Add a Windows CI job covering lint, compile, and test (#518)

.github/workflows/ci.yml

@@ -5,6 +5,13 @@ on:
     types: [opened, synchronize, reopened]
   workflow_dispatch:
 
+env:
+  # Single source of truth for the cargo-nextest pin. `make test` runs the
+  # non-doctest suite through nextest, so every job that installs it reads
+  # this value. Declared once at workflow scope so the documented
+  # AGENTS.md `sed` extraction yields exactly one version.
+  NEXTEST_VERSION: '0.9.133'
+
 jobs:
   build-test:
     runs-on: ubuntu-latest
@@ -18,9 +25,6 @@ jobs:
       # the dated nightly pinned in rust-toolchain.toml.
       NETSUKE_RUST_TOOLCHAIN: nightly-2026-06-25
       WHITAKER_INSTALLER_VERSION: '0.2.7'
-      # Single source of truth for the cargo-nextest pin. `make test` runs the
-      # non-doctest suite through nextest, so the job installs it up front.
-      NEXTEST_VERSION: '0.9.133'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
@@ -124,6 +128,99 @@ jobs:
           access-token: ${{ env.CS_ACCESS_TOKEN }}
           installer-checksum: ${{ vars.CODESCENE_CLI_SHA256 }}
 
+  build-test-windows:
+    # Gates merges: the `#[cfg(windows)]` tree is compiled, linted, and tested
+    # under `-D warnings` on this platform (see #518).
+    runs-on: windows-latest
+    permissions:
+      contents: read
+    env:
+      CARGO_TERM_COLOR: always
+      BUILD_PROFILE: debug
+      # The tree requires -Zpolonius=next (see
+      # docs/adr-006-adopt-polonius-nightly-toolchain.md), so CI builds with
+      # the dated nightly pinned in rust-toolchain.toml.
+      NETSUKE_RUST_TOOLCHAIN: nightly-2026-06-25
+      WHITAKER_INSTALLER_VERSION: '0.2.7'
+    defaults:
+      run:
+        # The Makefile uses POSIX shell constructs throughout; Git Bash is
+        # preinstalled on windows-latest. GNU Make's default recipe shell on
+        # Windows is cmd.exe, so every make invocation overrides SHELL to bash.
+        shell: bash
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install GNU Make
+        run: choco install make --yes --no-progress
+      - name: Setup Rust
+        uses: leynos/shared-actions/.github/actions/setup-rust@8add2d99854a5b77548eae98cca59202e68fefc8
+        with:
+          toolchain: ${{ env.NETSUKE_RUST_TOOLCHAIN }}
+          components: rustfmt, clippy
+          # Preserve warnings-as-errors and Polonius through toolchain setup.
+          rustflags: -D warnings -Zpolonius=next
+      - name: Install Ninja
+        uses: seanmiddleditch/gha-setup-ninja@3b1f8f94a2f8254bd26914c4ab9474d4f0015f67  # v6
+      - name: Install cargo-nextest
+        uses: taiki-e/install-action@18b1216eba7f8039b0f8d131d5473787f0edce68  # v2.85.3
+        with:
+          tool: nextest@${{ env.NEXTEST_VERSION }}
+      - name: Show rustc version
+        run: |
+          rustup show
+          rustc --version
+          cargo --version
+      - name: Show Ninja version
+        run: ninja --version
+      - name: Format
+        run: make SHELL=bash check-fmt
+      - name: Lint (Clippy)
+        # Clippy and `cargo doc` over the whole workspace under `-D warnings`,
+        # including the `#[cfg(windows)]` arms.
+        run: make SHELL=bash lint-clippy
+      - name: Cache Whitaker installer
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
+        with:
+          path: |
+            ~/.cargo/bin/whitaker-installer
+            ~/.cache/cargo-binstall
+          key: whitaker-installer-${{ runner.os }}-${{ runner.arch }}-${{ env.WHITAKER_INSTALLER_VERSION }}
+      - name: Install Whitaker
+        # Installs and runs on windows-latest (verified in #562); the same
+        # binstall-with-cargo-install-fallback path as the Linux job. On
+        # Windows the installer ships `whitaker` as a PowerShell wrapper
+        # (.ps1), which Git Bash cannot execute, so shim `whitaker` in the
+        # cargo bin directory (already on PATH) to run the wrapper through
+        # PowerShell. A failure here blocks the merge.
+        run: |
+          if ! command -v whitaker-installer >/dev/null 2>&1; then
+            if cargo binstall --version >/dev/null 2>&1; then
+              cargo binstall --no-confirm --locked "whitaker-installer@${WHITAKER_INSTALLER_VERSION}"
+            else
+              echo "cargo-binstall unavailable; building whitaker-installer from crates.io"
+              cargo install --locked whitaker-installer --version "${WHITAKER_INSTALLER_VERSION}"
+            fi
+          fi
+          whitaker-installer
+          if [ -f "${HOME}/.local/bin/whitaker.ps1" ]; then
+            printf '%s\n' \
+              '#!/bin/bash' \
+              'exec powershell -NoProfile -ExecutionPolicy Bypass -File "${HOME}/.local/bin/whitaker.ps1" "$@"' \
+              > "${CARGO_HOME:-$HOME/.cargo}/bin/whitaker"
+            chmod +x "${CARGO_HOME:-$HOME/.cargo}/bin/whitaker"
+          fi
+      - name: Lint (Whitaker)
+        # Whitaker/Dylint over the workspace under `-D warnings`, including
+        # the `#[cfg(windows)]` arms. A failure blocks the merge.
+        run: make SHELL=bash lint-whitaker
+      - name: Test
+        # cargo-nextest plus doctests under `-D warnings -Zpolonius=next`,
+        # compiling and running the `#[cfg(windows)]` test tree. A failure
+        # blocks the merge.
+        run: make SHELL=bash test
+
   kani-smoke:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest

docs/developers-guide.md

@@ -368,6 +368,7 @@ Four workflows carry the contract:
 | Workflow | Job | Shared action | `with.rustflags` |
 | --- | --- | --- | --- |
 | [`ci.yml`](../.github/workflows/ci.yml) | `build-test` | `setup-rust` | `-D warnings -Zpolonius=next` |
+| [`ci.yml`](../.github/workflows/ci.yml) | `build-test-windows` | `setup-rust` | `-D warnings -Zpolonius=next` |
 | [`coverage-main.yml`](../.github/workflows/coverage-main.yml) | `coverage-upload` | `setup-rust` | `-D warnings -Zpolonius=next` |
 | [`netsukefile-test.yml`](../.github/workflows/netsukefile-test.yml) | `netsukefile` | `setup-rust` | `-Zpolonius=next` |
 | [`build-and-package.yml`](../.github/workflows/build-and-package.yml) | `build` | `rust-build-release` | `-Zpolonius=next` |
@@ -2592,6 +2593,14 @@ rules — normalization, the fallback — in the `#[cfg(any(windows, test))]` un
 tests that the Linux suite executes, and reserve the Windows-gated suite for
 behaviour that genuinely cannot run elsewhere.
 
+The `build-test-windows` job in `.github/workflows/ci.yml` is a merge gate: it
+compiles, lints (Clippy and Whitaker), and tests the `#[cfg(windows)]` suite on
+`windows-latest` under `-D warnings`, so a Windows-gated test or lint finding
+blocks a merge. The split still stands: host-independent rules stay in the
+`#[cfg(any(windows, test))]` unit tests so every host — including a developer
+on Unix — exercises them, while the Windows-gated suite covers the behaviour
+that only exists there.
+
 #### `PATHEXT` normalization
 
 `stdlib::which::env::parse_pathext` turns a raw `PATHEXT` value into lowercase,
@@ -2615,6 +2624,17 @@ Composition rules:
   empty result would mean Windows treats nothing as executable, so `which`
   would report every command missing.
 
+The widening was reassessed when `build-test-windows` began compiling and
+testing the `#[cfg(windows)]` arm directly (#518): the original motivation for
+`#[cfg(any(windows, test))]` — reaching the pure string logic from a CI host
+that never compiled Windows — is gone, but reverting to `#[cfg(windows)]`
+would drop Unix-host coverage of `parse_pathext`'s normalization,
+de-duplication, and fallback rules, which `src/stdlib/which/pathext_tests.rs`
+pins on every host. There is no equivalent Unix-side test for a Windows-only
+function, so the widening stays: the pure string logic is exercised on both
+Linux and Windows, and a Windows-gated regression cannot hide from the Unix
+suite.
+
 The full normalization contract, which the property tests in
 `src/stdlib/which/pathext_tests.rs` pin:
 

src/manifest/glob/tests/capability.rs

@@ -1,8 +1,11 @@
 //! Tests for the capability handle the glob metadata checks run through.
-use super::super::walk::{literal_dir_prefix, open_root_dir};
+#[cfg(unix)]
+use super::super::walk::literal_dir_prefix;
+use super::super::walk::open_root_dir;
 use super::super::{GlobPattern, glob_paths};
 use anyhow::{Context, Result, anyhow, ensure};
 use camino::{Utf8Path, Utf8PathBuf};
+#[cfg(unix)]
 use minijinja::ErrorKind;
 use rstest::{fixture, rstest};
 use tempfile::{TempDir, tempdir};

src/manifest/glob/tests/diagnostics.rs

@@ -4,7 +4,9 @@
 //! subscriber scoped to the call. The recorder and subscriber are both
 //! thread-local, so no test-wide lock is needed.
 
-use super::super::{MAX_UNREACHABLE_SYMLINK_SAMPLES, expand_glob, glob_paths, record_expansion};
+#[cfg(unix)]
+use super::super::MAX_UNREACHABLE_SYMLINK_SAMPLES;
+use super::super::{expand_glob, glob_paths, record_expansion};
 use anyhow::{Context, Result, ensure};
 use metrics::SharedString;
 use metrics_util::{

src/manifest/glob/tests/expansion.rs

@@ -1,7 +1,13 @@
 //! Tests for the match set [`glob_paths`] returns.
+#[cfg(unix)]
+use super::super::GlobPattern;
+use super::super::glob_paths;
+#[cfg(unix)]
 use super::super::walk::{GlobRoot, process_glob_entry};
-use super::super::{GlobPattern, glob_paths};
-use anyhow::{Context, Result, anyhow, ensure};
+#[cfg(unix)]
+use anyhow::{Context, anyhow};
+use anyhow::{Result, ensure};
+#[cfg(unix)]
 use cap_std::{ambient_authority, fs::Dir};
 use minijinja::ErrorKind;
 use rstest::rstest;

src/manifest/glob/validate.rs

@@ -39,7 +39,11 @@ impl ValidationState {
     }
 
     #[cfg(not(unix))]
-    fn process_escape(&mut self, _ch: char) -> bool {
+    #[expect(
+        clippy::unused_self,
+        reason = "signature must mirror the Unix arm, which reads self.escaped"
+    )]
+    const fn process_escape(&mut self, _ch: char) -> bool {
         false
     }
 

src/manifest/glob/walk.rs

@@ -349,7 +349,7 @@ fn prefix_is_unopenable(err: &io::Error) -> bool {
     {
         /// `ERROR_DIRECTORY`: the path is not a directory.
         const ERROR_DIRECTORY: i32 = 267;
-        return err.raw_os_error() == Some(ERROR_DIRECTORY);
+        err.raw_os_error() == Some(ERROR_DIRECTORY)
     }
     #[cfg(not(windows))]
     false

src/stdlib/command/quote.rs

@@ -26,6 +26,10 @@ impl fmt::Display for QuoteError {
     }
 }
 
+/// `QuoteError` crosses into `anyhow::Result` in the Windows quoting tests,
+/// which requires the `std::error::Error` trait.
+impl std::error::Error for QuoteError {}
+
 #[cfg(windows)]
 pub(super) fn quote(arg: &str) -> Result<String, QuoteError> {
     if arg.chars().any(|ch| matches!(ch, '\n' | '\r')) {

src/stdlib/register.rs

@@ -174,7 +174,7 @@ fn is_fifo(ft: fs::FileType) -> bool {
 }
 
 #[cfg(not(unix))]
-fn is_fifo(_ft: fs::FileType) -> bool {
+const fn is_fifo(_ft: fs::FileType) -> bool {
     false
 }
 
@@ -184,7 +184,7 @@ fn is_block_device(ft: fs::FileType) -> bool {
 }
 
 #[cfg(not(unix))]
-fn is_block_device(_ft: fs::FileType) -> bool {
+const fn is_block_device(_ft: fs::FileType) -> bool {
     false
 }
 
@@ -194,7 +194,7 @@ fn is_char_device(ft: fs::FileType) -> bool {
 }
 
 #[cfg(not(unix))]
-fn is_char_device(_ft: fs::FileType) -> bool {
+const fn is_char_device(_ft: fs::FileType) -> bool {
     false
 }
 
@@ -204,6 +204,6 @@ fn is_device(ft: fs::FileType) -> bool {
 }
 
 #[cfg(not(unix))]
-fn is_device(_ft: fs::FileType) -> bool {
+const fn is_device(_ft: fs::FileType) -> bool {
     false
 }

src/stdlib/which/env.rs

@@ -67,13 +67,26 @@ pub(super) struct EnvSnapshot {
 }
 
 impl EnvSnapshot {
+    /// Capture a snapshot without a `PATHEXT` override.
+    ///
+    /// This is the production capture entry on platforms without `PATHEXT`
+    /// semantics, where `capture_with_pathext` delegates to it. On Windows the
+    /// production entry is `capture_with_pathext` itself, so here the function
+    /// survives only for tests, which is why the gate admits `test`.
+    #[cfg(any(not(windows), test))]
     pub(super) fn capture(
         cwd_override: Option<&Utf8Path>,
         path_override: Option<&OsStr>,
     ) -> Result<Self, ResolveError> {
         Self::capture_with_env(cwd_override, path_override, &DefaultEnv)
     }
 
+    /// Capture with an injected environment provider.
+    ///
+    /// See [`Self::capture`] for why this is gated to non-Windows production
+    /// plus tests: on Windows the production path threads a `PATHEXT` override
+    /// and reaches `capture_impl` directly, so this chain is test-only there.
+    #[cfg(any(not(windows), test))]
     pub(super) fn capture_with_env(
         cwd_override: Option<&Utf8Path>,
         path_override: Option<&OsStr>,
@@ -88,7 +101,11 @@ impl EnvSnapshot {
     /// concept of, so the two `capture_impl` arities diverge. Isolating the
     /// divergence in a pair of wrappers keeps `capture_with_env` free of a
     /// `cfg`-gated bare `return`, which reads as dead code on either target.
-    #[cfg(windows)]
+    ///
+    /// Reachable only from `capture_with_env`, which is itself test-only on
+    /// Windows (production enters through `capture_with_pathext`), so this
+    /// arm is compiled only under `test`.
+    #[cfg(all(windows, test))]
     fn capture_for_platform(
         cwd_override: Option<&Utf8Path>,
         path_override: Option<&OsStr>,

src/stdlib/which/lookup/tests.rs

@@ -230,7 +230,7 @@ fn pathext_without_leading_dots_is_normalised_and_deduplicated(
         Some(std::ffi::OsStr::new("COM;EXE;EXE; .BAT ;bat")),
     )?;
     let mut pathexts = snapshot.pathext().to_vec();
-    pathexts.sort_unstable_by(|a, b| a.to_lowercase().cmp(&b.to_lowercase()));
+    pathexts.sort_unstable_by_key(|ext| ext.to_lowercase());
 
     let contains_ci = |needle: &str| pathexts.iter().any(|ext| ext.eq_ignore_ascii_case(needle));
 
@@ -286,7 +286,6 @@ fn direct_path_not_executable_raises_direct_not_found(
 #[cfg(windows)]
 #[rstest]
 fn resolve_direct_appends_pathext(workspace: Result<TempWorkspace>) -> Result<()> {
-    use crate::stdlib::which::workspace_switch::WorkspaceSwitch;
     use test_support::exec::make_executable;
 
     let env = workspace?;
@@ -297,16 +296,14 @@ fn resolve_direct_appends_pathext(workspace: Result<TempWorkspace>) -> Result<()
     test_fs::create_dir_all(tools_dir.as_std_path()).context("mkdir tools")?;
     let exe = base.with_extension("bat");
     test_fs::write(exe.as_std_path(), b"@echo off\r\n").context("write stub")?;
-    make_executable(&exe)?;
-
-    let snapshot = EnvSnapshot {
-        cwd: env.root.clone(),
-        raw_path: None,
-        raw_pathext: Some(".bat".into()),
-        entries: vec![],
-        pathext: vec![".bat".into()],
-        workspace_switch: WorkspaceSwitch::Absent,
-    };
+    make_executable(exe.as_std_path())?;
+
+    let snapshot = EnvSnapshot::capture_with_pathext(
+        Some(env.root()),
+        None,
+        Some(std::ffi::OsStr::new(".bat")),
+    )
+    .context("capture env for direct PATHEXT resolution")?;
 
     let matches = resolve_direct(".\\tools\\gradlew", &snapshot, &WhichOptions::default())?;
 

src/stdlib/which/lookup/workspace/windows.rs

@@ -23,7 +23,7 @@ struct CollectionState {
 }
 
 impl CollectionState {
-    fn new(collect_all: bool) -> Self {
+    const fn new(collect_all: bool) -> Self {
         Self {
             matches: Vec::new(),
             collect_all,
@@ -119,11 +119,11 @@ impl WorkspaceMatchContext {
 
         if !command_has_ext {
             let candidates = env::candidate_paths(Utf8Path::new(""), &command_lower, env.pathext());
-            for candidate in candidates {
-                if let Some(name) = Utf8Path::new(candidate.as_str()).file_name() {
-                    basenames.insert(name.to_ascii_lowercase());
-                }
-            }
+            basenames.extend(candidates.into_iter().filter_map(|candidate| {
+                Utf8Path::new(candidate.as_str())
+                    .file_name()
+                    .map(str::to_ascii_lowercase)
+            }));
         }
 
         Self {