chore(windows/make.ps1) ensure Pester is only installed as user (instead of system) (jenkinsci#2236)

* chore(windows/make.ps1) ensure Pester is only installed as user (instead of system)

Caused by jenkins-infra/helpdesk#4939 (comment)

Ref. https://learn.microsoft.com/en-us/powershell/module/powershellget/install-module?view=powershellget-2.x#example-5-install-a-module-only-for-the-current-user an

* tests(windows/plugins-cli) ensure workdir is cleaned up with docker to avoid permissions issues, only when needed

* fixup

Signed-off-by: Damien Duportal <damien.duportal@gmail.com>

---------

Signed-off-by: Damien Duportal <damien.duportal@gmail.com>

Author: dduportal

make.ps1

@@ -210,14 +210,7 @@ if ($target -eq 'test') {
         $mod = Get-InstalledModule -Name Pester -MinimumVersion 5.3.0 -MaximumVersion 5.3.3 -ErrorAction SilentlyContinue
         if ($null -eq $mod) {
             Write-Host '= TEST: Pester 5.3.x not found: installing...'
-            $module = 'C:\Program Files\WindowsPowerShell\Modules\Pester'
-            if (Test-Path $module) {
-                takeown /F $module /A /R
-                icacls $module /reset
-                icacls $module /grant Administrators:'F' /inheritance:d /T
-                Remove-Item -Path $module -Recurse -Force -Confirm:$false
-            }
-            Install-Module -Force -Name Pester -MaximumVersion 5.3.3
+            Install-Module -Force -Name Pester -MaximumVersion 5.3.3 -Scope CurrentUser
         }
 
         Import-Module Pester

tests/plugins-cli.Tests.ps1

@@ -5,8 +5,6 @@ $global:SUT_IMAGE=Get-SutImage
 $global:SUT_CONTAINER=Get-SutImage
 $global:TEST_TAG=$global:SUT_IMAGE.Replace('pester-jenkins-', '')
 
-$global:WORK = Join-Path $PSScriptRoot "upgrade-plugins/work-${global:SUT_IMAGE}"
-
 Describe "[plugins-cli > $global:TEST_TAG] build image" {
   BeforeEach {
     Push-Location -StackName 'jenkins' -Path "$PSScriptRoot/.."
@@ -150,43 +148,35 @@ Describe "[plugins-cli > $global:TEST_TAG] plugins are installed with jenkins-pl
     $exitCode, $stdout, $stderr = Build-DockerChild $global:SUT_IMAGE-plugins-cli-update $PSScriptRoot/plugins-cli/update --no-cache
     $exitCode | Should -Be 0
   }
-    
+
   It 'has the correct version of junit' {
     $exitCode, $stdout, $stderr = Run-Program 'docker.exe' "run --rm $global:SUT_IMAGE-plugins-cli-update Import-Module -Force -DisableNameChecking C:/ProgramData/Jenkins/jenkins-support.psm1 ; Expand-Zip `$env:JENKINS_HOME/plugins/junit.jpi 'META-INF/MANIFEST.MF'"
     $exitCode | Should -Be 0
     $stdout | Should -Match 'Plugin-Version: 1.28'
   }
 }
 
-Describe "[plugins-cli > $global:TEST_TAG] clean work directory" {
-  It 'cleanup' {
-    if(Test-Path $PSScriptRoot/upgrade-plugins/work-$global:SUT_IMAGE) {
-      Remove-Item -Recurse -Force $PSScriptRoot/upgrade-plugins/work-$global:SUT_IMAGE | Out-Null
-    }
-  }
-}
-
 # Only test on Java 21, one JDK is enough to test all versions
 Describe "[plugins-cli > $global:TEST_TAG] plugins are getting upgraded but not downgraded" -Skip:(-not $global:TEST_TAG.Contains('jdk21-')) {
+  BeforeAll {
+    $dockerVolume = (New-Guid).Guid
+    docker volume rm -f $dockerVolume
+  }
   It 'builds child image' {
     # Initial execution
     $exitCode, $stdout, $stderr = Build-DockerChild $global:SUT_IMAGE-plugins-cli $PSScriptRoot/plugins-cli
     $exitCode | Should -Be 0
   }
 
   It 'has correct version of junit and ant plugins' {
-    if(-not (Test-Path $global:WORK)) {
-      New-Item -ItemType Directory -Path $global:WORK
-    }
-
     # Image contains junit 1.6 and ant-plugin 1.3
-    $exitCode, $stdout, $stderr = Run-Program 'docker.exe' "run -v `"${work}:C:\ProgramData\Jenkins\JenkinsHome`" --rm $global:SUT_IMAGE-plugins-cli exit 0"
+    $exitCode, $stdout, $stderr = Run-Program 'docker.exe' "run -v ${dockerVolume}:C:\ProgramData\Jenkins\JenkinsHome --rm $global:SUT_IMAGE-plugins-cli exit 0"
     $exitCode | Should -Be 0
 
-    $exitCode, $stdout, $stderr = Unzip-Manifest $global:SUT_IMAGE "junit.jpi" $global:WORK
+    $exitCode, $stdout, $stderr = Unzip-Manifest $global:SUT_IMAGE "junit.jpi" $dockerVolume
     $exitCode | Should -Be 0
     $stdout | Should -Match 'Plugin-Version: 1.6'
-    $exitCode, $stdout, $stderr = Unzip-Manifest $global:SUT_IMAGE "ant.jpi" $global:WORK
+    $exitCode, $stdout, $stderr = Unzip-Manifest $global:SUT_IMAGE "ant.jpi" $dockerVolume
     $exitCode | Should -Be 0
     $stdout | Should -Match 'Plugin-Version: 1.3'
   }
@@ -196,121 +186,107 @@ Describe "[plugins-cli > $global:TEST_TAG] plugins are getting upgraded but not
     $exitCode, $stdout, $stderr = Build-DockerChild $global:SUT_IMAGE-upgrade-plugins $PSScriptRoot/upgrade-plugins
     $exitCode | Should -Be 0
     # Images contains junit 1.28 and ant-plugin 1.2
-    $exitCode, $stdout, $stderr = Run-Program 'docker.exe' "run -v `"${work}:C:\ProgramData\Jenkins\JenkinsHome`" --rm $global:SUT_IMAGE-upgrade-plugins exit 0"
+    $exitCode, $stdout, $stderr = Run-Program 'docker.exe' "run -v ${dockerVolume}:C:\ProgramData\Jenkins\JenkinsHome --rm $global:SUT_IMAGE-upgrade-plugins exit 0"
     $exitCode | Should -Be 0
-    $exitCode, $stdout, $stderr = Unzip-Manifest $global:SUT_IMAGE 'junit.jpi' $global:WORK
+    $exitCode, $stdout, $stderr = Unzip-Manifest $global:SUT_IMAGE 'junit.jpi' $dockerVolume
     $exitCode | Should -Be 0
     # Should be updated
     $stdout | Should -Match 'Plugin-Version: 1.28'
-    $exitCode, $stdout, $stderr = Unzip-Manifest $global:SUT_IMAGE 'ant.jpi' $global:WORK
+    $exitCode, $stdout, $stderr = Unzip-Manifest $global:SUT_IMAGE 'ant.jpi' $dockerVolume
     $exitCode | Should -Be 0
     # 1.2 is older than the existing 1.3, so keep 1.3
     $stdout | Should -Match 'Plugin-Version: 1.3'
   }
-}
-
-Describe "[plugins-cli > $global:TEST_TAG] clean work directory" {
-  It 'cleanup' {
-    if(Test-Path $global:WORK) {
-      Remove-Item -Recurse -Force $global:WORK | Out-Null
-    }
+  AfterAll {
+    docker volume rm -f $dockerVolume
   }
 }
 
 # Only test on Java 21, one JDK is enough to test all versions
 Describe "[plugins-cli > $global:TEST_TAG] do not upgrade if plugin has been manually updated" -Skip:(-not $global:TEST_TAG.Contains('jdk21-')) {
-  
+  BeforeAll {
+    $dockerVolume = (New-Guid).Guid
+    docker volume rm -f $dockerVolume
+  }
+
   It 'builds child image' {
     $exitCode, $stdout, $stderr = Build-DockerChild $global:SUT_IMAGE-plugins-cli $PSScriptRoot/plugins-cli
     $exitCode | Should -Be 0
   }
 
   It 'updates plugin manually and then via plugin-cli' {
-    if(-not (Test-Path $global:WORK)) {
-      New-Item -ItemType Directory -Path $global:WORK
-    }
-    
     # Image contains junit 1.8 and ant-plugin 1.3
-    $exitCode, $stdout, $stderr = Run-Program 'docker.exe' "run -v `"${work}:C:\ProgramData\Jenkins\JenkinsHome`" --rm $global:SUT_IMAGE-plugins-cli curl.exe --connect-timeout 20 --retry 5 --retry-delay 0 --retry-max-time 60 -s -f -L https://updates.jenkins.io/download/plugins/junit/1.8/junit.hpi -o C:/ProgramData/Jenkins/JenkinsHome/plugins/junit.jpi"
+    $exitCode, $stdout, $stderr = Run-Program 'docker.exe' "run -v ${dockerVolume}:C:\ProgramData\Jenkins\JenkinsHome --rm $global:SUT_IMAGE-plugins-cli curl.exe --connect-timeout 20 --retry 5 --retry-delay 0 --retry-max-time 60 -s -f -L https://updates.jenkins.io/download/plugins/junit/1.8/junit.hpi -o C:/ProgramData/Jenkins/JenkinsHome/plugins/junit.jpi"
     $exitCode | Should -Be 0
-    $exitCode, $stdout, $stderr = Unzip-Manifest $global:SUT_IMAGE 'junit.jpi' $global:WORK
+    $exitCode, $stdout, $stderr = Unzip-Manifest $global:SUT_IMAGE 'junit.jpi' $dockerVolume
     $exitCode | Should -Be 0
     $stdout | Should -Match 'Plugin-Version: 1.8'
-    $exitCode, $stdout, $stderr = Unzip-Manifest $global:SUT_IMAGE 'ant.jpi' $global:WORK
+    $exitCode, $stdout, $stderr = Unzip-Manifest $global:SUT_IMAGE 'ant.jpi' $dockerVolume
     $exitCode | Should -Be 0
     $stdout | Should -Match 'Plugin-Version: 1.3'
 
     $exitCode, $stdout, $stderr = Build-DockerChild $global:SUT_IMAGE-upgrade-plugins $PSScriptRoot/upgrade-plugins
     $exitCode | Should -Be 0
 
     # Images contains junit 1.28 and ant-plugin 1.2
-    $exitCode, $stdout, $stderr = Run-Program 'docker.exe' "run -v `"${work}:C:\ProgramData\Jenkins\JenkinsHome`" --rm $global:SUT_IMAGE-upgrade-plugins exit 0"
+    $exitCode, $stdout, $stderr = Run-Program 'docker.exe' "run -v ${dockerVolume}:C:\ProgramData\Jenkins\JenkinsHome --rm $global:SUT_IMAGE-upgrade-plugins exit 0"
     $exitCode | Should -Be 0
     # junit shouldn't be upgraded
-    $exitCode, $stdout, $stderr = Unzip-Manifest $global:SUT_IMAGE 'junit.jpi' $global:WORK
+    $exitCode, $stdout, $stderr = Unzip-Manifest $global:SUT_IMAGE 'junit.jpi' $dockerVolume
     $exitCode | Should -Be 0
     $stdout | Should -Match 'Plugin-Version: 1.8'
     $stdout | Should -Not -Match 'Plugin-Version: 1.28'
     # ant shouldn't be downgraded
-    $exitCode, $stdout, $stderr = Unzip-Manifest $global:SUT_IMAGE 'ant.jpi' $global:WORK
+    $exitCode, $stdout, $stderr = Unzip-Manifest $global:SUT_IMAGE 'ant.jpi' $dockerVolume
     $exitCode | Should -Be 0
     $stdout | Should -Match 'Plugin-Version: 1.3'
     $stdout | Should -Not -Match 'Plugin-Version: 1.2'
   }
-}
-
-Describe "[plugins-cli > $global:TEST_TAG] clean work directory" {
-  It 'cleanup' {
-    if(Test-Path $global:WORK) {
-      Remove-Item -Recurse -Force $global:WORK | Out-Null
-    }
+  AfterAll {
+    docker volume rm -f $dockerVolume
   }
 }
 
 # Only test on Java 21, one JDK is enough to test all versions
 Describe "[plugins-cli > $global:TEST_TAG] upgrade plugin even if it has been manually updated when PLUGINS_FORCE_UPGRADE=true" -Skip:(-not $global:TEST_TAG.Contains('jdk21-')) {
+   BeforeAll {
+    $dockerVolume = (New-Guid).Guid
+    docker volume rm -f $dockerVolume
+  }
+
   It 'builds child image' {
     $exitCode, $stdout, $stderr = Build-DockerChild $global:SUT_IMAGE-plugins-cli $PSScriptRoot/plugins-cli
     $exitCode | Should -Be 0
   }
 
   It 'upgrades plugins' {
-    if(-not (Test-Path $global:WORK)) {
-      New-Item -ItemType Directory -Path $global:WORK
-    }
-    
     # Image contains junit 1.6 and ant-plugin 1.3
-    $exitCode, $stdout, $stderr = Run-Program 'docker.exe' "run -v `"${work}:C:\ProgramData\Jenkins\JenkinsHome`" --rm $global:SUT_IMAGE-plugins-cli curl.exe --connect-timeout 20 --retry 5 --retry-delay 0 --retry-max-time 60 -s -f -L https://updates.jenkins.io/download/plugins/junit/1.8/junit.hpi -o C:/ProgramData/Jenkins/JenkinsHome/plugins/junit.jpi"
+    $exitCode, $stdout, $stderr = Run-Program 'docker.exe' "run -v ${dockerVolume}:C:\ProgramData\Jenkins\JenkinsHome --rm $global:SUT_IMAGE-plugins-cli curl.exe --connect-timeout 20 --retry 5 --retry-delay 0 --retry-max-time 60 -s -f -L https://updates.jenkins.io/download/plugins/junit/1.8/junit.hpi -o C:/ProgramData/Jenkins/JenkinsHome/plugins/junit.jpi"
     $exitCode | Should -Be 0
 
-    $exitCode, $stdout, $stderr = Unzip-Manifest $global:SUT_IMAGE 'junit.jpi' $global:WORK
+    $exitCode, $stdout, $stderr = Unzip-Manifest $global:SUT_IMAGE 'junit.jpi' $dockerVolume
     $exitCode | Should -Be 0
     $stdout | Should -Match 'Plugin-Version: 1.8'
-    
+
     $exitCode, $stdout, $stderr = Build-DockerChild $global:SUT_IMAGE-upgrade-plugins $PSScriptRoot/upgrade-plugins
     $exitCode | Should -Be 0
-    
+
     # Images contains junit 1.28 and ant-plugin 1.2
-    $exitCode, $stdout, $stderr = Run-Program 'docker.exe' "run -e PLUGINS_FORCE_UPGRADE=true -v ${work}:C:/ProgramData/Jenkins/JenkinsHome --rm $global:SUT_IMAGE-upgrade-plugins exit 0"
+    $exitCode, $stdout, $stderr = Run-Program 'docker.exe' "run -e PLUGINS_FORCE_UPGRADE=true -v ${dockerVolume}:C:\ProgramData\Jenkins\JenkinsHome --rm $global:SUT_IMAGE-upgrade-plugins exit 0" true
     $exitCode | Should -Be 0
     # junit should be upgraded
-    $exitCode, $stdout, $stderr = Unzip-Manifest $global:SUT_IMAGE 'junit.jpi' $global:WORK
+    $exitCode, $stdout, $stderr = Unzip-Manifest $global:SUT_IMAGE 'junit.jpi' $dockerVolume
     $exitCode | Should -Be 0
     $stdout | Should -Not -Match 'Plugin-Version: 1.8'
     $stdout | Should -Match 'Plugin-Version: 1.28'
     # ant shouldn't be downgraded
-    $exitCode, $stdout, $stderr = Unzip-Manifest $global:SUT_IMAGE 'ant.jpi' $global:WORK
+    $exitCode, $stdout, $stderr = Unzip-Manifest $global:SUT_IMAGE 'ant.jpi' $dockerVolume
     $exitCode | Should -Be 0
     $stdout | Should -Match 'Plugin-Version: 1.3'
     $stdout | Should -Not -Match 'Plugin-Version: 1.2'
   }
-}
-
-Describe "[plugins-cli > $global:TEST_TAG] clean work directory" {
-  It 'cleanup' {
-    if(Test-Path $global:WORK) {
-      Remove-Item -Recurse -Force $global:WORK | Out-Null
-    }
+  AfterAll {
+    docker volume rm -f $dockerVolume
   }
 }
 
@@ -329,11 +305,3 @@ Describe "[plugins-cli > $global:TEST_TAG] Use a custom jenkins.war" -Skip:(-not
     $exitCode | Should -Be 0
   }
 }
-
-Describe "[plugins-cli > $global:TEST_TAG] clean work directory" {
-  It 'cleanup' {
-    if(Test-Path $global:WORK) {
-      Remove-Item -Recurse -Force $global:WORK | Out-Null
-    }
-  }
-}

tests/test_helpers.psm1

@@ -5,11 +5,11 @@ function Test-CommandExists($command) {
   $ErrorActionPreference = 'stop'
   $res = $false
   try {
-      if(Get-Command $command) { 
-          $res = $true 
+      if(Get-Command $command) {
+          $res = $true
       }
   } catch {
-      $res = $false 
+      $res = $false
   } finally {
       $ErrorActionPreference=$oldPreference
   }
@@ -24,24 +24,24 @@ if(-Not (Test-CommandExists docker)) {
 function Retry-Command {
     [CmdletBinding()]
     param (
-        [parameter(Mandatory, ValueFromPipeline)] 
+        [parameter(Mandatory, ValueFromPipeline)]
         [ValidateNotNullOrEmpty()]
         [scriptblock] $ScriptBlock,
         [int] $RetryCount = 3,
         [int] $Delay = 30,
         [string] $SuccessMessage = "Command executed successfully!",
         [string] $FailureMessage = "Failed to execute the command"
         )
-        
+
     process {
         $Attempt = 1
         $Flag = $true
-        
+
         do {
             try {
                 $PreviousPreference = $ErrorActionPreference
                 $ErrorActionPreference = 'Stop'
-                Invoke-Command -NoNewScope -ScriptBlock $ScriptBlock -OutVariable Result 4>&1              
+                Invoke-Command -NoNewScope -ScriptBlock $ScriptBlock -OutVariable Result 4>&1
                 $ErrorActionPreference = $PreviousPreference
 
                 # flow control will execute the next line only if the command in the scriptblock executed without any errors
@@ -84,20 +84,20 @@ function Run-Program($cmd, $params, $verbose=$false) {
     if($verbose) {
         Write-Host "$cmd $params"
     }
-    $psi = New-Object System.Diagnostics.ProcessStartInfo 
-    $psi.CreateNoWindow = $true 
-    $psi.UseShellExecute = $false 
-    $psi.RedirectStandardOutput = $true 
+    $psi = New-Object System.Diagnostics.ProcessStartInfo
+    $psi.CreateNoWindow = $true
+    $psi.UseShellExecute = $false
+    $psi.RedirectStandardOutput = $true
     $psi.RedirectStandardError = $true
     $psi.WorkingDirectory = (Get-Location)
-    $psi.FileName = $cmd 
+    $psi.FileName = $cmd
     $psi.Arguments = $params
-    $proc = New-Object System.Diagnostics.Process 
-    $proc.StartInfo = $psi 
+    $proc = New-Object System.Diagnostics.Process
+    $proc.StartInfo = $psi
     [void]$proc.Start()
-    $stdout = $proc.StandardOutput.ReadToEnd() 
+    $stdout = $proc.StandardOutput.ReadToEnd()
     $stderr = $proc.StandardError.ReadToEnd()
-    $proc.WaitForExit() 
+    $proc.WaitForExit()
     if($proc.ExitCode -ne 0) {
         Write-Host "`n`nstdout:`n$stdout`n`nstderr:`n$stderr`n`n"
     }
@@ -156,7 +156,7 @@ function Run-In-Script-Console($Container, $Script) {
             return $res.Content.replace('Result: ', '')
         }
     }
-    return $null    
+    return $null
 }
 
 function Test-Url($Container, $Url) {
@@ -171,17 +171,17 @@ function Test-Url($Container, $Url) {
         $res = Invoke-WebRequest -Uri $('{0}{1}' -f $jenkinsUrl, $Url) -Headers $Headers -TimeoutSec 60 -Method Head -UseBasicParsing
         if($res.StatusCode -eq 200) {
             return $true
-        } 
+        }
     }
     Write-Error "URL $(Get-JenkinsUrl $Container)$Url failed"
-    return $false    
+    return $false
 }
 
 function Cleanup($image) {
     docker kill "$image" 2>&1 | Out-Null
     docker rm -fv "$image" 2>&1 | Out-Null
 }
 
-function Unzip-Manifest($Container, $Plugin, $Work) {
-    return (Run-Program "docker.exe" "run --rm -v `"${Work}:C:\ProgramData\Jenkins\JenkinsHome`" $Container mkdir C:/ProgramData/Jenkins/temp | Out-Null ; Copy-Item C:/ProgramData/Jenkins/JenkinsHome/plugins/$Plugin C:/ProgramData/Jenkins/temp/$Plugin.zip ; Expand-Archive C:/ProgramData/Jenkins/temp/$Plugin.zip -Destinationpath C:/ProgramData/Jenkins/temp ; `$content = Get-Content C:/ProgramData/Jenkins/temp/META-INF/MANIFEST.MF ; Remove-Item -Force -Recurse C:/ProgramData/Jenkins/temp ; Write-Host `$content ; exit 0")
+function Unzip-Manifest($Container, $Plugin, $DockerVolume) {
+    return (Run-Program "docker.exe" "run --rm -v `"${DockerVolume}:C:\ProgramData\Jenkins\JenkinsHome`" $Container mkdir C:/ProgramData/Jenkins/temp | Out-Null ; Copy-Item C:/ProgramData/Jenkins/JenkinsHome/plugins/$Plugin C:/ProgramData/Jenkins/temp/$Plugin.zip ; Expand-Archive C:/ProgramData/Jenkins/temp/$Plugin.zip -Destinationpath C:/ProgramData/Jenkins/temp ; `$content = Get-Content C:/ProgramData/Jenkins/temp/META-INF/MANIFEST.MF ; Remove-Item -Force -Recurse C:/ProgramData/Jenkins/temp ; Write-Host `$content ; exit 0")
 }