Automated pipeline for building and optimizing Windows ISO images via GitHub Actions.
Combines UUP dump ISO assembly with Tiny11 optimization into a single workflow.
UUP dump API → Download UUP files → Build ISO → Tiny11 optimization → Upload artifact
(optional)
- UUP dump — fetches Windows update packages and builds a clean ISO
- Tiny11 — removes bloatware, applies registry tweaks, bypasses system requirements
- Fork this repository
- Go to Actions → Build Windows
- Select parameters and click Run workflow
- Download the ISO from Artifacts
| Input | Options | Default |
|---|---|---|
| Version | Windows 11 25H2, Beta, 26H1, Experimental, Future Platforms | Windows 11 25H2 |
| Architecture | x64, arm64 | x64 |
| Edition | Pro, Home | Pro |
| Language | 38 languages (ar-sa → zh-tw) | English (United States) |
| Revision | Optional build matching the selected version, for example 26300.8553 |
— |
| Input | Description | Default |
|---|---|---|
| ESD | Use ESD compression | false |
| NetFx3 | Add .NET Framework 3.5 | false |
| Tiny11 | Apply Tiny11 optimization | true |
| ISO test | Quickly validate the x64 ISO and verify Windows PE boot in QEMU | false |
| Full install test | Validate the ISO, install x64 Windows in QEMU, and audit the first boot | false |
When enabled, the built ISO is processed through Tiny11 which:
- Teams, OneDrive, Edge, Copilot, Recall
- Xbox Game Bar & Gaming Services
- Clipchamp, Paint 3D, 3D Viewer, Mixed Reality Portal
- Weather, News, Maps, Bing Search, Cortana
- Office Hub, Solitaire, Sticky Notes, To Do, and more
- TPM 2.0 / Secure Boot / CPU / RAM requirement bypass
- All telemetry endpoints disabled
- Sponsored apps and consumer features blocked
- OneDrive backup prompts disabled
- BitLocker encryption disabled
- Chat icon / Widgets / Cortana startup removed
- OOBE bypass (local account, no Microsoft account required)
- Additional app/capability/feature cleanup on first boot
- Privacy-focused defaults
Enable ISO test when manually starting Build Windows to run an optional test job after the ISO artifact is uploaded. The test:
- verifies the ISO boot files and x64 WIM/ESD metadata;
- runs
wimverifyagainstboot.wimandinstall.wimorinstall.esd; - validates a root
autounattend.xmlwhen present; - boots the ISO with UEFI in QEMU and waits up to 20 minutes for a Windows PE startup marker.
The boot test uses KVM when the runner exposes /dev/kvm and automatically falls back to TCG software emulation otherwise. Its answer file and startup marker are stored on a temporary raw FAT image; the guest signals startup over COM1, shuts down cleanly, and the runner reads the marker only after QEMU exits.
When Full install test is enabled, this separate Windows PE boot job is skipped. The full test performs the same structural and WIM/ESD checks first, then proceeds directly to installation, first boot, and audit. Selecting both checkboxes therefore does not download or test the ISO twice.
To test an existing image without rebuilding it, manually run Test Windows ISO from URL. Supply a direct HTTPS URL to the ISO and, optionally, its SHA256. A download page or a GitHub Actions artifact page is not a direct ISO URL. QEMU and WIM tools are installed only on the temporary Ubuntu runner.
Enable Full install test to perform a separate, opt-in integration test on an ephemeral Ubuntu runner. It first validates the ISO structure and WIM/ESD integrity without a redundant Windows PE boot, then requires KVM, creates a sparse 64 GiB virtual disk, installs image index 1 with a temporary CI answer-file overlay, boots the installed x64 system, runs the production FirstLogon.ps1, and returns a JSON audit report. The ISO and repository autounattend.xml are not modified.
When Tiny11 is enabled, the guest audit checks the setup logs, selected registry policies, disabled services and scheduled tasks, removed Appx packages, capabilities, optional features, and Edge/OneDrive paths. A success screenshot and compact logs are uploaded; the virtual disk is always deleted. The job frees unused SDKs only on the temporary GitHub runner and requires at least 25 GiB of free workspace before starting.
The URL workflow provides matching Full installation test and Tiny11 audit checkboxes. Structural validation always runs; when the full installation test is selected, the separate Windows PE boot is skipped even if its checkbox is also selected. Disable Tiny11 audit when testing an ISO that was not produced by this repository.
pwsh uup-dump-get-windows-iso.ps1 win11-25h2 c:/output -architecture x64 -edition pro -lang en-us -esd -netfx3Supported target keys:
| Target | UUP branch | Current UUP ring |
|---|---|---|
win11-25h2 |
26200.* |
Retail |
win11-beta |
26220.* |
WIS |
win11-26h1 |
28000.* |
Retail |
win11-experimental |
26300.* |
WIF |
win11-future-platforms |
Latest future platform build | Canary |
Use -revision with a full build number matching the selected target, such as -revision 26300.8553 for Experimental. For fixed branches, a suffix such as -revision 8553 is also accepted. Future Platforms requires the full build number because its major build changes over time.
# Option A: Pass ISO file path (auto-mounts)
.\scripts\tiny11maker-headless.ps1 -ISOPath "C:\path\to\windows.iso" -INDEX 1
# Option B: Pass mounted drive letter
.\scripts\tiny11maker-headless.ps1 -ISO E -INDEX 1
# With custom output path
.\scripts\tiny11maker-headless.ps1 -ISOPath "C:\path\to\windows.iso" -INDEX 1 -OutputPath "C:\output\optimized.iso"
Agent-facing documentation is available in AGENTS.md and .agents/:
.agents/README.md— overview and operating rules.agents/repository-map.md— file responsibilities and generated artifacts.agents/workflow.md— GitHub Actions pipeline notes.agents/local-runbook.md— local commands, validation, and safety notes
windows-iso-builder/
├── .agents/
│ ├── README.md # Agent docs entry point
│ ├── local-runbook.md # Local validation and safety notes
│ ├── repository-map.md # File ownership map
│ └── workflow.md # GitHub Actions pipeline notes
├── .github/workflows/
│ ├── build.yml # Build and optional ISO test workflow
│ └── test-iso-url.yml # Test an existing ISO from an HTTPS URL
├── scripts/
│ ├── test-windows-iso.ps1 # CI-only ISO and Windows PE smoke test
│ ├── test-windows-install.ps1 # CI-only full installation orchestrator
│ ├── test-installed-windows.ps1 # In-guest installed-state audit
│ └── tiny11maker-headless.ps1 # Tiny11 optimizer
├── AGENTS.md # Root pointer for IDE/CLI agents
├── uup-dump-get-windows-iso.ps1 # UUP dump ISO builder
├── CustomAppsList.txt # UUP dump app selection
├── autounattend.xml # OOBE bypass & post-install
├── .gitignore
├── README.md
└── LICENSE
| Requirement | Minimum | Recommended |
|---|---|---|
| OS | Windows 10 | Windows 11 |
| PowerShell | 5.1 | 7.0+ |
| RAM | 8GB | 16GB+ |
| Free Disk | 30GB | 50GB+ |
| Permissions | Administrator | Administrator |
System requirements are bypassed:
- Any x64 processor
- 1GB+ RAM (2GB+ recommended)
- 10GB+ storage
- No TPM / Secure Boot required
- UUP dump: uupdump.net / source
- Tiny11 builder: ntdevlabs/tiny11builder
- Tiny11 headless: kelexine
This tool is provided "as is" without warranty. You must have a valid Windows license. Use at your own risk.