Simone
68cde01c9d
§1.4 — Replace loose IP ValidatePattern with per-octet regex in 4 scripts
(Invoke-CIJob, Invoke-RemoteBuild, Get-BuildArtifacts, Wait-VMReady)
§1.1 — Migrate all WinRM connections from HTTP/5985 to HTTPS/5986
- Deploy post-install.ps1: remove AllowUnencrypted=true; self-signed cert + HTTPS listener
already present; firewall rule restricted to 192.168.79.0/24
- Setup-WinBuild2025.ps1: assert AllowUnencrypted=false
- Prepare-WinBuild2025.ps1: preflight uses TCP/5986; Test-WSMan -UseSSL -Port 5986;
New-PSSession -UseSSL -Port 5986; host AllowUnencrypted save/restore removed (not needed for HTTPS)
- Invoke-RemoteBuild, Get-BuildArtifacts: New-PSSession -UseSSL -Port 5986 -Authentication Basic
- Wait-VMReady: New-WSManSessionOption + Test-WSMan -Port 5986 -UseSSL
- Validate-DeployState, Validate-SetupState: Invoke-Command -UseSSL -Port 5986,
AllowUnencrypted check → false; AllowUnencrypted host-side removed from both
- Docs: PLAN, README, ARCHITECTURE, BEST-PRACTICES, HOST-SETUP, WINDOWS-TEMPLATE-SETUP,
LINUX-TEMPLATE-SETUP, TODO updated
§1.3 — SHA256 hash pinning infrastructure
- Assert-Hash function + $script:Hashes hashtable added to Setup-WinBuild2025.ps1
- Assert-Hash called after dotnet-install.ps1, python installer, vs_buildtools.exe downloads
- Hashes initialized to '' (warn-skip); must be filled before next snapshot refresh
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
44 lines
2.3 KiB
Markdown
44 lines
2.3 KiB
Markdown
# Local CI/CD System — Design & Status
|
|
|
|
## Sistema implementato e operativo (2026-05-08)
|
|
|
|
### Hardware
|
|
- Windows 11 host — CPU i9-10900X, 64 GB RAM, NVMe SSD
|
|
|
|
### Hypervisor
|
|
- VMware Workstation Pro
|
|
- Template VM: Windows Server 2025
|
|
- VMX: `F:\CI\Templates\WinBuild\CI-WinBuild.vmx`
|
|
- Snapshot: `BaseClean`
|
|
- Toolchain: VS Build Tools 2026 (MSBuild 18.5.4 / v145), .NET SDK 10.0.203, Python 3.13.3
|
|
|
|
### CI System
|
|
- Gitea self-hosted — `http://10.10.20.11:3100`
|
|
- act_runner v1.0.2 — Windows service su host, label `windows-build`
|
|
- Build VMs: subnet VMnet8 NAT — `192.168.79.0/24`
|
|
- WinRM HTTPS/5986 (Basic auth over HTTPS, self-signed cert, SkipCACheck lab-only)
|
|
|
|
### Architettura implementata
|
|
1. Gitea Actions enqueue job → act_runner lo prende
|
|
2. `Invoke-CIJob.ps1` orchestra 6 fasi:
|
|
- **Phase 1**: `git clone` repo (con submoduli) su host in `C:\Temp\ci-src-<jobid>`
|
|
- **Phase 2**: `New-BuildVM.ps1` — linked clone da template snapshot `BaseClean`
|
|
- **Phase 3**: `vmrun start` VM headless
|
|
- **Phase 4**: `Wait-VMReady.ps1` — polling WinRM readiness (~5s)
|
|
- **Phase 5**: `Invoke-RemoteBuild.ps1` — trasferisce sorgente (zip), esegue build via WinRM, raccoglie `artifacts.zip`
|
|
- **Phase 6**: `Get-BuildArtifacts.ps1` — copia zip in `F:\CI\Artifacts\<jobid>\`
|
|
3. `finally`: `Remove-BuildVM.ps1` — stop VM + rimozione directory clone
|
|
|
|
### Caso d'uso implementato e testato
|
|
- Repo: `Simone/nsis-plugin-nsinnounp` (NSIS plugin C++ — MSBuild)
|
|
- Build command: `python build_plugin.py --final --dist-dir dist`
|
|
- 4 configurazioni parallele: x86-unicode, x64-unicode, cli-x86, cli-x64
|
|
- Artifact: `dist/x86-unicode/nsInnoUnp.dll`, `dist/amd64-unicode/nsInnoUnp.dll`, `dist/nsInnoUnpCLI.exe`, `dist/nsInnoUnpCLI64.exe`
|
|
- e2e-009: SUCCESS in 02:09, cleanup automatico confermato
|
|
|
|
### Fix critici applicati durante sviluppo
|
|
- **TRK0002 Windows quota exhaustion**: `build_plugin.py` divide thread count per numero di build parallele
|
|
- **MSBuild detection per VS 2026**: fix in `build_plugin.py` per vswhere con VS 2026 BuildTools
|
|
- **Output filter nascondeva errori**: filtro cambiato da substring a prefix match
|
|
- **--dist-dir**: nuovo flag per raccogliere artifact in cartella piatta pre-clean
|
|
- **--no-clean / --no-copy**: flag CI-friendly per skip cleanup e skip copia verso plugins dir |