From 8a92794d024e5a7272d8e4a5b5ac938bbf094bc3 Mon Sep 17 00:00:00 2001 From: TheAbider <51920546+TheAbider@users.noreply.github.com> Date: Wed, 12 Aug 2026 22:27:55 -0700 Subject: [PATCH] Print the Microsoft submission obligation into the release summary Antivirus false-positive clearances are granted per hash. The v1.122.4 clearance on 2026-08-12 covers exactly that binary, so every release starts over with the machine-learning models no matter how small the change. That obligation was living in a checklist, which is the same place the previous one lived when it got missed. The release job now writes the new SHA-256, the portal link, and the priority caveat into the run summary, so it appears where the release is already being validated instead of depending on recall. Section 209 pins the step: it exists, links the portal, publishes the hash, writes to the summary, and carries the same version-bump gate as the build steps it follows. Also adds the winget manifests for 1.122.4. The first submission was withdrawn in July because CI retention deleted the previous release and killed the manifest's InstallerUrl between versions; that retention step was removed in #95, so the URL now stays alive. Manifests pass winget validate and the installer URL returns 200. One encoding trap fixed while writing the tests. ci.yml has no BOM, and Windows PowerShell 5.1 decodes BOM-less files as ANSI, so its em-dashes arrive as mojibake while pwsh 7 reads them correctly. The suite runs both ways -- directly under pwsh, and under powershell.exe via Validate-Release -- so an assertion matching non-ASCII text in that file passed one host and failed the other. Section 209 now reads ci.yml as UTF-8 explicitly and anchors only on ASCII. Verified green under both hosts. Structural tests 5485 -> 5493. --- .github/workflows/ci.yml | 40 +++++++++++++++++++ README.md | 2 +- Tests/Run-Tests.ps1 | 33 ++++++++++++++- .../TheAbider.RackStack.installer.yaml | 16 ++++++++ .../TheAbider.RackStack.locale.en-US.yaml | 33 +++++++++++++++ dist/winget/1.122.4/TheAbider.RackStack.yaml | 6 +++ 6 files changed, 128 insertions(+), 2 deletions(-) create mode 100644 dist/winget/1.122.4/TheAbider.RackStack.installer.yaml create mode 100644 dist/winget/1.122.4/TheAbider.RackStack.locale.en-US.yaml create mode 100644 dist/winget/1.122.4/TheAbider.RackStack.yaml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3b2d9ed..188b8e9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -579,3 +579,43 @@ jobs: # storage quota, so there is no storage argument for deleting them. If disk hygiene # ever matters, prune Actions *artifacts* — never releases that a published package # points at. Run-Tests section 206 asserts this workflow contains no release deletion. + + # ───────────────────────────────────────────────────────────────────────── + # Antivirus false-positive submission reminder. + # + # Microsoft clears false positives PER HASH. A clearance covers exactly the + # binary it was granted for, so every release starts over with the + # machine-learning models regardless of how small the change was. v1.122.4 + # was cleared on 2026-08-12 ("the detection has been removed") — that + # clearance does nothing for the next build. + # + # This writes the new hash and the submission link into the run summary so + # the obligation shows up exactly where the release is already being + # validated, rather than depending on someone remembering. + # ───────────────────────────────────────────────────────────────────────── + - name: Remind — submit this build to Microsoft + if: steps.vercheck.outputs.bumped == 'true' && steps.releasecheck.outputs.exists == 'false' + shell: pwsh + run: | + $ver = '${{ steps.vercheck.outputs.version }}' + $sha = (Get-FileHash 'builds\RackStack.exe' -Algorithm SHA256).Hash.ToLower() + $lines = @( + "## Submit v$ver to Microsoft" + "" + "False-positive clearances are **per hash**, so this build is not covered by any" + "previous determination. Submit it, including for patch releases." + "" + "| | |" + "|---|---|" + "| Version | ``$ver`` |" + "| SHA-256 | ``$sha`` |" + "" + "1. https://www.microsoft.com/en-us/wdsi/filesubmission -> **Software developer**" + "2. Priority **Medium** — the default is Low, which states it *may never be processed by an analyst*" + "3. Upload the release asset verified against ``release-hashes.txt``, never a local ``builds/`` copy" + "4. Cite the prior clearance to speed review: submission ``665636df-07e9-4437-9f44-adb3030413ef``" + "" + "Typical turnaround: about two days." + ) + $lines -join "`n" | Out-File -FilePath $env:GITHUB_STEP_SUMMARY -Append -Encoding utf8 + Write-Host "Submission reminder written to the run summary (SHA-256 $sha)." diff --git a/README.md b/README.md index bed2376..680db49 100644 --- a/README.md +++ b/README.md @@ -28,7 +28,7 @@ OpenSSF Best Practices codecov PSScriptAnalyzer 0 errors - 5485 structural tests + 5493 structural tests Pester 312 tests SLSA Level 3

diff --git a/Tests/Run-Tests.ps1 b/Tests/Run-Tests.ps1 index 8f1968a..ff9c59a 100644 --- a/Tests/Run-Tests.ps1 +++ b/Tests/Run-Tests.ps1 @@ -10774,7 +10774,13 @@ Write-SectionHeader "SECTION 209: BUILD METADATA INTEGRITY" try { $ciPath209 = Join-Path $script:ModuleRoot '.github\workflows\ci.yml' if (Test-Path -LiteralPath $ciPath209) { - $ci209 = Get-Content -LiteralPath $ciPath209 -Raw + # -Encoding UTF8 is load-bearing. ci.yml has no BOM, and Windows PowerShell + # 5.1 decodes BOM-less files as ANSI, so its em-dashes and box-drawing + # characters arrive as mojibake while pwsh 7 reads them correctly. The suite + # is run BOTH ways — directly under pwsh, and under powershell.exe by + # local/Validate-Release.ps1 — so without this, assertions that touch any + # non-ASCII text in this file pass in one host and fail in the other. + $ci209 = Get-Content -LiteralPath $ciPath209 -Raw -Encoding UTF8 # Compiler must be pinned to an exact version, never floating. Write-TestResult "Build: ps2exe is pinned to an explicit version" ` @@ -10804,6 +10810,31 @@ try { Write-TestResult "Build: EXE CompanyName matches RackStack.psd1 ('$psdCompany209')" ` ($psdCompany209 -and $exeCompany209 -and $psdCompany209 -eq $exeCompany209) ` "psd1='$psdCompany209' exe='$exeCompany209'" + + # Antivirus FP clearances are granted per hash, so every release — patches + # included — has to be resubmitted. Depending on memory for that failed + # once already; the release job prints the obligation, with the new hash, + # into the run summary that gets read while validating the release. + # Anchor on ASCII only. The step name contains an em-dash; matching it would + # re-introduce the host-dependent decoding problem above even with -Encoding + # set, and 'name: Remind' is already unique in this workflow. + $reminder209 = [regex]::Match($ci209, '(?s)- name: Remind.*?(?=\r?\n\s{6}- name:|\r?\n\s{0,4}\S|\z)') + Write-TestResult "Build: release job carries the Microsoft submission reminder" ` + $reminder209.Success "no reminder step found in ci.yml release job" + $rBody209 = $reminder209.Value + Write-TestResult "Build: reminder links the WDSI submission portal" ` + ($reminder209.Success -and $rBody209 -match 'wdsi/filesubmission') + # Single-quoted so the backslash in builds\RackStack.exe stays literal — the + # first cut of this used a double-quoted pattern whose over-escaped \\\\ + # required two backslashes and never matched the one that is actually there. + Write-TestResult "Build: reminder publishes the new SHA-256" ` + ($reminder209.Success -and $rBody209 -match 'Get-FileHash' -and ` + $rBody209 -match 'SHA256' -and $rBody209 -match 'RackStack\.exe') + Write-TestResult "Build: reminder writes to the run summary" ` + ($reminder209.Success -and $rBody209 -match 'GITHUB_STEP_SUMMARY') + # Only meaningful on an actual release — must carry the same gate as the build steps. + Write-TestResult "Build: reminder is gated on a version bump" ` + ($reminder209.Success -and $rBody209 -match "steps\.vercheck\.outputs\.bumped == 'true'") } else { Write-TestResult "Build: metadata integrity" -Skipped -Message "no .github/workflows in this layout" diff --git a/dist/winget/1.122.4/TheAbider.RackStack.installer.yaml b/dist/winget/1.122.4/TheAbider.RackStack.installer.yaml new file mode 100644 index 0000000..278d415 --- /dev/null +++ b/dist/winget/1.122.4/TheAbider.RackStack.installer.yaml @@ -0,0 +1,16 @@ +# yaml-language-server: $schema=https://aka.ms/winget-manifest.installer.1.6.0.schema.json +PackageIdentifier: TheAbider.RackStack +PackageVersion: 1.122.4 +Platform: + - Windows.Desktop +MinimumOSVersion: 6.1.0.0 +InstallerType: portable +Commands: + - rackstack +ReleaseDate: 2026-08-10 +Installers: + - Architecture: x64 + InstallerUrl: https://github.com/TheAbider/RackStack/releases/download/v1.122.4/RackStack.exe + InstallerSha256: 658EDCC53D5139CE0A0F4DF167FA3F3CB293111DFF851BE300D8E4B788323034 +ManifestType: installer +ManifestVersion: 1.6.0 diff --git a/dist/winget/1.122.4/TheAbider.RackStack.locale.en-US.yaml b/dist/winget/1.122.4/TheAbider.RackStack.locale.en-US.yaml new file mode 100644 index 0000000..cbd37d5 --- /dev/null +++ b/dist/winget/1.122.4/TheAbider.RackStack.locale.en-US.yaml @@ -0,0 +1,33 @@ +# yaml-language-server: $schema=https://aka.ms/winget-manifest.defaultLocale.1.6.0.schema.json +PackageIdentifier: TheAbider.RackStack +PackageVersion: 1.122.4 +PackageLocale: en-US +Publisher: TheAbider +PublisherUrl: https://github.com/TheAbider +PublisherSupportUrl: https://github.com/TheAbider/RackStack/issues +PackageName: RackStack +PackageUrl: https://github.com/TheAbider/RackStack +License: MIT +LicenseUrl: https://github.com/TheAbider/RackStack/blob/master/LICENSE +Copyright: Copyright (c) 2026 TheAbider +ShortDescription: PowerShell automation toolkit for configuring Windows Server hosts. +Description: |- + RackStack is a menu-driven PowerShell tool that automates everything between + "Windows is installed" and "server is in production." It provides 201 CLI + actions and 60+ interactive menus covering networking, Hyper-V, SAN/iSCSI, + clustering, VM deployment, cloud onboarding, and batch automation, all with + undo, transaction rollback, and audit logging. Built for MSPs, sysadmins, + and infrastructure teams who build Windows Servers repeatedly. +Moniker: rackstack +Tags: + - windows-server + - hyper-v + - iscsi + - clustering + - powershell + - sysadmin + - automation + - msp +ReleaseNotesUrl: https://github.com/TheAbider/RackStack/releases/tag/v1.122.4 +ManifestType: defaultLocale +ManifestVersion: 1.6.0 diff --git a/dist/winget/1.122.4/TheAbider.RackStack.yaml b/dist/winget/1.122.4/TheAbider.RackStack.yaml new file mode 100644 index 0000000..bd0ff0e --- /dev/null +++ b/dist/winget/1.122.4/TheAbider.RackStack.yaml @@ -0,0 +1,6 @@ +# yaml-language-server: $schema=https://aka.ms/winget-manifest.version.1.6.0.schema.json +PackageIdentifier: TheAbider.RackStack +PackageVersion: 1.122.4 +DefaultLocale: en-US +ManifestType: version +ManifestVersion: 1.6.0