ci: run Windows argument-comment-lint via native Bazel

.github/scripts/run-argument-comment-lint-bazel.sh

@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+manual_rust_test_targets=()
+incompatible_manual_rust_test_targets=()
+cquery_stdout="$(mktemp)"
+cquery_stderr="$(mktemp)"
+trap 'rm -f "$cquery_stdout" "$cquery_stderr"' EXIT
+
+ci_config=ci-linux
+case "${RUNNER_OS:-}" in
+  macOS)
+    ci_config=ci-macos
+    ;;
+  Windows)
+    ci_config=ci-windows
+    ;;
+esac
+
+bazel_startup_args=()
+if [[ -n "${BAZEL_OUTPUT_USER_ROOT:-}" ]]; then
+  bazel_startup_args+=("--output_user_root=${BAZEL_OUTPUT_USER_ROOT}")
+fi
+
+cquery_args=("$@" "--config=${ci_config}" "--keep_going")
+if [[ -n "${BAZEL_REPO_CONTENTS_CACHE:-}" ]]; then
+  cquery_args+=("--repo_contents_cache=${BAZEL_REPO_CONTENTS_CACHE}")
+fi
+if [[ -n "${BAZEL_REPOSITORY_CACHE:-}" ]]; then
+  cquery_args+=("--repository_cache=${BAZEL_REPOSITORY_CACHE}")
+fi
+if [[ -n "${BUILDBUDDY_API_KEY:-}" ]]; then
+  cquery_args+=("--remote_header=x-buildbuddy-api-key=${BUILDBUDDY_API_KEY}")
+fi
+
+# Wildcard target patterns skip manual-tagged unit-test binaries, so resolve
+# them explicitly to keep Bazel lint coverage aligned with Cargo --all-targets.
+# Use cquery with the active Bazel flags so platform-incompatible manual tests
+# are filtered out before the build, especially on Windows.
+manual_rust_test_query='kind("rust_test rule", attr("tags", "manual", //codex-rs/...))'
+if ! bazel "${bazel_startup_args[@]}" \
+  --noexperimental_remote_repo_contents_cache \
+  cquery \
+  "${cquery_args[@]}" \
+  --output=label \
+  "$manual_rust_test_query" >"$cquery_stdout" 2>"$cquery_stderr"; then
+  if [[ ! -s "$cquery_stdout" ]]; then
+    cat "$cquery_stderr" >&2
+    exit 1
+  fi
+fi
+
+while IFS= read -r label; do
+  [[ -n "$label" ]] || continue
+  incompatible_manual_rust_test_targets+=("$label")
+done < <(
+  sed -n 's/^Target \(\/\/[^ ]*\) is incompatible and cannot be built, but was explicitly requested\.$/\1/p' "$cquery_stderr"
+)
+
+is_incompatible_manual_rust_test_target() {
+  local candidate="$1"
+  local incompatible_label
+  for incompatible_label in "${incompatible_manual_rust_test_targets[@]}"; do
+    if [[ "$candidate" == "$incompatible_label" ]]; then
+      return 0
+    fi
+  done
+  return 1
+}
+
+manual_rust_test_target_is_compatible() {
+  local candidate="$1"
+  local compatibility_stderr
+  compatibility_stderr="$(mktemp)"
+  if bazel "${bazel_startup_args[@]}" \
+    --noexperimental_remote_repo_contents_cache \
+    cquery \
+    "${cquery_args[@]}" \
+    --output=label \
+    "$candidate" > /dev/null 2>"$compatibility_stderr"; then
+    rm -f "$compatibility_stderr"
+    return 0
+  fi
+
+  if grep -Fq "Target ${candidate} is incompatible and cannot be built, but was explicitly requested." "$compatibility_stderr"; then
+    rm -f "$compatibility_stderr"
+    return 1
+  fi
+
+  cat "$compatibility_stderr" >&2
+  rm -f "$compatibility_stderr"
+  exit 1
+}
+
+while IFS= read -r label; do
+  [[ -n "$label" ]] || continue
+  # cquery emits configured target labels as `//pkg:target (abcdef0)`. Strip
+  # the configuration hash before passing the label back to `bazel build`.
+  label="${label%% (*}"
+  if is_incompatible_manual_rust_test_target "$label"; then
+    continue
+  fi
+  if [[ "${RUNNER_OS:-}" == "Windows" ]] && ! manual_rust_test_target_is_compatible "$label"; then
+    continue
+  fi
+  manual_rust_test_targets+=("$label")
+done <"$cquery_stdout"
+
+./.github/scripts/run-bazel-ci.sh \
+  -- \
+  build \
+  "$@" \
+  -- \
+  //codex-rs/... \
+  "${manual_rust_test_targets[@]}"

.github/scripts/run-bazel-ci.sh

@@ -126,6 +126,17 @@ if [[ $remote_download_toplevel -eq 1 ]]; then
   post_config_bazel_args+=(--remote_download_toplevel)
 fi
 
+if [[ -n "${BAZEL_REPO_CONTENTS_CACHE:-}" ]]; then
+  # Windows self-hosted runners can run multiple Bazel jobs concurrently. Give
+  # each job its own repo contents cache so they do not fight over the shared
+  # path configured in `ci-windows`.
+  post_config_bazel_args+=("--repo_contents_cache=${BAZEL_REPO_CONTENTS_CACHE}")
+fi
+
+if [[ -n "${BAZEL_REPOSITORY_CACHE:-}" ]]; then
+  post_config_bazel_args+=("--repository_cache=${BAZEL_REPOSITORY_CACHE}")
+fi
+
 bazel_console_log="$(mktemp)"
 trap 'rm -f "$bazel_console_log"' EXIT