Wine

.circleci/config.yml

@@ -201,6 +201,58 @@ jobs:
        - save_cache:
            key: go-freebsd-v1-{{ checksum "third_party/go/BUILD" }}
            paths: [ ".plz-cache/third_party/go" ]
+
+   build-windows:
+     working_directory: ~/please
+     docker:
+       - image: ghcr.io/thought-machine/please_windows_builder:20260910
+     resource_class: large
+     steps:
+       - checkout
+       - attach_workspace:
+           at: /tmp/workspace
+       - restore_cache:
+           key: go-windows-v1-{{ checksum "third_party/go/BUILD" }}
+       - run:
+           name: Extract plz
+           command: tar -xzf /tmp/workspace/linux_amd64/please_*.tar.gz
+       - run:
+           name: Cross-compile
+           command: ./please/please build -p -v2 --profile ci --arch windows_amd64 //package:release_files
+       - persist_to_workspace:
+           root: plz-out/pkg
+           paths:
+             - windows_amd64/*
+       - store_artifacts:
+           path: plz-out/log
+       - save_cache:
+           key: go-windows-v1-{{ checksum "third_party/go/BUILD" }}
+           paths: [ ".plz-cache/third_party/go" ]
+
+   # Runs the Windows binaries we just cross-built, under Wine, on Linux. This is the only
+   # thing in CI that checks the port's runtime behaviour rather than that it compiles; see
+   # docs/design/windows/05-testing-strategy.md for what it does and does not cover.
+   test-windows-wine:
+     working_directory: ~/please
+     docker:
+       - image: ghcr.io/thought-machine/please_windows_builder:20260910
+     resource_class: large
+     steps:
+       - checkout
+       - attach_workspace:
+           at: /tmp/workspace
+       - restore_cache:
+           key: go-windows-v1-{{ checksum "third_party/go/BUILD" }}
+       - run:
+           name: Extract plz
+           command: tar -xzf /tmp/workspace/linux_amd64/please_*.tar.gz
+       - run:
+           name: Test under Wine
+           command: ./please/please test -p -v2 --profile ci --include=wine
+       - store_test_results:
+           path: plz-out/log/test_results.xml
+       - store_artifacts:
+           path: plz-out/log
    build-linux-arm64:
      working_directory: ~/please
      docker:
@@ -515,6 +567,12 @@ workflows:
       - build-freebsd:
           requires:
             - build-alpine
+      - build-windows:
+          requires:
+            - build-alpine
+      - test-windows-wine:
+          requires:
+            - build-alpine
       - test-rex:
           requires:
             - build-alpine
@@ -531,6 +589,8 @@ workflows:
           requires:
             - build-alpine
             - build-freebsd
+            - build-windows
+            - test-windows-wine
             - build-darwin-amd64
             - build-linux-arm64
             - build-linux

.circleci/release.sh

@@ -50,6 +50,7 @@ release_folder /tmp/workspace/darwin_arm64 darwin_arm64/$VERSION
 release_folder /tmp/workspace/linux_amd64 linux_amd64/$VERSION
 release_folder /tmp/workspace/linux_arm64 linux_arm64/$VERSION
 release_folder /tmp/workspace/freebsd_amd64 freebsd_amd64/$VERSION
+release_folder /tmp/workspace/windows_amd64 windows_amd64/$VERSION
 
 # Sign the download script with our release key
 /tmp/workspace/release_signer pgp -o get_plz.sh.asc -i tools/misc/get_plz.sh
@@ -58,6 +59,14 @@ release_file tools/misc/get_plz.sh get_plz.sh text/x-shellscript
 release_file get_plz.sh.asc get_plz.sh.asc text/plain
 release_file get_plz.sh.sig get_plz.sh.sig application/octet-stream
 
+# The Windows installer, served the same way and signed the same way. Windows has no shell to
+# curl | sh with; this is run with irm ... | iex instead.
+/tmp/workspace/release_signer pgp -o get_plz.ps1.asc -i tools/misc/get_plz.ps1
+/tmp/workspace/release_signer kms -o get_plz.ps1.sig -i tools/misc/get_plz.ps1
+release_file tools/misc/get_plz.ps1 get_plz.ps1 text/plain
+release_file get_plz.ps1.asc get_plz.ps1.asc text/plain
+release_file get_plz.ps1.sig get_plz.ps1.sig application/octet-stream
+
 if [[ "$VERSION" == *"beta"* ]] || [[ "$VERSION" == *"alpha"* ]] || [[ "$VERSION" == *"prerelease"* ]]; then
   echo "$VERSION is a prerelease, only setting latest_prerelease_version"
 else

.gitattributes

@@ -1,5 +1,7 @@
-*.build_defs linguist-language=Starlark diff=python
-BUILD.plz linguist-language=Starlark diff=python
-docs/* linguist-documentation
-*_bindata.go linguist-generated
-third_party/go/zip/* linguist-vendored
+# Batch files are read by cmd.exe, which is not reliable on LF-only input, and the fixtures
+# under test/windows are compared byte for byte against output the bundled busybox produced.
+# Neither should be translated on checkout.
+*.cmd -text
+src/run/test_data/** -text
+test/windows/smoke_repo/** -text
+test/windows/offline_repo/** -text

.github/workflows/release.yml

@@ -0,0 +1,85 @@
+# Builds and publishes a release from this fork.
+#
+# Upstream publishes to a GCS bucket from CircleCI, which only runs on thought-machine/please.
+# A fork cannot drive that, so nothing this branch produces was downloadable by pleasew.ps1,
+# get_plz.ps1 or plz update - the Windows support was real and unreachable at the same time.
+#
+# This publishes the same artifacts as a GitHub Release instead. The asset names carry the
+# platform, which is what gen_release.py does for the GitHub half of an upstream release, so the
+# two layouts agree on names even though they disagree on paths.
+#
+# Delete this whole workflow if upstream ever starts publishing Windows builds.
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+  # So a release can be cut without tagging, while this is still being worked out.
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag to release, e.g. v17.34.0"
+        required: true
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    name: release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Please
+        run: |
+          ./pleasew --version
+          echo "$HOME/.please" >> "$GITHUB_PATH"
+      - name: Build this repo's Please
+        # The released Please is not this one, and it hangs parsing //test/windows. Everything
+        # below uses the one we just built, the same two-step test.sh insists on.
+        run: ./pleasew build -p -v2 --profile ci //src:please
+      - name: Work out what we are releasing
+        id: version
+        run: |
+          tag="${{ github.event.inputs.tag }}"
+          [ -n "$tag" ] || tag="${GITHUB_REF#refs/tags/}"
+          version="$(cat VERSION)"
+          # A tag that disagrees with VERSION would publish assets nobody can find, since every
+          # consumer builds the filename out of the version rather than out of the tag.
+          [ "$tag" = "v$version" ] || { echo "tag $tag does not match VERSION $version" >&2; exit 1; }
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+      - name: Build the releases
+        run: |
+          plz-out/bin/src/please build -p -v2 --profile ci --arch windows_amd64 //package:release_files
+          plz-out/bin/src/please build -p -v2 --profile ci //package:release_files
+      - name: Name the assets by platform
+        id: assets
+        run: |
+          version="${{ steps.version.outputs.version }}"
+          mkdir -p assets
+          for arch in windows_amd64 linux_amd64; do
+            for f in plz-out/pkg/$arch/*; do
+              [ -f "$f" ] || continue
+              # The same rename gen_release.py does: please_1.2.3.zip -> please_1.2.3_arch.zip.
+              base="$(basename "$f")"
+              cp "$f" "assets/${base/$version/${version}_$arch}"
+            done
+          done
+          ls -l assets
+      - name: Publish
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release create "${{ steps.version.outputs.tag }}" \
+            --repo "${{ github.repository }}" \
+            --title "Please ${{ steps.version.outputs.version }}" \
+            --notes "Built from this fork, which carries Windows support that is not upstream yet.
+
+          Install on Windows:
+
+              irm https://raw.githubusercontent.com/${{ github.repository }}/${{ steps.version.outputs.tag }}/tools/misc/get_plz.ps1 | iex
+
+          See docs/design/windows/07-state-of-play.md for what works and what does not." \
+            assets/*

.github/workflows/windows.yml

@@ -0,0 +1,183 @@
+# The only thing anywhere that runs Please on a real Windows machine.
+#
+# Everything else the port claims rests on Wine, and docs/design/windows/05-testing-strategy.md
+# is explicit that Wine passing is evidence rather than proof. The classes it cannot show are
+# the ones Please works hardest in: sharing violations on teardown, path length, case-insensitive
+# collisions, symlink privileges.
+#
+# CircleCI cross-builds the same artifacts, but its workspaces are scoped to one CircleCI run
+# and cannot be read from here, so this cross-builds its own on a Linux runner and hands them
+# over. That duplication is the price of there being no Windows runner in CircleCI's config.
+name: Windows
+
+on:
+  push:
+    branches:
+      - master
+      - wine
+  pull_request:
+
+concurrency:
+  group: windows-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  cross-build:
+    name: cross-build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Please
+        run: |
+          ./pleasew --version
+          echo "$HOME/.please" >> "$GITHUB_PATH"
+      - name: Build this repo's Please
+        # The released Please is not this one, and the difference is not cosmetic: it predates
+        # the parse-deadlock fix and hangs parsing //test/windows, silently and for ever.
+        # Everything below uses the one we just built, the same two-step test.sh insists on.
+        run: ./pleasew build -p -v2 --profile ci //src:please
+      - name: Cross-build the test bundle
+        run: plz-out/bin/src/please build -p -v2 --profile ci //test/windows:native_test_bundle
+      - name: Cross-build the release
+        # The same command CircleCI's build-windows job runs, so what the Windows job gets here
+        # is what a user would get.
+        run: plz-out/bin/src/please build -p -v2 --profile ci --arch windows_amd64 //package:release_files
+      - name: Extract the codelab plan
+        # Built here, on Linux, so the Windows job replays a plan that
+        # //test/windows/codelab_script/script:script_test has already checked against the same
+        # codelabs and the same sidecar. See test/windows/run_codelabs.ps1.
+        run: plz-out/bin/src/please build -p -v2 --profile ci //test/windows:codelab_plan
+      - name: Upload the codelab plan
+        uses: actions/upload-artifact@v4
+        with:
+          name: windows-codelab-plan
+          path: plz-out/gen/test/windows/codelab_plan.json
+          retention-days: 7
+      - name: Upload the test bundle
+        uses: actions/upload-artifact@v4
+        with:
+          name: windows-test-bundle
+          path: plz-out/gen/test/windows/native_test_bundle
+          # The bundle's repo-root marker is a .plzconfig, and this action drops hidden files
+          # unless told not to. Without it the tests that look for a repo root find none and
+          # die, which nothing on the Linux side can catch - the Wine test runs the bundle
+          # directly, never through an artifact.
+          include-hidden-files: true
+          retention-days: 7
+      - name: Upload the release
+        uses: actions/upload-artifact@v4
+        with:
+          name: windows-release
+          path: plz-out/pkg/windows_amd64/please_*.zip
+          retention-days: 7
+      - name: Upload the logs
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: cross-build-logs
+          path: plz-out/log
+          retention-days: 7
+
+  test:
+    name: test
+    needs: cross-build
+    runs-on: windows-latest
+    # Blocking. It was advisory for exactly one run, to produce a failure list without a red
+    # check nobody had read yet; everything that run found is fixed. Anything genuinely left
+    # over belongs in test/windows/known_failures.txt with a reason, not behind a flag that
+    # makes the whole job ignorable.
+    steps:
+      - name: Keep Unix line endings
+        # The fixtures are compared byte for byte against output the bundled busybox produced,
+        # and busybox does not translate line endings. Has to precede the checkout.
+        run: git config --global core.autocrlf input
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          name: windows-test-bundle
+          path: ${{ runner.temp }}\bundle
+      - uses: actions/download-artifact@v4
+        with:
+          name: windows-release
+          path: ${{ runner.temp }}\release
+      - name: Report the machine
+        # Both of these change what is reachable, both differ between runner images, and
+        # guessing either has already cost time. Print them rather than assuming.
+        run: |
+          (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem' -Name LongPathsEnabled -EA SilentlyContinue) |
+            Select-Object -ExpandProperty LongPathsEnabled -EA SilentlyContinue |
+            ForEach-Object { "LongPathsEnabled=$_" } | Tee-Object -Append $env:GITHUB_STEP_SUMMARY
+          whoami /priv | Select-String SeCreateSymbolicLinkPrivilege |
+            Tee-Object -Append $env:GITHUB_STEP_SUMMARY
+      - name: Run the cross-built unit tests
+        run: |
+          ./test/windows/run_native_tests.ps1 `
+            -Bundle "$env:RUNNER_TEMP\bundle" `
+            -Logs "$env:RUNNER_TEMP\logs" `
+            -KnownFailures test/windows/known_failures.txt
+      - name: Build a repo with the release
+        if: ${{ !cancelled() }}
+        run: |
+          ./test/windows/run_native_probes.ps1 `
+            -Release "$env:RUNNER_TEMP\release" `
+            -Logs "$env:RUNNER_TEMP\logs"
+      - name: Upload the logs
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: windows-test-logs
+          path: ${{ runner.temp }}\logs
+          retention-days: 7
+
+  codelabs:
+    name: codelabs
+    needs: cross-build
+    runs-on: windows-latest
+    # A job of its own rather than a step in test. It needs the release but not the bundle, it
+    # runs for far longer - eight codelabs, plugin downloads, a Go toolchain - and a hung codelab
+    # should not eat the unit tests' time or delay the signal people actually read.
+    timeout-minutes: 90
+    # Blocking from its first run, for the reason the test job gives. What the codelabs cannot do
+    # on Windows is expected, and the mechanism for expected already exists: every such step is
+    # in test/windows/codelab_known_failures.txt with a reason. There is no advisory mode to
+    # forget to take out.
+    steps:
+      - name: Keep Unix line endings
+        # The runner script and the failures list come from the checkout. Has to precede it.
+        run: git config --global core.autocrlf input
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          name: windows-release
+          path: ${{ runner.temp }}\release
+      - uses: actions/download-artifact@v4
+        with:
+          name: windows-codelab-plan
+          path: ${{ runner.temp }}\plan
+      - name: Report the toolchains
+        # The codelabs assume Go, Python, git, Docker and kubectl, and which of those exist - and
+        # for Docker, which kind of containers it runs - decides what is skipped. Print it rather
+        # than inferring it from the results.
+        run: |
+          "pwsh = $($PSVersionTable.PSVersion)" | Tee-Object -Append $env:GITHUB_STEP_SUMMARY
+          foreach ($t in 'go', 'python', 'git', 'docker', 'kubectl') {
+            $c = Get-Command $t -EA SilentlyContinue
+            "$t = $(if ($c) { $c.Source } else { 'not installed' })" | Tee-Object -Append $env:GITHUB_STEP_SUMMARY
+          }
+          if (Get-Command docker -EA SilentlyContinue) {
+            "docker OSType = $(docker info --format '{{.OSType}}' 2>$null)" | Tee-Object -Append $env:GITHUB_STEP_SUMMARY
+          }
+      - name: Run the codelabs
+        run: |
+          ./test/windows/run_codelabs.ps1 `
+            -Plan "$env:RUNNER_TEMP\plan\codelab_plan.json" `
+            -Release "$env:RUNNER_TEMP\release" `
+            -Logs "$env:RUNNER_TEMP\logs" `
+            -KnownFailures test/windows/codelab_known_failures.txt
+      - name: Upload the logs
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: windows-codelab-logs
+          path: ${{ runner.temp }}\logs
+          retention-days: 7