Skip to content

ci: add windows-latest build job so Windows compile/link breaks fail PRs #6610

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
proggeramlug merged 1 commit into from
Jul 19, 2026
Merged

ci: add windows-latest build job so Windows compile/link breaks fail PRs #6610

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 42 additions & 0 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -598,6 +598,48 @@ jobs:
done <<< "$SUITES"
exit "$status"

# ---------------------------------------------------------------------------
# Windows build gate
#
# Exists because Windows-only compile/link breaks previously shipped to main
# unseen — every other job runs on ubuntu/macos. Two real examples that
# landed through green required checks: an MSVC-only rustc error (E0308 on
# the `ExitProcess` extern in crates/perry-runtime/src/process/env_misc.rs)
# and an MSVC-only link error (LNK2019: `js_crypto_ed25519_verify`
# unresolved when linking perry.exe — Unix linkers dead-strip the unused
# extern, link.exe errors). Building `perry` LINKS perry.exe, so the LNK2019
# class is caught here, not just rustc errors. The perry-dev profile
# (opt-level 1, no LTO) keeps a cold Windows build inside a PR-sized budget;
# --release would be far too slow for per-PR CI.
# ---------------------------------------------------------------------------
windows-build:
runs-on: windows-latest
# Cold Windows builds are slow, and this workflow never runs on pushes to
# main, so rust-cache only saves on the nightly cron (github.ref is
# refs/heads/main for `schedule`) — PR runs after a quiet night can be
# near-cold. 75 leaves headroom over a fully cold build while still
# bounding a true hang (same reasoning as conformance-smoke's bump: a
# timeout on a required-path job is a deterministic PR blocker).
timeout-minutes: 75
steps:
- uses: actions/checkout@v7

@coderabbitai coderabbitai Bot Jul 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect the relevant workflow section around the reported line.
sed -n '600,650p' .github/workflows/test.yml

# Show the workflow triggers and top-level permissions if present.
python3 - <<'PY'
from pathlib import Path
import re
p = Path('.github/workflows/test.yml')
text = p.read_text()
for key in ['on:', 'permissions:']:
    m = re.search(rf'(^\s*{key}.*$)', text, re.M)
    print(f"\n== first {key} line ==")
    print(m.group(1) if m else 'not found')
PY

Repository: PerryTS/perry

Length of output: 3005

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Map all uses of actions/checkout in workflows to see if this repo consistently disables credentials.
rg -n "actions/checkout@v7|persist-credentials" .github/workflows -S

Repository: PerryTS/perry

Length of output: 3401

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Read the workflow header to inspect triggers and permissions.
sed -n '1,120p' .github/workflows/test.yml

# Inspect the exact job block around the reported checkout step.
sed -n '610,640p' .github/workflows/test.yml

Repository: PerryTS/perry

Length of output: 6956

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Find the event names used by this workflow.
rg -n "^\s*(pull_request|pull_request_target|push|schedule|workflow_dispatch|workflow_call)\b" .github/workflows/test.yml

# Show the job name that contains the reported checkout step.
python3 - <<'PY'
from pathlib import Path
text = Path('.github/workflows/test.yml').read_text().splitlines()
for i in range(620, 633):
    print(f"{i+1}: {text[i]}")
PY

Repository: PerryTS/perry

Length of output: 735

🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '1,90p' .github/workflows/test.yml

Repository: PerryTS/perry

Length of output: 3980

🏁 Script executed:

#!/bin/bash
set -euo pipefail

nl -ba .github/workflows/test.yml | sed -n '618,633p'

Repository: PerryTS/perry

Length of output: 191

Disable checkout credential persistence for the PR build job.

actions/checkout writes ${{ github.token }} into the local Git config by default. Since this job runs Cargo build scripts and procedural macros on pull requests, set persist-credentials: false so untrusted build code can’t reuse the token.

🧰 Tools
🪛 zizmor (1.26.1)

[warning] 625-625: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/test.yml at line 625, Update the actions/checkout step in
the PR build job to set persist-credentials to false, preventing the GitHub
token from being stored in local Git configuration while leaving the existing
checkout behavior unchanged.

Source: Linters/SAST tools


- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable

- uses: Swatinem/rust-cache@v2
with:
shared-key: "${{ runner.os }}-perry"
save-if: ${{ github.ref == 'refs/heads/main' }}

# perry-dev (see Cargo.toml [profile.perry-dev]) trades peak optimization
# for build speed. The package set covers the compiler binary (link
# gate), the runtime/stdlib pair (the usual source of cfg(windows)
# externs), and both Windows UI crates — the ones cargo-test's ubuntu
# runner must exclude and therefore never compiles.
- name: Build compiler + runtime + Windows UI crates (perry-dev)
run: cargo build --profile perry-dev -p perry -p perry-runtime -p perry-stdlib -p perry-ui-windows -p perry-ui-windows-winui

# ---------------------------------------------------------------------------
# GC write-barrier stress (optional / non-blocking)
#
Expand Down
Loading