136 lines
5.1 KiB
PowerShell
136 lines
5.1 KiB
PowerShell
# register-boot-task.ps1
|
|
# Registers the VignettePublicRuntime scheduled task to run at user logon
|
|
# (hidden window). The boot script (scripts/boot-public-runtime.ps1) does the
|
|
# actual recovery. Re-run to refresh (-Force). Remove with:
|
|
# Unregister-ScheduledTask -TaskName VignettePublicRuntime -Confirm:$false
|
|
#
|
|
# powershell -NoProfile -ExecutionPolicy Bypass -File scripts\register-boot-task.ps1 `
|
|
# -StableSourceRoot D:\workspace\vignette-public-runtime-<commit>
|
|
|
|
param(
|
|
[Parameter(Mandatory = $true)]
|
|
[string]$StableSourceRoot,
|
|
[string]$TaskName = "VignettePublicRuntime"
|
|
)
|
|
|
|
$ErrorActionPreference = "Stop"
|
|
|
|
$resolvedSourceRoot = (Resolve-Path -LiteralPath $StableSourceRoot).Path
|
|
$RegisterScript = Join-Path $resolvedSourceRoot "scripts\register-boot-task.ps1"
|
|
$BootScript = Join-Path $resolvedSourceRoot "scripts\boot-public-runtime.ps1"
|
|
$StartScript = Join-Path $resolvedSourceRoot "scripts\start-public-runtime.ps1"
|
|
$UserName = "$env:USERDOMAIN\$env:USERNAME"
|
|
|
|
function Invoke-GitText {
|
|
param([string[]]$Arguments)
|
|
|
|
$value = & git.exe -C $resolvedSourceRoot @Arguments
|
|
if ($LASTEXITCODE -ne 0) {
|
|
throw "Stable source Git command failed (exit=$LASTEXITCODE): git $($Arguments -join ' ')"
|
|
}
|
|
return (@($value) -join [Environment]::NewLine).Trim()
|
|
}
|
|
|
|
foreach ($requiredScript in @($RegisterScript, $BootScript, $StartScript)) {
|
|
if (-not (Test-Path -LiteralPath $requiredScript -PathType Leaf)) {
|
|
throw "Public runtime script not found: $requiredScript"
|
|
}
|
|
}
|
|
|
|
$runningRegisterScript = (Resolve-Path -LiteralPath $PSCommandPath).Path
|
|
if (-not [string]::Equals(
|
|
$runningRegisterScript,
|
|
(Resolve-Path -LiteralPath $RegisterScript).Path,
|
|
[System.StringComparison]::OrdinalIgnoreCase
|
|
)) {
|
|
throw "Boot task registrar is not executing from the pinned stable source root"
|
|
}
|
|
|
|
$gitRoot = Invoke-GitText -Arguments @("rev-parse", "--show-toplevel")
|
|
$resolvedGitRoot = (Resolve-Path -LiteralPath $gitRoot).Path
|
|
if (-not [string]::Equals(
|
|
$resolvedGitRoot,
|
|
$resolvedSourceRoot,
|
|
[System.StringComparison]::OrdinalIgnoreCase
|
|
)) {
|
|
throw "Stable source root does not match its Git toplevel"
|
|
}
|
|
|
|
$symbolicHead = & git.exe -C $resolvedSourceRoot symbolic-ref --quiet HEAD
|
|
$symbolicHeadExit = $LASTEXITCODE
|
|
if ($symbolicHeadExit -eq 0) {
|
|
throw "Stable source must be a detached HEAD, not branch $symbolicHead"
|
|
}
|
|
if ($symbolicHeadExit -ne 1) {
|
|
throw "Could not prove detached HEAD (git exit=$symbolicHeadExit)"
|
|
}
|
|
|
|
$dirty = Invoke-GitText -Arguments @("status", "--porcelain=v1", "--untracked-files=normal")
|
|
if ($dirty) {
|
|
throw "Stable source is not clean; refusing boot task registration"
|
|
}
|
|
foreach ($relativePath in @(
|
|
"scripts/register-boot-task.ps1",
|
|
"scripts/boot-public-runtime.ps1",
|
|
"scripts/start-public-runtime.ps1"
|
|
)) {
|
|
Invoke-GitText -Arguments @("ls-files", "--error-unmatch", "--", $relativePath) | Out-Null
|
|
}
|
|
|
|
$sourceCommit = Invoke-GitText -Arguments @("rev-parse", "--verify", "HEAD")
|
|
$sourceTree = Invoke-GitText -Arguments @("rev-parse", "--verify", "HEAD^{tree}")
|
|
$bootScriptSha256 = (Get-FileHash -LiteralPath $BootScript -Algorithm SHA256).Hash.ToLowerInvariant()
|
|
$startScriptSha256 = (Get-FileHash -LiteralPath $StartScript -Algorithm SHA256).Hash.ToLowerInvariant()
|
|
|
|
$bootArguments = @(
|
|
"-NoProfile",
|
|
"-ExecutionPolicy Bypass",
|
|
"-WindowStyle Hidden",
|
|
"-File `"$BootScript`"",
|
|
"-StableSourceRoot `"$resolvedSourceRoot`"",
|
|
"-ExpectedSourceCommit $sourceCommit",
|
|
"-ExpectedSourceTree $sourceTree",
|
|
"-ExpectedBootScriptSha256 $bootScriptSha256",
|
|
"-ExpectedStartScriptSha256 $startScriptSha256"
|
|
)
|
|
|
|
$action = New-ScheduledTaskAction `
|
|
-Execute "powershell.exe" `
|
|
-Argument ($bootArguments -join " ") `
|
|
-WorkingDirectory $resolvedSourceRoot
|
|
|
|
$trigger = New-ScheduledTaskTrigger -AtLogOn -User $UserName
|
|
|
|
# Interactive: runs in the user session (Start-Process hidden window / Docker Desktop GUI work).
|
|
# Limited: no admin rights needed.
|
|
$principal = New-ScheduledTaskPrincipal `
|
|
-UserId $env:USERNAME `
|
|
-LogonType Interactive `
|
|
-RunLevel Limited
|
|
|
|
$settings = New-ScheduledTaskSettingsSet `
|
|
-AllowStartIfOnBatteries `
|
|
-DontStopIfGoingOnBatteries `
|
|
-StartWhenAvailable `
|
|
-ExecutionTimeLimit (New-TimeSpan -Minutes 15)
|
|
|
|
Register-ScheduledTask `
|
|
-TaskName $TaskName `
|
|
-Action $action `
|
|
-Trigger $trigger `
|
|
-Principal $principal `
|
|
-Settings $settings `
|
|
-Description "Vignette public runtime auto-recovery from detached clean commit $sourceCommit at logon" `
|
|
-Force | Out-Null
|
|
|
|
$task = Get-ScheduledTask -TaskName $TaskName
|
|
Write-Output ("Registered : " + $TaskName)
|
|
Write-Output ("State : " + $task.State)
|
|
Write-Output ("User : " + $principal.UserId)
|
|
Write-Output ("Trigger : AtLogOn (" + $UserName + ")")
|
|
Write-Output ("Command : " + $action.Execute + " " + $action.Argument)
|
|
Write-Output ("Source : root=" + $resolvedSourceRoot + " commit=" + $sourceCommit + " tree=" + $sourceTree)
|
|
Write-Output ("Hashes : boot=" + $bootScriptSha256 + " start=" + $startScriptSha256)
|
|
Write-Output ""
|
|
Write-Output ("Run now : " + $action.Execute + " " + $action.Argument)
|
|
Write-Output ("Unregister : Unregister-ScheduledTask -TaskName " + $TaskName + " -Confirm:`$false")
|