You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
TLDR; Current telemetry consent store / policy key tests use the debug build with a fake environment. This test will actually mutate the machine using the release build of MXC. Runs during build in CI.
--
The telemetry consent store and policy key both have debug-only overrides gated on cfg(any(test, all(feature = "test-support", debug_assertions))). A shipped binary resolves the store through SHGetKnownFolderPath and reads policy from HKLM, and that release-only shape had no coverage. The existing smoke tests refuse release binaries, and cargo test --release still compiles the override branch in because cfg(test) is on.
Adds tests/scripts/run_telemetry_consent_release_test.ps1, which drives a release wxc-exec.exe against the real per-user store and the real HKLM policy key. It covers CLI exit codes, fresh-store resolution, fail-closed behavior on presenter EOF, corrupt and stale-prompt records, and the policy ceiling. It also sets both override environment variables and asserts the release binary ignores them, which is the property the cfg gating exists for.
Wired into the Windows build job, which already produces the release executor, so it adds about a second and no extra build time. The test mutates the machine, so it requires -AcceptRealMachineMutation and runs only on the ephemeral GitHub-hosted runners that job declares. Prior state is backed up and restored, and -RequirePolicyCeiling makes CI fail rather than silently skip the HKLM section if the runner ever stops being elevated.
Also enables the two existing telemetry smoke tests on arm64. They were gated to x64 with no arch-specific reason: there is no target_arch cfg in the telemetry code, and logman and tracerpt are native on ARM64. While enabling them, fixed the ETW test printing a blank exit code, since Start-Process -PassThru does not retain the process handle unless it is dereferenced first.
New release-path test passed on both windows-2025 and windows-11-arm, with all seven checks reporting and the HKLM section running elevated rather than skipping.
Both existing telemetry smoke tests pass on arm64, the consent one on a native ARM64 dev box and the ETW one elevated.
Verified the override assertion actually discriminates: the environment variable names match the constants in consent.rs and policy.rs, and the owner-PID check requires the direct parent, which the script satisfies. A debug binary would honor the override, so the release result is meaningful.
Confirmed the script leaves the consent store and the HKLM value as it found them.
The consent store location and policy key both have a test-only override
branch gated on `any(test, all(feature = "test-support", debug_assertions))`,
so the shipped release shape -- real %LocalAppData% store and real HKLM
policy key -- is never executed. `cargo test --release` does not close this:
`cfg(test)` is on there, so the compiled function still contains the override.
Add a test that drives a release wxc-exec.exe through the CLI and asserts the
overrides are inert: it seeds a temp store saying granted and a registry key
saying blocked, sets both override variables, and requires the binary to
ignore them. It also covers real store creation and atomic replace, corruption
and stale-prompt recovery, piped-EOF fail-closed, and the HKLM policy ceiling.
Because it mutates real machine state it refuses to run without
-AcceptRealMachineMutation, and refuses debug binaries outright. The temporary
workflow runs it on ephemeral GitHub-hosted runners only and asserts
RUNNER_ENVIRONMENT, since self-hosted runners also set GITHUB_ACTIONS.
Refs #691
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.
Elliot (theelliotm)
changed the title
Cover the telemetry consent path in release builds, and enable the telemetry smoke tests on arm64
Test the telemetry consent path in release builds, and enable the telemetry smoke tests on arm64
Sep 23, 2026
The ambient AllowTelemetry value is backed up but never removed before tests that require policy = unrestricted. Any machine already configured with 0, 1, or 3 fails Test-FreshStore for reasons unrelated to the release path. Clear an existing value after backing it up (or reject a non-elevated run that cannot do so), then restore it in finally.
Preserve original registry value kind during policy restore
This restores every pre-existing policy value as REG_DWORD, but wrong-type values are explicitly valid fail-closed input for this subsystem. For example, a pre-existing REG_SZ is converted (or cleanup throws), so the script does not restore the machine state it backed up. Record the original RegistryValueKind and restore the value with that exact kind.
Remove-RealConsentFile leaves a pre-existing withdrawal marker in place. Once that marker is at least five seconds old, the first status call performs withdrawal recovery by writing a denied record, so this “fresh store” check fails instead of exercising the absent-store path. The marker is already backed up for restoration; remove it as part of this reset.
The test backs up an existing AllowTelemetry value but never clears it before running checks that require policy == 'unrestricted'. On a machine already configured with either 0 or 3, the fresh/lifecycle assertions fail before the policy-ceiling section, despite the script claiming to preserve and restore prior state. Normalize the backed-up value while elevated, and fail early with a clear prerequisite when a non-elevated session cannot do so.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Elliot (theelliotm)
changed the title
📖 Description
TLDR; Current telemetry consent store / policy key tests use the debug build with a fake environment. This test will actually mutate the machine using the release build of MXC. Runs during build in CI.
--
The telemetry consent store and policy key both have debug-only overrides gated on
cfg(any(test, all(feature = "test-support", debug_assertions))). A shipped binary resolves the store throughSHGetKnownFolderPathand reads policy fromHKLM, and that release-only shape had no coverage. The existing smoke tests refuse release binaries, andcargo test --releasestill compiles the override branch in becausecfg(test)is on.Adds
tests/scripts/run_telemetry_consent_release_test.ps1, which drives a releasewxc-exec.exeagainst the real per-user store and the real HKLM policy key. It covers CLI exit codes, fresh-store resolution, fail-closed behavior on presenter EOF, corrupt and stale-prompt records, and the policy ceiling. It also sets both override environment variables and asserts the release binary ignores them, which is the property the cfg gating exists for.Wired into the Windows build job, which already produces the release executor, so it adds about a second and no extra build time. The test mutates the machine, so it requires
-AcceptRealMachineMutationand runs only on the ephemeral GitHub-hosted runners that job declares. Prior state is backed up and restored, and-RequirePolicyCeilingmakes CI fail rather than silently skip the HKLM section if the runner ever stops being elevated.Also enables the two existing telemetry smoke tests on arm64. They were gated to x64 with no arch-specific reason: there is no
target_archcfg in the telemetry code, andlogmanandtracerptare native on ARM64. While enabling them, fixed the ETW test printing a blank exit code, sinceStart-Process -PassThrudoes not retain the process handle unless it is dereferenced first.🔗 References
Resolves #691
🔍 Validation
windows-2025andwindows-11-arm, with all seven checks reporting and the HKLM section running elevated rather than skipping.consent.rsandpolicy.rs, and the owner-PID check requires the direct parent, which the script satisfies. A debug binary would honor the override, so the release result is meaningful.✅ Checklist
Cargo.lock, thedependency-feed-checkcheck passes (see docs/pull-requests.md)📋 Issue Type
Microsoft Reviewers: Open in CodeFlow