Running PSScriptAnalyzer on nanoserver

[mlocati]

PSScriptAnalyzer does not currently run on nanoserver.

Try this command on a Windows machine with Docker installed (and configured to run Windows containers):

docker run --rm --tty microsoft/nanoserver powershell.exe "Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force | Out-Null; Install-Module PSScriptAnalyzer -Force; Get-Module -ListAvailable | Where-Object { $_.Name -eq 'PSScriptAnalyzer' }; Set-Content -Value 'Write-Output ''test''' -Path test.ps1; Invoke-ScriptAnalyzer -Path test.ps1"

The output will be

    Directory: C:\Program Files\WindowsPowerShell\Modules


ModuleType Version    Name                                ExportedCommands
---------- -------    ----                                ----------------
Script     1.16.1     PSScriptAnalyzer                    {Get-ScriptAnalyzerRule, Invoke-ScriptAnalyzer, Invoke-Formatter}
Invoke-ScriptAnalyzer : Could not load type 'System.Management.Automation.SemanticVersion' from assembly 'System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35'.
At line:1 char:257
+ ... Output ''test''' -Path test.ps1; Invoke-ScriptAnalyzer -Path test.ps1
+                                      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Invoke-ScriptAnalyzer], TypeLoadException
    + FullyQualifiedErrorId : System.TypeLoadException,Microsoft.Windows.PowerShell.ScriptAnalyzer.Commands.InvokeScriptAnalyzerCommand

The only relevant info I found about running PSScriptAnalyzer on NanoServer is located at https://github.com/PowerShell/PSScriptAnalyzer/blob/NanoServer/ExtraStepsSettingUpNanoServerScriptAnalyzer.md , but it seems quite outdated and unmaintained.

[bergmeister]

Thank you for reporting this.
Without having investigated it yet, there is a chance that this might be already fixed or at least improved in the upcoming release of 1.17 (hopefully next week) because the references to SMA are now properly configured, therefore I'd like to wait for the results with the new release if that is OK with you? I could already give you a preview (i.e. unsigned) version of it if you want?

By looking at your referenced document, I do not think/hope that you need to compile PSSA yourself but the instructions say so.

Can you also print the output of $PSVersionTable please? If I remember correctly, then NanoServer has a custom version 6 of Windows PowerShell in it. I know there is custom code in PSSA for Windows PowerShell vs PowerShell Core and I imagine it thinks it is a core version because of the 6 in the version and then calls the wrong api...

Out of interest: Are you using PSSA in NanoServer as part of testing phase of your CI process or is there a different reason why you need to use it on NanoServer?

[mlocati]

Without having investigated it yet, there is a chance that this might be already fixed or at least improved in the upcoming release of 1.17 (hopefully next week) because the references to SMA are now properly configured, therefore I'd like to wait for the results with the new release if that is OK with you? I could already give you a preview (i.e. unsigned) version of it if you want?

No hurry at all... I'm going to use PSScriptAnalyzer to run Appveyor tests for a package I'm developing.
I'm planning to run these tests both on the default Appveyor Windows Server and in a Docker image with nanoserver. Of course, for the time being I can skip the PSScriptAnalyzer tests on nanoserver (since they are executed on the Windows Server).

Can you also print the output of $PSVersionTable please? If I remember correctly, then NanoServer has a custom version 6 of Windows PowerShell in it.

Sure! Here it is:

C:\>docker run --rm --tty microsoft/nanoserver powershell.exe $PSVersionTable
Name                           Value
----                           -----
PSRemotingProtocolVersion      2.3
BuildVersion                   10.0.14393.1000
SerializationVersion           1.1.0.1
WSManStackVersion              3.0
PSEdition                      Core
CLRVersion
PSVersion                      5.1.14393.1000
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}

[mlocati]

PS:

C:\>docker images -a
REPOSITORY             TAG                 IMAGE ID            CREATED             SIZE
microsoft/nanoserver   latest              353592ac9faa        3 weeks ago         1.11GB

C:\>docker pull microsoft/nanoserver
Using default tag: latest
latest: Pulling from microsoft/nanoserver
Digest: sha256:59558bd57c0d14a4df5b827a676fb061abacefebfa2089038f018cf9eea17ecb
Status: Image is up to date for microsoft/nanoserver:latest

[bergmeister]

Thanks. Aha, the PSVersionTable reveals that it is actually a (custom pre-release) version of PowerShell Core but of version 5.1 (really confusing versioning but I guess the PowerShell team was asked to quickly give out something that works on NanoServer..).
I will setup Docker on an Azure VM in the next days and play with it a bit to give you a more detailed answer/solution.

[bergmeister]

P.S. For the moment, I am not sure if PSSA is currently supported or supposed to work on NanoServer as-is since your referenced branch seems to be rather an old PoC. But anyway, I will try to make it work on it.

[mlocati]

Thank you, Christoph.

For the time being I just excluded PSSA from my tests on nanoserver (see https://ci.appveyor.com/project/mlocati/powershell-phpmanager/build/Build%2097 ).

[bergmeister]

Some minor updates, I can repro now (even when I use -Scope CurrentUser for installation, since some images have issues with not using that option) and the full stack trace is (using $error[0] | select *):

Exception             : System.TypeLoadException: Could not load type 'System.Management.Automation.SemanticVersion' from assembly
                        'System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35'.
                           at Microsoft.Windows.PowerShell.ScriptAnalyzer.PSVersionTable..ctor(Hashtable psVersionTable)
                           at Microsoft.Windows.PowerShell.ScriptAnalyzer.Helper.SetPSVersionTable(Hashtable psVersionTable)
                           at Microsoft.Windows.PowerShell.ScriptAnalyzer.Commands.InvokeScriptAnalyzerCommand.BeginProcessing()
                           at System.Management.Automation.Cmdlet.DoBeginProcessing()
                           at System.Management.Automation.CommandProcessorBase.DoBegin()

This is happening here because it seems that the SemanticVersion class is not present in this version of PowerShell Core (maybe hence why they used 5.1 as a version for it as it seems to be a stripped version of Windows PowerShell but running on .Net Core). One can also verify this using docker run --rm --tty microsoft/nanoserver powershell.exe "[System.Management.Automation.SemanticVersion]'1.2.3'", therefore the current version is definitely not compatible with the nanoserver image.
I was playing a bit around with the other Docker images and it seems the microsoft/powershell image (which has the latest version of PsCore) are only Linux images. Would that be a viable alternative to use that (since PSSA works on Linux) or the (bigger) microsoft/windowsservercore image before I start looking into fixing it? In the meantime a logged the following bug for the nanoserver-insider-powershell image: PowerShell/PowerShell#6826
For the moment what I tested and works is the windowsservercore image

docker run  --rm --tty microsoft/windowsservercore powershell "Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force | Out-Null; Install-Module PSScriptAnalyzer -Force; Get-Module -ListAvailable | Where-Object { $_.Name -eq 'PSScriptAnalyzer' }; Set-Content -Value 'Write-Output ''test''' -Path test.ps1; Invoke-ScriptAnalyzer -Path test.ps1"

Or alternatively in Linux mode the powershell image works as well:

docker run --rm --tty microsoft/powershell pwsh -c "Install-Module PSScriptAnalyzer -Force; Get-Module -ListAvailable | Where-Object { $_.Name -eq 'PSScriptAnalyzer' }; Set-Content -Value 'Write-Output ''test''' -Path test.ps1; Invoke-ScriptAnalyzer -Path test.ps1"

[mlocati]

I was playing a bit around with the other Docker images and it seems the microsoft/powershell image (which has the latest version of PsCore) are only Linux images. Would that be a viable alternative to use that (since PSSA works on Linux) or the (bigger) microsoft/windowsservercore image before I start looking into fixing it?

Not for me: the PSGallery package I'm developing is meant to work only on Windows (it's used to install/update/configure PHP on Windows).

[bergmeister]

Hmm, ok. For the moment, it seems you can only use it using the windowsservercore image on Windows but I will try to get NanoServer support in as well.

[bergmeister]

Note that I found that some of the docs on the PowerShell repo seem to be out of date as well. For example they refer to the microsoft\nanoserver-insider-powershell image, which hasn't been updated for 9 months. I found that the microsoft\powershell image has also other tags with the latest nanoserver images with the latest version of PowerShell Core. However, when trying those, I ran into other problems with bootstrapping the NuGet package provider and PowerShellGet...
I will keep you updated, but I imagine doing a volume mapping or just downloading PSSA via the REST Api of the PsGallery and then setting the $env:Psmodulepath should make it work then.
Can someone from the PowerShell team comment on the recommendation for a good image and best practices or known issues? Cc @SteveL-MSFT