From c0236bed2d41206cca4ef021e757c3d43701fbd8 Mon Sep 17 00:00:00 2001 From: Kris Hicks Date: Fri, 23 Oct 2026 12:12:43 -0700 Subject: [PATCH 1/2] ci(windows): run Windows MSVC tests on every PR and seed the cache from main Prior to this change, the Windows MSVC lint and test job ran only on pull-request mirrors labeled test:windows. Most PRs never ran it, and main broke on Windows across five PRs before an unrelated labeled PR exposed 15 failing tests (#4861). The job also ran cold every time: the cache-seed job ran only on pushes to the windows branch, and GitHub scopes caches by branch, so pull-request mirrors could never restore that cache. Rust cache hits were 0% and each run took about 40 minutes. Now, every pull-request mirror runs the Windows lint and test job without a label. Pushes to main run the cache-seed job, which reports failures normally there, so a Windows break on main shows up within one merge. Main runs are not cancelled by later pushes, so each seed finishes. Pull-request runs restore the main cache but no longer save their own, since no other branch can restore it and saving it only evicts the main cache. Release-binary builds stay on the windows branch. The checks remain non-required for merging. CI.md, the Windows build skill, the principal engineer reviewer agent, and the gator gate skill no longer refer to the test:windows label. Signed-off-by: Kris Hicks --- .../build-openshell-mxc-windows/SKILL.md | 20 ++++++++--------- .claude/agents/principal-engineer-reviewer.md | 2 +- .github/workflows/windows-msvc.yml | 22 +++++++++++-------- CI.md | 11 +++++----- .../gator/bin/review_feedback_ledger_test.sh | 4 ++-- .../agents/gator/skills/gator-gate/SKILL.md | 4 ++-- 6 files changed, 34 insertions(+), 29 deletions(-) diff --git a/.agents/skills/build-openshell-mxc-windows/SKILL.md b/.agents/skills/build-openshell-mxc-windows/SKILL.md index eef3b009ea..e006f06ad1 100644 --- a/.agents/skills/build-openshell-mxc-windows/SKILL.md +++ b/.agents/skills/build-openshell-mxc-windows/SKILL.md @@ -204,16 +204,16 @@ order: The GitHub Actions jobs layer architecture-specific `Swatinem/rust-cache` entries for Cargo registry and dependency target artifacts with sccache's GHA backend for cacheable Rust compiler outputs. Failed runs also save their usable -dependency artifacts. Pull-request mirrors labeled `test:windows` run Clippy for the -Windows-supported workspace and e2e crates plus Rust tests. Pushes to `windows` and -manual dispatches on that branch run the same lint and test commands in a cache-seed job, -followed by a dependent release-binary build job. The seed and PR jobs use the -same cache namespaces, but pull-request mirrors cannot restore the -`windows` branch cache because GitHub scopes caches by branch. Merge queues do -not run this workflow. Release-branch seed -and build jobs use job-level `continue-on-error: true`; opt-in PR jobs report -failures normally. Applying the label alone does not start a run: re-run all -jobs in the current mirror push run, or push a new mirrored commit. The binaries are not uploaded or published. +dependency artifacts. Every pull-request mirror runs Clippy for the +Windows-supported workspace and e2e crates plus Rust tests. Pushes to `main` and +`windows` run the same lint and test commands in a cache-seed job; `windows` +pushes and manual dispatches on that branch follow it with a dependent +release-binary build job. GitHub scopes caches by branch, so pull-request +mirrors restore the `main` cache and do not save their own. `main` runs are not +cancelled by later pushes, so each seed finishes. Merge queues do not run this +workflow. Release-branch seed and build jobs use job-level +`continue-on-error: true`; `main` seed and PR jobs report failures normally. The +binaries are not uploaded or published. The ARM64 check/build steps in this x64-host contract are cross-builds. The wrapper discovers and adds host-native LLVM and Ninja to `PATH`, requires the diff --git a/.claude/agents/principal-engineer-reviewer.md b/.claude/agents/principal-engineer-reviewer.md index f944fbf7af..63697d5302 100644 --- a/.claude/agents/principal-engineer-reviewer.md +++ b/.claude/agents/principal-engineer-reviewer.md @@ -61,7 +61,7 @@ When reviewing code or diffs: 6. When suggesting a change, show the concrete fix — don't just describe it. 7. If something is good, say so briefly. Positive signal is useful too. 8. When behavior, commands, or development workflows change, consult the `sync-agent-infra` maintenance map and verify that related skills were updated. Apply its full consistency checklist when the changes add, remove, or rename skills or crates; change workflow relationships or skill coverage; modify issue or PR templates; or change agent cross-references. Report missing companion updates or drift as a warning. -9. For pull request reviews, determine whether the changes affect Windows support. Changes to Windows or MSVC CI and `mise` tasks, Windows lock-file platform entries, the MXC driver, or `cfg(windows)` implementations and tests require the `test:windows` label. Report that requirement explicitly to the caller so the PR workflow can apply the label; label routing is review metadata, not a code-review finding. +9. For pull request reviews, determine whether the changes affect Windows support. Changes to Windows or MSVC CI and `mise` tasks, Windows lock-file platform entries, the MXC driver, or `cfg(windows)` implementations and tests require passing x64 and ARM64 `Windows MSVC` checks, which run on every PR but are not required for merging. Report that requirement explicitly to the caller; check routing is review metadata, not a code-review finding. 10. When the task includes a prior review feedback ledger, treat trusted resolved or explicitly waived findings as durable across later revisions. Do not re-raise the same finding with different wording unless the new diff diff --git a/.github/workflows/windows-msvc.yml b/.github/workflows/windows-msvc.yml index a268629a22..439e48cda3 100644 --- a/.github/workflows/windows-msvc.yml +++ b/.github/workflows/windows-msvc.yml @@ -3,6 +3,7 @@ name: Windows MSVC on: push: branches: + - main - windows - "pull-request/[0-9]+" workflow_dispatch: @@ -12,7 +13,8 @@ permissions: concurrency: group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true + # Let main runs finish so they seed the cache that pull-request mirrors restore. + cancel-in-progress: ${{ github.ref != 'refs/heads/main' }} env: # sccache cannot cache incremental Rust compilations, and rust-cache removes @@ -27,21 +29,20 @@ jobs: contents: read pull-requests: read outputs: - should_run: ${{ github.ref == 'refs/heads/windows' || steps.gate.outputs.should_run == 'true' }} + should_run: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/windows' || steps.gate.outputs.should_run == 'true' }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - id: gate - if: github.ref != 'refs/heads/windows' + if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/windows' uses: ./.github/actions/pr-gate - with: - required_label: test:windows pr-check: name: PR lint and test (${{ matrix.arch }}) needs: pr_metadata if: >- needs.pr_metadata.outputs.should_run == 'true' && + github.ref != 'refs/heads/main' && github.ref != 'refs/heads/windows' && github.event_name != 'workflow_dispatch' strategy: @@ -92,7 +93,9 @@ jobs: with: shared-key: windows-msvc-${{ matrix.arch }} cache-targets: "true" - cache-on-failure: "true" + # Other mirrors cannot restore this branch's cache, so saving it only + # evicts the main cache they do restore. + save-if: "false" cache-bin: "false" - name: Lint Windows-supported crates run: mise run --skip-tools windows:lint:${{ matrix.arch }} @@ -105,11 +108,11 @@ jobs: cache-seed: name: Seed cache (${{ matrix.arch }}) # Keep release-branch Windows validation advisory while the lane matures. - continue-on-error: true + continue-on-error: ${{ github.ref == 'refs/heads/windows' }} needs: pr_metadata if: >- needs.pr_metadata.outputs.should_run == 'true' && - github.ref == 'refs/heads/windows' + (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/windows') strategy: fail-fast: false matrix: @@ -156,7 +159,7 @@ jobs: cache-bin: "false" - name: Lint Windows-supported crates # Keep the seed workload identical to the pull-request workload so the - # windows-branch cache reflects the same lint and test commands. + # seeded cache reflects the same lint and test commands. run: mise run --skip-tools windows:lint:${{ matrix.arch }} - name: Test run: mise run --skip-tools windows:test:${{ matrix.arch }} @@ -168,6 +171,7 @@ jobs: name: Build binaries (${{ matrix.arch }}) continue-on-error: true needs: cache-seed + if: github.ref == 'refs/heads/windows' strategy: fail-fast: false matrix: diff --git a/CI.md b/CI.md index fb63409c41..dbe8775fea 100644 --- a/CI.md +++ b/CI.md @@ -67,11 +67,12 @@ For an intentional minor-train incompatibility, record the Buf finding, linked issue, consumer impact, and migration plan in the PR. Keep the finding visible; do not disable the job or add a broad Buf ignore rule. -Windows PR checks are opt-in: add `test:windows`, then select **Re-run all jobs** -on the current Windows MSVC run. Subsequent mirrored commits run them automatically. -Windows checks are not required for merging and do not run in merge queues. -Main and manual runs also build release binaries, with `continue-on-error: true` -so Windows failures do not fail the workflow. +Windows MSVC lint and tests run on every mirrored PR commit. They are not +required for merging and do not run in merge queues. Pushes to `main` run the +same lint and tests to seed the Rust caches that PR runs restore; PR runs do not +save caches. Pushes to `windows` and manual runs on that branch also build +release binaries, with `continue-on-error: true` so Windows failures do not fail +the workflow. ### Advisory compatibility review diff --git a/scripts/agents/gator/bin/review_feedback_ledger_test.sh b/scripts/agents/gator/bin/review_feedback_ledger_test.sh index c97f5b941c..9e8e8c31a9 100755 --- a/scripts/agents/gator/bin/review_feedback_ledger_test.sh +++ b/scripts/agents/gator/bin/review_feedback_ledger_test.sh @@ -449,9 +449,9 @@ rg -q 'alone is not a process blocker' \ "$GATOR_DIR/skills/gator-gate/SKILL.md" rg -q '`test_dispatch_required`' \ "$GATOR_DIR/skills/gator-gate/SKILL.md" -rg -q 'Apply `test:windows` whenever a PR affects Windows support' \ +rg -q 'treat both Windows checks as required gates' \ "$GATOR_DIR/skills/gator-gate/SKILL.md" -rg -q 'require the `test:windows` label' \ +rg -q 'require passing x64 and ARM64 `Windows MSVC` checks' \ "$GATOR_DIR/../../../.claude/agents/principal-engineer-reviewer.md" rg -q 'attacker_or_operator_prerequisite' \ "$GATOR_DIR/skills/gator-gate/references/review-findings-schema.md" diff --git a/scripts/agents/gator/skills/gator-gate/SKILL.md b/scripts/agents/gator/skills/gator-gate/SKILL.md index 99c6b711de..a27e21aaa2 100644 --- a/scripts/agents/gator/skills/gator-gate/SKILL.md +++ b/scripts/agents/gator/skills/gator-gate/SKILL.md @@ -944,7 +944,7 @@ Use `test:e2e` for Helm, Agent Sandbox CRDs, Kubernetes scheduling, namespace, w Add `test:e2e-kubernetes` for gateway high availability or Kubernetes Secrets and Vault credential driver storage. It runs only the HA and credential-driver suites, so apply it alongside `test:e2e` when other Kubernetes coverage is also needed. -Apply `test:windows` whenever a PR affects Windows support. This includes Windows or MSVC CI and `mise` tasks, Windows lock-file platform entries, the MXC driver, and `cfg(windows)` implementations or tests in otherwise cross-platform crates. Apply it alongside any applicable E2E label; it is not a substitute for runtime coverage. +Windows MSVC checks run on every PR without a label. When a PR affects Windows support, treat both Windows checks as required gates. This includes Windows or MSVC CI and `mise` tasks, Windows lock-file platform entries, the MXC driver, and `cfg(windows)` implementations or tests in otherwise cross-platform crates. The Windows checks are not a substitute for runtime coverage. After applying a `test:*` label, read the bot comment that is posted by the E2E Label Help workflow and follow its instructions. @@ -996,7 +996,7 @@ Required gates include at least: - `OpenShell / Trivy Changes` - `OpenShell / E2E` when `test:e2e` is applied - `OpenShell / GPU E2E` when `test:e2e-gpu` is applied -- Both x64 and ARM64 `Windows MSVC / PR lint and test` checks when `test:windows` is applied +- Both x64 and ARM64 `Windows MSVC / PR lint and test` checks when the PR affects Windows support If checks are pending, wait a reasonable interval and re-check. From 6a2a5f3cd48c72a74f2fa1db723cce8007ee1f55 Mon Sep 17 00:00:00 2001 From: Kris Hicks Date: Fri, 23 Oct 2026 12:21:13 -0700 Subject: [PATCH 2/2] DO NOT MERGE: save the Rust cache from PR runs to measure warm builds Signed-off-by: Kris Hicks --- .github/workflows/windows-msvc.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/windows-msvc.yml b/.github/workflows/windows-msvc.yml index 439e48cda3..ed4ab44049 100644 --- a/.github/workflows/windows-msvc.yml +++ b/.github/workflows/windows-msvc.yml @@ -95,7 +95,7 @@ jobs: cache-targets: "true" # Other mirrors cannot restore this branch's cache, so saving it only # evicts the main cache they do restore. - save-if: "false" + save-if: "true" cache-bin: "false" - name: Lint Windows-supported crates run: mise run --skip-tools windows:lint:${{ matrix.arch }}