Introspect Windows CI image and skip setup accordingly (#192)

Co-authored-by: Olivier Halligon <[email protected]>

Author: mokagio

CHANGELOG.md

@@ -38,15 +38,15 @@ _None._
 
 ### New Features
 
-_None._
+- The `prepare_windows_host_for_app_distribution.ps1` command for Windows builds will inspect the environment it's running on and skip time consuming steps when running on our custom CI image. [#192]
 
 ### Bug Fixes
 
 _None._
 
 ### Internal Changes
 
-Improved header comment documentation of `pr_changed_files`. [#191]
+- Improved header comment documentation of `pr_changed_files`. [#191]
 
 ## 5.6.0
 

bin/install_python.ps1

@@ -66,17 +66,17 @@ if ($DryRun) {
 # Some Node.js packages require Python during npm install for building native extensions
 Write-Output "Installing Python 3 via Chocolatey..."
 choco install python3 --yes --no-progress
-If ($LastExitCode -ne 0) { 
+If ($LastExitCode -ne 0) {
     Write-Output "[!] Failed to install Python via Chocolatey"
-    Exit $LastExitCode 
+    Exit $LastExitCode
 }
 
 # Refresh environment to make Python available in PATH
 Write-Output "Refreshing environment variables..."
 & "$PSScriptRoot\path_aware_refreshenv.ps1"
-If ($LastExitCode -ne 0) { 
+If ($LastExitCode -ne 0) {
     Write-Output "[!] Failed to refresh environment after Python installation"
-    Exit $LastExitCode 
+    Exit $LastExitCode
 }
 
 # Verify Python installation

bin/prepare_windows_host_for_app_distribution.ps1

@@ -27,6 +27,14 @@ param (
 # Stop script execution when a non-terminating error occurs
 $ErrorActionPreference = "Stop"
 
+$amiVersion = [Environment]::GetEnvironmentVariable('AMI_VERSION', 'Machine')
+Write-Output "AMI_VERSION is: $amiVersion"
+if (![string]::IsNullOrWhiteSpace($amiVersion) -and [version]$amiVersion -ge [version]'0.2') {
+  Write-Output "Tooling is already pre-installed in AMI versions >= 0.2. Only installing code signing certificate."
+  & "setup_windows_code_signing.ps1"
+  Exit 0
+}
+
 # Validate parameter combinations
 if ($InstallNativeCompilationTools -and $SkipWindows10SDKInstallation) {
     Write-Output "[!] Invalid parameter combination: -InstallNativeCompilationTools cannot be used with -SkipWindows10SDKInstallation."
@@ -88,14 +96,6 @@ Write-Output "--- :windows: Setting up Package Manager"
 $env:ChocolateyInstall = Convert-Path "$((Get-Command choco).Path)\..\.."
 Import-Module "$env:ChocolateyInstall\helpers\chocolateyProfile.psm1"
 
-if ($InstallPython) {
-  Write-Output "Run with InstallPython = true. Installing Python for Node.js native module compilation..."
-  & "$PSScriptRoot\install_python.ps1"
-  If ($LastExitCode -ne 0) { Exit $LastExitCode }
-} else {
-  Write-Output "Python installation not requested. Skipping Python installation."
-}
-
 # This should avoid issues with symlinks not being supported in Windows.
 #
 # See how this build failed
@@ -115,29 +115,24 @@ if ($developerMode.State -eq 'Enabled') {
   }
 }
 
+if ($InstallPython) {
+  Write-Output "Run with InstallPython = true. Installing Python for Node.js native module compilation..."
+  & "$PSScriptRoot\install_python.ps1"
+  If ($LastExitCode -ne 0) { Exit $LastExitCode }
+} else {
+  Write-Output "Python installation not requested. Skipping Python installation."
+}
+
 if ($env:SKIP_CERTIFICATE_DOWNLOAD -eq "true") {
   Write-Output "--- :lock_with_ink_pen: Skipping Code Signing Certificate download"
 } else {
-  Write-Output "--- :lock_with_ink_pen: Download Code Signing Certificate"
-  $certificateBinPath = "certificate.bin"
-  $EncodedText = aws secretsmanager get-secret-value --secret-id windows-code-signing-certificate `
-    | jq -r '.SecretString' `
-    | Out-File $certificateBinPath
-  $certificatePfxPath = "certificate.pfx"
-  certutil -decode $certificateBinPath $certificatePfxPath
-  Write-Output "Code signing certificate downloaded at: $((Get-Item $certificatePfxPath).FullName)"
-
-  If ($LastExitCode -ne 0) {
-    Write-Output "[!] Failed to download code signing certificate."
-    Exit $LastExitCode
-  }
+  & "setup_windows_code_signing.ps1"
 }
 
-Write-Output "--- :windows: Checking whether to install Windows 10 SDK..."
-
 # When using Electron Forge and electron2appx, building Appx requires the Windows 10 SDK
 #
 # See https://github.com/hermit99/electron-windows-store/tree/v2.1.2?tab=readme-ov-file#usage
+Write-Output "--- :windows: Checking whether to install Windows 10 SDK..."
 
 if ($SkipWindows10SDKInstallation) {
   Write-Output "Run with SkipWindows10SDKInstallation = true. Skipping Windows 10 SDK installation check."
@@ -147,7 +142,7 @@ if ($SkipWindows10SDKInstallation) {
 $windowsSDKVersionFile = ".windows-10-sdk-version"
 if (Test-Path $windowsSDKVersionFile) {
   Write-Output "Found $windowsSDKVersionFile file, installing Windows 10 SDK..."
-  
+
   if ($InstallNativeCompilationTools) {
     & "$PSScriptRoot\install_windows_10_sdk.ps1" -InstallNativeCompilationTools
   } else {

bin/setup_windows_code_signing.ps1

@@ -0,0 +1,22 @@
+# Installs the code signing certificate for Windows app distribution.
+#
+# The certificate is stored in our AWS SecretsManager storage (`windows-code-signing-certificate` secret ID).
+# It is decoded and stored in the `certificate.pfx` file.
+
+# Stop script execution when a non-terminating error occurs
+$ErrorActionPreference = "Stop"
+
+Write-Output "--- :lock_with_ink_pen: Download Code Signing Certificate"
+$certificateBinPath = "certificate.bin"
+$EncodedText = aws secretsmanager get-secret-value --secret-id windows-code-signing-certificate `
+  | jq -r '.SecretString' `
+  | Out-File $certificateBinPath
+$certificatePfxPath = "certificate.pfx"
+certutil -decode $certificateBinPath $certificatePfxPath
+
+If ($LastExitCode -ne 0) {
+  Write-Output "[!] Failed to download code signing certificate."
+  Exit $LastExitCode
+} else {
+  Write-Output "Code signing certificate downloaded at: $((Get-Item $certificatePfxPath).FullName)"
+}

tests/test_prepare_windows_host_for_app_distribution.ps1

@@ -6,8 +6,8 @@
 # 3. No .windows-10-sdk-version file with -InstallNativeCompilationTools (should skip installation - no version file available)
 # 4. No .windows-10-sdk-version file without -InstallNativeCompilationTools (should skip installation)
 #
-# Note: These tests focus on parameter validation and decision logic only, without performing
-# expensive installations or downloads.
+# Note: These tests focus on parameter validation and decision logic only,
+# without performing expensive installations or downloads.
 
 param (
   [int]$ExpectedExitCode = 0
@@ -141,7 +141,69 @@ if ($output -match [regex]::Escape($expectedNoFileSkipMessage)) {
   Exit 1
 }
 
-# Clean up
+#
+# FIXME: Disabled because I haven't figured out how to set the env var in a way that the scripts can read but doesn't alter the machine.
+# Tracked in https://linear.app/a8c/issue/AINFRA-1467
+#
+# # Test 5: If CI AMI version is == 0.2, only installs certificates
+# Write-Output "`n--- Test 5: If AMI version env == 0.2, only installs certificates"
+# Remove-TestFiles
+
+# # Notice that setting via $env is process bound, which is perfect for unit tests.
+# $env:AMI_VERSION = '0.2'
+
+# # Notice running the command via . so that it runs in the same process and accesses AMI_VERSION
+# $output = . "$PSScriptRoot\..\bin\prepare_windows_host_for_app_distribution.ps1"
+# $exitCode = $LASTEXITCODE
+
+# if ($exitCode -ne $ExpectedExitCode) {
+#   Write-Output "$emojiRedCross Test 5: Expected exit code $ExpectedExitCode, got $exitCode"
+#   Write-Output "Output was:"
+#   Write-Output "$output"
+#   Exit 1
+# } else {
+#   Write-Output "$emojiGreenCheck Test 5: Exit code matches expected value ($ExpectedExitCode)"
+# }
+
+# $expectedOnlyCertsMessage = "Tooling is already pre-installed in AMI versions >= 0.2. Only installing code signing certificate."
+# if ($output -match [regex]::Escape($expectedOnlyCertsMessage)) {
+#   Write-Output "$emojiGreenCheck Test 5: Found expected message regarding AMI version and what to install."
+# } else {
+#   Write-Output "$emojiRedCross Test 5: Expected to find AMI version acknowledgement, but got:"
+#   Write-Output "$output"
+#   Exit 1
+# }
+
+# # Test 6: If CI AMI version is > 0.2, only installs certificates
+# Write-Output "`n--- Test 6: If AMI version env > 0.2, only installs certificates"
+# Remove-TestFiles
+
+# # Notice that setting via $env is process bound, which is perfect for unit tests.
+# $env:AMI_VERSION = '1.0'
+
+# # Notice running the command via . so that it runs in the same process and accesses AMI_VERSION
+# $output = . "$PSScriptRoot\..\bin\prepare_windows_host_for_app_distribution.ps1"
+# $exitCode = $LASTEXITCODE
+
+# if ($exitCode -ne $ExpectedExitCode) {
+#   Write-Output "$emojiRedCross Test 6: Expected exit code $ExpectedExitCode, got $exitCode"
+#   Write-Output "Output was:"
+#   Write-Output "$output"
+#   Exit 1
+# } else {
+#   Write-Output "$emojiGreenCheck Test 6: Exit code matches expected value ($ExpectedExitCode)"
+# }
+
+# $expectedOnlyCertsMessage = "Tooling is already pre-installed in AMI versions >= 0.2. Only installing code signing certificate."
+# if ($output -match [regex]::Escape($expectedOnlyCertsMessage)) {
+#   Write-Output "$emojiGreenCheck Test 6: Found expected message regarding AMI version and what to install."
+# } else {
+#   Write-Output "$emojiRedCross Test 6: Expected to find AMI version acknowledgement, but got:"
+#   Write-Output "$output"
+#   Exit 1
+# }
+
+# Final clean up
 Remove-TestFiles
 
 Write-Output "`n$emojiGreenCheck All tests completed successfully."