Skip to content

Windows base (2/2): windows-latest compile and tests job (stacked on #75) - #76

Merged
EVMCOD merged 7 commits into
mainfrom
ci/windows-job
Oct 29, 2026
Merged

EVMCOD merged 7 commits into
mainfrom
ci/windows-job

Conversation

@EVMCOD

@EVMCOD EVMCOD commented Oct 29, 2026

Copy link
Copy Markdown
Owner

Windows base, PR 9 of docs/PORTABILITY.md: a windows-latest compile-and-test job

Stacked on #75 (PR 8). Base branch: fix/windows-python-portability. It depends on #75 because the Windows job compiles and runs #75's Windows code (getrandom branch, alive(), exclusive bind). Merge #75 first; GitHub then retargets this PR to main (if it does not, change the base by hand). The diff here is only the second commit.

Windows is still not supported. This only makes a Windows regression visible.

What it adds

.github/workflows/windows.yml, two jobs, both windows-latest (GitHub-hosted, literal label, timeout-minutes, SHA-pinned actions with version comments, permissions: contents: read):

  • windows-rust: cargo check --locked --all-targets of desktop/src-tauri for the Windows target (with a placeholder sidecar conductloop-server-<triple>.exe, same trick as the Linux/macOS jobs) and cargo test of desktop/url-policy. The wrapper's own tests are not run (they would link the WebView2 loader, and nothing launches the app).
  • windows-python: pip install -r requirements-dev.txt, then pytest -m "not live" minus the live license worker, the two headless-Chrome JS tests and the *_ui_browser tests (those run in ci.yml). PYTHONUTF8=1 (the plan's item 8 starts the sidecar with it); core.autocrlf false.
  • Tests that cannot exist on Windows are skipped with a written reason in tests/windows_skips.py (bubblewrap/seatbelt sandbox, bash scripts, AF_UNIX agent bridge), applied by tests/conftest.py on win32 only: macOS/Linux collection is unchanged.
  • It builds no installer, signs nothing, publishes nothing, uploads no artifact, uses no secret. It is not a required check (branch protection lists only gitleaks and test); path-filtered to ops_dashboard/, tests/, desktop/, requirements, pyproject.toml and itself.

Tests

tests/test_windows_workflow.py: both jobs on windows-latest with a timeout; no secrets./artifact/release/sign/tauri-build words in the workflow; read-only permissions; job names do not collide with the required checks; every entry of the skip list exists and has a reason; the conftest hook skips only on win32. tests/test_workflows_guard.py passes unchanged (windows-latest is already allowed, ubuntu-22.04 stays only in linux-bundles).

Untested

Whether the Windows Python suite passes as-is: it was never run on Windows. The skip list only contains files that obviously need Unix. If the first run shows more real Windows failures they will be fixed if small, or added to the skip list with a reason, in a follow-up commit.

Local: scripts/verify.sh --offline passes ruff, mypy ratchet, evals and pytest; the Secret-scan step fails only locally because of a stale local ref (gitleaks on HEAD is clean).

New workflow windows.yml: cargo check --locked --all-targets of the Tauri wrapper
for Windows plus url-policy tests, and the pytest suite on Windows minus the
files in tests/windows_skips.py (each with a reason, applied on win32 only).
No signing, release, artifact or secret; SHA-pinned actions; stacked on PR 8.
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 29, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-29T16:00:06.995447Z 7013292 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 70132921dd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread .github/workflows/windows.yml
…ests with reasons

First windows-python run: 1676 passed, 108 failed. 40 were the evals harness
failing to delete a temp dir holding an open sqlite file (ignore_cleanup_errors).
One test helper compared a backslash path. The rest (code sessions, macOS keychain
backend, POSIX permission bits, POSIX paths, vault/skills tools not yet
investigated) are skipped on win32 only, each with a reason.
…dexes backslashes)

Last failure of the first Windows run: the RAG eval cases check a posix path
suffix against citations whose path has backslashes on Windows. Linux/macOS
unchanged.
@EVMCOD
EVMCOD changed the base branch from fix/windows-python-portability to main October 29, 2026 17:49
…gainst new ones

- posix_perms marker (skipped on win32 by conftest, with the reason) for tests
  that are about permission bits; tests/posix_perms.py helpers (no-ops on Windows)
  for tests where the bits are one assertion among others, so the rest still
  runs on Windows.
- tests/test_posix_perms_guard.py fails if a test reads st_mode/S_IMODE/S_I*/
  os.access(R/W/X_OK) without the marker or a helper.
- Per-test entries for permission tests removed from windows_skips.py.
macOS/Linux assert exactly what they did.
…patched sys.platform

windows-latest run 40926549010 (windows-python, job 123633486845): 1 failed, 1707 passed.
test_secrets_store_secret_service patches sys.platform to 'linux' to exercise the Linux
code path, so the helper no longer saw Windows and asserted 0o600 on a real Windows file
(mode 0o666). The helpers now follow the real OS; a test pins that.
@EVMCOD
EVMCOD merged commit 0768b68 into main Oct 29, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant