[codex] Eliminate direct writes to GITHUB_ENV

.github/scripts/compute-bazel-windows-path.ps1

@@ -8,9 +8,9 @@ This script derives a smaller, cache-stable PATH that keeps the Windows
 toolchain entries Bazel-backed CI tasks need: MSVC and Windows SDK paths,
 MinGW runtime DLL paths for gnullvm-built tests, Git, PowerShell, Node, Python,
 DotSlash, and the standard Windows system directories.
-`setup-bazel-ci` runs this after exporting the MSVC environment, and the script
-publishes the result via `GITHUB_ENV` as `CODEX_BAZEL_WINDOWS_PATH` so later
-steps can pass that explicit PATH to Bazel.
+`setup-bazel-ci` runs this after materializing the MSVC environment, and the
+script returns the derived PATH so the composite action can expose it as an
+explicit output for later Bazel steps.
 #>
 
 $stablePathEntries = New-Object System.Collections.Generic.List[string]
@@ -101,13 +101,9 @@ if ($stablePathEntries.Count -eq 0) {
   throw 'Failed to derive cache-stable Windows PATH.'
 }
 
-if ([string]::IsNullOrWhiteSpace($env:GITHUB_ENV)) {
-  throw 'GITHUB_ENV must be set.'
-}
-
 $stablePath = $stablePathEntries -join ';'
 Write-Host 'Derived CODEX_BAZEL_WINDOWS_PATH entries:'
 foreach ($pathEntry in $stablePathEntries) {
   Write-Host "  $pathEntry"
 }
-"CODEX_BAZEL_WINDOWS_PATH=$stablePath" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+Write-Output $stablePath

.github/scripts/load-bazel-ci-config.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+
+load_bazel_ci_config() {
+  local config_path="${CODEX_BAZEL_CI_CONFIG:-}"
+  if [[ -z "$config_path" ]]; then
+    return
+  fi
+
+  if [[ ! -f "$config_path" ]]; then
+    echo "Bazel CI config file not found: $config_path" >&2
+    exit 1
+  fi
+
+  local name
+  local value
+  while IFS=$'\t' read -r name value; do
+    [[ -n "$name" ]] || continue
+    value="${value%$'\r'}"
+    case "$name" in
+      BAZEL_REPOSITORY_CACHE | \
+      BAZEL_OUTPUT_USER_ROOT | \
+      BAZEL_REPO_CONTENTS_CACHE | \
+      CODEX_BAZEL_EXECUTION_LOG_COMPACT_DIR | \
+      CODEX_BAZEL_WINDOWS_PATH | \
+      INCLUDE | \
+      LIB | \
+      LIBPATH | \
+      UCRTVersion | \
+      UniversalCRTSdkDir | \
+      VCINSTALLDIR | \
+      VCToolsInstallDir | \
+      WindowsLibPath | \
+      WindowsSdkBinPath | \
+      WindowsSdkDir | \
+      WindowsSDKLibVersion | \
+      WindowsSDKVersion)
+        if [[ -z "${!name:-}" ]]; then
+          printf -v "$name" '%s' "$value"
+          export "$name"
+        fi
+        ;;
+      *)
+        echo "Unknown Bazel CI config key: $name" >&2
+        exit 1
+        ;;
+    esac
+  done < "$config_path"
+}

.github/scripts/run-bazel-ci.sh

@@ -2,6 +2,9 @@
 
 set -euo pipefail
 
+source "$(dirname "${BASH_SOURCE[0]}")/load-bazel-ci-config.sh"
+load_bazel_ci_config
+
 print_failed_bazel_test_logs=0
 print_failed_bazel_action_summary=0
 remote_download_toplevel=0

.github/scripts/run-bazel-query-ci.sh

@@ -2,6 +2,9 @@
 
 set -euo pipefail
 
+source "$(dirname "${BASH_SOURCE[0]}")/load-bazel-ci-config.sh"
+load_bazel_ci_config
+
 # Run Bazel queries with the same CI startup settings as the main build/test
 # invocation so target-discovery queries can reuse the same Bazel server.