[Windows] Reorganize temporary file storage and separate cleanup activities (#11054)

images/windows/scripts/build/Configure-System.ps1

@@ -3,12 +3,6 @@
 ##  Desc:  Applies various configuration settings to the final image
 ################################################################################
 
-Write-Host "Cleanup WinSxS"
-dism.exe /online /Cleanup-Image /StartComponentCleanup /ResetBase
-if ($LASTEXITCODE -ne 0) {
-    throw "Failed to cleanup WinSxS"
-}
-
 # Set default version to 1 for WSL (aka LXSS - Linux Subsystem)
 # The value should be set in the default user registry hive
 # https://github.com/actions/runner-images/issues/5760
@@ -35,49 +29,6 @@ if (Test-IsWin22) {
     Dismount-RegistryHive "HKLM\DEFAULT"
 }
 
-Write-Host "Clean up various directories"
-@(
-    "$env:SystemDrive\Recovery",
-    "$env:SystemRoot\logs",
-    "$env:SystemRoot\winsxs\manifestcache",
-    "$env:SystemRoot\Temp",
-    "$env:SystemDrive\Users\$env:INSTALL_USER\AppData\Local\Temp",
-    "$env:TEMP",
-    "$env:AZURE_CONFIG_DIR\logs",
-    "$env:AZURE_CONFIG_DIR\commands",
-    "$env:AZURE_CONFIG_DIR\telemetry"
-) | ForEach-Object {
-    if (Test-Path $_) {
-        Write-Host "Removing $_"
-        cmd /c "takeown /d Y /R /f $_ 2>&1" | Out-Null
-        if ($LASTEXITCODE -ne 0) {
-            throw "Failed to take ownership of $_"
-        }
-        cmd /c "icacls $_ /grant:r administrators:f /t /c /q 2>&1" | Out-Null
-        if ($LASTEXITCODE -ne 0) {
-            throw "Failed to grant administrators full control of $_"
-        }
-        Remove-Item $_ -Recurse -Force -ErrorAction SilentlyContinue | Out-Null
-    }
-}
-
-$winInstallDir = "$env:SystemRoot\Installer"
-New-Item -Path $winInstallDir -ItemType Directory -Force | Out-Null
-
-# Remove AllUsersAllHosts profile
-Remove-Item $profile.AllUsersAllHosts -Force -ErrorAction SilentlyContinue | Out-Null
-
-# Clean yarn and npm cache
-cmd /c "yarn cache clean 2>&1" | Out-Null
-if ($LASTEXITCODE -ne 0) {
-    throw "Failed to clean yarn cache"
-}
-
-cmd /c "npm cache clean --force 2>&1" | Out-Null
-if ($LASTEXITCODE -ne 0) {
-    throw "Failed to clean npm cache"
-}
-
 # allow msi to write to temp folder
 # see https://github.com/actions/runner-images/issues/1704
 cmd /c "icacls $env:SystemRoot\Temp /grant Users:f /t /c /q 2>&1" | Out-Null

images/windows/scripts/build/Install-BizTalkBuildComponent.ps1

@@ -9,7 +9,7 @@ $signatureThumbprint = "8740DF4ACB749640AD318E4BE842F72EC651AD80"
 Write-Host "Downloading BizTalk Project Build Component archive..."
 $zipFile = Invoke-DownloadWithRetry $downloadUrl
 
-$setupPath = Join-Path $env:TEMP "BizTalkBuildComponent"
+$setupPath = Join-Path $env:TEMP_DIR "BizTalkBuildComponent"
 if (-not (Test-Path -Path $setupPath)) {
     New-Item -Path $setupPath -ItemType Directory -Force | Out-Null
 }

images/windows/scripts/build/Install-Docker.ps1

@@ -23,9 +23,9 @@ $mobyReleaseUrl = $dockerceUrl + $mobyRelease
 
 Write-Host "Install Moby $mobyRelease..."
 $mobyArchivePath = Invoke-DownloadWithRetry $mobyReleaseUrl
-Expand-Archive -Path $mobyArchivePath -DestinationPath $env:TEMP
+Expand-Archive -Path $mobyArchivePath -DestinationPath $env:TEMP_DIR
-$dockerPath = "$env:TEMP\docker\docker.exe"
+$dockerPath = "$env:TEMP_DIR\docker\docker.exe"
-$dockerdPath = "$env:TEMP\docker\dockerd.exe"
+$dockerdPath = "$env:TEMP_DIR\docker\dockerd.exe"
 
 Write-Host "Install Docker CE"
 $instScriptUrl = "https://raw.githubusercontent.com/microsoft/Windows-Containers/Main/helpful_tools/Install-DockerCE/install-docker-ce.ps1"

images/windows/scripts/build/Install-Toolset.ps1

@@ -13,7 +13,7 @@ Function Install-Asset {
     )
 
     $releaseAssetName = [System.IO.Path]::GetFileNameWithoutExtension($ReleaseAsset.filename)
-    $assetFolderPath = Join-Path $env:TEMP $releaseAssetName
+    $assetFolderPath = Join-Path $env:TEMP_DIR $releaseAssetName
     $assetArchivePath = Invoke-DownloadWithRetry $ReleaseAsset.download_url
 
     Write-Host "Extract $($ReleaseAsset.filename) content..."

images/windows/scripts/build/Invoke-Cleanup.ps1

@@ -0,0 +1,51 @@
+################################################################################
+##  File:  Invoke-Cleanup.ps1
+##  Desc:  Cleanup WinSxS, temp, cache and compress some directories
+################################################################################
+
+Write-Host "Cleanup WinSxS"
+dism.exe /online /Cleanup-Image /StartComponentCleanup /ResetBase
+if ($LASTEXITCODE -ne 0) {
+    throw "Failed to cleanup WinSxS"
+}
+
+Write-Host "Clean up various directories"
+@(
+    "$env:SystemDrive\Recovery",
+    "$env:SystemRoot\logs",
+    "$env:SystemRoot\winsxs\manifestcache",
+    "$env:SystemRoot\Temp",
+    "$env:SystemRoot\Installer",
+    "$env:SystemDrive\Users\$env:INSTALL_USER\AppData\Local\Temp",
+    "$env:TEMP",
+    "$env:AZURE_CONFIG_DIR\logs",
+    "$env:AZURE_CONFIG_DIR\commands",
+    "$env:AZURE_CONFIG_DIR\telemetry"
+) | ForEach-Object {
+    if (Test-Path $_) {
+        Write-Host "Removing $_"
+        cmd /c "takeown /d Y /R /f $_ 2>&1" | Out-Null
+        if ($LASTEXITCODE -ne 0) {
+            throw "Failed to take ownership of $_"
+        }
+        cmd /c "icacls $_ /grant:r administrators:f /t /c /q 2>&1" | Out-Null
+        if ($LASTEXITCODE -ne 0) {
+            throw "Failed to grant administrators full control of $_"
+        }
+        Remove-Item $_ -Recurse -Force -ErrorAction SilentlyContinue | Out-Null
+    }
+}
+
+# Remove AllUsersAllHosts profile
+Remove-Item $profile.AllUsersAllHosts -Force -ErrorAction SilentlyContinue | Out-Null
+
+# Clean yarn and npm cache
+cmd /c "yarn cache clean 2>&1" | Out-Null
+if ($LASTEXITCODE -ne 0) {
+    throw "Failed to clean yarn cache"
+}
+
+cmd /c "npm cache clean --force 2>&1" | Out-Null
+if ($LASTEXITCODE -ne 0) {
+    throw "Failed to clean npm cache"
+}

images/windows/scripts/helpers/InstallHelpers.ps1

@@ -70,7 +70,7 @@ function Install-Binary {
         } else {
             $fileName = [System.IO.Path]::GetFileNameWithoutExtension([System.IO.Path]::GetRandomFileName()) + ".$Type".ToLower()
         }
-        $filePath = Invoke-DownloadWithRetry -Url $Url -Path "${env:Temp}\$fileName"
+        $filePath = Invoke-DownloadWithRetry -Url $Url -Path "${env:TEMP_DIR}\$fileName"
     }
 
     if ($PSBoundParameters.ContainsKey('ExpectedSignature')) {
@@ -174,7 +174,7 @@ function Invoke-DownloadWithRetry {
         if ([String]::IsNullOrEmpty($fileName)) {
             $fileName = [System.IO.Path]::GetRandomFileName()
         }
-        $Path = Join-Path -Path "${env:Temp}" -ChildPath $fileName
+        $Path = Join-Path -Path "${env:TEMP_DIR}" -ChildPath $fileName
     }
 
     Write-Host "Downloading package from $Url to $Path..."
@@ -549,7 +549,7 @@ function Get-GithubReleasesByVersion {
         [switch] $WithAssetsOnly
     )
 
-    $localCacheFile = Join-Path ${env:TEMP} "github-releases_$($Repository -replace "/", "_").json"
+    $localCacheFile = Join-Path ${env:TEMP_DIR} "github-releases_$($Repository -replace "/", "_").json"
 
     if (Test-Path $localCacheFile) {
         $releases = Get-Content $localCacheFile | ConvertFrom-Json
@@ -827,7 +827,7 @@ function Get-ChecksumFromUrl {
         [string] $HashType
     )
 
-    $tempFile = Join-Path -Path $env:TEMP -ChildPath ([System.IO.Path]::GetRandomFileName())
+    $tempFile = Join-Path -Path $env:TEMP_DIR -ChildPath ([System.IO.Path]::GetRandomFileName())
     $checksums = (Invoke-DownloadWithRetry -Url $Url -Path $tempFile | Get-Item | Get-Content) -as [string[]]
     Remove-Item -Path $tempFile
 

images/windows/scripts/helpers/VisualStudioHelpers.ps1

@@ -85,10 +85,10 @@ Function Install-VisualStudio {
             }
 
             # Expand the zip file
-            Expand-Archive -Path "$env:TEMP\vslogs.zip" -DestinationPath "$env:TEMP\vslogs"
+            Expand-Archive -Path "$env:TEMP_DIR\vslogs.zip" -DestinationPath "$env:TEMP_DIR\vslogs"
 
             # Print logs
-            $vsLogsPath = "$env:TEMP\vslogs"
+            $vsLogsPath = "$env:TEMP_DIR\vslogs"
             $vsLogs = Get-ChildItem -Path $vsLogsPath -Recurse | Where-Object { -not $_.PSIsContainer } | Select-Object -ExpandProperty FullName
             foreach ($log in $vsLogs) {
                 Write-Host "============================"

images/windows/templates/windows-2019.pkr.hcl

@@ -72,6 +72,11 @@ variable "imagedata_file" {
   default = "C:\\imagedata.json"
 }
 
+variable "temp_dir" {
+  type    = string
+  default = "D:\\temp"
+}
+
 variable "install_password" {
   type      = string
   default   = ""
@@ -190,7 +195,10 @@ build {
   sources = ["source.azure-arm.image"]
 
   provisioner "powershell" {
-    inline = ["New-Item -Path ${var.image_folder} -ItemType Directory -Force"]
+    inline = [
+      "New-Item -Path ${var.image_folder} -ItemType Directory -Force",
+      "New-Item -Path ${var.temp_dir} -ItemType Directory -Force"
+    ]
   }
 
   provisioner "file" {
@@ -253,7 +261,7 @@ build {
   }
 
   provisioner "powershell" {
-    environment_vars = ["IMAGE_VERSION=${var.image_version}", "IMAGE_OS=${var.image_os}", "AGENT_TOOLSDIRECTORY=${var.agent_tools_directory}", "IMAGEDATA_FILE=${var.imagedata_file}", "IMAGE_FOLDER=${var.image_folder}"]
+    environment_vars = ["IMAGE_VERSION=${var.image_version}", "IMAGE_OS=${var.image_os}", "AGENT_TOOLSDIRECTORY=${var.agent_tools_directory}", "IMAGEDATA_FILE=${var.imagedata_file}", "IMAGE_FOLDER=${var.image_folder}", "TEMP_DIR=${var.temp_dir}"]
     execution_policy = "unrestricted"
     scripts          = [
       "${path.root}/../scripts/build/Configure-WindowsDefender.ps1",
@@ -277,7 +285,7 @@ build {
   }
 
   provisioner "powershell" {
-    environment_vars = ["IMAGE_FOLDER=${var.image_folder}"]
+    environment_vars = ["IMAGE_FOLDER=${var.image_folder}", "TEMP_DIR=${var.temp_dir}"]
     scripts          = [
       "${path.root}/../scripts/build/Install-VCRedist.ps1",
       "${path.root}/../scripts/build/Install-Docker.ps1",
@@ -297,7 +305,7 @@ build {
   provisioner "powershell" {
     elevated_password = "${var.install_password}"
     elevated_user     = "${var.install_user}"
-    environment_vars  = ["IMAGE_FOLDER=${var.image_folder}"]
+    environment_vars  = ["IMAGE_FOLDER=${var.image_folder}", "TEMP_DIR=${var.temp_dir}"]
     scripts           = [
       "${path.root}/../scripts/build/Install-VisualStudio.ps1",
       "${path.root}/../scripts/build/Install-KubernetesTools.ps1",
@@ -307,7 +315,7 @@ build {
   }
 
   provisioner "powershell" {
-    environment_vars = ["IMAGE_FOLDER=${var.image_folder}"]
+    environment_vars = ["IMAGE_FOLDER=${var.image_folder}", "TEMP_DIR=${var.temp_dir}"]
     scripts          = [
       "${path.root}/../scripts/build/Install-Wix.ps1",
       "${path.root}/../scripts/build/Install-WDK.ps1",
@@ -323,7 +331,7 @@ build {
 
   provisioner "powershell" {
     execution_policy = "remotesigned"
-    environment_vars = ["IMAGE_FOLDER=${var.image_folder}"]
+    environment_vars = ["IMAGE_FOLDER=${var.image_folder}", "TEMP_DIR=${var.temp_dir}"]
     scripts          = ["${path.root}/../scripts/build/Install-ServiceFabricSDK.ps1"]
   }
 
@@ -336,7 +344,7 @@ build {
   }
 
   provisioner "powershell" {
-    environment_vars = ["IMAGE_FOLDER=${var.image_folder}"]
+    environment_vars = ["IMAGE_FOLDER=${var.image_folder}", "TEMP_DIR=${var.temp_dir}"]
     scripts          = [
       "${path.root}/../scripts/build/Install-ActionsCache.ps1",
       "${path.root}/../scripts/build/Install-Ruby.ps1",
@@ -409,9 +417,10 @@ build {
 
   provisioner "powershell" {
     pause_before     = "2m0s"
-    environment_vars = ["IMAGE_FOLDER=${var.image_folder}"]
+    environment_vars = ["IMAGE_FOLDER=${var.image_folder}", "TEMP_DIR=${var.temp_dir}"]
     scripts          = [
       "${path.root}/../scripts/build/Install-WindowsUpdatesAfterReboot.ps1",
+      "${path.root}/../scripts/build/Invoke-Cleanup.ps1",
       "${path.root}/../scripts/tests/RunAll-Tests.ps1"
     ]
   }

images/windows/templates/windows-2022.pkr.hcl

@@ -72,6 +72,11 @@ variable "imagedata_file" {
   default = "C:\\imagedata.json"
 }
 
+variable "temp_dir" {
+  type    = string
+  default = "D:\\temp"
+}
+
 variable "install_password" {
   type      = string
   default   = ""
@@ -190,7 +195,10 @@ build {
   sources = ["source.azure-arm.image"]
 
   provisioner "powershell" {
-    inline = ["New-Item -Path ${var.image_folder} -ItemType Directory -Force"]
+    inline = [
+      "New-Item -Path ${var.image_folder} -ItemType Directory -Force",
+      "New-Item -Path ${var.temp_dir} -ItemType Directory -Force"
+    ]
   }
 
   provisioner "file" {
@@ -242,7 +250,7 @@ build {
   }
 
   provisioner "powershell" {
-    environment_vars = ["IMAGE_VERSION=${var.image_version}", "IMAGE_OS=${var.image_os}", "AGENT_TOOLSDIRECTORY=${var.agent_tools_directory}", "IMAGEDATA_FILE=${var.imagedata_file}", "IMAGE_FOLDER=${var.image_folder}"]
+    environment_vars = ["IMAGE_VERSION=${var.image_version}", "IMAGE_OS=${var.image_os}", "AGENT_TOOLSDIRECTORY=${var.agent_tools_directory}", "IMAGEDATA_FILE=${var.imagedata_file}", "IMAGE_FOLDER=${var.image_folder}", "TEMP_DIR=${var.temp_dir}"]
     execution_policy = "unrestricted"
     scripts          = [
       "${path.root}/../scripts/build/Configure-WindowsDefender.ps1",
@@ -268,7 +276,7 @@ build {
   }
 
   provisioner "powershell" {
-    environment_vars = ["IMAGE_FOLDER=${var.image_folder}"]
+    environment_vars = ["IMAGE_FOLDER=${var.image_folder}", "TEMP_DIR=${var.temp_dir}"]
     scripts          = [
       "${path.root}/../scripts/build/Install-Docker.ps1",
       "${path.root}/../scripts/build/Install-DockerWinCred.ps1",
@@ -287,7 +295,7 @@ build {
   provisioner "powershell" {
     elevated_password = "${var.install_password}"
     elevated_user     = "${var.install_user}"
-    environment_vars  = ["IMAGE_FOLDER=${var.image_folder}"]
+    environment_vars  = ["IMAGE_FOLDER=${var.image_folder}", "TEMP_DIR=${var.temp_dir}"]
     scripts           = [
       "${path.root}/../scripts/build/Install-VisualStudio.ps1",
       "${path.root}/../scripts/build/Install-KubernetesTools.ps1"
@@ -302,7 +310,7 @@ build {
 
   provisioner "powershell" {
     pause_before     = "2m0s"
-    environment_vars = ["IMAGE_FOLDER=${var.image_folder}"]
+    environment_vars = ["IMAGE_FOLDER=${var.image_folder}", "TEMP_DIR=${var.temp_dir}"]
     scripts          = [
       "${path.root}/../scripts/build/Install-Wix.ps1",
       "${path.root}/../scripts/build/Install-WDK.ps1",
@@ -318,7 +326,7 @@ build {
 
   provisioner "powershell" {
     execution_policy = "remotesigned"
-    environment_vars = ["IMAGE_FOLDER=${var.image_folder}"]
+    environment_vars = ["IMAGE_FOLDER=${var.image_folder}", "TEMP_DIR=${var.temp_dir}"]
     scripts          = ["${path.root}/../scripts/build/Install-ServiceFabricSDK.ps1"]
   }
 
@@ -331,7 +339,7 @@ build {
   }
 
   provisioner "powershell" {
-    environment_vars = ["IMAGE_FOLDER=${var.image_folder}"]
+    environment_vars = ["IMAGE_FOLDER=${var.image_folder}", "TEMP_DIR=${var.temp_dir}"]
     scripts          = [
       "${path.root}/../scripts/build/Install-ActionsCache.ps1",
       "${path.root}/../scripts/build/Install-Ruby.ps1",
@@ -385,7 +393,7 @@ build {
   provisioner "powershell" {
     elevated_password = "${var.install_password}"
     elevated_user     = "${var.install_user}"
-    environment_vars  = ["IMAGE_FOLDER=${var.image_folder}"]
+    environment_vars  = ["IMAGE_FOLDER=${var.image_folder}", "TEMP_DIR=${var.temp_dir}"]
     scripts           = [
       "${path.root}/../scripts/build/Install-WindowsUpdates.ps1",
       "${path.root}/../scripts/build/Configure-DynamicPort.ps1",
@@ -404,9 +412,10 @@ build {
 
   provisioner "powershell" {
     pause_before     = "2m0s"
-    environment_vars = ["IMAGE_FOLDER=${var.image_folder}"]
+    environment_vars = ["IMAGE_FOLDER=${var.image_folder}", "TEMP_DIR=${var.temp_dir}"]
     scripts          = [
       "${path.root}/../scripts/build/Install-WindowsUpdatesAfterReboot.ps1",
+      "${path.root}/../scripts/build/Invoke-Cleanup.ps1",
       "${path.root}/../scripts/tests/RunAll-Tests.ps1"
     ]
   }