From 0add39b43d1418809259d60e4df7e5bf53d4326f Mon Sep 17 00:00:00 2001
From: Michael Bolin <mbolin@openai.com>
Date: Thu, 26 Mar 2026 21:51:22 -0700
Subject: [PATCH] ci: enable the Windows Bazel workflow path

---
 .bazelrc                    |  5 +++--
 .github/workflows/bazel.yml | 31 ++++++++++++++++++++++++-------
 2 files changed, 27 insertions(+), 9 deletions(-)

diff --git a/.bazelrc b/.bazelrc
index ce7c1e1d43..8915330b91 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -20,8 +20,9 @@ common:windows --host_platform=//:local_windows
 common --@rules_cc//cc/toolchains/args/archiver_flags:use_libtool_on_macos=False
 common --@llvm//config:experimental_stub_libgcc_s
 
-# We need to use the sh toolchain on windows so we don't send host bash paths to the linux executor.
-common:windows --@rules_rust//rust/settings:experimental_use_sh_toolchain_for_bootstrap_process_wrapper
+# `rules_rs` no longer exposes this `rules_rust` setting, so keep Windows on the
+# default bootstrap process wrapper path until the workflow is green again.
+# common:windows --@rules_rust//rust/settings:experimental_use_sh_toolchain_for_bootstrap_process_wrapper
 
 # TODO(zbarsky): rules_rust doesn't implement this flag properly with remote exec...
 # common --@rules_rust//rust/settings:pipelined_compilation
diff --git a/.github/workflows/bazel.yml b/.github/workflows/bazel.yml
index 79d963a537..e795375758 100644
--- a/.github/workflows/bazel.yml
+++ b/.github/workflows/bazel.yml
@@ -17,6 +17,7 @@ concurrency:
   cancel-in-progress: ${{ github.ref_name != 'main' }}
 jobs:
   test:
+    timeout-minutes: 120
     strategy:
       fail-fast: false
       matrix:
@@ -39,18 +40,24 @@ jobs:
           # - os: ubuntu-24.04-arm
           #   target: aarch64-unknown-linux-gnu
 
-          # TODO: Enable Windows once we fix the toolchain issues there.
-          #- os: windows-latest
-          #  target: x86_64-pc-windows-gnullvm
+          # Windows
+          - os: windows-latest
+            target: x86_64-pc-windows-gnullvm
     runs-on: ${{ matrix.os }}
 
     # Configure a human readable name for each job
     name: Local Bazel build on ${{ matrix.os }} for ${{ matrix.target }}
 
     steps:
+      - name: Skip non-Windows Bazel PR jobs
+        if: github.event_name == 'pull_request' && runner.os != 'Windows' && (matrix.os != 'ubuntu-24.04' || matrix.target != 'x86_64-unknown-linux-gnu')
+        run: echo "Skipping non-Windows Bazel job while iterating on Windows support."
+
       - uses: actions/checkout@v6
+        if: github.event_name != 'pull_request' || runner.os == 'Windows' || (matrix.os == 'ubuntu-24.04' && matrix.target == 'x86_64-unknown-linux-gnu')
 
       - name: Set up Node.js for js_repl tests
+        if: github.event_name != 'pull_request' || runner.os == 'Windows'
         uses: actions/setup-node@v6
         with:
           node-version-file: codex-rs/node-version.txt
@@ -58,10 +65,11 @@ jobs:
       # Some integration tests rely on DotSlash being installed.
       # See https://github.com/openai/codex/pull/7617.
       - name: Install DotSlash
+        if: github.event_name != 'pull_request' || runner.os == 'Windows'
         uses: facebook/install-dotslash@v2
 
       - name: Make DotSlash available in PATH (Unix)
-        if: runner.os != 'Windows'
+        if: github.event_name != 'pull_request' && runner.os != 'Windows'
         run: cp "$(which dotslash)" /usr/local/bin
 
       - name: Make DotSlash available in PATH (Windows)
@@ -71,6 +79,7 @@ jobs:
 
       # Install Bazel via Bazelisk
       - name: Set up Bazel
+        if: github.event_name != 'pull_request' || runner.os == 'Windows'
         uses: bazelbuild/setup-bazelisk@v3
 
       - name: Check MODULE.bazel.lock is up to date
@@ -81,6 +90,7 @@ jobs:
       # Restore bazel repository cache so we don't have to redownload all the external dependencies
       # on every CI run.
       - name: Restore bazel repository cache
+        if: github.event_name != 'pull_request' || runner.os == 'Windows'
         id: cache_bazel_repository_restore
         uses: actions/cache/restore@v5
         with:
@@ -94,10 +104,17 @@ jobs:
         if: runner.os == 'Windows'
         shell: pwsh
         run: |
-          # Use a very short path to reduce argv/path length issues.
-          "BAZEL_STARTUP_ARGS=--output_user_root=C:\" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+          # Use a very short path to reduce argv/path length issues, but avoid the
+          # drive root because some Windows test launchers mis-handle MANIFEST paths there.
+          "BAZEL_STARTUP_ARGS=--output_user_root=D:\b" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+
+      - name: Enable Git long paths (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: git config --global core.longpaths true
 
       - name: bazel test //...
+        if: github.event_name != 'pull_request' || runner.os == 'Windows'
         env:
           BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
         shell: bash
@@ -224,7 +241,7 @@ jobs:
       # Save bazel repository cache explicitly; make non-fatal so cache uploading
       # never fails the overall job. Only save when key wasn't hit.
       - name: Save bazel repository cache
-        if: always() && !cancelled() && steps.cache_bazel_repository_restore.outputs.cache-hit != 'true'
+        if: (github.event_name != 'pull_request' || runner.os == 'Windows') && always() && !cancelled() && steps.cache_bazel_repository_restore.outputs.cache-hit != 'true'
         continue-on-error: true
         uses: actions/cache/save@v5
         with: