orca/config/scripts/ssh-relay-runtime-windows-openssh-workflow-contract.mjs

export function assertWindowsOpenSshWorkflow(workflow, expect) {
  const steps = workflow.jobs['build-windows-runtime'].steps
  const start = steps.find(
    (step) => step.name === 'Start loopback Windows OpenSSH system-SSH fixture'
  )
  const measure = steps.find(
    (step) => step.name === 'Measure exact full-size runtime over Windows system SSH'
  )
  const stop = steps.find(
    (step) => step.name === 'Stop loopback Windows OpenSSH system-SSH fixture'
  )

  expect(start).toBeDefined()
  expect(measure).toBeDefined()
  expect(stop).toBeDefined()
  expect(start.shell).toBe('pwsh')
  expect(start.run).toContain('10.0.0.0p2-Preview')
  expect(start.run).toContain('23f50f3458c4c5d0b12217c6a5ddfde0137210a30fa870e98b29827f7b43aba5')
  expect(start.run).toContain('698c6aec31c1dd0fb996206e8741f4531a97355686b5431ef347d531b07fcd42')
  expect(start.run).toContain('4652e861c0335ee80a51306ceab75aa35c8865b235f97ce7dd5a0fd9dab44b5d')
  expect(start.run).toContain('7ad2b7721893c54ad6e4fec1a3477701fb48975323c2c4ac6cd0b8c972ab242a')
  expect(start.run).toContain('--connect-timeout 20 --max-time 300 --retry 2')
  expect(start.run).toContain('Get-AuthenticodeSignature')
  expect(start.run).toContain('$actualNativeNames -join "`n"')
  expect(start.run).toContain('$expectedNativeNames -join "`n"')
  expect(start.run).toContain("'ssh-sk-helper.exe'")
  expect(start.run).toContain("'sshd-session.exe'")
  expect(start.run).toContain('$libcryptoFiles.Count -ne 1')
  expect(start.run).toContain("$libcryptoSignature.Status -ne 'Valid'")
  expect(start.run).toContain('587116075365AA15BCD8E4FA9CB31BE372B5DE51')
  expect(start.run).toContain('CN=Microsoft 3rd Party Application Component')
  expect(start.run).toContain('F5877012FBD62FABCBDC8D8CEE9C9585BA30DF79')
  expect(start.run).toContain('3F56A45111684D454E231CFDC4DA5C8D370F9816')
  expect(start.run).toContain('$expectedExecutableSignerThumbprints -notcontains $thumbprint')
  expect(start.run).not.toContain("'NotSigned'")
  expect(start.run).toContain("if ($nativeFile.Name -eq 'libcrypto.dll') { continue }")
  expect(start.run).toContain("$signature.Status -ne 'Valid'")
  expect(start.run).toContain('CN=Microsoft Corporation')
  expect(start.run).toContain('[Security.AccessControl.DirectorySecurity]::new()')
  expect(start.run).toContain('[Security.AccessControl.FileSecurity]::new()')
  expect(start.run).toContain('$security.SetAccessRuleProtection($true, $false)')
  expect(start.run).toContain('[void]$security.AddAccessRule($accessRule)')
  expect(start.run).toContain('$acl.AreAccessRulesProtected')
  expect(start.run).toContain('Fixture ACL trustee closure changed')
  expect(start.run).toContain('@($systemSid, $administratorsSid)')
  expect(start.run).not.toContain('Add-WindowsCapability')
  expect(start.run).toContain('New-LocalUser')
  expect(start.run.indexOf("Join-Path $fixture 'account-owned'")).toBeLessThan(
    start.run.indexOf('New-LocalUser')
  )
  expect(start.run).toContain('ListenAddress 127.0.0.1')
  expect(start.run).toContain('PasswordAuthentication no')
  expect(start.run).toContain('StrictModes yes')
  expect(start.run).toContain('StrictHostKeyChecking=yes')
  expect(start.run).toContain('powershell.exe')
  expect(start.run).toContain('([Version]$remotePowerShellVersion).Major -ne 5')
  expect(start.run).toContain('/setowner')
  expect(start.run).toContain("Set-FixtureOwner $hostKey 'S-1-5-18'")
  expect(start.run).toContain('Set-FixtureOwner $authorizedKeys $userSid')
  expect(start.run).not.toContain('administrators_authorized_keys')
  expect(start.run).toContain('New-Service')
  expect(start.run.indexOf("Join-Path $fixture 'service-owned'")).toBeLessThan(
    start.run.indexOf('New-Service')
  )
  expect(measure.shell).toBe('pwsh')
  expect(measure.run).toContain("$env:ORCA_SSH_FORCE_SYSTEM_TRANSPORT = '1'")
  expect(measure.run).toContain('ssh-system-no-input-windows-openssh.test.ts')
  expect(measure.run).toContain('ssh-relay-runtime-windows-system-ssh-openssh-full-size.test.ts')
  expect(measure.run.indexOf('ssh-system-no-input-windows-openssh.test.ts')).toBeLessThan(
    measure.run.indexOf('ssh-relay-runtime-windows-system-ssh-openssh-full-size.test.ts')
  )
  expect(measure.run).toContain("throw 'Windows no-input handle diagnostic failed'")
  expect(measure.run).toContain("Join-Path $firstOutput 'runtime'")
  expect(stop.if).toBe("always() && runner.os == 'Windows'")
  expect(stop.shell).toBe('pwsh')
  expect(stop.run).toContain('fixture-owned')
  expect(stop.run).toContain('service-owned')
  expect(stop.run).toContain('account-owned')
  expect(stop.run).not.toContain('service-backup.json')
  expect(stop.run).not.toContain('sc.exe config')
  expect(stop.run).toContain('sc.exe delete')
  expect(stop.run).toContain('Get-FixtureOwnedProcesses $fixtureSid')
  expect(stop.run).toContain('$owner.Sid -eq $fixtureSid')
  expect(stop.run).toContain('-MethodName Terminate')
  expect(stop.run).toContain('Fixture account processes did not settle within 10 seconds')
  expect(stop.run.indexOf('Stop-FixtureOwnedProcesses $userSid')).toBeLessThan(
    stop.run.indexOf('Dismount-FixtureRegistryHive "${userSid}_Classes"')
  )
  expect(stop.run).toContain('Dismount-FixtureRegistryHive "${userSid}_Classes"')
  expect(stop.run).toContain('Dismount-FixtureRegistryHive $userSid')
  expect(stop.run).toContain("Join-Path $env:SystemRoot 'System32/reg.exe'")
  expect(stop.run).toContain('@(\'unload\', "HKU\\$hiveName")')
  expect(stop.run).toContain('$process.WaitForExit(2000)')
  expect(stop.run).toContain('$process.Kill()')
  expect(stop.run.indexOf('Dismount-FixtureRegistryHive "${userSid}_Classes"')).toBeLessThan(
    stop.run.indexOf('Dismount-FixtureRegistryHive $userSid')
  )
  expect(stop.run.indexOf('Dismount-FixtureRegistryHive $userSid')).toBeLessThan(
    stop.run.indexOf('Remove-CimInstance -InputObject $profile')
  )
  expect(stop.run).toContain('Remove-CimInstance -InputObject $profile')
  expect(stop.run).toContain('Fixture profile did not settle within 10 seconds')
  expect(stop.run).toContain('fixture profile directory remains')
  expect(stop.run).toContain('Remove-LocalUser')
}