[DRAFT] Windows HW baked install.wim pipeline (Packer, Azure build host) - #830

Draft

markcor wants to merge 152 commits into

mainfrom

nuc-wim-pipeline

Commits on Jul 24, 2026

nuc-wim: config-driven baked install.wim pipeline (Packer, Azure build host)

markcor
and
claude
committed
d19ac00
nuc-wim: add ci/kickoff-nuc-wim-build.ps1 (build-host kickoff, used by the GHA)

markcor
and
claude
committed
c278174
win-hw-wim: rename pipeline from nuc-wim (generic Windows HW WIM pre-bake)

markcor
and
claude
committed
f4c045e
win-hw-wim: config-driven driver injection + resolve WIM index by edition name

markcor
and
claude
committed
5d68cf6
win-hw-wim: set win11-24h2-hw base edition to Windows 11 Enterprise

markcor
and
claude
committed
19fbb55
win-hw-wim: pin ronin bake to wim-bake-role @ 4463ab7 (ronin_puppet#1297)

markcor
and
claude
committed
b1f5b65
win-hw-wim: use short SHA (4463ab7) for ronin hash to match deploymentId convention

markcor
and
claude
committed
f87f577
win-hw-wim: add temp-testing image config win11-24h2-hw-test

markcor
and
claude
committed
1bc32a8
win-hw-wim review pass 1 (correctness): bin-dir fallback + robust driver bool

markcor
and
claude
committed
8a24866
win-hw-wim review pass 2 (robustness): input guards + build-host reboot retry

markcor
and
claude
committed
75e366b
win-hw-wim review pass 3 (consistency): docs match Entra-only reality

markcor
and
claude
committed
b3466e6
win-hw-wim: packer fmt (fix pre-commit packer_fmt hook)

markcor
and
claude
committed
0d31028
win-hw-wim: make azcopy actually use the identity (AZCLI auto-login + MI fallback)

markcor
and
claude
committed
06caefb
win-hw-wim: ephemeral build-VM lifecycle + poll-to-completion

markcor
and
claude
committed
66108b0
win-hw-wim: attach pre-provisioned user-assigned identity (no per-run role grant)

markcor
and
claude
committed
fe1046f
win-hw-wim: fix infinite recursion in az helper (call depth overflow)

markcor
and
claude
committed
02048be
win-hw-wim: portable password gen (System.Web absent in pwsh 7 on Linux)

markcor
and
claude
committed
1c8af59
win-hw-wim: set short --computer-name (Windows 15-char limit)

markcor
and
claude
committed
c3b23c6

Commits on Jul 27, 2026

win-hw-wim: fix silent bootstrap no-op (phase passing, PATH, fail-loud)

markcor
and
claude
committed
f43a253
win-hw-wim: destroy sweeps leaked NIC/disks by name prefix (failed-create cleanup)

markcor
and
claude
committed
7a7eece
win-hw-wim: fix bootstrap script path on Linux runner + inline phase

markcor
and
claude
committed
2246716
win-hw-wim: capture stderr from run-command (value[].message)

markcor
and
claude
committed
364c9a9
win-hw-wim: fix nested-virt build VM — Standard security type + WS2025 + D96ads_v5

markcor
and
claude
committed
22684bf
win-hw-wim: use D64ads_v5 (D96ads_v5 exceeds the 64-core DADSv5 quota)

markcor
and
claude
committed
5fea10f
win-hw-wim: fix PowerShell parse error in bootstrap ($DataDriveLetter:)

markcor
and
claude
committed
1b9e1bc
win-hw-wim: drop nonexistent choco pkg windows-adk-deploymenttools (DISM is native)

markcor
and
claude
committed
4560e16
fix(win-hw-wim): stop powershell-yaml Install-Module hang in run-command

markcor
and
claude
committed
e423243
fix(win-hw-wim): fix quote escaping in kickoff scheduled-task arg

markcor
and
claude
committed
5bf9ecf
fix(win-hw-wim): don't single-quote scheduled-task args (literal quotes leaked into $Image)

markcor
and
claude
committed
1925f4d
fix(win-hw-wim): az login with the user-assigned identity on the build VM

markcor
and
claude
committed
d76c021
fix(win-hw-wim): use az login --identity --client-id (2.88 dropped --username)

markcor
and
claude
committed
d1afcb3
fix(win-hw-wim): replace PS7 ternary in download-wim (build runs under WinPS 5.1)

markcor
and
claude
committed
30cf374
fix(win-hw-wim): drop azcopy --auth-mode (removed from copy in 10.32)

markcor
and
claude
committed
d177dc9
fix(win-hw-wim): don't Join-Path an already-rooted OutVhdx

markcor
and
claude
committed
d931032
feat(win-hw-wim): NAT switch for the nested bake VM (no 'Default Switch' on Server)

markcor
and
claude
committed
218e4ba
fix(win-hw-wim): run packer against the dir, not a single file

markcor
and
claude
committed
8536279
fix(win-hw-wim): add required publicKeyToken to unattend components

markcor
and
claude
committed
964c50d
fix(win-hw-wim): auto-answer OOBE region/keyboard (International-Core)

markcor
and
claude
committed
7205132
fix(win-hw-wim): fully-unattended OOBE, modeled on MDC1 base-autounattend

markcor
and
claude
committed
f4e2129
fix(win-hw-wim): create WinRM listener on the NAT (Public) network

markcor
and
claude
committed
6111398

Commits on Jul 28, 2026

perf(win-hw-wim): max bake VM resources + put artifacts on the data disk

markcor
and
claude
committed
d59387f
fix(win-hw-wim): cap bake VM memory at 32 GiB (Packer hyperv builder max)

markcor
and
claude
committed
bdcfadd
fix(win-hw-wim): set up WinRM in specialize pass, not FirstLogonCommands

markcor
and
claude
committed
efc4730
fix(win-hw-wim): build the packer VM on the data disk (temp_path)

markcor
and
claude
committed
ddbd760
fix(win-hw-wim): repair specialize unattend parse failure (over-long Path)

markcor
and
claude
committed
614b592
fix(win-hw-wim): NTLM WinRM auth + Private profile + post-specialize boot watchdog

markcor
and
claude
committed
8aa3e44
feat(win-hw-wim): make the bake-time Windows Update pass a per-image toggle

markcor
and
claude
committed
dcbb390
fix(win-hw-wim): whole-build boot watchdog + reliable Private profile for WinRM

markcor
and
claude
committed
5fc0433
debug(win-hw-wim): surface puppet-apply failures + keep failed VM for inspection

markcor
and
claude
committed
f8b3299
feat(win-hw-wim): plumb a build-scoped GitHub token into the bake (tooltool)

markcor
and
claude
committed
7cf40ae
fix(win-hw-wim): fix bake puppet compile (rc=1) — no-BOM manifests + role-aware hiera

markcor
and
claude
committed
b862009
fix(win-hw-wim): run bake puppet apply as SYSTEM (fixes NgcCtnrSvc rc=6)

markcor
and
claude
committed
0c8ac06
fix(win-hw-wim): sysprep-generalize — parseable AppX-leftover warning

markcor
and
claude
committed
7f0cfe2
style(win-hw-wim): packer fmt — drop stray alignment on temp_path

markcor
and
claude
committed
baaf1da
refactor(win-hw-wim): make the pre-Sysprep AppX guard ASCII/robust

markcor
and
claude
committed
161ffcb
fix(win-hw-wim): drop em-dash inside Sysprep warning string

markcor
and
claude
committed
91ff202
refactor(win-hw-wim): drop the dead pre-Sysprep AppX guard

markcor
and
claude
committed
86853cd

Commits on Jul 29, 2026

fix(win-hw-wim): capture-wim verification must not fail the build on path format

markcor
and
claude
committed
da9a99d
fix(win-hw-wim): robust managed-identity az login on the build VM

markcor
and
claude
committed
358f3aa
fix(win-hw-wim): az login probe must not die under ErrorActionPreference=Stop

markcor
and
claude
committed
8d8341a
feat(MDC1Windows): relops1213 WIM-apply canary on the feature branch

markcor
and
claude
committed
b452ab2
feat(MDC1Windows): DISM /Apply-Image deploy path for pre-baked WIMs

markcor
and
claude
committed
1f072c2
fix(MDC1Windows): locate + mount the ESP before bcdboot (was hardcoded S:)

markcor
and
claude
committed
510acf0
feat(win-hw-wim): bake OpenSSH + SetupComplete first-boot runner into the WIM

markcor
and
claude
committed
d5a10cd
fix(win-hw-wim): re-assert bake network/WinRM on every boot (mid-bake restart flake)

markcor
and
claude
committed
3f8d1ad
fix(win-hw-wim): make the kickoff build.done poll resilient (was hanging jobs)

markcor
and
claude
committed
7438ee1
chore(MDC1Windows): point relops1213 canary at the SSH+SetupComplete golden WIM

markcor
and
claude
committed
c7cd415
fix(win-hw-wim): run first-boot bootstrap via a baked SYSTEM startup task

markcor
and
claude
committed
7b21547

Commits on Jul 30, 2026

fix(win-hw-wim): retry the transient StepCloneVM/secure-boot flake in-place

markcor
and
claude
committed
95fc039
fix(win-hw-wim): stop the boot watchdog racing packer at StepCloneVM (root cause)

markcor
and
claude
committed
6b50185
revert(win-hw-wim): drop the ineffective in-place packer-build retry

markcor
and
claude
committed
f4e2d85
test(win-hw-wim): option 1 - rebuild the SOURCE VM on a StepCloneVM flake

markcor
and
claude
committed
21184f3
fix(win-hw-wim): kickoff poll crashed on multi-line status (killed good-host bakes)

markcor
and
claude
committed
bf8102d
chore(MDC1Windows): point relops1213 canary at the startup-task golden WIM

markcor
and
claude
committed
0910fc1
fix(win-hw-wim): detect bake completion via blob, not run-command (kickoff hang)

markcor
and
claude
committed
96fdc2f
bake: add admin-group SSH key + nxlog log shipping to golden WIM

markcor
and
claude
committed
d47aa16
bake: enable built-in Administrator + disable packer acct for deploy autologon

markcor
and
claude
committed
bf1026e

Commits on Jul 31, 2026

ci(win-hw-wim): keep az authed across the long bake (OIDC re-login)

markcor
and
claude
committed
97288b4
MDC1Windows: relops1213 image -> win11-24h2-hw-test-20260730-223108

markcor
and
claude
committed
0b30b4f
ci(win-hw-wim): only accept a completion marker newer than kickoff

markcor
and
claude
committed
09982ce
canary(RELOPS-2487): consume prebaked artifacts in the deploy bootstrap

markcor
and
claude
committed
61b2318
canary(RELOPS-2487): version-guard nxlog install (consume prebake)

markcor
and
claude
committed
7f2c717
canary(RELOPS-2487): nxlog guard = presence, not version

markcor
and
claude
committed
3260646
canary(RELOPS-2487): deterministically set node name offline in DISM deploy

markcor
and
claude
committed
2261ab3
bake: drop C:\ronin after the puppet run so deploy re-clones fresh

markcor
and
claude
committed
d972886
MDC1Windows: bump relops1213 ronin hash d409da5 -> adf1034 (AppX log fix)

markcor
and
claude
committed
24dfe0d
canary(RELOPS-2487): bake NuGet+modules, drop deploy NuGet poll, skip WinRM

markcor
and
claude
committed
ff1072a

Commits on Aug 3, 2026

MDC1Windows: relops1213 image -> win11-24h2-hw-test-20260731-190855

markcor
and
claude
committed
83f7807
MDC1Windows: bump relops1213 ronin hash adf1034 -> c3b9793

markcor
and
claude
committed
7a03908
OS-deploy: cache the baked WIM on D: instead of recopying ~6 GB every deploy

markcor
and
claude
committed
0dbb23c
OS-deploy: quick-format C: before DISM apply (clean target)

markcor
and
claude
committed
8acdc40
MDC1Windows: bump relops1213 ronin hash c3b9793 -> 8d713d9

markcor
and
claude
committed
8d65460
win-hw-wim: bake NUC13 drivers into the WIM (scalable .cab/.zip list)

markcor
and
claude
committed
0ca9df1
MDC1Windows: relops1213 -> drivers-in-WIM image + ronin be05a38

markcor
and
claude
committed
560f41e
MDC1Windows: relops1213 ronin hash be05a38 -> 883b4d8

markcor
and
claude
committed
35a1271
bootstrap: on-host driver install for the pre-baked deploy path (RELOPS-2487)

markcor
and
claude
committed
47d109d
bootstrap: temporarily disable Install-Drivers call (RELOPS-2487)

markcor
and
claude
committed
1457e39

Commits on Aug 4, 2026

win-hw-wim: bake the Intel graphics driver (32.0.101.7085) into the WIM

markcor
and
claude
committed
5323c97
win-hw-wim: fix multi-cab arg passing (-File can't bind array params)

markcor
and
claude
committed
9baa437
MDC1Windows: relops1213 -> drivers-in-WIM image 20260804-175453 + ronin 0d530e1

markcor
and
claude
committed
2c56233
MDC1Windows: relops1213 ronin hash 0d530e1 -> 5230f32 (Set-PXE re-enabled)

markcor
and
claude
committed
159039f

Commits on Aug 5, 2026

Commits on Aug 6, 2026

win-hw-wim: add 'iso' stage - build a requirement-bypass Windows 11 ISO

markcor
and
claude
committed
c17e6c1
win-hw-wim: add iso: section to win11-24h2-hw.yaml (POC, reuse same config)

markcor
and
claude
committed
847242c
win-hw-wim: keep the iso builder in its own config (distinct from the WIM bake)

markcor
and
claude
committed
3bc91e1
win-hw-wim: thread -Stages through kickoff -> run-build-task -> New-WinHwWim

markcor
and
claude
committed
071130f
win-hw-wim: config-driven ISO toggle (iso.enabled) instead of a stage input

markcor
and
claude
committed
5084932
win-hw-wim: modular iso builder — base + scripts inject-library (nocheck)

markcor
and
claude
committed
0e05798
win-hw-wim: 25H2 media + base-WIM-from-ISO fallback

markcor
and
claude
committed
444ed21
win-hw-wim: iso stage self-provisions oscdimg from our blob

markcor
and
claude
committed
1a78250
win-hw-wim: iso output -> captured/ with golden-WIM naming

markcor
and
claude
committed
19e7357

Commits on Aug 7, 2026

Get-Bootstrap: stop calling Set-WinRM (always fails); keep the function

markcor
and
claude
committed
549deb5
win-hw-wim: retarget storage to hardwareimaging + resources/captured folder layout

markcor
and
claude
committed
3e95d0a
win-hw-wim: rebrand infra refs nuc-wim -> hardware-imaging

markcor
and
claude
committed
f4f9520
win-hw-wim iso: offline driver injection into boot.wim + install.wim

markcor
and
claude
committed
be31cae

Commits on Aug 10, 2026

win11-24h2-hw: bump ronin pin 4463ab7 -> 48a8b9d4 (fixes marlin_pw compile fail)
markcor
committed
85a968c

Commits on Aug 11, 2026

win-hw-wim: 60m restart timeout + fix the flake classifier that ate run 31428853582

markcor
and
claude
committed
1876078
win11-24h2-hw: turn OFF bake-time Windows Update

markcor
and
claude
committed
7506574
win-hw-wim: stream the build log live into the GH job, plus a filtered SolarWinds tail

markcor
and
claude
committed
44caa86
win-hw-wim: generate release notes / SBOM the same way the Azure images do

markcor
and
claude
committed
73afd13
win-hw-wim: drop the SolarWinds tail for a PowerShell Direct stall capture

markcor
and
claude
committed
25f2dbf

Commits on Aug 12, 2026

win-hw-wim: silence az blob JSON, which drowned the live log 8:1

markcor
and
claude
committed
6543896

Commits on Aug 18, 2026

perf-debug: point the canary at the win11-24h2-hw production WIM

markcor
and
claude
committed
0070ba0
perf-debug: bump ronin hash to 48a8b9d4, matching the new WIM's bake

markcor
and
claude
committed
ca1eeb8
pools: take main's node membership for every pool except relops1213

markcor
and
claude
committed
822ad09
pools: sync relops1213's nodes from main too, clearing the 159/160 overlap

markcor
and
claude
committed
4c476a9
ref-alpha: point at the same baked WIM as perf-debug

markcor
and
claude
committed
0a89a79
ref-alpha: align puppet with perf-debug (wim-bake-role @ 48a8b9d4)

markcor
and
claude
committed
794b780

Commits on Aug 20, 2026

Commits on Aug 21, 2026

Commits on Aug 26, 2026

win-hw-wim: stage in-guest bake payloads to C:\bake\extras (Intel Graphics Software)

markcor
and
claude
committed
47ea36d
pools: move the two canary pools to ronin 4c2e223d

markcor
and
claude
committed
579b7de
win11-24h2-hw: bump the bake's ronin pin to 4c2e223d

markcor
and
claude
committed
3147fd0
win-hw-wim: fix the bake's puppet log encoding so class output is greppable

markcor
and
claude
committed
6c97f88
pools: point the canary pools at win11-24h2-hw-20260826-180420

markcor
and
claude
committed
edb4026

Commits on Aug 27, 2026

win-hw-wim: inject the platform/chipset driver packs so baked nodes match production

markcor
and
claude
committed
3e9142d
win-hw-wim: stop the boot watchdog racing Packer's initial Start-VM

markcor
and
claude
committed
7a35d34
pools: point the canary pools at win11-24h2-hw-20260827-174334

markcor
and
claude
committed
b84e1a3

Commits on Sep 4, 2026

pools: align ref-alpha's git_version with perf-debug

markcor
and
claude
committed
cb635f4

Commits on Sep 8, 2026

win-hw-wim: ship the Intel graphics installer in the WIM at C:\extras

markcor
and
claude
committed
7a4157d
pools: point the canary pools at win11-24h2-hw-20260908-172915

markcor
and
claude
committed
9a2963e

Commits on Sep 11, 2026

pools: bump the canary pools to ronin 459102e1 (master merged in)

markcor
and
claude
committed
4a82154