feat!: dockur/windows based runners with self-healing install

.env.example

@@ -1,6 +1,10 @@
 # Copy to .env and fill in. .env is git-ignored.
+#
+# Compose reads this file for the ${...} values in docker-compose.yml and also
+# bind-mounts it into the VM's shared folder, where oem/install.ps1 reads it.
+# Keep one KEY=VALUE per line, comments on their own lines, no "$" in values.
 
-# --- Runner registration ---------------------------------------------------
+# --- Runner registration ----------------------------------------------------
 # Org:  https://github.com/<org>
 # Repo: https://github.com/<org>/<repo>
 RUNNER_URL=
@@ -13,13 +17,48 @@ PAT=
 # Number of runners registered from this VM
 RUNNERS=2
 
-# Optional overrides of the image defaults
+# Pin an actions/runner release; empty means the latest release at install time
 # GITHUB_RUNNER_VERSION=2.338.0
-# GITHUB_RUNNER_NAME=windows_x64_vagrant
-# GITHUB_RUNNER_LABELS=windows,win_x64,windows_x64,windows_vagrant_action
-
-# --- VM sizing -------------------------------------------------------------
-# MEMORY in MiB, DISK_SIZE in GiB
-MEMORY=8000
-CPU=4
-DISK_SIZE=100
+
+# Runner name prefix and labels
+# GITHUB_RUNNER_NAME=windows_x64_dockur
+# GITHUB_RUNNER_LABELS=windows,win_x64,windows_x64,windows_dockur_action
+# GITHUB_RUNNER_GROUP=
+
+# Middle part of the runner name (<prefix>_<host id>_<n>). Defaults to the
+# Windows computer name, which dockur picks at random on install. Set it when
+# you run several VMs against the same org or want names that survive a wipe.
+# RUNNER_HOST_ID=
+
+# service (default): Windows services that start with the VM, no desktop.
+# interactive: scheduled tasks in the auto-logon desktop session, for jobs
+# that drive GUI tooling.
+# RUNNER_MODE=service
+
+# Account the runner services run as. Default is the Windows user below.
+# Built-in accounts need no password, e.g. NT AUTHORITY\NETWORK SERVICE
+# RUNNER_SERVICE_ACCOUNT=
+
+# --- Toolchain --------------------------------------------------------------
+# Git, jq, 7-Zip, PowerShell 7 and Chocolatey are always installed.
+# INSTALL_VISUAL_STUDIO=true
+# enterprise | professional | community | buildtools (see licensing note in README)
+# VS_EDITION=enterprise
+# Comma-separated workload ids. For buildtools use Microsoft.VisualStudio.Workload.VCTools
+# VS_WORKLOADS=Microsoft.VisualStudio.Workload.NativeDesktop
+# INSTALL_RTOOLS=true
+
+# --- VM (dockur/windows) ----------------------------------------------------
+# All optional; these are the defaults from docker-compose.yml.
+# Windows release; 2022 = Windows Server 2022 evaluation
+VERSION=2022
+# RAM_SIZE and CPU_CORES apply at the next 'docker compose down && up'.
+# DISK_SIZE can only grow; C: is extended by install.ps1 at the next boot.
+# Never lower it (or drop it after raising it): dockur refuses to shrink the
+# disk and the container will not start until the value is put back.
+RAM_SIZE=8G
+CPU_CORES=4
+DISK_SIZE=100G
+# Local administrator created by the unattended install; also the RDP login
+WIN_USERNAME=admin
+WIN_PASSWORD=runner

.github/PSScriptAnalyzerSettings.psd1

@@ -0,0 +1,13 @@
+@{
+    Severity     = @('Error', 'Warning')
+    ExcludeRules = @(
+        # Console output of a one-shot provisioning script; the transcript captures it.
+        'PSAvoidUsingWriteHost',
+        # Microsoft's documented one-liners for install-powershell.ps1 and Chocolatey.
+        'PSAvoidUsingInvokeExpression',
+        # Install-Runners / Install-BaseTools read better plural.
+        'PSUseSingularNouns',
+        # Internal helpers of a non-interactive script; -WhatIf is meaningless here.
+        'PSUseShouldProcessForStateChangingFunctions'
+    )
+}

.github/dependabot.yml

@@ -9,8 +9,8 @@ updates:
         patterns:
           - "*"
 
-  # Tracks the base image tag in the Dockerfile
-  - package-ecosystem: docker
+  # Tracks the dockurr/windows tag in docker-compose.yml
+  - package-ecosystem: docker-compose
     directory: /
     schedule:
       interval: weekly

.github/workflows/lint.yml

@@ -16,13 +16,19 @@ jobs:
       - name: Checkout current repository
         uses: actions/checkout@v7
 
-      - name: Dockerfile (hadolint)
-        uses: hadolint/hadolint-action@v3.5.0
-        with:
-          dockerfile: Dockerfile
+      - name: docker-compose.yml
+        run: cp .env.example .env && docker compose config -q
 
-      - name: Vagrantfile (Ruby syntax)
-        run: ruby -c Vagrantfile
+      - name: install.ps1 (parse + PSScriptAnalyzer)
+        shell: pwsh
+        run: |
+          $errors = $null
+          [System.Management.Automation.Language.Parser]::ParseFile("$PWD/oem/install.ps1", [ref]$null, [ref]$errors) | Out-Null
+          if ($errors) { $errors | ForEach-Object { Write-Error $_.Message }; exit 1 }
+          Install-Module PSScriptAnalyzer -Force -Scope CurrentUser
+          $findings = Invoke-ScriptAnalyzer -Path oem/install.ps1 -Settings .github/PSScriptAnalyzerSettings.psd1
+          $findings | Format-Table -AutoSize
+          if ($findings) { exit 1 }
 
       - name: Workflows (actionlint)
         uses: raven-actions/actionlint@v2

.gitignore

@@ -1,5 +1,6 @@
 # Local configuration (contains PAT/TOKEN)
 .env
 
-# Vagrant state
-.vagrant/
+# VM disk, install ISO and the shared folder
+storage/
+shared/