[johnmccrae]

Description

Fix: Windows upgrade rollback never triggered on install script failure

The Windows upgrade path in [execute_install_script] wraps the install script call in a PowerShell try/catch block intended to roll back to the backup directory if installation fails. However, PowerShell's try/catch only catches terminating errors — external programs such as msiexec.exe signal failure via a non-zero exit code, which is a non-terminating condition. As a result, a failed installation silently fell through the catch block, the backup was never restored, and the node was left in an indeterminate state with no Chef Infra Client installed.

Changes:

Reset $LASTEXITCODE to $null immediately before invoking the install script. This prevents a stale exit code left by the preceding [uninstall_if_necessary] block (which may itself call msiexec /x) from causing a false positive.
After the install script runs, explicitly check $LASTEXITCODE and throw a terminating error if it is non-zero. This ensures the existing catch block fires correctly, the backup directory is moved back to the install path, and the run exits with code 100 as designed.

This mirrors the behaviour of the non-Windows code path, which already checks [upgrade_command.exitstatus != 0] and raises on failure.

A comment has also been added to [default_spec.rb] noting that this Windows-specific behaviour requires a Windows Test Kitchen suite for full integration coverage, as ChefSpec cannot exercise the [run_action(:run)] path.

Version checking to moved to the chef_client_updater_helper.rb for two reasons, both driven by testability:

The LWRP class barrier: Methods defined directly on the old-style LWRP provider (default.rb) live on the auto-generated subclass Chef::Provider::ChefClientUpdater, not on Chef::Provider itself. That means allow_any_instance_of(Chef::Provider) in ChefSpec won't stub them — the stub simply never fires. Moving the method into ChefClientUpdaterHelper (a plain module) means it can be stubbed with allow_any_instance_of(ChefClientUpdaterHelper), which works correctly.

Direct unit testing: Once it's in the helper module, chef_client_updater_helper_spec.rb can test desired_version in isolation — including the new license_id branch and the X.Y.Z fast-path — without spinning up a full ChefSpec runner or making real HTTP calls to mixlib-install's API.

Issues Resolved

Check List

• All tests pass. See https://github.com/chef-cookbooks/community_cookbook_documentation/blob/master/TESTING.MD
• New functionality includes testing.
• New functionality has been documented in the README if applicable
• All commits have been signed for the Developer Certificate of Origin. See https://github.com/chef-cookbooks/community_cookbook_documentation/blob/master/CONTRIBUTING.MD