ci: isolate Windows lint execution environments

.bazelrc

@@ -165,11 +165,15 @@ common:ci-windows --config=ci-bazel
 common:ci-windows --build_metadata=TAG_os=windows
 common:ci-windows --repo_contents_cache=D:/a/.cache/bazel-repo-contents-cache
 
-# Keep Windows Rust lint actions on the native gnullvm execution platform while
-# offloading only hermetic C++ compilation and linking to Linux RBE workers.
+# Keep Windows Rust, build-script, and lint actions on the native gnullvm
+# execution platform while offloading hermetic native and generator work to
+# Linux RBE workers.
 common:ci-windows-argument-lint --config=ci-windows
 common:ci-windows-argument-lint --extra_execution_platforms=//:rbe
-common:ci-windows-argument-lint --strategy=local
+common:ci-windows-argument-lint --strategy=Rustc=local
+common:ci-windows-argument-lint --strategy=RustcMetadata=local
+common:ci-windows-argument-lint --strategy=CargoBuildScriptRun=local
+common:ci-windows-argument-lint --strategy=ArgumentCommentLint=local
 common:ci-windows-argument-lint --strategy=CppCompile=remote
 common:ci-windows-argument-lint --strategy=CppArchive=remote
 common:ci-windows-argument-lint --strategy=CppLink=remote

.github/scripts/run-bazel-ci.sh

@@ -296,16 +296,18 @@ if [[ $remote_download_toplevel -eq 1 ]]; then
   post_config_bazel_args+=(--remote_download_toplevel)
 fi
 
-if [[ "${RUNNER_OS:-}" == "Windows" && $windows_cross_compile -eq 1 && -n "${BUILDBUDDY_API_KEY:-}" ]]; then
-  # `--enable_platform_specific_config` expands `common:windows` on Windows
-  # hosts after ordinary rc configs, which can override `ci-windows-cross`'s
-  # RBE host platform. Repeat the host platform on the command line so V8 and
-  # other genrules execute on Linux RBE workers instead of Git Bash locally.
-  #
-  # Bazel also derives the default genrule shell from the client host. Without
-  # an explicit shell executable, remote Linux actions can be asked to run
-  # `C:\Program Files\Git\usr\bin\bash.exe`.
-  post_config_bazel_args+=(--host_platform=//:rbe --shell_executable=/bin/bash)
+if [[ "${RUNNER_OS:-}" == "Windows" && -n "${BUILDBUDDY_API_KEY:-}" && ( $windows_cross_compile -eq 1 || "$ci_config" == "ci-windows-argument-lint" ) ]]; then
+  # Bazel derives the default genrule shell from the client host. Remote Linux
+  # actions must not be asked to run Git Bash from the Windows runner.
+  post_config_bazel_args+=(--shell_executable=/bin/bash)
+
+  if [[ $windows_cross_compile -eq 1 ]]; then
+    # `--enable_platform_specific_config` expands `common:windows` on Windows
+    # hosts after ordinary rc configs, which can override `ci-windows-cross`'s
+    # RBE host platform. Repeat it on the command line for cross builds. The
+    # argument-lint lane keeps its gnullvm host platform for local Rust actions.
+    post_config_bazel_args+=(--host_platform=//:rbe)
+  fi
 fi
 
 if [[ "${RUNNER_OS:-}" == "Windows" && $windows_cross_compile -eq 1 && -z "${BUILDBUDDY_API_KEY:-}" ]]; then
@@ -334,10 +336,10 @@ fi
 
 if [[ "${RUNNER_OS:-}" == "Windows" ]]; then
   pass_windows_build_env=1
-  if [[ $windows_cross_compile -eq 1 && -n "${BUILDBUDDY_API_KEY:-}" ]]; then
-    # Remote build actions execute on Linux RBE workers. Passing the Windows
-    # runner's build environment there makes Bazel genrules try to execute
-    # C:\Program Files\Git\usr\bin\bash.exe on Linux.
+  if [[ -n "${BUILDBUDDY_API_KEY:-}" && ( $windows_cross_compile -eq 1 || "$ci_config" == "ci-windows-argument-lint" ) ]]; then
+    # Generic build actions execute on Linux RBE workers. Passing the Windows
+    # runner's compiler environment there leaks VS/SDK paths and makes genrules
+    # try to execute tools that do not exist on the worker.
     pass_windows_build_env=0
   fi
 
@@ -374,10 +376,10 @@ if [[ "${RUNNER_OS:-}" == "Windows" ]]; then
       "--action_env=PATH=${CODEX_BAZEL_WINDOWS_PATH}"
       "--host_action_env=PATH=${CODEX_BAZEL_WINDOWS_PATH}"
     )
-  elif [[ $windows_cross_compile -eq 1 ]]; then
+  else
     # Remote build actions run on Linux RBE workers. Give their shell snippets
-    # a Linux PATH while preserving CODEX_BAZEL_WINDOWS_PATH below for local
-    # Windows test execution.
+    # a frozen Linux PATH while preserving CODEX_BAZEL_WINDOWS_PATH below only
+    # for local Windows test execution.
     post_config_bazel_args+=(
       "--action_env=PATH=/usr/bin:/bin"
       "--host_action_env=PATH=/usr/bin:/bin"

.github/scripts/test_run_bazel_with_buildbuddy.py

@@ -119,6 +119,76 @@ class RunBazelWithBuildBuddyTest(unittest.TestCase):
             ],
         )
 
+    def test_windows_argument_lint_separates_remote_build_and_test_environments(
+        self,
+    ) -> None:
+        with TemporaryDirectory() as temp_dir:
+            fake_bazel = Path(temp_dir) / "fake-bazel"
+            fake_bazel.write_text(
+                "#!/usr/bin/env python3\n"
+                "import json\n"
+                "import sys\n"
+                "print(json.dumps(sys.argv[1:]))\n",
+                encoding="utf-8",
+            )
+            fake_bazel.chmod(0o755)
+
+            env = os.environ.copy()
+            for name in (
+                "GITHUB_ACTIONS",
+                "GITHUB_EVENT_NAME",
+                "GITHUB_EVENT_PATH",
+                "GITHUB_REPOSITORY",
+            ):
+                env.pop(name, None)
+            env.update(
+                {
+                    "BUILDBUDDY_API_KEY": "token",
+                    "CODEX_BAZEL_BIN": str(fake_bazel),
+                    "CODEX_BAZEL_WINDOWS_PATH": r"C:\runtime\bin",
+                    "INCLUDE": r"C:\Visual Studio\include",
+                    "RUNNER_OS": "Windows",
+                }
+            )
+
+            result = subprocess.run(
+                [
+                    "bash",
+                    str(Path(__file__).with_name("run-bazel-ci.sh")),
+                    "--",
+                    "build",
+                    "--config=argument-comment-lint",
+                    "--",
+                    "//codex-rs/arg0:arg0",
+                ],
+                env=env,
+                check=False,
+                capture_output=True,
+                text=True,
+            )
+
+            self.assertEqual(result.returncode, 0, result.stderr)
+            command = next(
+                json.loads(line)
+                for line in result.stdout.splitlines()
+                if line.startswith("[")
+            )
+            self.assertIn("--config=ci-windows-argument-lint", command)
+            self.assertIn("--shell_executable=/bin/bash", command)
+            self.assertIn("--action_env=PATH=/usr/bin:/bin", command)
+            self.assertIn("--host_action_env=PATH=/usr/bin:/bin", command)
+            self.assertIn(r"--test_env=PATH=C:\runtime\bin", command)
+            self.assertNotIn("--host_platform=//:rbe", command)
+            self.assertNotIn("--action_env=INCLUDE", command)
+            self.assertNotIn("--host_action_env=INCLUDE", command)
+            self.assertFalse(
+                any(
+                    arg.startswith("--action_env=PATH=C:")
+                    or arg.startswith("--host_action_env=PATH=C:")
+                    for arg in command
+                )
+            )
+
     def test_query_remote_configuration_is_inserted_before_expression(self) -> None:
         expression = 'kind("rust_library rule", //codex-rs/...)'
         env = {"BUILDBUDDY_API_KEY": "fork-token"}