Windows: Add an extra restart onto the end of our buildkite-worker provisioner

windows-kvm/base-image/setup_scripts/3-00-disable-windows-updates.ps1

@@ -0,0 +1,50 @@
+# We don't want our downstream images to be installing windows updates, EVER.
+# So we set the Windows Update server to localhost, which breaks it nicely.
+
+# Helper function to avoid having to create root keys all the time
+function RegMkPath()
+{
+    Param($Path)
+    if (-NOT (Test-Path $Path)) {
+        New-Item -Path $Path -Force
+    }
+    return $Path
+}
+
+Write-Output " -> Disabling Windows Update..."
+$RegPath = RegMkPath -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"
+New-ItemProperty -Path $RegPath -Name "WUServer" -Value "http://127.0.0.1" -PropertyType STRING -Force
+New-ItemProperty -Path $RegPath -Name "WUStatusServer" -Value "http://127.0.0.1" -PropertyType STRING -Force
+
+$RegPath = RegMkPath -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
+New-ItemProperty -Path $RegPath -Name "UseWUServer" -Value 1 -PropertyType DWORD -Force
+New-ItemProperty -Path $RegPath -Name "NoAutoUpdate" -Value 1 -PropertyType DWORD -Force
+New-ItemProperty -Path $RegPath -Name "AUOptions" -Value 1 -PropertyType DWORD -Force
+
+$RegPath = RegMkPath -Path "HKLM:\SYSTEM\CurrentControlSet\Services\wuauserv"
+New-ItemProperty -Path $RegPath -Name "Start" -Value 4 -PropertyType DWORD -Force
+$RegPath = RegMkPath -Path "HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc"
+New-ItemProperty -Path $RegPath -Name "Start" -Value 4 -PropertyType DWORD -Force
+
+$RegPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverSearching"
+Set-ItemProperty -Path $RegPath -Name "SearchOrderConfig" -Value 0 -PropertyType DWORD -Force
+
+# Disable Windows Update Services
+$services = @(
+    "wuauserv",        # Windows Update
+    "bits",            # Background Intelligent Transfer Service
+    "dosvc",           # Delivery Optimization
+    "WaaSMedicSvc",    # Windows Update Medic Service
+    "UsoSvc",          # Update Orchestrator Service
+    "sedsvc"           # (Sometimes present on older systems)
+)
+
+foreach ($service in $services) {
+    Write-Host "Disabling service: $service"
+    Stop-Service -Name $service -Force -ErrorAction SilentlyContinue
+    Set-Service -Name $service -StartupType Disabled
+}
+
+# Disable all Windows Update-related scheduled tasks
+Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\'  | Disable-ScheduledTask
+Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\'  | Disable-ScheduledTask

windows-kvm/buildkite-worker/common.jl

@@ -147,13 +147,13 @@ function generate_systemd_script(io::IO, brg::BuildkiteRunnerGroup;
                 # If the buildkite-agent pristine disk image is newer than our timestamp sentinel file
                 "[ $(agent_pristine_disk_path(agent_hostname)) -nt $(agent_timestamp_path(agent_hostname)) ]",
                 # Then copy over our cache disk (since it was also re-created)
-                "cp $(agent_pristine_disk_path(agent_hostname))-1 $(agent_scratch_dir(agent_hostname))/",
+                "cp -v $(agent_pristine_disk_path(agent_hostname))-1 $(agent_scratch_dir(agent_hostname))/",
                 # Also update our timestamp path
                 "touch $(agent_timestamp_path(agent_hostname))",
             ], " && "), [:IgnoreExitCode]),
 
             # Copy our pristine image to our scratchspace, overwiting the one that already exists, always.
-            SystemdBashTarget("cp $(agent_pristine_disk_path(agent_hostname)) $(agent_scratch_dir(agent_hostname))/"),
+            SystemdBashTarget("cp -v $(agent_pristine_disk_path(agent_hostname)) $(agent_scratch_dir(agent_hostname))/"),
         ])
     else
         # If we're not a buildkite agent, we don't want to reset completely after every reboot

windows-kvm/buildkite-worker/kvm_machine.pkr.hcl.template

@@ -80,4 +80,8 @@ build {
         elevated_user = var.username
         elevated_password = var.password
     }
+
+    # Add a restart at the end, to try and get rid of any pending restarts
+    # that the image might have due to installed files.
+    provisioner "windows-restart" {}
 }