ci: run Windows argument-comment-lint via native Bazel

.github/actions/setup-bazel-ci/action.yml

@@ -60,8 +60,15 @@ runs:
         # Use the shortest available drive to reduce argv/path length issues,
         # but avoid the drive root because some Windows test launchers mis-handle
         # MANIFEST paths there.
-        $bazelOutputUserRoot = if (Test-Path 'D:\') { 'D:\b' } else { 'C:\b' }
+        $hasDDrive = Test-Path 'D:\'
+        $bazelOutputUserRoot = if ($hasDDrive) { 'D:\b' } else { 'C:\b' }
+        $repoContentsCache = Join-Path $env:RUNNER_TEMP "bazel-repo-contents-cache-$env:GITHUB_RUN_ID-$env:GITHUB_JOB"
         "BAZEL_OUTPUT_USER_ROOT=$bazelOutputUserRoot" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+        "BAZEL_REPO_CONTENTS_CACHE=$repoContentsCache" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+        if (-not $hasDDrive) {
+          $repositoryCache = Join-Path $env:USERPROFILE '.cache\bazel-repo-cache'
+          "BAZEL_REPOSITORY_CACHE=$repositoryCache" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+        }
 
     - name: Enable Git long paths (Windows)
       if: runner.os == 'Windows'

.github/scripts/run-argument-comment-lint-bazel.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+manual_rust_test_targets=()
+cquery_stdout="$(mktemp)"
+cquery_stderr="$(mktemp)"
+trap 'rm -f "$cquery_stdout" "$cquery_stderr"' EXIT
+
+ci_config=ci-linux
+case "${RUNNER_OS:-}" in
+  macOS)
+    ci_config=ci-macos
+    ;;
+  Windows)
+    ci_config=ci-windows
+    ;;
+esac
+
+bazel_startup_args=()
+if [[ -n "${BAZEL_OUTPUT_USER_ROOT:-}" ]]; then
+  bazel_startup_args+=("--output_user_root=${BAZEL_OUTPUT_USER_ROOT}")
+fi
+
+cquery_args=("$@" "--config=${ci_config}" "--keep_going")
+if [[ -n "${BAZEL_REPO_CONTENTS_CACHE:-}" ]]; then
+  cquery_args+=("--repo_contents_cache=${BAZEL_REPO_CONTENTS_CACHE}")
+fi
+if [[ -n "${BAZEL_REPOSITORY_CACHE:-}" ]]; then
+  cquery_args+=("--repository_cache=${BAZEL_REPOSITORY_CACHE}")
+fi
+if [[ -n "${BUILDBUDDY_API_KEY:-}" ]]; then
+  cquery_args+=("--remote_header=x-buildbuddy-api-key=${BUILDBUDDY_API_KEY}")
+fi
+
+# Wildcard target patterns skip manual-tagged unit-test binaries, so resolve
+# them explicitly to keep Bazel lint coverage aligned with Cargo --all-targets.
+# Use cquery with the active Bazel flags so platform-incompatible manual tests
+# are filtered out before the build, especially on Windows.
+manual_rust_test_query='kind("rust_test rule", attr("tags", "manual", //codex-rs/...))'
+if ! bazel "${bazel_startup_args[@]}" \
+  --noexperimental_remote_repo_contents_cache \
+  cquery \
+  "${cquery_args[@]}" \
+  --output=label \
+  "$manual_rust_test_query" >"$cquery_stdout" 2>"$cquery_stderr"; then
+  if [[ ! -s "$cquery_stdout" ]]; then
+    cat "$cquery_stderr" >&2
+    exit 1
+  fi
+fi
+
+while IFS= read -r label; do
+  [[ -n "$label" ]] || continue
+  # cquery emits configured target labels as `//pkg:target (abcdef0)`. Strip
+  # the configuration hash before passing the label back to `bazel build`.
+  label="${label%% (*}"
+  manual_rust_test_targets+=("$label")
+done <"$cquery_stdout"
+
+./.github/scripts/run-bazel-ci.sh \
+  -- \
+  build \
+  "$@" \
+  -- \
+  //codex-rs/... \
+  "${manual_rust_test_targets[@]}"

.github/scripts/run-bazel-ci.sh

@@ -126,6 +126,17 @@ if [[ $remote_download_toplevel -eq 1 ]]; then
   post_config_bazel_args+=(--remote_download_toplevel)
 fi
 
+if [[ -n "${BAZEL_REPO_CONTENTS_CACHE:-}" ]]; then
+  # Windows self-hosted runners can run multiple Bazel jobs concurrently. Give
+  # each job its own repo contents cache so they do not fight over the shared
+  # path configured in `ci-windows`.
+  post_config_bazel_args+=("--repo_contents_cache=${BAZEL_REPO_CONTENTS_CACHE}")
+fi
+
+if [[ -n "${BAZEL_REPOSITORY_CACHE:-}" ]]; then
+  post_config_bazel_args+=("--repository_cache=${BAZEL_REPOSITORY_CACHE}")
+fi
+
 bazel_console_log="$(mktemp)"
 trap 'rm -f "$bazel_console_log"' EXIT
 

.github/workflows/rust-ci-full.yml

@@ -100,16 +100,28 @@ jobs:
           sudo DEBIAN_FRONTEND=noninteractive apt-get update
           sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends pkg-config libcap-dev
       - name: Run argument comment lint on codex-rs via Bazel
+        if: ${{ runner.os != 'Windows' }}
+        env:
+          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
         shell: bash
         run: |
-          ./.github/scripts/run-bazel-ci.sh \
-            -- \
-            build \
+          ./.github/scripts/run-argument-comment-lint-bazel.sh \
             --config=argument-comment-lint \
             --keep_going \
-            --build_metadata=COMMIT_SHA=${GITHUB_SHA} \
-            -- \
-            //codex-rs/...
+            --build_metadata=COMMIT_SHA=${GITHUB_SHA}
+      - name: Run argument comment lint on codex-rs via Bazel
+        if: ${{ runner.os == 'Windows' }}
+        env:
+          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
+        shell: bash
+        run: |
+          ./.github/scripts/run-argument-comment-lint-bazel.sh \
+            --config=argument-comment-lint \
+            --host_platform=//:local_windows_msvc \
+            --platforms=//:local_windows \
+            --extra_execution_platforms=//:local_windows \
+            --keep_going \
+            --build_metadata=COMMIT_SHA=${GITHUB_SHA}
 
   # --- CI to validate on different os/targets --------------------------------
   lint_build:

.github/workflows/rust-ci.yml

@@ -159,35 +159,29 @@ jobs:
         run: |
           sudo DEBIAN_FRONTEND=noninteractive apt-get update
           sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends pkg-config libcap-dev
-      - name: Install nightly argument-comment-lint toolchain
-        if: ${{ runner.os == 'Windows' }}
-        shell: bash
-        run: |
-          rustup toolchain install nightly-2025-09-18 \
-            --profile minimal \
-            --component llvm-tools-preview \
-            --component rustc-dev \
-            --component rust-src \
-            --no-self-update
-          rustup default nightly-2025-09-18
       - name: Run argument comment lint on codex-rs via Bazel
         if: ${{ runner.os != 'Windows' }}
         env:
           BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
         shell: bash
         run: |
-          ./.github/scripts/run-bazel-ci.sh \
-            -- \
-            build \
+          ./.github/scripts/run-argument-comment-lint-bazel.sh \
             --config=argument-comment-lint \
             --keep_going \
-            --build_metadata=COMMIT_SHA=${GITHUB_SHA} \
-            -- \
-            //codex-rs/...
-      - name: Run argument comment lint on codex-rs via packaged wrapper
+            --build_metadata=COMMIT_SHA=${GITHUB_SHA}
+      - name: Run argument comment lint on codex-rs via Bazel
         if: ${{ runner.os == 'Windows' }}
+        env:
+          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
         shell: bash
-        run: python3 ./tools/argument-comment-lint/run-prebuilt-linter.py
+        run: |
+          ./.github/scripts/run-argument-comment-lint-bazel.sh \
+            --config=argument-comment-lint \
+            --host_platform=//:local_windows_msvc \
+            --platforms=//:local_windows \
+            --extra_execution_platforms=//:local_windows \
+            --keep_going \
+            --build_metadata=COMMIT_SHA=${GITHUB_SHA}
 
   # --- Gatherer job that you mark as the ONLY required status -----------------
   results: