[DRAFT] Windows HW baked install.wim pipeline (Packer, Azure build host)

ci/az-relogin.ps1

@@ -0,0 +1,61 @@
+<#
+.SYNOPSIS
+  Re-authenticate the Azure CLI mid-job using the GitHub Actions OIDC token.
+
+.DESCRIPTION
+  The workflow authenticates once via azure/login (OIDC). That yields an Azure access
+  token valid for ~1h that CANNOT be refreshed. The WIM bake step runs ~1h40m+, so by
+  the time the completion marker appears the runner's token is dead and every
+  `az ... --auth-mode login` call fails silently — the poll never detects completion
+  (240-min timeout) and the always() teardown can't delete the VM (quota leak).
+
+  This re-runs `az login` with a FRESH GitHub OIDC token. The job has
+  `permissions: id-token: write`, so any step can mint a new OIDC JWT on demand; a token
+  minted in the same job carries the same subject claim azure/login already succeeded
+  with, so the federated login succeeds again and yields a fresh ~1h Azure token.
+
+  Client/tenant/subscription are recovered from the CACHED az profile when not passed:
+  `az account show` reads ~/.azure locally and works even after the access token has
+  expired (SP login -> user.name is the app/client id). So callers need thread NO
+  secrets through the workflow YAML — this fix stays entirely in the checked-out ci/
+  scripts on the pipeline branch.
+
+.NOTES
+  Requires the GH OIDC request vars (present whenever the job has id-token: write):
+  ACTIONS_ID_TOKEN_REQUEST_URL / ACTIONS_ID_TOKEN_REQUEST_TOKEN.
+#>
+[CmdletBinding()]
+param(
+    [string] $ClientId,
+    [string] $TenantId,
+    [string] $SubscriptionId
+)
+$ErrorActionPreference = 'Stop'
+
+if (-not $env:ACTIONS_ID_TOKEN_REQUEST_URL -or -not $env:ACTIONS_ID_TOKEN_REQUEST_TOKEN) {
+    throw 'GH OIDC token endpoint unavailable (need permissions: id-token: write on the job).'
+}
+
+# Recover any missing identity fields from the cached az profile (survives token expiry).
+if (-not ($ClientId -and $TenantId -and $SubscriptionId)) {
+    $acct = az account show -o json 2>$null | ConvertFrom-Json
+    if (-not $acct) { throw 'Cannot recover identity for OIDC re-login: no cached az profile (az account show returned nothing).' }
+    if (-not $ClientId)       { $ClientId       = $acct.user.name }   # SP login: user.name = app/client id
+    if (-not $TenantId)       { $TenantId       = $acct.tenantId }
+    if (-not $SubscriptionId) { $SubscriptionId = $acct.id }
+}
+if (-not ($ClientId -and $TenantId -and $SubscriptionId)) {
+    throw "Incomplete identity for OIDC re-login (client='$ClientId' tenant='$TenantId' sub='$SubscriptionId')."
+}
+
+# Mint a fresh GitHub OIDC token scoped to the Azure token-exchange audience.
+$uri = "$($env:ACTIONS_ID_TOKEN_REQUEST_URL)&audience=api://AzureADTokenExchange"
+$jwt = (Invoke-RestMethod -Uri $uri -Method GET -Headers @{ Authorization = "Bearer $($env:ACTIONS_ID_TOKEN_REQUEST_TOKEN)" }).value
+if (-not $jwt) { throw 'GH OIDC token request returned an empty token.' }
+
+az login --service-principal -u $ClientId -t $TenantId --federated-token $jwt --output none
+if ($LASTEXITCODE -ne 0) { throw "az login (federated OIDC) failed with exit $LASTEXITCODE." }
+az account set --subscription $SubscriptionId --output none
+if ($LASTEXITCODE -ne 0) { throw "az account set --subscription '$SubscriptionId' failed with exit $LASTEXITCODE." }
+
+Write-Host "  [az-relogin] re-authenticated to Azure via GH OIDC (subscription $SubscriptionId)"

ci/win-hw-wim-vm.ps1

@@ -0,0 +1,130 @@
+<#
+.SYNOPSIS
+  Create or destroy the EPHEMERAL Azure build VM for a Windows HW WIM build. Runs on
+  the GitHub Actions runner (pwsh + az, already authenticated by azure/login).
+
+.DESCRIPTION
+  The workflow spins this VM up per run and tears it down afterward (in an
+  if: always() step), so there is no idle cost and no long-lived build host.
+
+  -Action create : nested-virt VM (no public IP / no NSG — driven only via
+    az vm run-command), system-assigned managed identity granted Storage Blob Data
+    Contributor on the storage account, Premium data disk, then bootstrap Hyper-V +
+    tooling (provisioners/windows/win-hw-wim/scripts/bootstrap-build-host.ps1).
+  -Action destroy : remove the VM + its OS disk + NIC + the MI role assignment.
+    Idempotent and best-effort so teardown never leaves the job stuck; safe to run
+    even if create only partially succeeded.
+
+  The VM name is run-scoped (e.g. win-hw-wim-build-<run_id>) so parallel runs don't
+  collide and teardown targets exactly this run's VM.
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)][ValidateSet('create', 'destroy')] [string] $Action,
+    [Parameter(Mandatory)] [string] $VmName,
+    [string] $ResourceGroup  = 'rg-central-us-hardware-imaging',
+    [string] $VnetName       = 'vn-central-us-hardware-imaging',
+    [string] $SubnetName     = 'sn-central-us-hardware-imaging-packer',
+    [string] $Size           = 'Standard_D64ads_v5',   # AMD, 64 vCPU/256 GiB, nested-virt capable (fits DADSv5 64-core quota)
+    # Plain Windows Server 2025 gen2 (NOT azure-edition — azure-edition pushes Trusted
+    # Launch, which is incompatible with nested virtualization).
+    [string] $Image          = 'MicrosoftWindowsServer:WindowsServer:2025-datacenter-g2:latest',
+    [int]    $DataDiskGB     = 512,
+    # Pre-provisioned user-assigned identity (Terraform) attached to the VM for blob
+    # access — so no per-run role assignment (and no role-assignment rights) is needed.
+    [string] $BuilderIdentityName = 'id-central-us-hardware-imaging-builder'
+)
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version Latest
+# Resolve the real az executable — PowerShell is case-insensitive, so a function
+# named "Az" would otherwise shadow "az" and recurse infinitely.
+$azExe = (Get-Command az -CommandType Application -ErrorAction Stop | Select-Object -First 1).Source
+function Az { $o = & $azExe @args 2>&1; if ($LASTEXITCODE) { throw "az $($args -join ' ') failed:`n$o" }; return $o }
+function AzTry { & $azExe @args 2>&1 | Out-Null }   # best-effort (teardown)
+
+if ($Action -eq 'create') {
+    $subnetId = (Az network vnet subnet show -g $ResourceGroup --vnet-name $VnetName -n $SubnetName --query id -o tsv)
+
+    # Random admin password (never used — no RDP; az just requires one). Portable:
+    # System.Web isn't available in pwsh 7 on Linux. Guid hex + 'Aa1!' meets Azure complexity.
+    $pw = 'Aa1!' + [guid]::NewGuid().ToString('N') + [guid]::NewGuid().ToString('N').Substring(0, 12)
+
+    $uamiId = (Az identity show -g $ResourceGroup -n $BuilderIdentityName --query id -o tsv)
+    # Windows computer name is capped at 15 chars, so derive a short one from the
+    # (longer) run-scoped VM resource name. It's just an ephemeral standalone host.
+    $computerName = ($VmName -replace '[^a-zA-Z0-9]', '')
+    if ($computerName.Length -gt 15) { $computerName = $computerName.Substring(0, 15) }
+    Write-Host "== Creating ephemeral VM $VmName ($Size, no public IP; computer $computerName; identity $BuilderIdentityName) =="
+    Az vm create -g $ResourceGroup -n $VmName `
+        --image $Image --size $Size --computer-name $computerName `
+        --security-type Standard `
+        --admin-username nucadmin --admin-password $pw `
+        --subnet $subnetId --public-ip-address "" --nsg "" `
+        --assign-identity $uamiId `
+        --os-disk-size-gb 128 --storage-sku Premium_LRS `
+        --data-disk-sizes-gb $DataDiskGB --output none
+
+    # Forward slashes so the path resolves on the Linux runner too.
+    $boot = "$PSScriptRoot/../provisioners/windows/win-hw-wim/scripts/bootstrap-build-host.ps1"
+    if (-not (Test-Path $boot)) { throw "bootstrap script not found: $boot" }
+    $bootBody = Get-Content -Raw $boot
+
+    # Run a bootstrap phase and ASSERT its success sentinel. `az vm run-command` returns
+    # exit 0 even if the inner script throws, so we can't rely on the az exit code.
+    # Inline the phase assignment + script content as ONE --scripts value (mixing a
+    # literal line with @file, or --parameters -> params, proved unreliable).
+    function Invoke-Phase([string]$Ph) {
+        $script = "`$Phase = '$Ph'`n" + $bootBody
+        # Capture ALL message streams (value[0]=stdout, value[1]=stderr) — a thrown
+        # error lands in stderr, so querying only value[0] hid the real failure.
+        $msg = Az vm run-command invoke -g $ResourceGroup -n $VmName --command-id RunPowerShellScript `
+            --scripts $script --query "join('`n', value[].message)" -o tsv
+        if ("$msg" -notmatch 'BOOTSTRAP_PHASE_OK') { throw "bootstrap phase '$Ph' did not succeed:`n$msg" }
+        Write-Host "  phase $Ph OK"
+    }
+
+    Write-Host '== Bootstrap phase 1: Hyper-V =='
+    Invoke-Phase 'Hyperv'
+    Write-Host '== Reboot for Hyper-V =='
+    Az vm restart -g $ResourceGroup -n $VmName --output none
+    Start-Sleep -Seconds 30
+    Write-Host '== Bootstrap phase 2: tooling (retry for guest-agent readiness) =='
+    $ok = $false
+    for ($i = 1; $i -le 5; $i++) {
+        try { Invoke-Phase 'Tooling'; $ok = $true; break }
+        catch { Write-Warning "phase 2 attempt $i failed; retry in 30s. $_"; Start-Sleep 30 }
+    }
+    if (-not $ok) { throw 'Bootstrap phase 2 (tooling) failed after retries.' }
+    Write-Host "== Ephemeral build VM $VmName ready =="
+}
+else {
+    Write-Host "== Destroying ephemeral VM $VmName (best-effort) =="
+    # This if: always() step runs AFTER the ~2h build, by which point azure/login's ~1h
+    # token is dead - so `az vm delete` silently no-ops (auth error) and the VM leaks,
+    # holding the single-bake 64-core quota. Re-auth with a fresh GitHub OIDC token first.
+    # Best-effort: never let a re-login failure abort teardown.
+    try { & (Join-Path $PSScriptRoot 'az-relogin.ps1') }
+    catch { Write-Warning "teardown OIDC re-login failed (continuing best-effort): $_" }
+
+    # Capture child resource ids before deleting the VM (az vm delete doesn't cascade).
+    # Use $azExe directly (best-effort; the VM may not exist) — not the throwing Az wrapper.
+    $diskId = (& $azExe vm show -g $ResourceGroup -n $VmName --query "storageProfile.osDisk.managedDisk.id" -o tsv 2>$null)
+    $nicIds = (& $azExe vm show -g $ResourceGroup -n $VmName --query "networkProfile.networkInterfaces[].id" -o tsv 2>$null)
+    $dataDisks = (& $azExe vm show -g $ResourceGroup -n $VmName --query "storageProfile.dataDisks[].managedDisk.id" -o tsv 2>$null)
+    # The UAMI is persistent (Terraform-managed) and just attached — nothing to detach/remove here.
+
+    AzTry vm delete -g $ResourceGroup -n $VmName --yes
+    foreach ($nic in ($nicIds -split "`n" | Where-Object { $_ })) { Write-Host "  deleting nic $nic"; AzTry network nic delete --ids $nic }
+    foreach ($d in (@($diskId) + ($dataDisks -split "`n") | Where-Object { $_ })) { Write-Host "  deleting disk $d"; AzTry disk delete --ids $d --yes }
+
+    # Sweep by name prefix — catches resources az created before a FAILED 'vm create'
+    # (the VM never existed, so 'az vm show' above found nothing). az's default NIC is
+    # <VmName>VMNic; disks are <VmName>_*.
+    foreach ($n in ((& $azExe network nic list -g $ResourceGroup --query "[?starts_with(name,'$VmName')].name" -o tsv 2>$null) -split "`n" | Where-Object { $_ })) {
+        Write-Host "  deleting leaked nic $n"; AzTry network nic delete -g $ResourceGroup -n $n
+    }
+    foreach ($d in ((& $azExe disk list -g $ResourceGroup --query "[?starts_with(name,'$VmName')].name" -o tsv 2>$null) -split "`n" | Where-Object { $_ })) {
+        Write-Host "  deleting leaked disk $d"; AzTry disk delete -g $ResourceGroup -n $d --yes
+    }
+    Write-Host "== Teardown complete for $VmName =="
+}

provisioners/windows/MDC1Windows/Get-Bootstrap.ps1

@@ -358,22 +358,30 @@ Test-ConnectionUntilOnline
 # Enable SSH and import keys
 Set-SSH
 
-# Enable WinRM (non-fatal, retry twice)
-$winrmOk = Set-WinRM -Retries 2 -DelaySeconds 10
-if (-not $winrmOk) {
-    Write-Log -message 'get-bootstrap :: WinRM setup did not succeed after retries; continuing without it.' -severity 'WARN'
-}
+# WinRM disabled for the pre-baked NUC deploy.
+# RELOPS-2487: Set-WinRM is NOT called here - Enable-PSRemoting can't publish a listener on the
+# NUC's Public/workgroup network (it failed every deploy) and nothing in the bootstrap path needs
+# WinRM; SSH (baked) is the access path. The Set-WinRM function is kept for future use / if Puppet
+# ever needs it. Mirrors the same skip in bootstrap.ps1.
+# $winrmOk = Set-WinRM -Retries 2 -DelaySeconds 10
+# if (-not $winrmOk) {
+#     Write-Log -message 'get-bootstrap :: WinRM setup did not succeed after retries; continuing without it.' -severity 'WARN'
+# }
 
 # Install Chocolatey
 Install-Choco
 
 # Fetch bootstrap.ps1
+# TEMPORARY (RELOPS-2487 canary): pull bootstrap.ps1 from the `nuc-wim-pipeline` feature
+# branch instead of `main` so we can iterate on a prebake-aware bootstrap (consume baked
+# Git/openvox/puppet/ronin/registry instead of re-doing them). *** REVERT THIS URL TO
+# `main` BEFORE MERGING TO main *** - production must always take bootstrap.ps1 from main.
 $local_bootstrap = "C:\bootstrap\bootstrap.ps1"
 if (-Not (Test-Path "D:\Secrets\pat.txt")) {
-    $splat = @{ Url = "https://raw.githubusercontent.com/mozilla-platform-ops/worker-images/main/provisioners/windows/MDC1Windows/bootstrap.ps1"; Path = $local_bootstrap }
+    $splat = @{ Url = "https://raw.githubusercontent.com/mozilla-platform-ops/worker-images/nuc-wim-pipeline/provisioners/windows/MDC1Windows/bootstrap.ps1"; Path = $local_bootstrap }
     Invoke-DownloadWithRetry @splat
 } else {
-    $splat = @{ Url = "https://raw.githubusercontent.com/mozilla-platform-ops/worker-images/main/provisioners/windows/MDC1Windows/bootstrap.ps1"; Path = $local_bootstrap; PAT = Get-Content "D:\Secrets\pat.txt" }
+    $splat = @{ Url = "https://raw.githubusercontent.com/mozilla-platform-ops/worker-images/nuc-wim-pipeline/provisioners/windows/MDC1Windows/bootstrap.ps1"; Path = $local_bootstrap; PAT = Get-Content "D:\Secrets\pat.txt" }
     Invoke-DownloadWithRetryGithub @splat
 }