[Windows] Apply code style rules to Windows scripts (#8957)

* Apply code style rules to Windows scripts * Fix typo * Fix configure-toolset script * Fix parameters in Msys2 installation script * Improve log readability * Remove broken exit code validation
2025-12-14 22:05:17 +00:00 · 2023-12-11 22:23:36 +01:00
parent 76d6f0f574
commit 7fe65a2204
54 changed files with 544 additions and 418 deletions
--- a/images/windows/scripts/build/Configure-BaseImage.ps1
+++ b/images/windows/scripts/build/Configure-BaseImage.ps1
@@ -4,10 +4,10 @@
 ################################################################################

 function Disable-InternetExplorerESC {
-    $AdminKey = "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}"
-    $UserKey = "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}"
-    Set-ItemProperty -Path $AdminKey -Name "IsInstalled" -Value 0 -Force
-    Set-ItemProperty -Path $UserKey -Name "IsInstalled" -Value 0 -Force
+    $adminKey = "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}"
+    $userKey = "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}"
+    Set-ItemProperty -Path $adminKey -Name "IsInstalled" -Value 0 -Force
+    Set-ItemProperty -Path $userKey -Name "IsInstalled" -Value 0 -Force

    $ieProcess = Get-Process -Name Explorer -ErrorAction SilentlyContinue

@@ -19,9 +19,9 @@ function Disable-InternetExplorerESC {
 }

 function Disable-InternetExplorerWelcomeScreen {
-    $AdminKey = "HKLM:\Software\Policies\Microsoft\Internet Explorer\Main"
-    New-Item -Path $AdminKey -Value 1 -Force
-    Set-ItemProperty -Path $AdminKey -Name "DisableFirstRunCustomize" -Value 1 -Force
+    $adminKey = "HKLM:\Software\Policies\Microsoft\Internet Explorer\Main"
+    New-Item -Path $adminKey -Value 1 -Force
+    Set-ItemProperty -Path $adminKey -Name "DisableFirstRunCustomize" -Value 1 -Force
    Write-Host "Disabled IE Welcome screen"
 }

@@ -31,9 +31,9 @@ function Disable-UserAccessControl {
 }

 function Disable-WindowsUpdate {
-    $AutoUpdatePath = "HKLM:SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
-    If (Test-Path -Path $AutoUpdatePath) {
-        Set-ItemProperty -Path $AutoUpdatePath -Name NoAutoUpdate -Value 1
+    $autoUpdatePath = "HKLM:SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
+    if (Test-Path -Path $autoUpdatePath) {
+        Set-ItemProperty -Path $autoUpdatePath -Name NoAutoUpdate -Value 1
        Write-Host "Disabled Windows Update"
    } else {
        Write-Host "Windows Update key does not exist"
--- a/images/windows/scripts/build/Configure-DeveloperMode.ps1
+++ b/images/windows/scripts/build/Configure-DeveloperMode.ps1
@@ -4,10 +4,10 @@
 ################################################################################

 # Create AppModelUnlock if it doesn't exist, required for enabling Developer Mode
-$RegistryKeyPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock"
-if (-not(Test-Path -Path $RegistryKeyPath)) {
-    New-Item -Path $RegistryKeyPath -ItemType Directory -Force
+$registryKeyPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock"
+if (-not(Test-Path -Path $registryKeyPath)) {
+    New-Item -Path $registryKeyPath -ItemType Directory -Force
 }

 # Add registry value to enable Developer Mode
-New-ItemProperty -Path $RegistryKeyPath -Name AllowDevelopmentWithoutDevLicense -PropertyType DWORD -Value 1
+New-ItemProperty -Path $registryKeyPath -Name AllowDevelopmentWithoutDevLicense -PropertyType DWORD -Value 1
--- a/images/windows/scripts/build/Configure-DynamicPort.ps1
+++ b/images/windows/scripts/build/Configure-DynamicPort.ps1
@@ -1,3 +1,9 @@
+################################################################################
+##  File:  Configure-DynamicPort.ps1
+##  Desc:  Configure dynamic port range for TCP and UDP to start at port 49152
+##         and to end at the 65536 (16384 ports)
+################################################################################
+
 # https://support.microsoft.com/en-us/help/929851/the-default-dynamic-port-range-for-tcp-ip-has-changed-in-windows-vista
 # The new default start port is 49152, and the new default end port is 65535.
 # Default port configuration was changed during image generation by Visual Studio Enterprise Installer to:
@@ -5,10 +11,17 @@
 #   ---------------------------------
 #   Start Port      : 1024
 #   Number of Ports : 64511
+
 Write-Host "Set the dynamic port range to start at port 49152 and to end at the 65536 (16384 ports)"
-$null = netsh int ipv4 set dynamicport tcp start=49152 num=16384
-$null = netsh int ipv4 set dynamicport udp start=49152 num=16384
-$null = netsh int ipv6 set dynamicport tcp start=49152 num=16384
-$null = netsh int ipv6 set dynamicport udp start=49152 num=16384
+foreach ($ipVersion in @("ipv4", "ipv6")) {
+    foreach ($protocol in @("tcp", "udp")) {
+        $command = "netsh int $ipVersion set dynamicport $protocol start=49152 num=16384"
+        Invoke-Expression $command | Out-Null
+        if ($LASTEXITCODE -ne 0) {
+            Write-Host "Failed to set dynamic port range for $ipVersion $protocol"
+            exit $LASTEXITCODE
+        }
+    }
+}

 Invoke-PesterTests -TestFile "WindowsFeatures" -TestName "DynamicPorts"
--- a/images/windows/scripts/build/Configure-GDIProcessHandleQuota.ps1
+++ b/images/windows/scripts/build/Configure-GDIProcessHandleQuota.ps1
@@ -1,3 +1,8 @@
+################################################################################
+##  File:  Configure-GDIProcessHandleQuota.ps1
+##  Desc:  Set the GDIProcessHandleQuota value to 20000
+################################################################################
+
 # https://docs.microsoft.com/en-us/windows/win32/sysinfo/gdi-objects
 # This value can be set to a number between 256 and 65,536

--- a/images/windows/scripts/build/Configure-PowerShell.ps1
+++ b/images/windows/scripts/build/Configure-PowerShell.ps1
@@ -17,7 +17,7 @@ $PSModuleAnalysisCachePath = 'C:\PSModuleAnalysisCachePath\ModuleAnalysisCache'
 # make variable to be available in the current session
 ${env:PSModuleAnalysisCachePath} = $PSModuleAnalysisCachePath

-$null = New-Item -Path $PSModuleAnalysisCachePath  -ItemType 'File'  -Force
+New-Item -Path $PSModuleAnalysisCachePath -ItemType 'File' -Force | Out-Null
 #endregion

 #region User (current user, image generation only)
--- a/images/windows/scripts/build/Configure-System.ps1
+++ b/images/windows/scripts/build/Configure-System.ps1
@@ -4,7 +4,10 @@
 ################################################################################

 Write-Host "Cleanup WinSxS"
-Dism.exe /online /Cleanup-Image /StartComponentCleanup /ResetBase
+dism.exe /online /Cleanup-Image /StartComponentCleanup /ResetBase
+if ($LASTEXITCODE -ne 0) {
+    throw "Failed to cleanup WinSxS"
+}

 # Set default version to 1 for WSL (aka LXSS - Linux Subsystem)
 # The value should be set in the default user registry hive
@@ -47,7 +50,13 @@ Write-Host "Clean up various directories"
    if (Test-Path $_) {
        Write-Host "Removing $_"
        cmd /c "takeown /d Y /R /f $_ 2>&1" | Out-Null
+        if ($LASTEXITCODE -ne 0) {
+            throw "Failed to take ownership of $_"
+        }
        cmd /c "icacls $_ /grant:r administrators:f /t /c /q 2>&1" | Out-Null
+        if ($LASTEXITCODE -ne 0) {
+            throw "Failed to grant administrators full control of $_"
+        }
        Remove-Item $_ -Recurse -Force -ErrorAction SilentlyContinue | Out-Null
    }
 }
@@ -60,11 +69,21 @@ Remove-Item $profile.AllUsersAllHosts -Force -ErrorAction SilentlyContinue | Out

 # Clean yarn and npm cache
 cmd /c "yarn cache clean 2>&1" | Out-Null
+if ($LASTEXITCODE -ne 0) {
+    throw "Failed to clean yarn cache"
+}
+
 cmd /c "npm cache clean --force 2>&1" | Out-Null
+if ($LASTEXITCODE -ne 0) {
+    throw "Failed to clean npm cache"
+}

 # allow msi to write to temp folder
 # see https://github.com/actions/runner-images/issues/1704
 cmd /c "icacls $env:SystemRoot\Temp /grant Users:f /t /c /q 2>&1" | Out-Null
+if ($LASTEXITCODE -ne 0) {
+    throw "Failed to grant Users full control of $env:SystemRoot\Temp"
+}

 # Registry settings
 $registrySettings = @(
--- a/images/windows/scripts/build/Configure-SystemEnvironment.ps1
+++ b/images/windows/scripts/build/Configure-SystemEnvironment.ps1
@@ -7,7 +7,6 @@ $variables = @{
    "ImageVersion"                        = $env:IMAGE_VERSION
    "ImageOS"                             = $env:IMAGE_OS
    "AGENT_TOOLSDIRECTORY"                = $env:AGENT_TOOLSDIRECTORY
-  "ACTIONS_RUNNER_ACTION_ARCHIVE_CACHE" = $env:ACTIONS_RUNNER_ACTION_ARCHIVE_CACHE
 }

 $variables.GetEnumerator() | ForEach-Object {
--- a/images/windows/scripts/build/Configure-Toolset.ps1
+++ b/images/windows/scripts/build/Configure-Toolset.ps1
@@ -4,34 +4,10 @@
 ##  Desc:  Configure Toolset
 ################################################################################

-Function Set-DefaultVariables
-{
-    param
-    (
-        [Parameter(Mandatory=$true)]
-        [object] $EnvVars,
-        [Parameter(Mandatory=$true)]
-        [string] $ToolVersionPath
-    )
-
-    $templates = $EnvVars.pathTemplates
-    foreach ($template in $templates)
-    {
-        $toolSystemPath = $template -f $ToolVersionPath
-        Add-MachinePathItem -PathItem $toolSystemPath | Out-Null
-    }
-
-    if (-not ([string]::IsNullOrEmpty($EnvVars.defaultVariable)))
-    {
-        [Environment]::SetEnvironmentVariable($toolEnvVars.defaultVariable, $ToolVersionPath, "Machine")
-    }
-}
-
-# Define executables for cached tools
-$toolsEnvironmentVariables = @{
+$toolEnvConfigs = @{
    Python = @{
        pathTemplates = @(
-            "{0}",
+            "{0}"
            "{0}\Scripts"
        )
    }
@@ -39,25 +15,26 @@ $toolsEnvironmentVariables = @{
        pathTemplates  = @(
            "{0}\bin"
        )
-        variableTemplate = "GOROOT_{0}_{1}_X64"
+        envVarTemplate = "GOROOT_{0}_{1}_X64"
    }
 }

-$toolsToConfigure = @("Python", "Go")
-$tools = Get-ToolsetContent | Select-Object -ExpandProperty toolcache `
-                            | Where-Object { $toolsToConfigure -contains $_.name }
+$tools = Get-ToolsetContent `
+| Select-Object -ExpandProperty toolcache `
+| Where-Object { $toolEnvConfigs.Keys -contains $_.name }

 Write-Host "Configure toolset tools environment..."
 foreach ($tool in $tools) {
-    $toolEnvVars = $toolsEnvironmentVariables[$tool.name]
+    $toolEnvConfig = $toolEnvConfigs[$tool.name]
    
-    if (-not ([string]::IsNullOrEmpty($toolEnvVars.variableTemplate))) {
+    if (-not ([string]::IsNullOrEmpty($toolEnvConfig.envVarTemplate))) {
        foreach ($version in $tool.versions) {
            Write-Host "Set $($tool.name) $version environment variable..."

            $foundVersionArchPath = Get-TCToolVersionPath -Name $tool.name -Version $version -Arch $tool.arch
-            $envName = $toolEnvVars.variableTemplate -f $version.Split(".")
+            $envName = $toolEnvConfig.envVarTemplate -f $version.Split(".")

+            Write-Host "Set $envName to $foundVersionArchPath"
            [Environment]::SetEnvironmentVariable($envName, $foundVersionArchPath, "Machine")
        }
    }
@@ -67,7 +44,16 @@ foreach ($tool in $tools) {

        $toolVersionPath = Get-TCToolVersionPath -Name $tool.name -Version $tool.default -Arch $tool.arch

-        Set-DefaultVariables -ToolVersionPath $toolVersionPath -EnvVars $toolEnvVars
+        foreach ($template in $toolEnvConfig.pathTemplates) {
+            $toolSystemPath = $template -f $toolVersionPath
+            Write-Host "Add $toolSystemPath to system PATH..."
+            Add-MachinePathItem -PathItem $toolSystemPath | Out-Null
+        }
+    
+        if (-not ([string]::IsNullOrEmpty($tool.defaultVariable))) {
+            Write-Host "Set $($tool.name) $($tool.default) $($tool.defaultVariable) environment variable..."
+            [Environment]::SetEnvironmentVariable($tool.defaultVariable, $toolVersionPath, "Machine")
+        }
    }
 }

--- a/images/windows/scripts/build/Configure-User.ps1
+++ b/images/windows/scripts/build/Configure-User.ps1
@@ -9,17 +9,23 @@
 #

 Write-Host "Warmup 'devenv.exe /updateconfiguration'"
-
 $vsInstallRoot = (Get-VisualStudioInstance).InstallationPath
-$devEnvPath = "$vsInstallRoot\Common7\IDE\devenv.exe"
-
-cmd.exe /c "`"$devEnvPath`" /updateconfiguration"
+cmd.exe /c "`"$vsInstallRoot\Common7\IDE\devenv.exe`" /updateconfiguration"
+if ($LASTEXITCODE -ne 0) {
+    throw "Failed to warmup 'devenv.exe /updateconfiguration'"
+}

 # we are fine if some file is locked and cannot be copied
 Copy-Item ${env:USERPROFILE}\AppData\Local\Microsoft\VisualStudio -Destination c:\users\default\AppData\Local\Microsoft\VisualStudio -Recurse -ErrorAction SilentlyContinue

-reg.exe load HKLM\DEFAULT c:\users\default\ntuser.dat
+Mount-RegistryHive `
+    -FileName "C:\Users\Default\NTUSER.DAT" `
+    -SubKey "HKLM\DEFAULT"
+
 reg.exe copy HKCU\Software\Microsoft\VisualStudio HKLM\DEFAULT\Software\Microsoft\VisualStudio /s
+if ($LASTEXITCODE -ne 0) {
+    throw "Failed to copy HKCU\Software\Microsoft\VisualStudio to HKLM\DEFAULT\Software\Microsoft\VisualStudio"
+}

 # disable TSVNCache.exe
 $registryKeyPath = 'HKCU:\Software\TortoiseSVN'
@@ -27,8 +33,12 @@ if (-not(Test-Path -Path $registryKeyPath)) {
    New-Item -Path $registryKeyPath -ItemType Directory -Force
 }

-New-ItemProperty -Path $RegistryKeyPath -Name CacheType -PropertyType DWORD -Value 0
+New-ItemProperty -Path $registryKeyPath -Name CacheType -PropertyType DWORD -Value 0
 reg.exe copy HKCU\Software\TortoiseSVN HKLM\DEFAULT\Software\TortoiseSVN /s
+if ($LASTEXITCODE -ne 0) {
+    throw "Failed to copy HKCU\Software\TortoiseSVN to HKLM\DEFAULT\Software\TortoiseSVN"
+}
+
+Dismount-RegistryHive "HKLM\DEFAULT"

-reg.exe unload HKLM\DEFAULT
 Write-Host "Configure-User.ps1 - completed"
--- a/images/windows/scripts/build/Install-ActionsCache.ps1
+++ b/images/windows/scripts/build/Install-ActionsCache.ps1
@@ -4,9 +4,11 @@
 ##  Maintainer: #actions-runtime and @TingluoHuang
 ################################################################################

-if (-not (Test-Path $env:ACTIONS_RUNNER_ACTION_ARCHIVE_CACHE)) {
+$actionArchiveCache = "C:\actionarchivecache\"
+
+if (-not (Test-Path $actionArchiveCache)) {
    Write-Host "Creating action archive cache folder"
-    New-Item -ItemType Directory -Path $env:ACTIONS_RUNNER_ACTION_ARCHIVE_CACHE | Out-Null
+    New-Item -ItemType Directory -Path $actionArchiveCache | Out-Null
 }

 $downloadUrl = Resolve-GithubReleaseAssetUrl `
@@ -18,6 +20,8 @@ Write-Host "Download Latest action-versions archive from $downloadUrl"
 $actionVersionsArchivePath = Invoke-DownloadWithRetry $downloadUrl

 Write-Host "Expand action-versions archive"
-Expand-7ZipArchive -Path $actionVersionsArchivePath -DestinationPath $env:ACTIONS_RUNNER_ACTION_ARCHIVE_CACHE
+Expand-7ZipArchive -Path $actionVersionsArchivePath -DestinationPath $actionArchiveCache
+
+[Environment]::SetEnvironmentVariable("ACTIONS_RUNNER_ACTION_ARCHIVE_CACHE", $actionArchiveCache, "Machine")

 Invoke-PesterTests -TestFile "ActionArchiveCache"
--- a/images/windows/scripts/build/Install-AzureCli.ps1
+++ b/images/windows/scripts/build/Install-AzureCli.ps1
@@ -9,7 +9,7 @@ $azureCliConfigPath = 'C:\azureCli'
 # Store azure-cli cache outside of the provisioning user's profile
 [Environment]::SetEnvironmentVariable('AZURE_CONFIG_DIR', $azureCliConfigPath, "Machine")

-$azureCliExtensionPath = Join-Path $Env:CommonProgramFiles 'AzureCliExtensionDirectory'
+$azureCliExtensionPath = Join-Path $env:CommonProgramFiles 'AzureCliExtensionDirectory'
 New-Item -ItemType 'Directory' -Path $azureCliExtensionPath | Out-Null
 [Environment]::SetEnvironmentVariable('AZURE_EXTENSION_DIR', $azureCliExtensionPath, "Machine")

--- a/images/windows/scripts/build/Install-BizTalkBuildComponent.ps1
+++ b/images/windows/scripts/build/Install-BizTalkBuildComponent.ps1
@@ -3,15 +3,15 @@
 ##  Desc:  Install BizTalk Project Build Component
 ################################################################################

-$BuildComponentUri = "https://aka.ms/BuildComponentSetup.EN"
-$BuildComponentSignatureThumbprint = "8740DF4ACB749640AD318E4BE842F72EC651AD80"
+$downloadUrl = "https://aka.ms/BuildComponentSetup.EN"
+$signatureThumbprint = "8740DF4ACB749640AD318E4BE842F72EC651AD80"

 Write-Host "Downloading BizTalk Project Build Component archive..."
-$zipFile = Invoke-DownloadWithRetry $BuildComponentUri
+$zipFile = Invoke-DownloadWithRetry $downloadUrl

 $setupPath = Join-Path $env:TEMP "BizTalkBuildComponent"
 if (-not (Test-Path -Path $setupPath)) {
-    $null = New-Item -Path $setupPath -ItemType Directory -Force
+    New-Item -Path $setupPath -ItemType Directory -Force | Out-Null
 }
 Expand-7ZipArchive -Path $zipFile -DestinationPath $setupPath

@@ -19,10 +19,10 @@ Write-Host "Installing BizTalk Project Build Component..."
 Install-Binary `
    -LocalPath "$setupPath\Bootstrap.msi" `
    -ExtraInstallArgs ("/l*v", "$setupPath\bootstrap.log") `
-    -ExpectedSignature $BuildComponentSignatureThumbprint
+    -ExpectedSignature $signatureThumbprint
 Install-Binary `
    -LocalPath "$setupPath\BuildComponentSetup.msi" `
    -ExtraInstallArgs ("/l*v", "$setupPath\buildComponentSetup.log") `
-    -ExpectedSignature $BuildComponentSignatureThumbprint
+    -ExpectedSignature $signatureThumbprint

 Invoke-PesterTests -TestFile "BizTalk" -TestName "BizTalk Build Component Setup"
--- a/images/windows/scripts/build/Install-Chocolatey.ps1
+++ b/images/windows/scripts/build/Install-Chocolatey.ps1
@@ -14,9 +14,9 @@ Update-Environment

 # Verify and run choco installer
 $signatureThumbprint = "83AC7D88C66CB8680BCE802E0F0F5C179722764B"
-$InstallScriptPath = Invoke-DownloadWithRetry 'https://chocolatey.org/install.ps1'
-Test-FileSignature -Path $InstallScriptPath -ExpectedThumbprint $signatureThumbprint
-Invoke-Expression $InstallScriptPath
+$installScriptPath = Invoke-DownloadWithRetry 'https://chocolatey.org/install.ps1'
+Test-FileSignature -Path $installScriptPath -ExpectedThumbprint $signatureThumbprint
+Invoke-Expression $installScriptPath

 # Turn off confirmation
 choco feature enable -n allowGlobalConfirmation
--- a/images/windows/scripts/build/Install-Chrome.ps1
+++ b/images/windows/scripts/build/Install-Chrome.ps1
@@ -32,52 +32,51 @@ $regGoogleParameters = @(
 )

 $regGoogleParameters | ForEach-Object {
-    $Arguments = $_
-    if (-not ($Arguments.Path)) {
-        $Arguments.Add("Path", $regGoogleUpdatePath)
+    $arguments = $_
+    if (-not ($arguments.Path)) {
+        $arguments.Add("Path", $regGoogleUpdatePath)
    }
-    $Arguments.Add("Force", $true)
-    New-ItemProperty @Arguments
+    $arguments.Add("Force", $true)
+    New-ItemProperty @arguments
 }
-
 # Install Chrome WebDriver
 Write-Host "Install Chrome WebDriver..."
-$ChromeDriverPath = "$($env:SystemDrive)\SeleniumWebDrivers\ChromeDriver"
-if (-not (Test-Path -Path $ChromeDriverPath)) {
-    New-Item -Path $ChromeDriverPath -ItemType Directory -Force
+$chromeDriverPath = "$($env:SystemDrive)\SeleniumWebDrivers\ChromeDriver"
+if (-not (Test-Path -Path $chromeDriverPath)) {
+    New-Item -Path $chromeDriverPath -ItemType Directory -Force
 }

 Write-Host "Get the Chrome WebDriver download URL..."
-$RegistryPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths"
-$ChromePath = (Get-ItemProperty "$RegistryPath\chrome.exe").'(default)'
-[version] $ChromeVersion = [System.Diagnostics.FileVersionInfo]::GetVersionInfo($ChromePath).ProductVersion
-$ChromeBuild = "$($ChromeVersion.Major).$($ChromeVersion.Minor).$($ChromeVersion.Build)"
-$ChromeDriverVersionsUrl = "https://googlechromelabs.github.io/chrome-for-testing/latest-patch-versions-per-build-with-downloads.json"
+$registryPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths"
+$chromePath = (Get-ItemProperty "$registryPath\chrome.exe").'(default)'
+[version] $chromeVersion = [System.Diagnostics.FileVersionInfo]::GetVersionInfo($chromePath).ProductVersion
+$chromeBuild = "$($chromeVersion.Major).$($chromeVersion.Minor).$($chromeVersion.Build)"
+$chromeDriverVersionsUrl = "https://googlechromelabs.github.io/chrome-for-testing/latest-patch-versions-per-build-with-downloads.json"

-Write-Host "Chrome version is $ChromeVersion"
-$ChromeDriverVersions = Invoke-RestMethod -Uri $ChromeDriverVersionsUrl
-$ChromeDriverVersion = $ChromeDriverVersions.builds.$ChromeBuild
+Write-Host "Chrome version is $chromeVersion"
+$chromeDriverVersions = Invoke-RestMethod -Uri $chromeDriverVersionsUrl
+$chromeDriverVersion = $chromeDriverVersions.builds.$chromeBuild

-if (-not ($ChromeDriverVersion)) {
-    $availableVersions = $ChromeDriverVersions.builds | Get-Member | Select-Object -ExpandProperty Name
+if (-not ($chromeDriverVersion)) {
+    $availableVersions = $chromeDriverVersions.builds | Get-Member | Select-Object -ExpandProperty Name
    Write-Host "Available chromedriver builds are $availableVersions"
-    throw "Can't determine chromedriver version that matches chrome build $ChromeBuild"
+    throw "Can't determine chromedriver version that matches chrome build $chromeBuild"
 }

-$ChromeDriverVersion.version | Out-File -FilePath "$ChromeDriverPath\versioninfo.txt" -Force;
+$chromeDriverVersion.version | Out-File -FilePath "$chromeDriverPath\versioninfo.txt" -Force;

-Write-Host "Chrome WebDriver version to install is $($ChromeDriverVersion.version)"
-$ChromeDriverZipDownloadUrl = ($ChromeDriverVersion.downloads.chromedriver | Where-Object platform -eq "win64").url
+Write-Host "Chrome WebDriver version to install is $($chromeDriverVersion.version)"
+$chromeDriverZipDownloadUrl = ($chromeDriverVersion.downloads.chromedriver | Where-Object platform -eq "win64").url

-Write-Host "Download Chrome WebDriver from $ChromeDriverZipDownloadUrl..."
-$ChromeDriverArchPath = Invoke-DownloadWithRetry $ChromeDriverZipDownloadUrl
+Write-Host "Download Chrome WebDriver from $chromeDriverZipDownloadUrl..."
+$chromeDriverArchPath = Invoke-DownloadWithRetry $chromeDriverZipDownloadUrl

 Write-Host "Expand Chrome WebDriver archive (without using directory names)..."
-Expand-7ZipArchive -Path $ChromeDriverArchPath -DestinationPath $ChromeDriverPath -ExtractMethod "e"
+Expand-7ZipArchive -Path $chromeDriverArchPath -DestinationPath $chromeDriverPath -ExtractMethod "e"

 Write-Host "Setting the environment variables..."
-[Environment]::SetEnvironmentVariable("ChromeWebDriver", $ChromeDriverPath, "Machine")
-Add-MachinePathItem $ChromeDriverPath
+[Environment]::SetEnvironmentVariable("ChromeWebDriver", $chromeDriverPath, "Machine")
+Add-MachinePathItem $chromeDriverPath
 Update-Environment

 Invoke-PesterTests -TestFile "Browsers" -TestName "Chrome"
--- a/images/windows/scripts/build/Install-CloudFoundryCli.ps1
+++ b/images/windows/scripts/build/Install-CloudFoundryCli.ps1
@@ -4,23 +4,23 @@
 ################################################################################

 # Download the latest cf cli exe
-$CloudFoundryCliUrl = "https://packages.cloudfoundry.org/stable?release=windows64-exe&source=github"
+$cloudFoundryCliUrl = "https://packages.cloudfoundry.org/stable?release=windows64-exe&source=github"

-$CloudFoundryArchPath = Invoke-DownloadWithRetry $CloudFoundryCliUrl
+$cloudFoundryArchPath = Invoke-DownloadWithRetry $cloudFoundryCliUrl

 # Create directory for cf cli
-$CloudFoundryCliPath = "C:\cf-cli"
-New-Item -Path $CloudFoundryCliPath -ItemType Directory -Force
+$cloudFoundryCliPath = "C:\cf-cli"
+New-Item -Path $cloudFoundryCliPath -ItemType Directory -Force

 # Extract the zip archive
 Write-Host "Extracting cf cli..."
-Expand-7ZipArchive -Path $CloudFoundryArchPath -DestinationPath $CloudFoundryCliPath
+Expand-7ZipArchive -Path $cloudFoundryArchPath -DestinationPath $cloudFoundryCliPath

 # Add cf to path
-Add-MachinePathItem $CloudFoundryCliPath
+Add-MachinePathItem $cloudFoundryCliPath

 # Validate cf signature
-$CloudFoundrySignatureThumbprint = "4C69EDD13930ED01B83DD1D17B09C434DC1F2177"
-Test-FileSignature -Path "$CloudFoundryCliPath\cf.exe" -ExpectedThumbprint $CloudFoundrySignatureThumbprint
+$cloudFoundrySignatureThumbprint = "4C69EDD13930ED01B83DD1D17B09C434DC1F2177"
+Test-FileSignature -Path "$cloudFoundryCliPath\cf.exe" -ExpectedThumbprint $cloudFoundrySignatureThumbprint

 Invoke-PesterTests -TestFile "CLI.Tools" -TestName "CloudFoundry CLI"
--- a/images/windows/scripts/build/Install-CodeQLBundle.ps1
+++ b/images/windows/scripts/build/Install-CodeQLBundle.ps1
@@ -4,33 +4,33 @@
 ################################################################################

 # Retrieve the CLI version of the latest CodeQL bundle.
-$Defaults = (Invoke-RestMethod "https://raw.githubusercontent.com/github/codeql-action/v2/src/defaults.json")
-$CliVersion = $Defaults.cliVersion
-$TagName = "codeql-bundle-v" + $CliVersion
+$defaults = (Invoke-RestMethod "https://raw.githubusercontent.com/github/codeql-action/v2/src/defaults.json")
+$cliVersion = $defaults.cliVersion
+$tagName = "codeql-bundle-v" + $cliVersion

-Write-Host "Downloading CodeQL bundle $($CliVersion)..."
+Write-Host "Downloading CodeQL bundle $($cliVersion)..."
 # Note that this is the all-platforms CodeQL bundle, to support scenarios where customers run
 # different operating systems within containers.
-$CodeQLBundlePath = Invoke-DownloadWithRetry "https://github.com/github/codeql-action/releases/download/$($TagName)/codeql-bundle.tar.gz"
-$DownloadDirectoryPath = (Get-Item $CodeQLBundlePath).Directory.FullName
+$codeQLBundlePath = Invoke-DownloadWithRetry "https://github.com/github/codeql-action/releases/download/$($tagName)/codeql-bundle.tar.gz"
+$downloadDirectoryPath = (Get-Item $codeQLBundlePath).Directory.FullName

-$CodeQLToolcachePath = Join-Path $Env:AGENT_TOOLSDIRECTORY -ChildPath "CodeQL" | Join-Path -ChildPath $CliVersion | Join-Path -ChildPath "x64"
-New-Item -Path $CodeQLToolcachePath -ItemType Directory -Force | Out-Null
+$codeQLToolcachePath = Join-Path $env:AGENT_TOOLSDIRECTORY -ChildPath "CodeQL" | Join-Path -ChildPath $cliVersion | Join-Path -ChildPath "x64"
+New-Item -Path $codeQLToolcachePath -ItemType Directory -Force | Out-Null

 Write-Host "Unpacking the downloaded CodeQL bundle archive..."
-Expand-7ZipArchive -Path $CodeQLBundlePath -DestinationPath $DownloadDirectoryPath
-$UnGzipedCodeQLBundlePath = Join-Path $DownloadDirectoryPath "codeql-bundle.tar"
-Expand-7ZipArchive -Path $UnGzipedCodeQLBundlePath -DestinationPath $CodeQLToolcachePath
+Expand-7ZipArchive -Path $codeQLBundlePath -DestinationPath $downloadDirectoryPath
+$unGzipedCodeQLBundlePath = Join-Path $downloadDirectoryPath "codeql-bundle.tar"
+Expand-7ZipArchive -Path $unGzipedCodeQLBundlePath -DestinationPath $codeQLToolcachePath

-Write-Host "CodeQL bundle at $($CodeQLToolcachePath) contains the following directories:"
-Get-ChildItem -Path $CodeQLToolcachePath -Depth 2
+Write-Host "CodeQL bundle at $($codeQLToolcachePath) contains the following directories:"
+Get-ChildItem -Path $codeQLToolcachePath -Depth 2

 # Touch a file to indicate to the CodeQL Action that this bundle shipped with the toolcache. This is
 # to support overriding the CodeQL version specified in defaults.json on GitHub Enterprise.
-New-Item -ItemType file (Join-Path $CodeQLToolcachePath -ChildPath "pinned-version")
+New-Item -ItemType file (Join-Path $codeQLToolcachePath -ChildPath "pinned-version")

 # Touch a file to indicate to the toolcache that setting up CodeQL is complete.
-New-Item -ItemType file "$CodeQLToolcachePath.complete"
+New-Item -ItemType file "$codeQLToolcachePath.complete"

 # Test that the tools have been extracted successfully.
 Invoke-PesterTests -TestFile "Tools" -TestName "CodeQL Bundle"
--- a/images/windows/scripts/build/Install-DotnetSDK.ps1
+++ b/images/windows/scripts/build/Install-DotnetSDK.ps1
@@ -42,13 +42,18 @@ function Invoke-DotnetWarmup {
    )
    # warm up dotnet for first time experience
    $projectTypes = @('console', 'mstest', 'web', 'mvc', 'webapi')
-    $projectTypes | ForEach-Object {
-        $template = $_
-        $projectPath = Join-Path -Path C:\temp -ChildPath $template
+    foreach ($template in $projectTypes) {
+        $projectPath = Join-Path -Path "C:\temp" -ChildPath $template
        New-Item -Path $projectPath -Force -ItemType Directory
        Push-Location -Path $projectPath
-        & $env:ProgramFiles\dotnet\dotnet.exe new globaljson --sdk-version "$SDKVersion"
-        & $env:ProgramFiles\dotnet\dotnet.exe new $template
+        & "$env:ProgramFiles\dotnet\dotnet.exe" new globaljson --sdk-version "$SDKVersion"
+        if ($LastExitCode -ne 0) {
+            throw "Dotnet new globaljson failed with exit code $LastExitCode"
+        }
+        & "$env:ProgramFiles\dotnet\dotnet.exe" new $template
+        if ($LastExitCode -ne 0) {
+            throw "Dotnet new $template failed with exit code $LastExitCode"
+        }
        Pop-Location
        Remove-Item $projectPath -Force -Recurse
    }
@@ -73,6 +78,8 @@ function Install-DotnetSDK {
    Write-Host "Installing dotnet $SDKVersion"
    $zipPath = Join-Path ([IO.Path]::GetTempPath()) ([IO.Path]::GetRandomFileName())
    & $InstallScriptPath -Version $SDKVersion -InstallDir $(Join-Path -Path $env:ProgramFiles -ChildPath 'dotnet') -ZipPath $zipPath -KeepZip
+    # Installer is PowerShell script that doesn't set exit code on failure
+    # If installation failed, tests will fail anyway

    #region Supply chain security
    $releasesJsonUri = "https://dotnetcli.blob.core.windows.net/dotnet/release-metadata/${DotnetVersion}/releases.json"
@@ -110,13 +117,19 @@ if (Test-Path $nugetPath) {

 # Generate and copy new NuGet.Config config
 dotnet nuget list source | Out-Null
-Copy-Item -Path $nugetPath -Destination C:\Users\Default\AppData\Roaming -Force -Recurse
+if ($LastExitCode -ne 0) {
+    throw "Dotnet nuget list source failed with exit code $LastExitCode"
+}
+Copy-Item -Path $nugetPath -Destination "C:\Users\Default\AppData\Roaming" -Force -Recurse

 # Install dotnet tools
 Write-Host "Installing dotnet tools"
 Add-DefaultPathItem "%USERPROFILE%\.dotnet\tools"
 foreach ($dotnetTool in $dotnetToolset.tools) {
-    dotnet tool install $($dotnetTool.name) --tool-path "C:\Users\Default\.dotnet\tools" --add-source https://api.nuget.org/v3/index.json | Out-Null
+    dotnet tool install $($dotnetTool.name) --tool-path "C:\Users\Default\.dotnet\tools" --add-source "https://api.nuget.org/v3/index.json" | Out-Null
+    if ($LastExitCode -ne 0) {
+        throw "Dotnet tool install failed with exit code $LastExitCode"
+    }
 }

 Invoke-PesterTests -TestFile "DotnetSDK"
--- a/images/windows/scripts/build/Install-Firefox.ps1
+++ b/images/windows/scripts/build/Install-Firefox.ps1
@@ -6,11 +6,11 @@

 # Install and configure Firefox browser
 Write-Host "Get the latest Firefox version..."
-$VersionsManifest = Invoke-RestMethod "https://product-details.mozilla.org/1.0/firefox_versions.json"
+$versionsManifest = Invoke-RestMethod "https://product-details.mozilla.org/1.0/firefox_versions.json"

 Write-Host "Install Firefox browser..."
-$installerUrl = "https://download.mozilla.org/?product=firefox-$($VersionsManifest.LATEST_FIREFOX_VERSION)&os=win64&lang=en-US"
-$hashUrl = "https://archive.mozilla.org/pub/firefox/releases/$($VersionsManifest.LATEST_FIREFOX_VERSION)/SHA256SUMS"
+$installerUrl = "https://download.mozilla.org/?product=firefox-$($versionsManifest.LATEST_FIREFOX_VERSION)&os=win64&lang=en-US"
+$hashUrl = "https://archive.mozilla.org/pub/firefox/releases/$($versionsManifest.LATEST_FIREFOX_VERSION)/SHA256SUMS"

 $externalHash = Get-ChecksumFromUrl -Type "SHA256" `
    -Url $hashUrl `
@@ -22,42 +22,42 @@ Install-Binary -Type EXE `
    -ExpectedSHA256Sum $externalHash

 Write-Host "Disable autoupdate..."
-$FirefoxDirectoryPath = Join-Path $env:ProgramFiles "Mozilla Firefox"
-New-Item -path $FirefoxDirectoryPath -Name 'mozilla.cfg' -Value '//
+$firefoxDirectoryPath = Join-Path $env:ProgramFiles "Mozilla Firefox"
+New-Item -path $firefoxDirectoryPath -Name 'mozilla.cfg' -Value '//
 pref("browser.shell.checkDefaultBrowser", false);
 pref("app.update.enabled", false);' -ItemType file -force

-$FirefoxPreferencesFolder = Join-Path $FirefoxDirectoryPath "defaults\pref"
-New-Item -path $FirefoxPreferencesFolder -Name 'local-settings.js' -Value 'pref("general.config.obscure_value", 0);
+$firefoxPreferencesFolder = Join-Path $firefoxDirectoryPath "defaults\pref"
+New-Item -path $firefoxPreferencesFolder -Name 'local-settings.js' -Value 'pref("general.config.obscure_value", 0);
 pref("general.config.filename", "mozilla.cfg");' -ItemType file -force

 # Download and install Gecko WebDriver
 Write-Host "Install Gecko WebDriver..."
-$GeckoDriverPath = "$($env:SystemDrive)\SeleniumWebDrivers\GeckoDriver"
-if (-not (Test-Path -Path $GeckoDriverPath)) {
-    New-Item -Path $GeckoDriverPath -ItemType Directory -Force
+$geckoDriverPath = "$($env:SystemDrive)\SeleniumWebDrivers\GeckoDriver"
+if (-not (Test-Path -Path $geckoDriverPath)) {
+    New-Item -Path $geckoDriverPath -ItemType Directory -Force
 }

 Write-Host "Get the Gecko WebDriver version..."
-$GeckoDriverVersion = (Get-GithubReleasesByVersion -Repo "mozilla/geckodriver" -Version "latest").version
-$GeckoDriverVersion | Out-File -FilePath "$GeckoDriverPath\versioninfo.txt" -Force
+$geckoDriverVersion = (Get-GithubReleasesByVersion -Repo "mozilla/geckodriver" -Version "latest").version
+$geckoDriverVersion | Out-File -FilePath "$geckoDriverPath\versioninfo.txt" -Force

 Write-Host "Download Gecko WebDriver WebDriver..."
-$GeckoDriverDownloadUrl = Resolve-GithubReleaseAssetUrl `
+$geckoDriverDownloadUrl = Resolve-GithubReleaseAssetUrl `
    -Repo "mozilla/geckodriver" `
-    -Version $GeckoDriverVersion `
+    -Version $geckoDriverVersion `
    -UrlMatchPattern "geckodriver-*-win64.zip"
-$GeckoDriverArchPath = Invoke-DownloadWithRetry $GeckoDriverDownloadUrl
+$geckoDriverArchPath = Invoke-DownloadWithRetry $geckoDriverDownloadUrl

 Write-Host "Expand Gecko WebDriver archive..."
-Expand-7ZipArchive -Path $GeckoDriverArchPath -DestinationPath $GeckoDriverPath
+Expand-7ZipArchive -Path $geckoDriverArchPath -DestinationPath $geckoDriverPath

 # Validate Gecko WebDriver signature
-$GeckoDriverSignatureThumbprint = "1326B39C3D5D2CA012F66FB439026F7B59CB1974"
-Test-FileSignature -Path "$GeckoDriverPath/geckodriver.exe" -ExpectedThumbprint $GeckoDriverSignatureThumbprint
+$geckoDriverSignatureThumbprint = "1326B39C3D5D2CA012F66FB439026F7B59CB1974"
+Test-FileSignature -Path "$geckoDriverPath/geckodriver.exe" -ExpectedThumbprint $geckoDriverSignatureThumbprint

 Write-Host "Setting the environment variables..."
-Add-MachinePathItem -PathItem $GeckoDriverPath
-[Environment]::SetEnvironmentVariable("GeckoWebDriver", $GeckoDriverPath, "Machine")
+Add-MachinePathItem -PathItem $geckoDriverPath
+[Environment]::SetEnvironmentVariable("GeckoWebDriver", $geckoDriverPath, "Machine")

 Invoke-PesterTests -TestFile "Browsers" -TestName "Firefox"
--- a/images/windows/scripts/build/Install-Git.ps1
+++ b/images/windows/scripts/build/Install-Git.ps1
@@ -35,6 +35,9 @@ Install-Binary `
 Update-Environment

 git config --system --add safe.directory "*"
+if ($LASTEXITCODE -ne 0) {
+    Write-Error "Failed to configure safe.directory for Git with exit code $LASTEXITCODE"
+}

 # Disable GCM machine-wide
 [Environment]::SetEnvironmentVariable("GCM_INTERACTIVE", "Never", "Machine")
--- a/images/windows/scripts/build/Install-Haskell.ps1
+++ b/images/windows/scripts/build/Install-Haskell.ps1
@@ -30,23 +30,35 @@ Add-MachinePathItem "$cabalDir\bin"
 Update-Environment

 # Get 3 latest versions of GHC
-$Versions = ghcup list -t ghc -r | Where-Object {$_ -notlike "prerelease"}
-$VersionsOutput = [Version[]]($Versions | ForEach-Object{ $_.Split(' ')[1]; })
-$LatestMajorMinor = $VersionsOutput | Group-Object { $_.ToString(2) } | Sort-Object { [Version] $_.Name } | Select-Object -last 3
-$VersionsList = $LatestMajorMinor | ForEach-Object { $_.Group | Select-Object -Last 1 } | Sort-Object
+$versions = ghcup list -t ghc -r | Where-Object { $_ -notlike "prerelease" }
+$versionsOutput = [version[]]($versions | ForEach-Object { $_.Split(' ')[1]; })
+$latestMajorMinor = $versionsOutput | Group-Object { $_.ToString(2) } | Sort-Object { [Version] $_.Name } | Select-Object -last 3
+$versionsList = $latestMajorMinor | ForEach-Object { $_.Group | Select-Object -Last 1 } | Sort-Object

 # The latest version will be installed as a default
-foreach ($version in $VersionsList) {
+foreach ($version in $versionsList) {
    Write-Host "Installing ghc $version..."
    ghcup install ghc $version
+    if ($LastExitCode -ne 0) {
+        throw "GHC installation failed with exit code $LastExitCode"
+    }
    ghcup set ghc $version
+    if ($LastExitCode -ne 0) {
+        throw "Setting GHC version failed with exit code $LastExitCode"
+    }
 }

 # Add default version of GHC to path
-$DefaultGhcVersion = $VersionsList | Select-Object -Last 1
-ghcup set ghc $DefaultGhcVersion
+$defaultGhcVersion = $versionsList | Select-Object -Last 1
+ghcup set ghc $defaultGhcVersion
+if ($LastExitCode -ne 0) {
+    throw "Setting default GHC version failed with exit code $LastExitCode"
+}

 Write-Host 'Installing cabal...'
 ghcup install cabal latest
+if ($LastExitCode -ne 0) {
+    throw "Cabal installation failed with exit code $LastExitCode"
+}

 Invoke-PesterTests -TestFile 'Haskell'
--- a/images/windows/scripts/build/Install-Miniconda.ps1
+++ b/images/windows/scripts/build/Install-Miniconda.ps1
@@ -4,29 +4,29 @@
 ##  Supply chain security: checksum validation
 ################################################################################

-$CondaDestination = "C:\Miniconda"
-$InstallerName = "Miniconda3-latest-Windows-x86_64.exe"
+$condaDestination = "C:\Miniconda"
+$installerName = "Miniconda3-latest-Windows-x86_64.exe"

 #region Supply chain security
 $distributorFileHash = $null
 $checksums = (Invoke-RestMethod -Uri 'https://repo.anaconda.com/miniconda/' | ConvertFrom-HTML).SelectNodes('//html/body/table/tr')

 foreach ($node in $checksums) {
-    if ($node.ChildNodes[1].InnerText -eq $InstallerName) {
+    if ($node.ChildNodes[1].InnerText -eq $installerName) {
        $distributorFileHash = $node.ChildNodes[7].InnerText
    }
 }

 if ($null -eq $distributorFileHash) {
-    throw "Unable to find checksum for $InstallerName in https://repo.anaconda.com/miniconda/"
+    throw "Unable to find checksum for $installerName in https://repo.anaconda.com/miniconda/"
 }
 #endregion

 Install-Binary `
-    -Url "https://repo.anaconda.com/miniconda/${InstallerName}" `
-    -InstallArgs @("/S", "/AddToPath=0", "/RegisterPython=0", "/D=$CondaDestination") `
+    -Url "https://repo.anaconda.com/miniconda/${installerName}" `
+    -InstallArgs @("/S", "/AddToPath=0", "/RegisterPython=0", "/D=$condaDestination") `
    -ExpectedSHA256Sum $distributorFileHash

-[Environment]::SetEnvironmentVariable("CONDA", $CondaDestination, "Machine")
+[Environment]::SetEnvironmentVariable("CONDA", $condaDestination, "Machine")

 Invoke-PesterTests -TestFile "Miniconda"
--- a/images/windows/scripts/build/Install-MongoDB.ps1
+++ b/images/windows/scripts/build/Install-MongoDB.ps1
@@ -4,26 +4,27 @@
 ####################################################################################

 # Install mongodb package
-$toolsetVersion = (Get-ToolsetContent).mongodb.version
+$toolsetContent = Get-ToolsetContent
+$toolsetVersion = $toolsetContent.mongodb.version

 $getMongoReleases = Invoke-WebRequest -Uri "mongodb.com/docs/manual/release-notes/$toolsetVersion/" -UseBasicParsing
-$TargetReleases = $getMongoReleases.Links.href | Where-Object {$_ -like "#$toolsetVersion*---*"}
+$targetReleases = $getMongoReleases.Links.href | Where-Object { $_ -like "#$toolsetVersion*---*" }

-$MinorVersions = @()
-foreach ($release in $TargetReleases) {
+$minorVersions = @()
+foreach ($release in $targetReleases) {
    if ($release -notlike "*upcoming*") {
        $pattern = '\d+\.\d+\.\d+'
        $version = $release | Select-String -Pattern $pattern -AllMatches | ForEach-Object { $_.Matches } | ForEach-Object { $_.Value }
-        $MinorVersions += $version
+        $minorVersions += $version
    }
 }

-$LatestVersion = $MinorVersions[0]
+$latestVersion = $minorVersions[0]

 Install-Binary `
-    -Url "https://fastdl.mongodb.org/windows/mongodb-windows-x86_64-$LatestVersion-signed.msi" `
+    -Url "https://fastdl.mongodb.org/windows/mongodb-windows-x86_64-$latestVersion-signed.msi" `
    -ExtraInstallArgs @('TARGETDIR=C:\PROGRA~1\MongoDB ADDLOCAL=ALL') `
-    -ExpectedSignature (Get-ToolsetContent).mongodb.signature
+    -ExpectedSignature $toolsetContent.mongodb.signature

 # Add mongodb to the PATH
 $mongoPath = (Get-CimInstance Win32_Service -Filter "Name LIKE 'mongodb'").PathName
--- a/images/windows/scripts/build/Install-Msys2.ps1
+++ b/images/windows/scripts/build/Install-Msys2.ps1
@@ -7,7 +7,7 @@
 # https://github.com/msys2/MINGW-packages/blob/master/azure-pipelines.yml
 # https://packages.msys2.org/group/

-$dash = "-" * 40
+$logPrefix = "`n" + ("-" * 40) + "`n---"
 $origPath = $env:PATH

 function Install-Msys2 {
@@ -31,28 +31,49 @@ function Install-Msys2 {

    Write-Host "Starting msys2 installation"
    & $installerPath in --confirm-command --accept-messages --root C:/msys64
+    if ($LastExitCode -ne 0) {
+        throw "MSYS2 installation failed with exit code $LastExitCode"
+    }
    Remove-Item $installerPath
 }

-function Install-Msys2Packages($Packages) {
+function Install-Msys2Packages {
+    param (
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyCollection()]
+        [string[]]$Packages
+    )
+
    if (-not $Packages) {
        return
    }

-  Write-Host "`n$dash Install msys2 packages"
+    Write-Host "$logPrefix Install msys2 packages"
    pacman.exe -S --noconfirm --needed --noprogressbar $Packages
+    if ($LastExitCode -ne 0) {
+        throw "MSYS2 packages installation failed with exit code $LastExitCode"
+    }
    taskkill /f /fi "MODULES eq msys-2.0.dll"

-  Write-Host "`n$dash Remove p7zip/7z package due to conflicts"
+    Write-Host "$logPrefix Remove p7zip/7z package due to conflicts"
    pacman.exe -R --noconfirm --noprogressbar p7zip
+    if ($LastExitCode -ne 0) {
+        throw "Removal of p7zip/7z package failed with exit code $LastExitCode"
+    }
 }

-function Install-MingwPackages($Packages) {
+function Install-MingwPackages {
+    param (
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyCollection()]
+        [object[]] $Packages
+    )
+
    if (-not $Packages) {
        return
    }

-  Write-Host "`n$dash Install mingw packages"
+    Write-Host "$logPrefix Install mingw packages"
    $archs = $Packages.arch

    foreach ($arch in $archs) {
@@ -63,18 +84,26 @@ function Install-MingwPackages($Packages) {
        $packagesToInstall = $runtimePackages + $additionalPackages
        Write-Host "The following packages will be installed: $packagesToInstall"
        pacman.exe -S --noconfirm --needed --noprogressbar $packagesToInstall
+        if ($LastExitCode -ne 0) {
+            throw "Installation of $arch packages failed with exit code $LastExitCode"
+        }
    }

    # clean all packages to decrease image size
-  Write-Host "`n$dash Clean packages"
+    Write-Host "$logPrefix Clean packages"
    pacman.exe -Scc --noconfirm
+    if ($LastExitCode -ne 0) {
+        throw "Cleaning of packages failed with exit code $LastExitCode"
+    }

    $pkgs = pacman.exe -Q
+    if ($LastExitCode -ne 0) {
+        throw "Listing of packages failed with exit code $LastExitCode"
+    }

-  foreach ($arch in $archs)
-  {
-    Write-Host "`n$dash Installed $arch packages"
-    $pkgs | grep ^${arch}-
+    foreach ($arch in $archs) {
+        Write-Host "$logPrefix Installed $arch packages"
+        $pkgs | Select-String -Pattern "^${arch}-"
    }
 }

@@ -83,11 +112,18 @@ Install-Msys2
 # Add msys2 bin tools folders to PATH temporary
 $env:PATH = "C:\msys64\mingw64\bin;C:\msys64\usr\bin;$origPath"

-Write-Host "`n$dash pacman --noconfirm -Syyuu"
+Write-Host "$logPrefix pacman --noconfirm -Syyuu"
 pacman.exe -Syyuu --noconfirm
+if ($LastExitCode -ne 0) {
+    throw "Updating of packages failed with exit code $LastExitCode"
+}
 taskkill /f /fi "MODULES eq msys-2.0.dll"
-Write-Host "`n$dash pacman --noconfirm -Syuu (2nd pass)"
+
+Write-Host "$logPrefix pacman --noconfirm -Syuu (2nd pass)"
 pacman.exe -Syuu --noconfirm
+if ($LastExitCode -ne 0) {
+    throw "Second pass updating of packages failed with exit code $LastExitCode"
+}
 taskkill /f /fi "MODULES eq msys-2.0.dll"

 $toolsetContent = (Get-ToolsetContent).MsysPackages
--- a/images/windows/scripts/build/Install-MysqlCli.ps1
+++ b/images/windows/scripts/build/Install-MysqlCli.ps1
@@ -3,33 +3,33 @@
 ##  Desc:  Install Mysql CLI
 ################################################################################

-# Installing visual c++ redistibutable package.
+# Installing visual c++ redistributable package.
 Install-Binary `
    -Url 'https://download.microsoft.com/download/0/5/6/056dcda9-d667-4e27-8001-8a0c6971d6b1/vcredist_x64.exe' `
    -InstallArgs @("/install", "/quiet", "/norestart") `
    -ExpectedSignature '3BDA323E552DB1FDE5F4FBEE75D6D5B2B187EEDC'

 # Downloading mysql
-[version] $MysqlVersion = (Get-ToolsetContent).mysql.version
-$MysqlVersionMajorMinor = $MysqlVersion.ToString(2)
+[version] $mysqlVersion = (Get-ToolsetContent).mysql.version
+$mysqlVersionMajorMinor = $mysqlVersion.ToString(2)

-if ($MysqlVersion.Build -lt 0) {
-    $downloadsPageUrl = "https://dev.mysql.com/downloads/mysql/${MysqlVersionMajorMinor}.html"
-    $MysqlVersion = Invoke-RestMethod -Uri $downloadsPageUrl -Headers @{ 'User-Agent' = 'curl/8.4.0' } `
-        | Select-String -Pattern "${MysqlVersionMajorMinor}\.\d+" `
+if ($mysqlVersion.Build -lt 0) {
+    $downloadsPageUrl = "https://dev.mysql.com/downloads/mysql/${mysqlVersionMajorMinor}.html"
+    $mysqlVersion = Invoke-RestMethod -Uri $downloadsPageUrl -Headers @{ 'User-Agent' = 'curl/8.4.0' } `
+    | Select-String -Pattern "${mysqlVersionMajorMinor}\.\d+" `
    | ForEach-Object { $_.Matches.Value }
 }

-$MysqlVersionFull = $MysqlVersion.ToString()
-$MysqlVersionUrl = "https://cdn.mysql.com/Downloads/MySQL-${MysqlVersionMajorMinor}/mysql-${MysqlVersionFull}-winx64.msi"
+$mysqlVersionFull = $mysqlVersion.ToString()
+$mysqlVersionUrl = "https://cdn.mysql.com/Downloads/MySQL-${mysqlVersionMajorMinor}/mysql-${mysqlVersionFull}-winx64.msi"

 Install-Binary `
-    -Url $MysqlVersionUrl `
+    -Url $mysqlVersionUrl `
    -ExpectedSignature (Get-ToolsetContent).mysql.signature

 # Adding mysql in system environment path
-$MysqlPath = $(Get-ChildItem -Path "C:\PROGRA~1\MySQL" -Directory)[0].FullName
+$mysqlPath = $(Get-ChildItem -Path "C:\PROGRA~1\MySQL" -Directory)[0].FullName

-Add-MachinePathItem "${MysqlPath}\bin"
+Add-MachinePathItem "${mysqlPath}\bin"

 Invoke-PesterTests -TestFile "Databases" -TestName "MySQL"
--- a/images/windows/scripts/build/Install-NSIS.ps1
+++ b/images/windows/scripts/build/Install-NSIS.ps1
@@ -4,9 +4,9 @@
 ##  Supply chain security: NSIS - managed by package manager
 ################################################################################

-$NsisVersion = (Get-ToolsetContent).nsis.version
+$nsisVersion = (Get-ToolsetContent).nsis.version

-Install-ChocoPackage nsis -ArgumentList "--version", "$NsisVersion"
+Install-ChocoPackage nsis -ArgumentList "--version", "$nsisVersion"

 Add-MachinePathItem "${env:ProgramFiles(x86)}\NSIS\"
 Update-Environment
--- a/images/windows/scripts/build/Install-NativeImages.ps1
+++ b/images/windows/scripts/build/Install-NativeImages.ps1
@@ -3,9 +3,20 @@
 ##  Desc: Generate and install native images for .NET assemblies
 ################################################################################

-Write-Host "NGen: Microsoft.PowerShell.Utility.Activities"
-$null = & $env:SystemRoot\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.PowerShell.Utility.Activities, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"
-Write-Host "NGen: Framework64"
-$null = & $env:SystemRoot\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update
-Write-Host "NGen: Framework"
-$null = & $env:SystemRoot\Microsoft.NET\Framework\v4.0.30319\ngen.exe update
+Write-Host "NGen: install Microsoft.PowerShell.Utility.Activities..."
+& $env:SystemRoot\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.PowerShell.Utility.Activities, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" | Out-Null
+if ($LASTEXITCODE -ne 0) {
+    throw "Installation of Microsoft.PowerShell.Utility.Activities failed with exit code $LASTEXITCODE"
+}
+
+Write-Host "NGen: update x64 native images..."
+& $env:SystemRoot\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update | Out-Null
+if ($LASTEXITCODE -ne 0) {
+    throw "Update of x64 native images failed with exit code $LASTEXITCODE"
+}
+
+Write-Host "NGen: update x86 native images..."
+& $env:SystemRoot\Microsoft.NET\Framework\v4.0.30319\ngen.exe update | Out-Null
+if ($LASTEXITCODE -ne 0) {
+    throw "Update of x86 native images failed with exit code $LASTEXITCODE"
+}
--- a/images/windows/scripts/build/Install-NodeJS.ps1
+++ b/images/windows/scripts/build/Install-NodeJS.ps1
@@ -4,24 +4,24 @@
 ##         Must run after python is configured
 ################################################################################

-$PrefixPath = 'C:\npm\prefix'
-$CachePath = 'C:\npm\cache'
+$prefixPath = 'C:\npm\prefix'
+$cachePath = 'C:\npm\cache'

-New-Item -Path $PrefixPath -Force -ItemType Directory
-New-Item -Path $CachePath -Force -ItemType Directory
+New-Item -Path $prefixPath -Force -ItemType Directory
+New-Item -Path $cachePath -Force -ItemType Directory

 $defaultVersion = (Get-ToolsetContent).node.default
 $versionToInstall = Resolve-ChocoPackageVersion -PackageName "nodejs" -TargetVersion $defaultVersion

-Install-ChocoPackage nodejs -ArgumentList "--version=$versionToInstall"
+Install-ChocoPackage "nodejs" -ArgumentList "--version=$versionToInstall"

-Add-MachinePathItem $PrefixPath
+Add-MachinePathItem $prefixPath
 Update-Environment

-[Environment]::SetEnvironmentVariable("npm_config_prefix", $PrefixPath, "Machine")
-$env:npm_config_prefix = $PrefixPath
+[Environment]::SetEnvironmentVariable("npm_config_prefix", $prefixPath, "Machine")
+$env:npm_config_prefix = $prefixPath

-npm config set cache $CachePath --global
+npm config set cache $cachePath --global
 npm config set registry https://registry.npmjs.org/

 $globalNpmPackages = (Get-ToolsetContent).npm.global_packages
--- a/images/windows/scripts/build/Install-OpenSSL.ps1
+++ b/images/windows/scripts/build/Install-OpenSSL.ps1
@@ -9,7 +9,7 @@ $bits = '64'
 $light = $false
 $installerType = "exe"
 $version = (Get-ToolsetContent).openssl.version
-$installDir = "$Env:ProgramFiles\OpenSSL"
+$installDir = "$env:ProgramFiles\OpenSSL"

 # Fetch available installers list
 $jsonUrl = 'https://raw.githubusercontent.com/slproweb/opensslhashes/master/win32_openssl_hashes.json'
--- a/images/windows/scripts/build/Install-Pipx.ps1
+++ b/images/windows/scripts/build/Install-Pipx.ps1
@@ -8,6 +8,9 @@ $env:PIPX_BIN_DIR = "${env:ProgramFiles(x86)}\pipx_bin"
 $env:PIPX_HOME = "${env:ProgramFiles(x86)}\pipx"

 pip install pipx
+if ($LASTEXITCODE -ne 0) {
+    throw "pipx installation failed with exit code $LASTEXITCODE"
+}

 Add-MachinePathItem "${env:PIPX_BIN_DIR}"
 [Environment]::SetEnvironmentVariable("PIPX_BIN_DIR", $env:PIPX_BIN_DIR, "Machine")
@@ -27,6 +30,10 @@ foreach ($tool in $pipxToolset) {
        Write-Host "Install ${tool.package} into default python"
        pipx install $tool.package
    }
+
+    if ($LASTEXITCODE -ne 0) {
+        throw "Package ${tool.package} installation failed with exit code $LASTEXITCODE"
+    }
 }

 Invoke-PesterTests -TestFile "PipxPackages"
--- a/images/windows/scripts/build/Install-PostgreSQL.ps1
+++ b/images/windows/scripts/build/Install-PostgreSQL.ps1
@@ -1,3 +1,8 @@
+################################################################################
+##  File:  Install-PostgreSQL.ps1
+##  Desc:  Install PostgreSQL
+################################################################################
+
 # Define user and password for PostgreSQL database
 $pgUser = "postgres"
 $pgPwd = "root"
@@ -10,47 +15,47 @@ $pgPwd = "root"
 $toolsetVersion = (Get-ToolsetContent).postgresql.version
 $getPostgreReleases = Invoke-WebRequest -Uri "https://git.postgresql.org/gitweb/?p=postgresql.git;a=tags" -UseBasicParsing
 # Getting all links matched to the pattern (e.g.a=log;h=refs/tags/REL_14)
-$TargetReleases = $getPostgreReleases.Links.href | Where-Object { $_ -match "a=log;h=refs/tags/REL_$toolsetVersion" }
-[Int32] $OutNumber = $null
-$MinorVersions = @()
-foreach ($release in $TargetReleases) {
+$targetReleases = $getPostgreReleases.Links.href | Where-Object { $_ -match "a=log;h=refs/tags/REL_$toolsetVersion" }
+[Int32] $outNumber = $null
+$minorVersions = @()
+foreach ($release in $targetReleases) {
    $version = $release.split('/')[-1]
-    # Checking if the latest symbol of the release version is actually a number. If yes, add to $MinorVersions array
-    if ([Int32]::TryParse($($version.Split('_')[-1]), [ref] $OutNumber)) {
-        $MinorVersions += $OutNumber
+    # Checking if the latest symbol of the release version is actually a number. If yes, add to $minorVersions array
+    if ([Int32]::TryParse($($version.Split('_')[-1]), [ref] $outNumber)) {
+        $minorVersions += $outNumber
    }
 }
 # Sorting and getting the last one
-$TargetMinorVersions = ($MinorVersions | Sort-Object)[-1]
+$targetMinorVersions = ($minorVersions | Sort-Object)[-1]

 # Install latest PostgreSQL
 # In order to get rid of error messages (we know we will have them), force ErrorAction to SilentlyContinue
-$ErrorActionOldValue = $ErrorActionPreference
+$errorActionOldValue = $ErrorActionPreference
 $ErrorActionPreference = 'SilentlyContinue'
 # Starting from number 9 and going down, check if the installer is available. If yes, break the loop.
-# If an installer with $TargetMinorVersions is not to be found, the $TargetMinorVersions will be decreased by 1
+# If an installer with $targetMinorVersions is not to be found, the $targetMinorVersions will be decreased by 1
 $increment = 9
 do {
-    $url = "https://get.enterprisedb.com/postgresql/postgresql-$toolsetVersion.$TargetMinorVersions-$increment-windows-x64.exe"
-    $checkaccess = [System.Net.WebRequest]::Create($url)
+    $url = "https://get.enterprisedb.com/postgresql/postgresql-$toolsetVersion.$targetMinorVersions-$increment-windows-x64.exe"
+    $checkAccess = [System.Net.WebRequest]::Create($url)
    $response = $null
-    $response = $checkaccess.GetResponse()
+    $response = $checkAccess.GetResponse()
    if ($response) {
-        $InstallerUrl = $response.ResponseUri.OriginalString
+        $installerUrl = $response.ResponseUri.OriginalString
    } elseif (!$response -and ($increment -eq 0)) {
        $increment = 9
-        $TargetMinorVersions--
+        $targetMinorVersions--
    } else {
        $increment--
    }
 } while (!$response)

 # Return the previous value of ErrorAction and invoke Install-Binary function
-$ErrorActionPreference = $ErrorActionOldValue
-$InstallerArgs = @("--install_runtimes 0", "--superpassword root", "--enable_acledit 1", "--unattendedmodeui none", "--mode unattended")
+$ErrorActionPreference = $errorActionOldValue
+$installerArgs = @("--install_runtimes 0", "--superpassword root", "--enable_acledit 1", "--unattendedmodeui none", "--mode unattended")
 Install-Binary `
-    -Url $InstallerUrl `
-    -InstallArgs $InstallerArgs `
+    -Url $installerUrl `
+    -InstallArgs $installerArgs `
    -ExpectedSignature (Get-ToolsetContent).postgresql.signature

 # Get Path to pg_ctl.exe
--- a/images/windows/scripts/build/Install-PowershellAzModules.ps1
+++ b/images/windows/scripts/build/Install-PowershellAzModules.ps1
@@ -8,7 +8,7 @@
 $installPSModulePath = "C:\\Modules"
 if (-not (Test-Path -LiteralPath $installPSModulePath)) {
    Write-Host "Creating ${installPSModulePath} folder to store PowerShell Azure modules..."
-    $null = New-Item -Path $installPSModulePath -ItemType Directory
+    New-Item -Path $installPSModulePath -ItemType Directory | Out-Null
 }

 # Get modules content from toolset
--- a/images/windows/scripts/build/Install-PowershellCore.ps1
+++ b/images/windows/scripts/build/Install-PowershellCore.ps1
@@ -7,7 +7,7 @@
 $ErrorActionPreference = "Stop"

 $tempDir = Join-Path ([System.IO.Path]::GetTempPath()) ([System.IO.Path]::GetRandomFileName())
-$null = New-Item -ItemType Directory -Path $tempDir -Force -ErrorAction SilentlyContinue
+New-Item -ItemType Directory -Path $tempDir -Force -ErrorAction SilentlyContinue | Out-Null
 try {
    $originalValue = [Net.ServicePointManager]::SecurityProtocol
    [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
--- a/images/windows/scripts/build/Install-PyPy.ps1
+++ b/images/windows/scripts/build/Install-PyPy.ps1
@@ -4,8 +4,7 @@
 ##  Supply chain security: checksum validation
 ################################################################################

-function Install-PyPy
-{
+function Install-PyPy {
    param(
        [String] $PackagePath,
        [String] $Architecture
@@ -31,8 +30,7 @@ function Install-PyPy
    Write-Host "Put '$pypyFullVersion' to PYPY_VERSION file"
    New-Item -Path "$tempFolder\PYPY_VERSION" -Value $pypyFullVersion | Out-Null

-    if ($pythonVersion)
-    {
+    if ($pythonVersion) {
        Write-Host "Installing PyPy $pythonVersion"
        $pypyVersionPath = Join-Path -Path $pypyToolcachePath -ChildPath $pythonVersion
        $pypyArchPath = Join-Path -Path $pypyVersionPath -ChildPath $architecture
@@ -55,25 +53,19 @@ function Install-PyPy

        # Create pip.exe if missing
        $pipPath = Join-Path -Path $pypyArchPath -ChildPath "Scripts/pip.exe"
-        if (-not (Test-Path $pipPath))
-        {
+        if (-not (Test-Path $pipPath)) {
            $pip3Path = Join-Path -Path $pypyArchPath -ChildPath "Scripts/pip3.exe"
            Copy-Item -Path $pip3Path -Destination $pipPath 
        }

-        if ($LASTEXITCODE -ne 0)
-        {
-            Throw "Error happened during PyPy installation"
-            exit 1
+        if ($LASTEXITCODE -ne 0) {
+            throw "PyPy installation failed with exit code $LASTEXITCODE"
        }

        Write-Host "Create complete file"
        New-Item -ItemType File -Path $pypyVersionPath -Name "$architecture.complete" | Out-Null
-    }
-    else
-    {
-        Write-Host "PyPy application is not found. Failed to expand '$packagePath' archive"
-        exit 1
+    } else {
+        throw "PyPy application is not found. Failed to expand '$packagePath' archive"
    }
 }

@@ -86,17 +78,18 @@ $pypyVersions = Invoke-RestMethod https://downloads.python.org/pypy/versions.jso
 # required for html parsing
 $checksums = (Invoke-RestMethod -Uri 'https://www.pypy.org/checksums.html' | ConvertFrom-HTML).SelectNodes('//*[@id="content"]/article/div/pre')

-Write-Host "Starting installation PyPy..."
-foreach($toolsetVersion in $toolsetVersions.versions)
-{
+Write-Host "Start PyPy installation"
+foreach ($toolsetVersion in $toolsetVersions.versions) {
    # Query latest PyPy version
    $latestMajorPyPyVersion = $pypyVersions |
-        Where-Object {$_.python_version.StartsWith("$toolsetVersion") -and $_.stable -eq $true} |
+        Where-Object { $_.python_version.StartsWith("$toolsetVersion") -and $_.stable -eq $true } |
        Select-Object -ExpandProperty files -First 1 |
        Where-Object platform -like "win*"
    
-    if ($latestMajorPyPyVersion)
-    {
+    if (-not $latestMajorPyPyVersion) {
+        throw "Failed to query PyPy version '$toolsetVersion'"
+    }
+
    $filename = $latestMajorPyPyVersion.filename
    Write-Host "Found PyPy '$filename' package"
    $tempPyPyPackagePath = Invoke-DownloadWithRetry $latestMajorPyPyVersion.download_url
@@ -112,10 +105,4 @@ foreach($toolsetVersion in $toolsetVersions.versions)
    #endregion

    Install-PyPy -PackagePath $tempPyPyPackagePath -Architecture $toolsetVersions.arch
-    }
-    else
-    {
-        Write-Host "Failed to query PyPy version '$toolsetVersion'"
-        exit 1
-    }
 }
--- a/images/windows/scripts/build/Install-RootCA.ps1
+++ b/images/windows/scripts/build/Install-RootCA.ps1
@@ -1,3 +1,8 @@
+################################################################################
+##  File:  Install-RootCA.ps1
+##  Desc:  Install Root CA certificates
+################################################################################
+
 # https://www.sysadmins.lv/blog-en/how-to-retrieve-certificate-purposes-property-with-cryptoapi-and-powershell.aspx
 # https://www.sysadmins.lv/blog-en/dump-authroot-and-disallowed-certificates-with-powershell.aspx
 # https://www.sysadmins.lv/blog-en/constraining-extended-key-usages-in-microsoft-windows.aspx
@@ -26,7 +31,7 @@ function Add-ExtendedCertType {

 function Get-CertificatesWithoutPropId {
    # List installed certificates
-    $certs = Get-ChildItem -Path Cert:\LocalMachine\Root
+    $certs = Get-ChildItem -Path "Cert:\LocalMachine\Root"

    Write-Host "Certificates without CERT_NOT_BEFORE_FILETIME_PROP_ID property"
    $certsWithoutPropId = @{}
@@ -65,12 +70,7 @@ function Import-SSTFromWU {
        exit $LASTEXITCODE
    }

-    try {
    Import-Certificate -FilePath $sstFile -CertStoreLocation Cert:\LocalMachine\Root
-    } catch {
-        Write-Host "[Error]: failed to import ROOT CA`n$_"
-        exit 1
-    }
 }

 function Clear-CertificatesPropId {
--- a/images/windows/scripts/build/Install-Rust.ps1
+++ b/images/windows/scripts/build/Install-Rust.ps1
@@ -19,6 +19,9 @@ Test-FileChecksum $rustupPath -ExpectedSHA256Sum $distributorFileHash

 # Install Rust by running rustup-init.exe (disabling the confirmation prompt with -y)
 & $rustupPath -y --default-toolchain=stable --profile=minimal
+if ($LASTEXITCODE -ne 0) {
+    throw "Rust installation failed with exit code $LASTEXITCODE"
+}

 # Add %USERPROFILE%\.cargo\bin to USER PATH
 Add-DefaultPathItem "%USERPROFILE%\.cargo\bin"
@@ -33,7 +36,14 @@ rustup target add x86_64-pc-windows-gnu

 # Install common tools
 rustup component add rustfmt clippy
+if ($LASTEXITCODE -ne 0) {
+    throw "Rust component installation failed with exit code $LASTEXITCODE"
+}
+
 cargo install --locked bindgen-cli cbindgen cargo-audit cargo-outdated
+if ($LASTEXITCODE -ne 0) {
+    throw "Rust tools installation failed with exit code $LASTEXITCODE"
+}

 # Cleanup Cargo crates cache
 Remove-Item "${env:CARGO_HOME}\registry\*" -Recurse -Force
--- a/images/windows/scripts/build/Install-Stack.ps1
+++ b/images/windows/scripts/build/Install-Stack.ps1
@@ -14,22 +14,22 @@ $downloadUrl = Resolve-GithubReleaseAssetUrl `
    -UrlMatchPattern "stack-*-windows-x86_64.zip"

 Write-Host "Download stack archive"
-$StackToolcachePath = Join-Path $Env:AGENT_TOOLSDIRECTORY "stack\$version"
-$DestinationPath = Join-Path $StackToolcachePath "x64"
-$StackArchivePath = Invoke-DownloadWithRetry $downloadUrl
+$stackToolcachePath = Join-Path $env:AGENT_TOOLSDIRECTORY "stack\$version"
+$destinationPath = Join-Path $stackToolcachePath "x64"
+$stackArchivePath = Invoke-DownloadWithRetry $downloadUrl

 #region Supply chain security - Stack
 $externalHash = Get-ChecksumFromUrl -Type "SHA256" `
    -Url "$downloadUrl.sha256" `
    -FileName (Split-Path $downloadUrl -Leaf)
-Test-FileChecksum $StackArchivePath -ExpectedSHA256Sum $externalHash
+Test-FileChecksum $stackArchivePath -ExpectedSHA256Sum $externalHash
 #endregion

 Write-Host "Expand stack archive"
-Expand-7ZipArchive -Path $StackArchivePath -DestinationPath $DestinationPath
+Expand-7ZipArchive -Path $stackArchivePath -DestinationPath $destinationPath

-New-Item -Name "x64.complete" -Path $StackToolcachePath
+New-Item -Name "x64.complete" -Path $stackToolcachePath

-Add-MachinePathItem -PathItem $DestinationPath
+Add-MachinePathItem -PathItem $destinationPath

 Invoke-PesterTests -TestFile "Tools" -TestName "Stack"
--- a/images/windows/scripts/build/Install-Toolset.ps1
+++ b/images/windows/scripts/build/Install-Toolset.ps1
@@ -32,9 +32,8 @@ Function Install-Asset {
 }

 # Get toolcache content from toolset
-$ToolsToInstall = @("Python", "Node", "Go")
-
-$tools = Get-ToolsetContent | Select-Object -ExpandProperty toolcache | Where-Object { $ToolsToInstall -contains $_.Name }
+$toolsToInstall = @("Python", "Node", "Go")
+$tools = Get-ToolsetContent | Select-Object -ExpandProperty toolcache | Where-Object { $toolsToInstall -contains $_.Name }

 foreach ($tool in $tools) {
    # Get versions manifest for current tool
--- a/images/windows/scripts/build/Install-Vcpkg.ps1
+++ b/images/windows/scripts/build/Install-Vcpkg.ps1
@@ -11,7 +11,13 @@ git clone $Uri $InstallDir -q

 # Build and integrate vcpkg
 Invoke-Expression "$InstallDir\bootstrap-vcpkg.bat"
+if ($LASTEXITCODE -ne 0) {
+    throw "vcpkg bootstrap failed with exit code $LASTEXITCODE"
+}
 Invoke-Expression "$InstallDir\$VcpkgExecPath integrate install"
+if ($LASTEXITCODE -ne 0) {
+    throw "vcpkg integration failed with exit code $LASTEXITCODE"
+}

 # Add vcpkg to system environment
 Add-MachinePathItem $InstallDir
--- a/images/windows/scripts/build/Install-WindowsFeatures.ps1
+++ b/images/windows/scripts/build/Install-WindowsFeatures.ps1
@@ -13,12 +13,12 @@ foreach ($feature in $windowsFeatures) {
        $resultSuccess = $?
    } else {
        Write-Host "Activating Windows Feature '$($feature.name)'..."
-        $Arguments = @{
+        $arguments = @{
            Name                   = $feature.name
            IncludeAllSubFeature   = [System.Convert]::ToBoolean($feature.includeAllSubFeatures)
            IncludeManagementTools = [System.Convert]::ToBoolean($feature.includeManagementTools)
        }
-        $result = Install-WindowsFeature @Arguments
+        $result = Install-WindowsFeature @arguments

        $resultSuccess = $result.Success
    }
@@ -33,3 +33,6 @@ foreach ($feature in $windowsFeatures) {
 # it improves Android emulator launch on Windows Server
 # https://learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/manage/manage-hyper-v-scheduler-types
 bcdedit /set hypervisorschedulertype root
+if ($LASTEXITCODE -ne 0) {
+    throw "Failed to set hypervisorschedulertype to root"
+}
--- a/images/windows/scripts/docs-gen/SoftwareReport.Tools.psm1
+++ b/images/windows/scripts/docs-gen/SoftwareReport.Tools.psm1
@@ -43,7 +43,7 @@ function Get-CMakeVersion {
 }

 function Get-CodeQLBundleVersion {
-    $CodeQLVersionsWildcard = Join-Path $Env:AGENT_TOOLSDIRECTORY -ChildPath "CodeQL" | Join-Path -ChildPath "*"
+    $CodeQLVersionsWildcard = Join-Path $env:AGENT_TOOLSDIRECTORY -ChildPath "CodeQL" | Join-Path -ChildPath "*"
    $CodeQLVersionPath = Get-ChildItem $CodeQLVersionsWildcard | Select-Object -First 1 -Expand FullName
    $CodeQLPath = Join-Path $CodeQLVersionPath -ChildPath "x64" | Join-Path -ChildPath "codeql" | Join-Path -ChildPath "codeql.exe"
    $CodeQLVersion = & $CodeQLPath version --quiet
@@ -92,7 +92,7 @@ function Get-JQVersion {
 }

 function Get-KubectlVersion {
-    $kubectlVersion = (kubectl version --client --output=json | ConvertFrom-Json).clientVersion.gitVersion.Replace('v','')
+    $kubectlVersion = (kubectl version --client --output=json | ConvertFrom-Json).clientVersion.gitVersion.Replace('v', '')
    return $kubectlVersion
 }

@@ -138,7 +138,7 @@ function Get-MercurialVersion {
 }

 function Get-NSISVersion {
-    $nsisVersion =  &"c:\Program Files (x86)\NSIS\makensis.exe" "/Version"
+    $nsisVersion = & "c:\Program Files (x86)\NSIS\makensis.exe" "/Version"
    return $nsisVersion.TrimStart("v")
 }

--- a/images/windows/scripts/helpers/InstallHelpers.ps1
+++ b/images/windows/scripts/helpers/InstallHelpers.ps1
@@ -995,7 +995,7 @@ function Update-Environment {
    $pathItems = $locations | ForEach-Object { 
        (Get-Item $_).GetValue('PATH').Split(';') 
    } | Select-Object -Unique
-    $Env:PATH = $pathItems -join ';'
+    $env:PATH = $pathItems -join ';'

    # Update other variables
    $locations | ForEach-Object {
--- a/images/windows/scripts/tests/Databases.Tests.ps1
+++ b/images/windows/scripts/tests/Databases.Tests.ps1
@@ -5,7 +5,7 @@ Describe "MongoDB" {
            @{ ToolName = "mongod" }
        ) {
            $toolsetVersion = (Get-ToolsetContent).mongodb.version
-            (&$ToolName --version)[2].Split('"')[-2] | Should -BeLike "$toolsetVersion*"
+            (& $ToolName --version)[2].Split('"')[-2] | Should -BeLike "$toolsetVersion*"
        }
    }

@@ -29,9 +29,9 @@ Describe "MongoDB" {

 Describe "PostgreSQL" {
    $psqlTests = @(
-        @{envVar = "PGROOT"; pgPath = Get-EnvironmentVariable "PGROOT"}
-        @{envVar = "PGBIN"; pgPath = Get-EnvironmentVariable "PGBIN"}
-        @{envVar = "PGDATA"; pgPath = Get-EnvironmentVariable "PGDATA"}
+        @{envVar = "PGROOT"; pgPath = Get-EnvironmentVariable "PGROOT" }
+        @{envVar = "PGBIN"; pgPath = Get-EnvironmentVariable "PGBIN" }
+        @{envVar = "PGDATA"; pgPath = Get-EnvironmentVariable "PGDATA" }
    )

    Context "Environment variable" {
@@ -75,9 +75,9 @@ Describe "PostgreSQL" {
        It "PostgreSQL version should correspond to the version in the toolset" {
            $toolsetVersion = (Get-ToolsetContent).postgresql.version
            # Client version
-            (&$Env:PGBIN\psql --version).split()[-1] | Should -BeLike "$toolsetVersion*"
+            (& $env:PGBIN\psql --version).split()[-1] | Should -BeLike "$toolsetVersion*"
            # Server version
-            (&$Env:PGBIN\pg_config --version).split()[-1] | Should -BeLike "$toolsetVersion*"
+            (& $env:PGBIN\pg_config --version).split()[-1] | Should -BeLike "$toolsetVersion*"
        }
    }
 }
--- a/images/windows/scripts/tests/Tools.Tests.ps1
+++ b/images/windows/scripts/tests/Tools.Tests.ps1
@@ -23,19 +23,19 @@ Describe "Bazel" {

 Describe "CodeQL Bundle" {
    It "Single distribution installed" {
-        $CodeQLVersionsWildcard = Join-Path $Env:AGENT_TOOLSDIRECTORY -ChildPath "CodeQL" | Join-Path -ChildPath "*"
+        $CodeQLVersionsWildcard = Join-Path $env:AGENT_TOOLSDIRECTORY -ChildPath "CodeQL" | Join-Path -ChildPath "*"
        $CodeQLVersionPath = Get-ChildItem $CodeQLVersionsWildcard | Should -HaveCount 1
    }

    It "Contains CodeQL executable" {
-        $CodeQLVersionsWildcard = Join-Path $Env:AGENT_TOOLSDIRECTORY -ChildPath "CodeQL" | Join-Path -ChildPath "*"
+        $CodeQLVersionsWildcard = Join-Path $env:AGENT_TOOLSDIRECTORY -ChildPath "CodeQL" | Join-Path -ChildPath "*"
        $CodeQLVersionPath = Get-ChildItem $CodeQLVersionsWildcard | Sort-Object -Descending | Select-Object -First 1 -Expand FullName
        $CodeQLPath = Join-Path $CodeQLVersionPath -ChildPath "x64" | Join-Path -ChildPath "codeql" | Join-Path -ChildPath "codeql.exe"
        "$CodeQLPath version --quiet" | Should -ReturnZeroExitCode
    }

    It "Contains CodeQL packs" {
-        $CodeQLVersionsWildcard = Join-Path $Env:AGENT_TOOLSDIRECTORY -ChildPath "CodeQL" | Join-Path -ChildPath "*"
+        $CodeQLVersionsWildcard = Join-Path $env:AGENT_TOOLSDIRECTORY -ChildPath "CodeQL" | Join-Path -ChildPath "*"
        $CodeQLVersionPath = Get-ChildItem $CodeQLVersionsWildcard | Sort-Object -Descending | Select-Object -First 1 -Expand FullName
        $CodeQLPacksPath = Join-Path $CodeQLVersionPath -ChildPath "x64" | Join-Path -ChildPath "codeql" | Join-Path -ChildPath "qlpacks"
        $CodeQLPacksPath | Should -Exist
--- a/images/windows/scripts/tests/WindowsFeatures.Tests.ps1
+++ b/images/windows/scripts/tests/WindowsFeatures.Tests.ps1
@@ -26,7 +26,7 @@ Describe "DiskSpace" {

 Describe "DynamicPorts" {
    It "Test TCP dynamicport start=49152 num=16384" {
-        $tcpPorts = Get-NetTCPSetting | Where-Object {$_.SettingName -ne "Automatic"} | Where-Object {
+        $tcpPorts = Get-NetTCPSetting | Where-Object { $_.SettingName -ne "Automatic" } | Where-Object {
            $_.DynamicPortRangeStartPort -ne 49152 -or $_.DynamicPortRangeNumberOfPorts -ne 16384
        }

@@ -52,7 +52,7 @@ Describe "GDIProcessHandleQuota" {
 }

 Describe "Test Signed Drivers" {
-    It "bcdedit testsigning should be Yes"{
+    It "bcdedit testsigning should be Yes" {
        "$(bcdedit)" | Should -Match "testsigning\s+Yes"
    }
 }
--- a/images/windows/templates/windows-2019.json
+++ b/images/windows/templates/windows-2019.json
@@ -145,7 +145,6 @@
                "IMAGE_VERSION={{user `image_version`}}",
                "IMAGE_OS={{user `image_os`}}",
                "AGENT_TOOLSDIRECTORY={{user `agent_tools_directory`}}",
-                "ACTIONS_RUNNER_ACTION_ARCHIVE_CACHE=C:\\actionarchivecache\\",
                "IMAGEDATA_FILE={{user `imagedata_file`}}"
            ],
            "scripts": [
@@ -360,7 +359,7 @@
        {
            "type": "powershell",
            "inline": [
-                "if( Test-Path $Env:SystemRoot\\System32\\Sysprep\\unattend.xml ){ rm $Env:SystemRoot\\System32\\Sysprep\\unattend.xml -Force}",
+                "if( Test-Path $env:SystemRoot\\System32\\Sysprep\\unattend.xml ){ rm $env:SystemRoot\\System32\\Sysprep\\unattend.xml -Force}",
                "& $env:SystemRoot\\System32\\Sysprep\\Sysprep.exe /oobe /generalize /quiet /quit",
                "while($true) { $imageState = Get-ItemProperty HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\State | Select ImageState; if($imageState.ImageState -ne 'IMAGE_STATE_GENERALIZE_RESEAL_TO_OOBE') { Write-Output $imageState.ImageState; Start-Sleep -s 10 } else { break } }"
            ]
--- a/images/windows/templates/windows-2022.json
+++ b/images/windows/templates/windows-2022.json
@@ -129,7 +129,6 @@
                "IMAGE_VERSION={{user `image_version`}}",
                "IMAGE_OS={{user `image_os`}}",
                "AGENT_TOOLSDIRECTORY={{user `agent_tools_directory`}}",
-                "ACTIONS_RUNNER_ACTION_ARCHIVE_CACHE=C:\\actionarchivecache\\",
                "IMAGEDATA_FILE={{user `imagedata_file`}}"
            ],
            "scripts": [
@@ -347,7 +346,7 @@
        {
            "type": "powershell",
            "inline": [
-                "if( Test-Path $Env:SystemRoot\\System32\\Sysprep\\unattend.xml ){ rm $Env:SystemRoot\\System32\\Sysprep\\unattend.xml -Force}",
+                "if( Test-Path $env:SystemRoot\\System32\\Sysprep\\unattend.xml ){ rm $env:SystemRoot\\System32\\Sysprep\\unattend.xml -Force}",
                "& $env:SystemRoot\\System32\\Sysprep\\Sysprep.exe /oobe /generalize /mode:vm /quiet /quit",
                "while($true) { $imageState = Get-ItemProperty HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\State | Select ImageState; if($imageState.ImageState -ne 'IMAGE_STATE_GENERALIZE_RESEAL_TO_OOBE') { Write-Output $imageState.ImageState; Start-Sleep -s 10 } else { break } }"
            ]