james.maesandClaude Opus 5.5
529d9637ef
## What - **One-liners per OS** that set up a KofTwentyTwo workstation: - Windows: `& ([scriptblock]::Create((irm https://raw.githubusercontent.com/KofTwentyTwo/standards/main/setup/bootstrap.ps1)))` - macOS/Linux: `curl -fsSL https://raw.githubusercontent.com/KofTwentyTwo/standards/main/setup/bootstrap.sh | bash` - `setup/Install-Workstation.ps1` (PowerShell 7, all three OSes) installs the core tools plus optional language toolchains, configures git to **sign with an SSH key held in 1Password** (`op-ssh-sign`), points ssh at the 1Password agent, can register the signing key on GitHub, and checks disk encryption, firewall, malware protection, and private key files on disk. Idempotent; `-WhatIf` and `-CheckOnly`. - New **workstation standard** (`K22-WS-*`); the security program now names 1Password and forbids private key files (`K22-SEC-10`, `K22-SEC-14`). - README "Set up your machine" rewritten around the one-liners. ## Why Setup instructions were a list of commands to type; keys were allowed as files. A single script makes every machine identical and re-checkable, and keys created in 1Password never touch disk. ## How tested On Windows 11 (this machine): - `-CheckOnly` and `-WhatIf`: correct detection (including the Microsoft Store 1Password install), the right signing key chosen, no changes made. - PSScriptAnalyzer with `configs/shell/PSScriptAnalyzerSettings.psd1`: 0 findings; `Invoke-Formatter`: no layout changes. - `shellcheck --enable=all` and `shfmt --diff` on `bootstrap.sh`: clean. Not yet run on macOS or Linux. Depends on #1 for the markdownlint config (one code-fence finding in `policies/README.md` is fixed there). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Signed-off-by: James Maes <james@kof22.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
48 lines
2.0 KiB
PowerShell
48 lines
2.0 KiB
PowerShell
<#
|
|
.SYNOPSIS
|
|
Windows bootstrap: installs PowerShell 7 if needed, then runs Install-Workstation.ps1.
|
|
|
|
.DESCRIPTION
|
|
Runs in the Windows PowerShell 5.1 that ships with Windows, so it works on a brand-new
|
|
machine. It downloads Install-Workstation.ps1 from the same ref of
|
|
KofTwentyTwo/standards and runs it in PowerShell 7, passing through any arguments.
|
|
|
|
.PARAMETER Ref
|
|
Branch, tag, or commit of KofTwentyTwo/standards to use. Pin a release tag for a
|
|
reproducible setup.
|
|
|
|
.EXAMPLE
|
|
& ([scriptblock]::Create((Invoke-RestMethod https://raw.githubusercontent.com/KofTwentyTwo/standards/main/setup/bootstrap.ps1))) -Languages dotnet
|
|
#>
|
|
[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingWriteHost', '', Justification = 'Interactive bootstrap: progress messages for the person running it.')]
|
|
[CmdletBinding()]
|
|
param(
|
|
[string] $Ref = 'main',
|
|
|
|
[Parameter(ValueFromRemainingArguments)]
|
|
[object[]] $WorkstationArguments = @()
|
|
)
|
|
|
|
Set-StrictMode -Version Latest
|
|
$ErrorActionPreference = 'Stop'
|
|
|
|
if (-not (Get-Command -Name winget -ErrorAction SilentlyContinue))
|
|
{
|
|
throw 'winget (App Installer) is required. Install "App Installer" from the Microsoft Store, then run this again.'
|
|
}
|
|
|
|
if (-not (Get-Command -Name pwsh -ErrorAction SilentlyContinue))
|
|
{
|
|
Write-Host 'Installing PowerShell 7...'
|
|
& winget install --id Microsoft.PowerShell --exact --source winget --silent --accept-package-agreements --accept-source-agreements --disable-interactivity
|
|
$env:Path = [Environment]::GetEnvironmentVariable('Path', 'Machine') + ';' + [Environment]::GetEnvironmentVariable('Path', 'User')
|
|
}
|
|
|
|
$script = Join-Path ([System.IO.Path]::GetTempPath()) 'Install-Workstation.ps1'
|
|
$url = "https://raw.githubusercontent.com/KofTwentyTwo/standards/$Ref/setup/Install-Workstation.ps1"
|
|
Write-Host "Downloading $url"
|
|
Invoke-WebRequest -Uri $url -OutFile $script -UseBasicParsing
|
|
|
|
& pwsh -NoLogo -NoProfile -ExecutionPolicy Bypass -File $script @WorkstationArguments
|
|
exit $LASTEXITCODE
|