Add allow list for Windows versions

Automattic · Feb 21, 2025 · d26e5f5 · d26e5f5
1 parent 9276c74
commit d26e5f5
Show file tree

Hide file tree

Showing 2 changed files with 41 additions and 7 deletions.
diff --git a/.buildkite/pipeline.yml b/.buildkite/pipeline.yml
@@ -121,19 +121,19 @@ steps:
 
   - group: ":windows: install_windows_10_sdk Tests"
     steps:
-      - label: ":windows: install_windows_10_sdk Tests - Standard version file"
+      - label: ":windows: install_windows_10_sdk Tests - Version file with valid format and version"
         command: |
-          "123" | Out-File .windows-10-sdk-version
+          "20348" | Out-File .windows-10-sdk-version
           .\tests\test-install-windows-10-sdk.ps1 -ExpectedExitCode 0
         agents:
           queue: windows
         notify:
           - github_commit_status:
-              context: "install_windows_10_sdk Tests - Standard version file"
+              context: "install_windows_10_sdk Tests - Version file with valid format and version"
 
       - label: ":windows: install_windows_10_sdk Tests - Version file with one new line"
         command: |
-          "123`n" | Out-File .windows-10-sdk-version
+          "20348`n" | Out-File .windows-10-sdk-version
           .\tests\test-install-windows-10-sdk.ps1 -ExpectedExitCode 0
         agents:
           queue: windows
@@ -143,7 +143,7 @@ steps:
 
       - label: ":windows: install_windows_10_sdk Tests - Version file with more than one new line"
         command: |
-          "123`n`n" | Out-File .windows-10-sdk-version
+          "20348`n`n" | Out-File .windows-10-sdk-version
           .\tests\test-install-windows-10-sdk.ps1 -ExpectedExitCode 0
         agents:
           queue: windows
@@ -153,7 +153,7 @@ steps:
 
       - label: ":windows: install_windows_10_sdk Tests - Version file with leading whitespaces"
         command: |
-          "  123" | Out-File .windows-10-sdk-version
+          "  19041" | Out-File .windows-10-sdk-version
           .\tests\test-install-windows-10-sdk.ps1 -ExpectedExitCode 0
         agents:
           queue: windows
@@ -163,7 +163,7 @@ steps:
 
       - label: ":windows: install_windows_10_sdk Tests - Version file with trailing whitespaces"
         command: |
-          "123   " | Out-File .windows-10-sdk-version
+          "18362   " | Out-File .windows-10-sdk-version
           .\tests\test-install-windows-10-sdk.ps1 -ExpectedExitCode 0
         agents:
           queue: windows
@@ -193,3 +193,15 @@ steps:
         notify:
           - github_commit_status:
               context: "install_windows_10_sdk Tests - Version file with a word"
+
+      - label: ":windows: install_windows_10_sdk Tests - Version file with version number that is not in the allowed list"
+        command: |
+          "12345" | Out-File .windows-10-sdk-version
+          .\tests\test-install-windows-10-sdk.ps1 `
+            -ExpectedExitCode 1 `
+            -ExpectedErrorKeyphrase "Invalid Windows 10 SDK version: 12345"
+        agents:
+          queue: windows
+        notify:
+          - github_commit_status:
+              context: "install_windows_10_sdk Tests - Version file with version number that is not in the allowed list"
diff --git a/bin/install_windows_10_sdk.ps1 b/bin/install_windows_10_sdk.ps1
@@ -9,6 +9,18 @@ $ErrorActionPreference = "Stop"
 
 Write-Output "--- :windows: Installing Windows 10 SDK and Visual Studio Build Tools"
 
+# See list at https://learn.microsoft.com/en-us/visualstudio/install/workload-component-id-vs-build-tools?view=vs-2022
+$allowedVersions = @(
+  "20348",
+  "19041",
+  "18362",
+  "17763",
+  "17134",
+  "16299",
+  "15063",
+  "14393"
+)
+
 $windowsSDKVersionFile = ".windows-10-sdk-version"
 if (-not (Test-Path $windowsSDKVersionFile)) {
   Write-Output "[!] No Windows 10 SDK version file found at $windowsSDKVersionFile."
@@ -23,6 +35,16 @@ if ($windows10SDKVersion -notmatch '^\d+$') {
   exit 1
 }
 
+if ($allowedVersions -notcontains $windows10SDKVersion) {
+  Write-Output "[!] Invalid Windows 10 SDK version: $windows10SDKVersion"
+  Write-Output "Allowed versions are:"
+  foreach ($version in $allowedVersions) {
+    Write-Output "- $version"
+  }
+  Write-Output "More info at https://learn.microsoft.com/en-us/visualstudio/install/workload-component-id-vs-build-tools?view=vs-2022"
+  exit 1
+}
+
 Write-Host "Will attempt to set up Windows 10 ($windows10SDKVersion) SDK and Visual Studio Build Tools..."
 
 if ($DryRun) {