ci.yml

name: CI

on:
  push:
  pull_request:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
  cancel-in-progress: true

jobs:
  static:
    runs-on: windows-latest
    defaults:
      run:
        shell: pwsh
    steps:
      - uses: actions/checkout@v4
      - name: Parse scripts and config
        run: |
          $ErrorActionPreference = "Stop"
          foreach ($file in @("prepare-host.ps1", "create-workstation-vm.ps1", "check-workstation-vm.ps1", "bootstrap-windows.ps1", "enable-gpu-pv.ps1", "configure-workstation-management.ps1", "enable-os-bitlocker.ps1", "pair-moonlight.ps1", "set-workstation-session-policy.ps1", "write-rdp-file.ps1", "lib/iso-writer.ps1", "lib/session-policy.ps1", "vendor/Fido.ps1")) {
            $tokens = $null
            $errors = $null
            [System.Management.Automation.Language.Parser]::ParseFile((Resolve-Path $file), [ref]$tokens, [ref]$errors) | Out-Null
            if ($errors.Count) { throw "PowerShell parse failed: $file" }
          }
          $configs = @(Get-ChildItem config -Filter *.json)
          if ($configs.Count -eq 0) { throw "Expected at least one config file." }
          $configs | ForEach-Object {
            Get-Content -Raw $_.FullName | ConvertFrom-Json | Out-Null
          }

  smoke:
    needs: static
    runs-on: windows-latest
    timeout-minutes: 240
    defaults:
      run:
        shell: pwsh
    steps:
      - uses: actions/checkout@v4

      - name: Restore image cache
        uses: actions/cache@v4
        with:
          path: ${{ runner.temp }}\workstation-image-cache
          key: workstation-vm-${{ runner.os }}-windows11-v1
          restore-keys: |
            workstation-vm-${{ runner.os }}-windows11-

      - name: Prepare host
        run: .\prepare-host.ps1

      - name: Prepare Hyper-V network
        run: |
          Import-Module Hyper-V
          if (-not (Get-VMSwitch -Name "workstation-ci" -ErrorAction SilentlyContinue)) {
            New-VMSwitch -Name "workstation-ci" -SwitchType Internal | Out-Null
          }
          $adapter = "vEthernet (workstation-ci)"
          if (-not (Get-NetIPAddress -InterfaceAlias $adapter -IPAddress 192.168.240.1 -ErrorAction SilentlyContinue)) {
            New-NetIPAddress -InterfaceAlias $adapter -IPAddress 192.168.240.1 -PrefixLength 24 | Out-Null
          }
          if (-not (Get-NetNat -Name "workstation-ci" -ErrorAction SilentlyContinue)) {
            New-NetNat -Name "workstation-ci" -InternalIPInterfaceAddressPrefix "192.168.240.0/24" | Out-Null
          }

      - name: Prepare CI config
        run: |
          $cfg = Get-Content -Raw config/windows.json | ConvertFrom-Json
          $cfg.vmName = "ci-Windows11"
          $cfg.password = "Workstation123!"
          $cfg.switchName = "workstation-ci"
          $cfg.baseDir = "$env:RUNNER_TEMP/workstation-vm/windows11"
          $cfg.imageCacheDir = "$env:RUNNER_TEMP/workstation-image-cache/windows"
          $cfg.memoryGB = 2
          $cfg.cpuCount = 2
          $cfg.dataDiskGB = 1
          $cfg.sshEnabled = $false
          if ($cfg.PSObject.Properties.Name -contains "gpuPv") {
            $cfg.gpuPv.enabled = $false
          }
          if ($cfg.PSObject.Properties.Name -contains "gpu") {
            $cfg.gpu.enabled = $false
          }
          if ($cfg.PSObject.Properties.Name -contains "remoteStreaming") {
            $cfg.remoteStreaming.enabled = $true
            $cfg.remoteStreaming.installSunshine = $false
            $cfg.remoteStreaming.installVirtualDisplayDriver = $true
          }
          $cfg | Add-Member -Force NoteProperty guestIpAddress "192.168.240.2"
          $cfg | Add-Member -Force NoteProperty guestPrefixLength 24
          $cfg | Add-Member -Force NoteProperty guestGateway "192.168.240.1"
          $cfg | Add-Member -Force NoteProperty guestDnsServers @("1.1.1.1", "8.8.8.8")
          $cfg.recreate = $true
          $cfg.wingetPackages = @()
          $cfg | ConvertTo-Json -Depth 5 | Set-Content config/windows.json

      - name: Create VM
        run: .\create-workstation-vm.ps1 --config config/windows.json

      - name: Check CI network
        run: |
          $cfg = Get-Content -Raw config/windows.json | ConvertFrom-Json
          for ($i = 0; $i -lt 30; $i++) {
            $ips = @(Get-VMNetworkAdapter -VMName $cfg.vmName | Select-Object -ExpandProperty IPAddresses)
            if ($ips -contains "192.168.240.2") { break }
            Start-Sleep -Seconds 2
          }
          if ($ips -notcontains "192.168.240.2") { throw "CI VM IP address was not reported by Hyper-V." }

      - name: Check VM
        run: |
          $cfg = Get-Content -Raw config/windows.json | ConvertFrom-Json
          if ($cfg.PSObject.Properties.Name -contains "remoteStreaming") {
            $cfg.remoteStreaming.enabled = $false
            $cfg | ConvertTo-Json -Depth 5 | Set-Content config/windows.json
          }
          .\check-workstation-vm.ps1 --config config/windows.json

      - name: Enable CI SSH
        run: |
          $cfg = Get-Content -Raw config/windows.json | ConvertFrom-Json
          $key = Join-Path $cfg.baseDir "ssh_key_ed25519.key"
          & ssh-keygen.exe -t ed25519 -N "" -f $key -C "$($cfg.vmName)-ci"
          $publicKey = Get-Content -Raw "$key.pub"
          $secure = [Security.SecureString]::new()
          foreach ($ch in $cfg.password.ToCharArray()) { $secure.AppendChar($ch) }
          $secure.MakeReadOnly()
          $credential = [pscredential]::new($cfg.user, $secure)
          Invoke-Command -VMName $cfg.vmName -Credential $credential -ArgumentList $publicKey -ScriptBlock {
            param($publicKey)
            $capability = Get-WindowsCapability -Online | Where-Object Name -like "OpenSSH.Server*" | Select-Object -First 1
            if ($capability.State -ne "Installed") { Add-WindowsCapability -Online -Name $capability.Name | Out-Null }
            $sshDir = Join-Path $env:ProgramData "ssh"
            New-Item -ItemType Directory -Force -Path $sshDir | Out-Null
            $adminKeys = Join-Path $sshDir "administrators_authorized_keys"
            Set-Content -LiteralPath $adminKeys -Value $publicKey -Encoding ascii
            & icacls.exe $adminKeys /inheritance:r /grant "*S-1-5-32-544:F" /grant "*S-1-5-18:F" | Out-Null
            Set-Service -Name sshd -StartupType Automatic
            Start-Service -Name sshd
            if (-not (Get-NetFirewallRule -Name "OpenSSH-Server-In-TCP" -ErrorAction SilentlyContinue)) {
              New-NetFirewallRule -Name "OpenSSH-Server-In-TCP" -DisplayName "OpenSSH Server (sshd)" -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22 -Profile Any | Out-Null
            } else {
              Set-NetFirewallRule -Name "OpenSSH-Server-In-TCP" -Enabled True -Profile Any | Out-Null
            }
          }

      - name: SSH hello
        run: >
          $cfg = Get-Content -Raw config/windows.json | ConvertFrom-Json; $ip = @(Get-VMNetworkAdapter -VMName $cfg.vmName | Select-Object -ExpandProperty IPAddresses | Where-Object { $_ -match '^\d+\.\d+\.\d+\.\d+$' -and $_ -notlike '169.254.*' -and $_ -ne '0.0.0.0' } | Select-Object -First 1)[0]; ssh -i (Join-Path $cfg.baseDir "ssh_key_ed25519.key") -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=NUL "$($cfg.user)@$ip" "echo hello"

      - name: Configure private management access
        run: .\configure-workstation-management.ps1 --config config/windows.json

      - name: Enable OS BitLocker default mode
        run: |
          $recoveryDir = Join-Path $env:RUNNER_TEMP "workstation-os-bitlocker-recovery"
          .\enable-os-bitlocker.ps1 --config config/windows.json --recovery-key-path $recoveryDir
          $cfg = Get-Content -Raw config/windows.json | ConvertFrom-Json
          $recoveryFile = Join-Path $recoveryDir "$($cfg.vmName)-os-bitlocker-recovery-key.txt"
          if (-not (Test-Path -LiteralPath $recoveryFile)) { throw "OS BitLocker recovery key file was not written." }
          $metadata = Get-Item -LiteralPath $recoveryFile
          if ($metadata.Length -le 0) { throw "OS BitLocker recovery key file is empty." }

      - name: Verify OS BitLocker auto-unlock after reboot
        run: |
          $cfg = Get-Content -Raw config/windows.json | ConvertFrom-Json
          $secure = [Security.SecureString]::new()
          foreach ($ch in $cfg.password.ToCharArray()) { $secure.AppendChar($ch) }
          $secure.MakeReadOnly()
          $credential = [pscredential]::new($cfg.user, $secure)
          try {
            Invoke-Command -VMName $cfg.vmName -Credential $credential -ScriptBlock { Stop-Computer -Force } -ErrorAction Stop
          } catch {
            Write-Host "Guest shutdown command ended with: $($_.Exception.Message)"
          }
          $deadline = (Get-Date).AddMinutes(5)
          do {
            Start-Sleep -Seconds 3
            $vm = Get-VM -Name $cfg.vmName
          } while ($vm.State -ne "Off" -and (Get-Date) -lt $deadline)
          if ($vm.State -ne "Off") { throw "VM did not shut down for OS BitLocker reboot test." }
          Start-VM -Name $cfg.vmName | Out-Null
          $deadline = (Get-Date).AddMinutes(10)
          do {
            try {
              Invoke-Command -VMName $cfg.vmName -Credential $credential -ScriptBlock { "ready" } -ErrorAction Stop | Out-Null
              $ready = $true
              break
            } catch {
              Start-Sleep -Seconds 5
            }
          } while ((Get-Date) -lt $deadline)
          if (-not $ready) { throw "VM did not auto-unlock after OS BitLocker reboot test." }
          .\check-workstation-vm.ps1 --config config/windows.json

      - name: Enable OS BitLocker startup PIN mode
        run: |
          $recoveryDir = Join-Path $env:RUNNER_TEMP "workstation-os-bitlocker-recovery"
          $pinFile = Join-Path $env:RUNNER_TEMP "workstation-os-bitlocker-pin.txt"
          Set-Content -LiteralPath $pinFile -Value "123456" -NoNewline
          try {
            .\enable-os-bitlocker.ps1 --config config/windows.json --recovery-key-path $recoveryDir --require-startup-pin --startup-pin-file $pinFile
          } finally {
            Remove-Item -LiteralPath $pinFile -Force -ErrorAction SilentlyContinue
          }
          $cfg = Get-Content -Raw config/windows.json | ConvertFrom-Json
          $secure = [Security.SecureString]::new()
          foreach ($ch in $cfg.password.ToCharArray()) { $secure.AppendChar($ch) }
          $secure.MakeReadOnly()
          $credential = [pscredential]::new($cfg.user, $secure)
          $state = Invoke-Command -VMName $cfg.vmName -Credential $credential -ScriptBlock {
            $volume = Get-BitLockerVolume -MountPoint "C:"
            [pscustomobject]@{
              ProtectionStatus = [string]$volume.ProtectionStatus
              VolumeStatus = [string]$volume.VolumeStatus
              TpmOnly = @($volume.KeyProtector | Where-Object { [string]$_.KeyProtectorType -eq "Tpm" }).Count
              TpmPin = @($volume.KeyProtector | Where-Object { [string]$_.KeyProtectorType -match '^Tpm.*Pin$|^TpmPin$|^TpmAndPin$' }).Count
              Recovery = @($volume.KeyProtector | Where-Object { [string]$_.KeyProtectorType -eq "RecoveryPassword" }).Count
            }
          }
          if ($state.ProtectionStatus -ne "On") { throw "OS BitLocker protection is not on in startup PIN mode." }
          if ($state.VolumeStatus -ne "FullyEncrypted") { throw "OS BitLocker is not fully encrypted in startup PIN mode." }
          if ($state.TpmOnly -ne 0) { throw "Plain TPM protector is still present in startup PIN mode." }
          if ($state.TpmPin -lt 1) { throw "TPM+PIN protector is missing in startup PIN mode." }
          if ($state.Recovery -lt 1) { throw "Recovery protector is missing in startup PIN mode." }

      - name: Collect state
        if: always()
        run: |
          $cfg = Get-Content -Raw config/windows.json | ConvertFrom-Json
          Get-VM -Name $cfg.vmName -ErrorAction SilentlyContinue | Format-List * | Out-File "$env:RUNNER_TEMP\vm-state.txt"

      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: vm-state
          path: ${{ runner.temp }}\vm-state.txt
          if-no-files-found: ignore

      - name: Cleanup
        if: always()
        run: |
          $cfg = Get-Content -Raw config/windows.json | ConvertFrom-Json
          Stop-VM -Name $cfg.vmName -TurnOff -Force -ErrorAction SilentlyContinue
          Remove-VM -Name $cfg.vmName -Force -ErrorAction SilentlyContinue