual → solo Start)
• Step 6: WU gira via SchTask SYSTEM, ResultCode ∈ {0, 2, 3}
• Step 6b: wuauserv StartType=Disabled, UsoSvc StartType=Disabled, GPO keys re-scritti
• Final gate Windows Update permanently disabled → [OK]
• Exit code: 0 (o 3010 se WU richiede reboot — ripetere con -SkipWindowsUpdate)

---

Step 5 — Snapshot e promozione (opzionale)

Se tutti i check di Step 3 e 4 passano:

# Spegni VM test
& 'C:\Program Files (x86)\VMware\VMware Workstation\vmrun.exe' `
    -T ws stop 'F:\CI\Templates\WinBuildTest\CI-WinBuild-test.vmx' soft

# Snapshot versionato
& 'C:\Program Files (x86)\VMware\VMware Workstation\vmrun.exe' `
    -T ws snapshot 'F:\CI\Templates\WinBuildTest\CI-WinBuild-test.vmx' `
    "BaseClean_$(Get-Date -Format yyyyMMdd)"

Per promuovere a produzione (rimpiazza template esistente):

1. Copia F:\CI\Templates\WinBuildTest\ → F:\CI\Templates\WinBuild\ (backup prima)
2. Aggiorna GITEA_CI_TEMPLATE_PATH in runner/config.yaml se path cambia
3. Aggiorna GITEA_CI_SNAPSHOT_NAME se usi nome versionato (vedi TODO §2.5)

---

Checklist §7.4 — COMPLETATA 2026-05-10

• Step 1: Deploy exit 0, snapshot PostInstall presente
• Step 2: Firewall=False, wuauserv=Manual, NoAutoUpdate=1, MaxMemory≥2048, UAC=0 (UsoSvc era Automatic — fix applicato in Deploy; corretto manualmente sulla VM test)
• Step 3: Prepare -SkipWindowsUpdate exit 0, nessun Set in Step 1/3/4b/5b/5c
• Step 4: Prepare senza -Skip exit 0 (WU: 0 update, ResultCode=0), wuauserv=Disabled post-Step 6b
• Snapshot BaseClean preso con successo

Fix applicati durante il test:

• Deploy: UsoSvc esplicitamente a Manual (era omesso, default Server 2025 = Automatic)
• Setup cleanup: ri-applica Disabled su wuauserv/UsoSvc dopo DISM (WaaSMedicSvc resets StartType)
• Deploy + Setup 5c: autologin Administrator (AutoAdminLogon=1, DefaultUserName, DefaultPassword, DefaultDomainName)
• Nuovi: Validate-DeployState.ps1, Validate-SetupState.ps1