build: remove MSVC from Windows Bazel build actions

.bazelrc

@@ -207,8 +207,8 @@ common:ci-windows-cross --test_env=RUST_TEST_THREADS=1
 # the hidden dynamic-tool callback test, which currently times out on Windows.
 common:ci-windows-cross --test_env=CODEX_BAZEL_TEST_SKIP_FILTERS=powershell,suite::code_mode::code_mode_can_call_hidden_dynamic_tools
 common:ci-windows-cross --platforms=//:windows_x86_64_gnullvm
-common:ci-windows-cross --extra_execution_platforms=//:rbe,//:windows_x86_64_msvc
-common:ci-windows-cross --extra_toolchains=//:windows_gnullvm_tests_on_msvc_host_toolchain
+common:ci-windows-cross --extra_execution_platforms=//:rbe,//:windows_x86_64_gnullvm
+common:ci-windows-cross --extra_toolchains=//:windows_gnullvm_tests_on_gnullvm_host_toolchain
 
 # Linux-only V8 CI config.
 common:ci-v8 --config=ci

.github/actions/setup-bazel-ci/action.yml

@@ -59,64 +59,7 @@ runs:
         "BAZEL_OUTPUT_USER_ROOT=$bazelOutputUserRoot" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
         "BAZEL_REPO_CONTENTS_CACHE=$repoContentsCache" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
 
-    - name: Expose MSVC SDK environment (Windows)
-      if: runner.os == 'Windows'
-      shell: pwsh
-      run: |
-        # Bazel exec-side Rust build scripts do not reliably inherit the MSVC developer
-        # shell on GitHub-hosted Windows runners, so discover the latest VS install and
-        # ask `VsDevCmd.bat` to materialize the x64/x64 compiler + SDK environment.
-        $vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
-        if (-not (Test-Path $vswhere)) {
-          throw "vswhere.exe not found"
-        }
-
-        $installPath = & $vswhere -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath 2>$null
-        if (-not $installPath) {
-          throw "Could not locate a Visual Studio installation with VC tools"
-        }
-
-        $vsDevCmd = Join-Path $installPath 'Common7\Tools\VsDevCmd.bat'
-        if (-not (Test-Path $vsDevCmd)) {
-          throw "VsDevCmd.bat not found at $vsDevCmd"
-        }
-
-        # Keep the export surface explicit: these are the paths and SDK roots that the
-        # MSVC toolchain probes need later when Bazel runs Windows exec-platform build
-        # scripts such as `aws-lc-sys`.
-        $varsToExport = @(
-          'INCLUDE',
-          'LIB',
-          'LIBPATH',
-          'PATH',
-          'UCRTVersion',
-          'UniversalCRTSdkDir',
-          'VCINSTALLDIR',
-          'VCToolsInstallDir',
-          'WindowsLibPath',
-          'WindowsSdkBinPath',
-          'WindowsSdkDir',
-          'WindowsSDKLibVersion',
-          'WindowsSDKVersion'
-        )
-
-        # `VsDevCmd.bat` is a batch file, so invoke it under `cmd.exe`, suppress its
-        # banner, then dump the resulting environment with `set`. Re-export only the
-        # approved keys into `GITHUB_ENV` so later steps inherit the same MSVC context.
-        $envLines = & cmd.exe /c ('"{0}" -no_logo -arch=x64 -host_arch=x64 >nul && set' -f $vsDevCmd)
-        foreach ($line in $envLines) {
-          if ($line -notmatch '^(.*?)=(.*)$') {
-            continue
-          }
-
-          $name = $matches[1]
-          $value = $matches[2]
-          if ($varsToExport -contains $name) {
-            "$name=$value" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
-          }
-        }
-
-    - name: Compute cache-stable Windows Bazel PATH
+    - name: Configure frozen Windows Bazel paths
       if: runner.os == 'Windows'
       shell: pwsh
       run: ./.github/scripts/compute-bazel-windows-path.ps1

.github/scripts/compute-bazel-windows-path.ps1

@@ -1,113 +1,59 @@
 <#
-BuildBuddy cache keys include the action and test environment, so Bazel should
-not inherit the full hosted-runner PATH on Windows. That PATH includes volatile
-tool entries, such as Maven, that can change independently of this repo and
-cause avoidable cache misses.
-
-This script derives a smaller, cache-stable PATH that keeps the Windows
-toolchain entries Bazel-backed CI tasks need: MSVC and Windows SDK paths,
-MinGW runtime DLL paths for gnullvm-built tests, Git, PowerShell, Node, Python,
-DotSlash, and the standard Windows system directories.
-`setup-bazel-ci` runs this after exporting the MSVC environment, and the script
-publishes the result via `GITHUB_ENV` as `CODEX_BAZEL_WINDOWS_PATH` so later
-steps can pass that explicit PATH to Bazel.
+Bazel build actions must not inherit the hosted-runner PATH. Keep their
+execution substrate fixed to Windows and the Git-for-Windows shell utilities
+that Bazel genrules already use. Test actions get a separate fixed path with
+the product runtimes exercised by Windows tests (Git, PowerShell, and
+DotSlash). Compiler, SDK, MinGW, hosted Python, and hosted Node directories are
+intentionally absent from both values.
 #>
 
-$stablePathEntries = New-Object System.Collections.Generic.List[string]
-$seenEntries = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
-$windowsAppsPath = if ([string]::IsNullOrWhiteSpace($env:LOCALAPPDATA)) {
-  $null
-} else {
-  "$($env:LOCALAPPDATA)\Microsoft\WindowsApps"
-}
 $windowsDir = if ($env:WINDIR) {
   $env:WINDIR
 } elseif ($env:SystemRoot) {
   $env:SystemRoot
 } else {
-  $null
+  throw 'WINDIR or SystemRoot must be set.'
 }
 
-function Add-StablePathEntry {
-  param([string]$PathEntry)
-
-  if ([string]::IsNullOrWhiteSpace($PathEntry)) {
-    return
-  }
-
-  if ($seenEntries.Add($PathEntry)) {
-    [void]$stablePathEntries.Add($PathEntry)
-  }
+if ([string]::IsNullOrWhiteSpace($env:ProgramFiles)) {
+  throw 'ProgramFiles must be set.'
 }
-
-foreach ($pathEntry in ($env:PATH -split ';')) {
-  if ([string]::IsNullOrWhiteSpace($pathEntry)) {
-    continue
-  }
-
-  if (
-    $pathEntry -like '*Microsoft Visual Studio*' -or
-    $pathEntry -like '*Windows Kits*' -or
-    $pathEntry -like '*Microsoft SDKs*' -or
-    $pathEntry -eq 'C:\mingw64\bin' -or
-    $pathEntry -like 'C:\msys64\*\bin' -or
-    $pathEntry -like 'C:\Program Files\Git\*' -or
-    $pathEntry -like 'C:\Program Files\PowerShell\*' -or
-    $pathEntry -like 'C:\hostedtoolcache\windows\node\*' -or
-    $pathEntry -like 'C:\hostedtoolcache\windows\Python\*' -or
-    $pathEntry -eq 'D:\a\_temp\install-dotslash\bin' -or
-    ($windowsDir -and ($pathEntry -eq $windowsDir -or $pathEntry -like "${windowsDir}\*"))
-  ) {
-    Add-StablePathEntry $pathEntry
-  }
+if ([string]::IsNullOrWhiteSpace($env:LOCALAPPDATA)) {
+  throw 'LOCALAPPDATA must be set.'
 }
-
-$gitCommand = Get-Command git -ErrorAction SilentlyContinue
-if ($gitCommand) {
-  Add-StablePathEntry (Split-Path $gitCommand.Source -Parent)
-}
-
-$nodeCommand = Get-Command node -ErrorAction SilentlyContinue
-if ($nodeCommand) {
-  Add-StablePathEntry (Split-Path $nodeCommand.Source -Parent)
-}
-
-$python3Command = Get-Command python3 -ErrorAction SilentlyContinue
-if ($python3Command) {
-  Add-StablePathEntry (Split-Path $python3Command.Source -Parent)
-}
-
-$pythonCommand = Get-Command python -ErrorAction SilentlyContinue
-if ($pythonCommand) {
-  Add-StablePathEntry (Split-Path $pythonCommand.Source -Parent)
-}
-
-$pwshCommand = Get-Command pwsh -ErrorAction SilentlyContinue
-if ($pwshCommand) {
-  Add-StablePathEntry (Split-Path $pwshCommand.Source -Parent)
-}
-
-foreach ($mingwPath in @('C:\mingw64\bin', 'C:\msys64\mingw64\bin', 'C:\msys64\ucrt64\bin')) {
-  if (Test-Path $mingwPath) {
-    Add-StablePathEntry $mingwPath
-  }
-}
-
-if ($windowsAppsPath) {
-  Add-StablePathEntry $windowsAppsPath
-}
-
-if ($stablePathEntries.Count -eq 0) {
-  throw 'Failed to derive cache-stable Windows PATH.'
-}
-
 if ([string]::IsNullOrWhiteSpace($env:GITHUB_ENV)) {
   throw 'GITHUB_ENV must be set.'
 }
 
-$stablePath = $stablePathEntries -join ';'
-Write-Host 'Derived CODEX_BAZEL_WINDOWS_PATH entries:'
-foreach ($pathEntry in $stablePathEntries) {
-  Write-Host "  $pathEntry"
+$gitRoot = Join-Path $env:ProgramFiles 'Git'
+$executionPathEntries = @(
+  (Join-Path $gitRoot 'usr\bin'),
+  (Join-Path $windowsDir 'System32'),
+  $windowsDir
+)
+$testPathEntries = @(
+  (Join-Path $env:ProgramFiles 'PowerShell\7'),
+  (Join-Path $gitRoot 'bin'),
+  (Join-Path $gitRoot 'usr\bin'),
+  (Join-Path $env:LOCALAPPDATA 'Microsoft\WindowsApps'),
+  (Join-Path $windowsDir 'System32'),
+  $windowsDir
+)
+
+$requiredPathEntries = ($executionPathEntries + $testPathEntries) | Select-Object -Unique
+foreach ($pathEntry in $requiredPathEntries) {
+  if (-not (Test-Path $pathEntry)) {
+    throw "Required Windows Bazel substrate path does not exist: $pathEntry"
+  }
 }
-"CODEX_BAZEL_WINDOWS_PATH=$stablePath" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+
+$executionPath = $executionPathEntries -join ';'
+$testPath = $testPathEntries -join ';'
+
+Write-Host 'Frozen CODEX_BAZEL_WINDOWS_EXECUTION_PATH entries:'
+$executionPathEntries | ForEach-Object { Write-Host "  $_" }
+Write-Host 'Frozen CODEX_BAZEL_WINDOWS_TEST_PATH entries:'
+$testPathEntries | ForEach-Object { Write-Host "  $_" }
+
+"CODEX_BAZEL_WINDOWS_EXECUTION_PATH=$executionPath" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+"CODEX_BAZEL_WINDOWS_TEST_PATH=$testPath" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append

.github/scripts/run-bazel-ci.sh

@@ -5,7 +5,6 @@ set -euo pipefail
 print_failed_bazel_test_logs=0
 print_failed_bazel_action_summary=0
 remote_download_toplevel=0
-windows_msvc_host_platform=0
 windows_cross_compile=0
 windows_hybrid_execution=0
 
@@ -23,10 +22,6 @@ while [[ $# -gt 0 ]]; do
       remote_download_toplevel=1
       shift
       ;;
-    --windows-msvc-host-platform)
-      windows_msvc_host_platform=1
-      shift
-      ;;
     --windows-cross-compile)
       windows_cross_compile=1
       shift
@@ -47,7 +42,7 @@ while [[ $# -gt 0 ]]; do
 done
 
 if [[ $# -eq 0 ]]; then
-  echo "Usage: $0 [--print-failed-test-logs] [--print-failed-action-summary] [--remote-download-toplevel] [--windows-msvc-host-platform] [--windows-cross-compile] [--windows-hybrid-execution] -- <bazel args> -- <targets>" >&2
+  echo "Usage: $0 [--print-failed-test-logs] [--print-failed-action-summary] [--remote-download-toplevel] [--windows-cross-compile] [--windows-hybrid-execution] -- <bazel args> -- <targets>" >&2
   exit 1
 fi
 
@@ -102,9 +97,7 @@ print_bazel_test_log_tails() {
   local -a bazel_info_args=(info)
   if [[ -n "${BUILDBUDDY_API_KEY:-}" ]]; then
     # `bazel info` needs the same CI config as the failed test invocation so
-    # platform-specific output roots match. On Windows, omitting `ci-windows`
-    # would point at `local_windows-fastbuild` even when the test ran with the
-    # MSVC host platform under `local_windows_msvc-fastbuild`.
+    # platform-specific output roots match.
     bazel_info_args+=("--config=${ci_config}")
   fi
 
@@ -113,7 +106,7 @@ print_bazel_test_log_tails() {
   # mode can make `bazel info` fail, which would hide the real test log path.
   for arg in "${post_config_bazel_args[@]}"; do
     case "$arg" in
-      --host_platform=* | --repo_contents_cache=* | --repository_cache=*)
+      --host_platform=* | --platforms=* | --repo_contents_cache=* | --repository_cache=*)
         bazel_info_args+=("$arg")
         ;;
     esac
@@ -267,31 +260,7 @@ if [[ ${#bazel_args[@]} -eq 0 || ${#bazel_targets[@]} -eq 0 ]]; then
   exit 1
 fi
 
-if [[ "${RUNNER_OS:-}" == "Windows" && $windows_cross_compile -eq 1 && -z "${BUILDBUDDY_API_KEY:-}" ]]; then
-  # Windows cross-compilation depends on authenticated RBE. Preserve the local
-  # Windows build shape when credentials are unavailable.
-  ci_config=ci-windows
-  windows_msvc_host_platform=1
-fi
-
 post_config_bazel_args=()
-if [[ "${RUNNER_OS:-}" == "Windows" && $windows_msvc_host_platform -eq 1 ]]; then
-  has_host_platform_override=0
-  for arg in "${bazel_args[@]}"; do
-    if [[ "$arg" == --host_platform=* ]]; then
-      has_host_platform_override=1
-      break
-    fi
-  done
-
-  if [[ $has_host_platform_override -eq 0 ]]; then
-    # Use the MSVC Windows platform for jobs that need helper binaries like
-    # Rust test wrappers and V8 generators to resolve a compatible toolchain.
-    # Callers that need a different Windows target platform should pass an
-    # explicit `--platforms=...` flag.
-    post_config_bazel_args+=("--host_platform=//:local_windows_msvc")
-  fi
-fi
 
 if [[ $remote_download_toplevel -eq 1 ]]; then
   # Override the CI config's remote_download_minimal setting when callers need
@@ -308,16 +277,22 @@ if [[ "${RUNNER_OS:-}" == "Windows" && -n "${BUILDBUDDY_API_KEY:-}" && ( $window
     # `--enable_platform_specific_config` expands `common:windows` on Windows
     # hosts after ordinary rc configs, which can override `ci-windows-cross`'s
     # RBE host platform. Repeat it on the command line for cross builds. The
-    # Hybrid execution keeps its gnullvm host platform for local Rust actions.
+    # hybrid execution keeps its gnullvm host platform for local Rust actions.
     post_config_bazel_args+=(--host_platform=//:rbe)
   fi
 fi
 
 if [[ "${RUNNER_OS:-}" == "Windows" && $windows_cross_compile -eq 1 && -z "${BUILDBUDDY_API_KEY:-}" ]]; then
   # The Windows cross-compile config depends on authenticated remote
-  # execution. When credentials are unavailable, keep the local build shape
-  # and its lower concurrency cap.
-  post_config_bazel_args+=(--jobs=8)
+  # execution. When credentials are unavailable, spell out the equivalent
+  # local gnullvm platforms and keep the lower concurrency cap.
+  post_config_bazel_args+=(
+    --host_platform=//:local_windows
+    --platforms=//:windows_x86_64_gnullvm
+    --extra_execution_platforms=//:windows_x86_64_gnullvm
+    --extra_toolchains=//:windows_gnullvm_tests_on_gnullvm_host_toolchain
+    --jobs=8
+  )
 fi
 
 if [[ -n "${BAZEL_REPO_CONTENTS_CACHE:-}" ]]; then
@@ -338,57 +313,28 @@ if [[ -n "${CODEX_BAZEL_EXECUTION_LOG_COMPACT_DIR:-}" ]]; then
 fi
 
 if [[ "${RUNNER_OS:-}" == "Windows" ]]; then
-  pass_windows_build_env=1
-  if [[ -n "${BUILDBUDDY_API_KEY:-}" && ( $windows_cross_compile -eq 1 || $windows_hybrid_execution -eq 1 ) ]]; then
-    # Generic build actions execute on Linux RBE workers. Passing the Windows
-    # runner's compiler environment there leaks VS/SDK paths and makes genrules
-    # try to execute tools that do not exist on the worker.
-    pass_windows_build_env=0
+  if [[ -z "${CODEX_BAZEL_WINDOWS_EXECUTION_PATH:-}" ]]; then
+    echo "CODEX_BAZEL_WINDOWS_EXECUTION_PATH must be set for Windows Bazel CI." >&2
+    exit 1
   fi
-
-  if [[ $pass_windows_build_env -eq 1 ]]; then
-    windows_action_env_vars=(
-      INCLUDE
-      LIB
-      LIBPATH
-      UCRTVersion
-      UniversalCRTSdkDir
-      VCINSTALLDIR
-      VCToolsInstallDir
-      WindowsLibPath
-      WindowsSdkBinPath
-      WindowsSdkDir
-      WindowsSDKLibVersion
-      WindowsSDKVersion
-    )
-
-    for env_var in "${windows_action_env_vars[@]}"; do
-      if [[ -n "${!env_var:-}" ]]; then
-        post_config_bazel_args+=("--action_env=${env_var}" "--host_action_env=${env_var}")
-      fi
-    done
-  fi
-
-  if [[ -z "${CODEX_BAZEL_WINDOWS_PATH:-}" ]]; then
-    echo "CODEX_BAZEL_WINDOWS_PATH must be set for Windows Bazel CI." >&2
+  if [[ -z "${CODEX_BAZEL_WINDOWS_TEST_PATH:-}" ]]; then
+    echo "CODEX_BAZEL_WINDOWS_TEST_PATH must be set for Windows Bazel CI." >&2
     exit 1
   fi
 
-  if [[ $pass_windows_build_env -eq 1 ]]; then
-    post_config_bazel_args+=(
-      "--action_env=PATH=${CODEX_BAZEL_WINDOWS_PATH}"
-      "--host_action_env=PATH=${CODEX_BAZEL_WINDOWS_PATH}"
-    )
-  else
+  windows_execution_path="${CODEX_BAZEL_WINDOWS_EXECUTION_PATH}"
+  if [[ -n "${BUILDBUDDY_API_KEY:-}" && ( $windows_cross_compile -eq 1 || $windows_hybrid_execution -eq 1 ) ]]; then
     # Remote build actions run on Linux RBE workers. Give their shell snippets
-    # a frozen Linux PATH while preserving CODEX_BAZEL_WINDOWS_PATH below only
-    # for local Windows test execution.
-    post_config_bazel_args+=(
-      "--action_env=PATH=/usr/bin:/bin"
-      "--host_action_env=PATH=/usr/bin:/bin"
-    )
+    # a frozen Linux execution-substrate path. Windows Rust and build-script
+    # actions receive the same value, which intentionally cannot discover
+    # runner-installed Windows compilers or SDK tools.
+    windows_execution_path="/usr/bin:/bin"
   fi
-  post_config_bazel_args+=("--test_env=PATH=${CODEX_BAZEL_WINDOWS_PATH}")
+  post_config_bazel_args+=(
+    "--action_env=PATH=${windows_execution_path}"
+    "--host_action_env=PATH=${windows_execution_path}"
+    "--test_env=PATH=${CODEX_BAZEL_WINDOWS_TEST_PATH}"
+  )
 fi
 
 bazel_console_log="$(mktemp)"

.github/scripts/test_run_bazel_with_buildbuddy.py

@@ -12,6 +12,66 @@ import run_bazel_with_buildbuddy
 
 
 class RunBazelWithBuildBuddyTest(unittest.TestCase):
+    def run_bazel_ci(
+        self,
+        temp_dir: str,
+        env_overrides: dict[str, str],
+        *args: str,
+    ) -> list[str]:
+        fake_bazel_impl = Path(temp_dir) / "fake-bazel.py"
+        fake_bazel_impl.write_text(
+            "#!/usr/bin/env python3\n"
+            "import json\n"
+            "import sys\n"
+            "print(json.dumps(sys.argv[1:]))\n",
+            encoding="utf-8",
+        )
+        if os.name == "nt":
+            fake_bazel = Path(temp_dir) / "fake-bazel.cmd"
+            fake_bazel.write_text(
+                f'@"{sys.executable}" "{fake_bazel_impl}" %*\n',
+                encoding="utf-8",
+            )
+        else:
+            fake_bazel = fake_bazel_impl
+            fake_bazel.chmod(0o755)
+
+        env = os.environ.copy()
+        for name in (
+            "BUILDBUDDY_API_KEY",
+            "GITHUB_ACTIONS",
+            "GITHUB_EVENT_NAME",
+            "GITHUB_EVENT_PATH",
+            "GITHUB_REPOSITORY",
+        ):
+            env.pop(name, None)
+        env.update(env_overrides)
+        env["CODEX_BAZEL_BIN"] = str(fake_bazel)
+
+        bash = "bash"
+        if os.name == "nt":
+            bash = str(Path(os.environ["ProgramFiles"]) / "Git" / "bin" / "bash.exe")
+            self.assertTrue(Path(bash).is_file(), bash)
+
+        result = subprocess.run(
+            [
+                bash,
+                str(Path(__file__).with_name("run-bazel-ci.sh")),
+                *args,
+            ],
+            env=env,
+            check=False,
+            capture_output=True,
+            text=True,
+        )
+
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+        return next(
+            json.loads(line)
+            for line in result.stdout.splitlines()
+            if line.startswith("[")
+        )
+
     def github_env(
         self,
         temp_dir: str,
@@ -123,69 +183,21 @@ class RunBazelWithBuildBuddyTest(unittest.TestCase):
         self,
     ) -> None:
         with TemporaryDirectory() as temp_dir:
-            fake_bazel_impl = Path(temp_dir) / "fake-bazel.py"
-            fake_bazel_impl.write_text(
-                "#!/usr/bin/env python3\n"
-                "import json\n"
-                "import sys\n"
-                "print(json.dumps(sys.argv[1:]))\n",
-                encoding="utf-8",
-            )
-            if os.name == "nt":
-                fake_bazel = Path(temp_dir) / "fake-bazel.cmd"
-                fake_bazel.write_text(
-                    f'@"{sys.executable}" "{fake_bazel_impl}" %*\n',
-                    encoding="utf-8",
-                )
-            else:
-                fake_bazel = fake_bazel_impl
-                fake_bazel.chmod(0o755)
-
-            env = os.environ.copy()
-            for name in (
-                "GITHUB_ACTIONS",
-                "GITHUB_EVENT_NAME",
-                "GITHUB_EVENT_PATH",
-                "GITHUB_REPOSITORY",
-            ):
-                env.pop(name, None)
-            env.update(
+            command = self.run_bazel_ci(
+                temp_dir,
                 {
                     "BUILDBUDDY_API_KEY": "token",
-                    "CODEX_BAZEL_BIN": str(fake_bazel),
-                    "CODEX_BAZEL_WINDOWS_PATH": r"C:\runtime\bin",
+                    "CODEX_BAZEL_WINDOWS_EXECUTION_PATH": r"C:\substrate\bin",
+                    "CODEX_BAZEL_WINDOWS_TEST_PATH": r"C:\runtime\bin",
                     "INCLUDE": r"C:\Visual Studio\include",
                     "RUNNER_OS": "Windows",
-                }
-            )
-
-            bash = "bash"
-            if os.name == "nt":
-                bash = str(Path(os.environ["ProgramFiles"]) / "Git" / "bin" / "bash.exe")
-                self.assertTrue(Path(bash).is_file(), bash)
-
-            result = subprocess.run(
-                [
-                    bash,
-                    str(Path(__file__).with_name("run-bazel-ci.sh")),
-                    "--windows-hybrid-execution",
-                    "--",
-                    "build",
-                    "--config=argument-comment-lint",
-                    "--",
-                    "//codex-rs/arg0:arg0",
-                ],
-                env=env,
-                check=False,
-                capture_output=True,
-                text=True,
-            )
-
-            self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
-            command = next(
-                json.loads(line)
-                for line in result.stdout.splitlines()
-                if line.startswith("[")
+                },
+                "--windows-hybrid-execution",
+                "--",
+                "build",
+                "--config=argument-comment-lint",
+                "--",
+                "//codex-rs/arg0:arg0",
             )
             self.assertIn("--config=ci-windows-hybrid", command)
             self.assertIn("--shell_executable=/bin/bash", command)
@@ -203,6 +215,40 @@ class RunBazelWithBuildBuddyTest(unittest.TestCase):
                 )
             )
 
+    def test_keyless_windows_cross_build_uses_gnullvm_substrate(self) -> None:
+        with TemporaryDirectory() as temp_dir:
+            command = self.run_bazel_ci(
+                temp_dir,
+                {
+                    "CODEX_BAZEL_WINDOWS_EXECUTION_PATH": r"C:\substrate\bin",
+                    "CODEX_BAZEL_WINDOWS_TEST_PATH": r"C:\runtime\bin",
+                    "INCLUDE": r"C:\Visual Studio\include",
+                    "RUNNER_OS": "Windows",
+                },
+                "--windows-cross-compile",
+                "--",
+                "build",
+                "--",
+                "//codex-rs/arg0:arg0",
+            )
+
+            self.assertIn("--jobs=8", command)
+            self.assertIn("--host_platform=//:local_windows", command)
+            self.assertIn("--platforms=//:windows_x86_64_gnullvm", command)
+            self.assertIn(
+                "--extra_execution_platforms=//:windows_x86_64_gnullvm", command
+            )
+            self.assertIn(
+                "--extra_toolchains=//:windows_gnullvm_tests_on_gnullvm_host_toolchain",
+                command,
+            )
+            self.assertIn(r"--action_env=PATH=C:\substrate\bin", command)
+            self.assertIn(r"--host_action_env=PATH=C:\substrate\bin", command)
+            self.assertIn(r"--test_env=PATH=C:\runtime\bin", command)
+            self.assertFalse(any("msvc" in arg.lower() for arg in command))
+            self.assertNotIn("--action_env=INCLUDE", command)
+            self.assertNotIn("--host_action_env=INCLUDE", command)
+
     def test_query_remote_configuration_is_inserted_before_expression(self) -> None:
         expression = 'kind("rust_library rule", //codex-rs/...)'
         env = {"BUILDBUDDY_API_KEY": "fork-token"}

.github/workflows/bazel.yml

@@ -186,11 +186,12 @@ jobs:
         run: |
           set -euo pipefail
 
-          bazel_test_query='tests(//...) except tests(//third_party/v8:all) except attr(tags, "manual", tests(//...))'
+          bazel_test_query='tests(//...) except tests(//third_party/v8:all) except attr(tags, "manual", tests(//...)) except attr(tags, "windows-gnullvm-incompatible", tests(//...))'
           mapfile -t bazel_targets < <(
             ./.github/scripts/run-bazel-query-ci.sh --output=label -- "${bazel_test_query}" \
               | LC_ALL=C sort
           )
+          bazel_targets+=("//tools/windows-toolchain:stack-protector-probe")
 
           selected_targets=()
           for bazel_target in "${bazel_targets[@]}"; do
@@ -213,7 +214,6 @@ jobs:
 
           bazel_test_args=(
             test
-            --skip_incompatible_explicit_targets
             --test_tag_filters=-argument-comment-lint
             --test_verbose_timeout_warnings
             --build_metadata=COMMIT_SHA=${GITHUB_SHA}
@@ -386,17 +386,10 @@ jobs:
           if [[ "${RUNNER_OS}" == "Windows" ]]; then
             # Keep this aligned with the fast Windows Bazel test job: use
             # Linux RBE for clippy build actions while targeting Windows
-            # gnullvm. Fork/community PRs without the BuildBuddy secret fall
-            # back inside `run-bazel-ci.sh` to the previous local Windows MSVC
-            # host-platform shape.
+            # gnullvm. Fork/community PRs without the BuildBuddy secret use
+            # the same local Windows gnullvm host-platform shape.
             bazel_wrapper_args+=(--windows-cross-compile)
             bazel_target_list_args+=(--windows-cross-compile)
-            if [[ -z "${BUILDBUDDY_API_KEY:-}" ]]; then
-              # The fork fallback can see incompatible explicit Windows-cross
-              # internal test binaries in the generated target list. Preserve
-              # the old local-fallback behavior there.
-              bazel_clippy_args+=(--skip_incompatible_explicit_targets)
-            fi
           fi
 
           bazel_target_lines="$(./scripts/list-bazel-clippy-targets.sh "${bazel_target_list_args[@]}")"
@@ -482,9 +475,8 @@ jobs:
           if [[ "${RUNNER_OS}" == "Windows" ]]; then
             # This is build-only signal, so use the same Linux-RBE
             # cross-compile path as the fast Windows test and clippy jobs.
-            # Fork/community PRs without the BuildBuddy secret fall back
-            # inside `run-bazel-ci.sh` to the previous local Windows MSVC
-            # host-platform shape.
+            # Fork/community PRs without the BuildBuddy secret use the same
+            # local Windows gnullvm host-platform shape.
             bazel_wrapper_args+=(--windows-cross-compile)
           fi
 

BUILD.bazel

@@ -49,11 +49,11 @@ platform(
 )
 
 toolchain(
-    name = "windows_gnullvm_tests_on_msvc_host_toolchain",
+    name = "windows_gnullvm_tests_on_gnullvm_host_toolchain",
     exec_compatible_with = [
         "@platforms//cpu:x86_64",
         "@platforms//os:windows",
-        "@rules_rs//rs/experimental/platforms/constraints:windows_msvc",
+        "@rules_rs//rs/experimental/platforms/constraints:windows_gnullvm",
     ],
     target_compatible_with = [
         "@platforms//cpu:x86_64",

MODULE.bazel

@@ -106,10 +106,6 @@ single_version_override(
 )
 
 rules_rust = use_extension("@rules_rs//rs/experimental:rules_rust.bzl", "rules_rust")
-
-# Build-script probe binaries inherit CFLAGS/CXXFLAGS from Bazel's C++
-# toolchain. On `windows-gnullvm`, llvm-mingw does not ship
-# `libssp_nonshared`, so strip the forwarded stack-protector flags there.
 rules_rust.patch(
     patches = [
         "//patches:rules_rust_repository_set_replacement.patch",
@@ -251,13 +247,6 @@ inject_repo(crate, "zstd")
 use_repo(crate, "argument_comment_lint_crates")
 
 bazel_dep(name = "bzip2", version = "1.0.8.bcr.3")
-single_version_override(
-    module_name = "bzip2",
-    patch_strip = 1,
-    patches = [
-        "//patches:bzip2_windows_stack_args.patch",
-    ],
-)
 
 crate.annotation(
     crate = "bzip2-sys",
@@ -277,13 +266,6 @@ crate.annotation(
 inject_repo(crate, "zlib")
 
 bazel_dep(name = "xz", version = "5.4.5.bcr.8")
-single_version_override(
-    module_name = "xz",
-    patch_strip = 1,
-    patches = [
-        "//patches:xz_windows_stack_args.patch",
-    ],
-)
 
 crate.annotation(
     crate = "lzma-sys",

bazel/rules/testing/wine/wine.bzl

@@ -10,6 +10,7 @@ def wine_rust_test(
         windows_binaries,
         host_binaries = {},
         data = [],
+        tags = [],
         target_compatible_with = [],
         **kwargs):
     """Defines an x86-64 Linux Rust test with a pinned Wine runtime.
@@ -36,6 +37,7 @@ def wine_rust_test(
       windows_binaries: Map from `CARGO_BIN_EXE_*` suffixes to Windows targets.
       host_binaries: Map from `CARGO_BIN_EXE_*` suffixes to Linux host targets.
       data: Additional runtime data for the Linux test.
+      tags: Additional tags for the generated test.
       target_compatible_with: Additional compatibility constraints.
       **kwargs: Remaining attributes forwarded to `rust_test`.
     """
@@ -64,6 +66,7 @@ def wine_rust_test(
         name = name,
         data = data + runtime.data,
         env = runtime.env,
+        tags = tags + ["windows-gnullvm-incompatible"],
         target_compatible_with = target_compatible_with + WINE_TEST_TARGET_COMPATIBLE_WITH,
         **kwargs
     )

defs.bzl

@@ -486,7 +486,10 @@ def codex_rust_crate(
                 ],
                 rustc_env = rustc_env,
                 target_compatible_with = WINDOWS_GNULLVM_INCOMPATIBLE,
-                tags = test_tags + ["manual"],
+                tags = test_tags + [
+                    "manual",
+                    "windows-gnullvm-incompatible",
+                ],
             )
 
             workspace_root_test(
@@ -500,7 +503,7 @@ def codex_rust_crate(
                 test_bin = ":" + integration_test_binary,
                 workspace_root_marker = "//codex-rs/utils/cargo-bin:repo_root.marker",
                 target_compatible_with = WINDOWS_GNULLVM_INCOMPATIBLE,
-                tags = test_tags,
+                tags = test_tags + ["windows-gnullvm-incompatible"],
                 **test_kwargs
             )
         else:
@@ -526,7 +529,7 @@ def codex_rust_crate(
                 rustc_env = rustc_env,
                 env = integration_test_cargo_env,
                 target_compatible_with = WINDOWS_GNULLVM_INCOMPATIBLE,
-                tags = test_tags,
+                tags = test_tags + ["windows-gnullvm-incompatible"],
                 **test_kwargs
             )
 

patches/BUILD.bazel

@@ -3,7 +3,6 @@ exports_files([
     "aws-lc-sys_memcmp_check.patch",
     "aws-lc-sys_windows_msvc_prebuilt_nasm.patch",
     "aws-lc-sys_windows_msvc_memcmp_probe.patch",
-    "bzip2_windows_stack_args.patch",
     "llvm_rusty_v8_custom_libcxx.patch",
     "llvm_windows_arm64_powl.patch",
     "llvm_windows_mingw_compat.patch",
@@ -26,6 +25,5 @@ exports_files([
     "v8_source_portability.patch",
     "webrtc-sys_hermetic_darwin_sysroot.patch",
     "windows-link.patch",
-    "xz_windows_stack_args.patch",
     "zstd-sys_windows_msvc_include_dirs.patch",
 ])

patches/aws-lc-sys_windows_msvc_prebuilt_nasm.patch

@@ -73,12 +73,12 @@ diff --git a/builder/main.rs b/builder/main.rs
 index 51a9bc1..e714ba4 100644
 --- a/builder/main.rs
 +++ b/builder/main.rs
-@@ -723,14 +723,31 @@ fn get_crate_cflags() -> Option<String> {
+@@ -723,14 +723,35 @@ fn get_crate_cflags() -> Option<String> {
          .or(optional_env_optional_crate_target("CFLAGS"))
  }
  
-+pub(crate) fn is_bazel_windows_msvc_build_script() -> bool {
-+    if !target().ends_with("windows-msvc") {
++pub(crate) fn is_bazel_windows_build_script() -> bool {
++    if target_os() != "windows" {
 +        return false;
 +    }
 +
@@ -92,9 +92,13 @@ index 51a9bc1..e714ba4 100644
 +        .components()
 +        .any(|component| component.as_os_str() == "bazel-out")
 +}
++
++pub(crate) fn is_bazel_windows_msvc_build_script() -> bool {
++    target().ends_with("windows-msvc") && is_bazel_windows_build_script()
++}
 +
  fn use_prebuilt_nasm() -> bool {
-+    let use_prebuilt_for_bazel_windows_msvc = is_bazel_windows_msvc_build_script();
++    let use_prebuilt_for_bazel_windows = is_bazel_windows_build_script();
      target_os() == "windows"
          && target_arch() == "x86_64"
          && !is_no_asm()
@@ -102,17 +106,17 @@ index 51a9bc1..e714ba4 100644
          && Some(false) != allow_prebuilt_nasm() // not prevented by environment
          && !is_disable_prebuilt_nasm() // not prevented by feature
          // permitted by environment or by feature
-+        && (use_prebuilt_for_bazel_windows_msvc || !test_nasm_command())
++        && (use_prebuilt_for_bazel_windows || !test_nasm_command())
          && (Some(true) == allow_prebuilt_nasm() || is_prebuilt_nasm())
  }
  
-@@ -817,8 +834,12 @@ fn main() {
+@@ -817,8 +838,12 @@ fn main() {
      initialize();
      prepare_cargo_cfg();
  
 -    let manifest_dir = current_dir();
 -    let manifest_dir = dunce::canonicalize(Path::new(&manifest_dir)).unwrap();
-+    let manifest_dir = if is_bazel_windows_msvc_build_script() {
++    let manifest_dir = if is_bazel_windows_build_script() {
 +        PathBuf::from(cargo_env("CARGO_MANIFEST_DIR"))
 +    } else {
 +        let manifest_dir = current_dir();

patches/bzip2_windows_stack_args.patch

@@ -1,23 +0,0 @@
-diff --git a/BUILD.bazel b/BUILD.bazel
---- a/BUILD.bazel
-+++ b/BUILD.bazel
-@@ -28,4 +28,11 @@ cc_library(
-     defines = [
-         "_FILE_OFFSET_BITS=64",
-     ],
-+    copts = select({
-+        "@platforms//os:windows": [
-+            "-fno-stack-protector",
-+            "-mno-stack-arg-probe",
-+        ],
-+        "//conditions:default": [],
-+    }),
-     includes = ["."],
-diff --git a/MODULE.bazel b/MODULE.bazel
---- a/MODULE.bazel
-+++ b/MODULE.bazel
-@@ -4,3 +4,4 @@ module(
- )
- 
- bazel_dep(name = "rules_cc", version = "0.0.10")
-+bazel_dep(name = "platforms", version = "1.0.0")

patches/rules_rust_windows_exec_msvc_build_script_env.patch

@@ -1,7 +1,7 @@
 diff --git a/cargo/private/cargo_build_script.bzl b/cargo/private/cargo_build_script.bzl
 --- a/cargo/private/cargo_build_script.bzl
 +++ b/cargo/private/cargo_build_script.bzl
-@@ -144,9 +144,14 @@ def _rewrite_windows_exec_msvc_cc_args(toolchain, args):
+@@ -125,9 +125,14 @@ def _rewrite_windows_exec_msvc_cc_args(toolchain, args):
      if toolchain.target_flag_value != toolchain.exec_triple.str or not toolchain.exec_triple.str.endswith("-pc-windows-msvc"):
          return args
  
@@ -18,7 +18,7 @@ diff --git a/cargo/private/cargo_build_script.bzl b/cargo/private/cargo_build_sc
          if skip_next:
              skip_next = False
              continue
-@@ -161,21 +166,58 @@ def _rewrite_windows_exec_msvc_cc_args(toolchain, args):
+@@ -142,21 +147,58 @@ def _rewrite_windows_exec_msvc_cc_args(toolchain, args):
          if arg == "-nostdlibinc" or arg.startswith("--sysroot"):
              continue
  
@@ -84,7 +84,7 @@ diff --git a/cargo/private/cargo_build_script.bzl b/cargo/private/cargo_build_sc
  
  def get_cc_compile_args_and_env(cc_toolchain, feature_configuration):
      """Gather cc environment variables from the given `cc_toolchain`
-@@ -508,15 +550,23 @@ def _cargo_build_script_impl(ctx):
+@@ -487,15 +529,23 @@ def _cargo_build_script_impl(ctx):
      cc_toolchain, feature_configuration = find_cc_toolchain(ctx)
      linker, _, link_args, linker_env = get_linker_and_args(ctx, "bin", toolchain, cc_toolchain, feature_configuration, None)
      env.update(**linker_env)
@@ -114,7 +114,7 @@ diff --git a/cargo/private/cargo_build_script.bzl b/cargo/private/cargo_build_sc
          fallbacks = {
              "AR": "_fallback_ar",
              "CC": "_fallback_cc",
-@@ -542,36 +592,37 @@ def _cargo_build_script_impl(ctx):
+@@ -521,34 +571,35 @@ def _cargo_build_script_impl(ctx):
  
          toolchain_tools.append(cc_toolchain.all_files)
  
@@ -136,8 +136,6 @@ diff --git a/cargo/private/cargo_build_script.bzl b/cargo/private/cargo_build_sc
 -        if not env["AR"]:
 -            env["AR"] = cc_toolchain.ar_executable
 -
--        cc_c_args = _strip_stack_protector_for_windows_llvm_mingw(toolchain, cc_c_args)
--        cc_cxx_args = _strip_stack_protector_for_windows_llvm_mingw(toolchain, cc_cxx_args)
 -        cc_c_args = _rewrite_windows_exec_msvc_cc_args(toolchain, cc_c_args)
 -        cc_cxx_args = _rewrite_windows_exec_msvc_cc_args(toolchain, cc_cxx_args)
 -        # Populate CFLAGS and CXXFLAGS that cc-rs relies on when building from source, in particular
@@ -167,8 +165,6 @@ diff --git a/cargo/private/cargo_build_script.bzl b/cargo/private/cargo_build_sc
 +            if not env["AR"]:
 +                env["AR"] = cc_toolchain.ar_executable
 +
-+            cc_c_args = _strip_stack_protector_for_windows_llvm_mingw(toolchain, cc_c_args)
-+            cc_cxx_args = _strip_stack_protector_for_windows_llvm_mingw(toolchain, cc_cxx_args)
 +            cc_c_args = _rewrite_windows_exec_msvc_cc_args(toolchain, cc_c_args)
 +            cc_cxx_args = _rewrite_windows_exec_msvc_cc_args(toolchain, cc_cxx_args)
 +            # Populate CFLAGS and CXXFLAGS that cc-rs relies on when building from source, in particular

patches/rules_rust_windows_gnullvm_build_script.patch

@@ -1,29 +1,10 @@
 diff --git a/cargo/private/cargo_build_script.bzl b/cargo/private/cargo_build_script.bzl
 --- a/cargo/private/cargo_build_script.bzl
 +++ b/cargo/private/cargo_build_script.bzl
-@@ -120,6 +120,63 @@
+@@ -120,6 +120,44 @@
      executable = True,
  )
  
-+def _strip_stack_protector_for_windows_llvm_mingw(toolchain, args):
-+    """Drop stack protector flags unsupported by llvm-mingw build-script probes."""
-+    if "windows-gnullvm" not in toolchain.target_flag_value:
-+        return args
-+
-+    uses_llvm_mingw = False
-+    for arg in args:
-+        if "mingw-w64-" in arg:
-+            uses_llvm_mingw = True
-+            break
-+
-+    if not uses_llvm_mingw:
-+        return args
-+
-+    # llvm-mingw does not ship libssp_nonshared, so forwarding stack-protector
-+    # flags through CFLAGS/CXXFLAGS breaks build.rs probe binaries compiled via
-+    # cc-rs.
-+    return [arg for arg in args if not arg.startswith("-fstack-protector")]
-+
 +def _rewrite_windows_exec_msvc_cc_args(toolchain, args):
 +    """Translate GNU-flavored cc args when exec-side build scripts target Windows MSVC."""
 +    if toolchain.target_flag_value != toolchain.exec_triple.str or not toolchain.exec_triple.str.endswith("-pc-windows-msvc"):
@@ -65,12 +46,10 @@ diff --git a/cargo/private/cargo_build_script.bzl b/cargo/private/cargo_build_sc
  def get_cc_compile_args_and_env(cc_toolchain, feature_configuration):
      """Gather cc environment variables from the given `cc_toolchain`
  
-@@ -503,6 +560,10 @@
+@@ -503,6 +541,8 @@
          if not env["AR"]:
              env["AR"] = cc_toolchain.ar_executable
  
-+        cc_c_args = _strip_stack_protector_for_windows_llvm_mingw(toolchain, cc_c_args)
-+        cc_cxx_args = _strip_stack_protector_for_windows_llvm_mingw(toolchain, cc_cxx_args)
 +        cc_c_args = _rewrite_windows_exec_msvc_cc_args(toolchain, cc_c_args)
 +        cc_cxx_args = _rewrite_windows_exec_msvc_cc_args(toolchain, cc_cxx_args)
          # Populate CFLAGS and CXXFLAGS that cc-rs relies on when building from source, in particular

patches/xz_windows_stack_args.patch

@@ -1,14 +0,0 @@
-diff --git a/BUILD.bazel b/BUILD.bazel
---- a/BUILD.bazel
-+++ b/BUILD.bazel
-@@ -154,6 +154,9 @@ cc_library(
-     ],
-     copts = select({
--        "@platforms//os:windows": [],
-+        "@platforms//os:windows": [
-+            "-fno-stack-protector",
-+            "-mno-stack-arg-probe",
-+        ],
-         "//conditions:default": ["-std=c99"],
-     }),
-     defines = select({

scripts/list-bazel-clippy-targets.sh

@@ -22,23 +22,20 @@ done
 # Resolve the dynamic targets before printing anything so callers do not
 # continue with a partial list if `bazel query` fails. Target discovery is
 # local on all platforms.
+manual_rust_test_query='kind("rust_test rule", attr(tags, "manual", //codex-rs/... except //codex-rs/v8-poc/...))'
+if [[ "${RUNNER_OS:-}" == "Windows" && $windows_cross_compile -eq 1 ]]; then
+  manual_rust_test_query="(${manual_rust_test_query}) except attr(tags, \"windows-gnullvm-incompatible\", ${manual_rust_test_query})"
+fi
+
 manual_rust_test_targets="$(
   ./.github/scripts/run-bazel-query-ci.sh \
     --output=label \
-    -- 'kind("rust_test rule", attr(tags, "manual", //codex-rs/... except //codex-rs/v8-poc/...))'
+    -- "${manual_rust_test_query}"
 )"
 if [[ "${RUNNER_OS:-}" != "Windows" ]]; then
   # Non-Windows clippy jobs lint the native test binaries; the
   # Windows-cross binaries exist only for the fast Windows test leg.
   manual_rust_test_targets="$(printf '%s\n' "${manual_rust_test_targets}" | grep -v -- '-windows-cross-bin$' || true)"
-elif [[ $windows_cross_compile -eq 1 ]]; then
-  # `bazel query` is intentionally pre-analysis and does not remove targets
-  # made incompatible by `target_compatible_with`. Sharded integration tests
-  # add native-only manual helpers such as `core-all-test-bin`, plus separate
-  # `core-all-test-windows-cross-bin` helpers for the Windows cross leg. Keep
-  # the Windows helpers and unit-test helpers, but do not pass the native-only
-  # sharded integration helpers as explicit clippy targets.
-  manual_rust_test_targets="$(printf '%s\n' "${manual_rust_test_targets}" | grep -v -- '-test-bin$' || true)"
 fi
 
 printf '%s\n' \

tools/windows-toolchain/BUILD.bazel

@@ -0,0 +1,12 @@
+load("@rules_cc//cc:cc_test.bzl", "cc_test")
+
+cc_test(
+    name = "stack-protector-probe",
+    srcs = ["stack_protector_probe.c"],
+    copts = ["-fstack-protector-all"],
+    tags = ["manual"],
+    target_compatible_with = [
+        "@platforms//os:windows",
+        "@rules_rs//rs/experimental/platforms/constraints:windows_gnullvm",
+    ],
+)

tools/windows-toolchain/stack_protector_probe.c

@@ -0,0 +1,11 @@
+#if !defined(_WIN32)
+#error "this probe must be compiled for Windows"
+#endif
+
+__attribute__((noinline)) static int protected_value(int value) {
+  volatile char buffer[32] = {0};
+  buffer[0] = (char)value;
+  return buffer[0];
+}
+
+int main(void) { return protected_value(7) == 7 ? 0 : 1; }