feat: add Windows smoke test to CI pipeline

JonZeolla · claude · JonZeolla · commit 1c341f1fc735 · 2026-04-03T13:35:22.000-04:00
Add a windows-latest job that generates a project from the template
and verifies it renders correctly with all defaults. The bootstrap
action is updated to handle Windows by skipping Unix-specific steps
(Homebrew, trufflehog, sha256sum) and using PowerShell alternatives.

The smoke test verifies:
- Project directory is created
- Key files exist (pyproject.toml, Taskfile.yml, Dockerfile, etc.)
- No unrendered cookiecutter variables remain
- Git repo is initialized with at least one commit

Co-Authored-By: Claude Opus 4.6 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/.github/actions/bootstrap/action.yml b/.github/actions/bootstrap/action.yml
@@ -16,13 +16,21 @@ inputs:
 runs:
   using: 'composite'
   steps:
-    - name: Create run_script for running scripts downstream
+    - name: Create run_script for running scripts downstream (Unix)
+      if: runner.os != 'Windows'
       shell: 'bash --noprofile --norc -Eeuo pipefail {0}'
       working-directory: ${{ inputs.working-directory }}
       run: |
         run_script="uv run --frozen"
         echo "run_script=${run_script}" | tee -a "${GITHUB_ENV}"
 
+    - name: Create run_script for running scripts downstream (Windows)
+      if: runner.os == 'Windows'
+      shell: pwsh
+      working-directory: ${{ inputs.working-directory }}
+      run: |
+        echo "run_script=uv run --frozen" | Tee-Object -Append $env:GITHUB_ENV
+
     - name: Setup uv
       uses: astral-sh/setup-uv@v4
       with:
@@ -37,6 +45,7 @@ runs:
         repo-token: ${{ inputs.token }}
 
     - name: Add Homebrew to the path
+      if: runner.os != 'Windows'
       shell: 'bash --noprofile --norc -Eeuo pipefail {0}'
       # This ensures compatibility with macOS runners and Linux runners with Homebrew
       run: |
@@ -68,23 +77,44 @@ runs:
       working-directory: ${{ inputs.working-directory }}
 
     - name: Install trufflehog
+      if: runner.os != 'Windows'
       shell: 'bash --noprofile --norc -Eeuo pipefail {0}'
       run: |
         curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin
 
-    - name: Set Python hash for caching
+    - name: Set Python hash for caching (Unix)
+      if: runner.os != 'Windows'
       shell: 'bash --noprofile --norc -Eeuo pipefail {0}'
       run: |
         # Create a hash of the Python version for better cache keys
         echo "PY=$(python -VV | sha256sum | cut -d' ' -f1)" | tee -a "${GITHUB_ENV}"
 
+    - name: Set Python hash for caching (Windows)
+      if: runner.os == 'Windows'
+      shell: pwsh
+      run: |
+        $pyVersion = python -VV 2>&1
+        $hash = [System.BitConverter]::ToString(
+          [System.Security.Cryptography.SHA256]::Create().ComputeHash(
+            [System.Text.Encoding]::UTF8.GetBytes($pyVersion)
+          )
+        ).Replace("-", "").ToLower()
+        echo "PY=$hash" | Tee-Object -Append $env:GITHUB_ENV
+
     - name: Cache pre-commit environments
       uses: actions/cache@v4
       with:
         path: ~/.cache/pre-commit
         key: pre-commit|${{ env.PY }}|${{ hashFiles(format('{0}/.pre-commit-config.yaml', inputs.working-directory)) }}
 
-    - name: Initialize the repository
+    - name: Initialize the repository (Unix)
+      if: runner.os != 'Windows'
       working-directory: ${{ inputs.working-directory }}
       shell: 'bash --noprofile --norc -Eeuo pipefail {0}'
       run: task -v init
+
+    - name: Initialize the repository (Windows)
+      if: runner.os == 'Windows'
+      working-directory: ${{ inputs.working-directory }}
+      shell: pwsh
+      run: task -v init
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -102,6 +102,89 @@ jobs:
           name: vuln-scan-results
           path: vulns.json
           if-no-files-found: error
+  windows-smoke-test:
+    name: Windows Smoke Test
+    runs-on: windows-latest
+    steps:
+      - name: Checkout the repository
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: 'false'
+      - name: Setup uv
+        uses: astral-sh/setup-uv@v4
+        with:
+          python-version: ${{ env.python_version }}
+      - name: Install Task
+        uses: go-task/setup-task@v1
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Generate project from template
+        shell: pwsh
+        env:
+          RUN_POST_HOOK: 'true'
+          SKIP_GIT_PUSH: 'true'
+        run: |
+          # Configure git identity for the post-gen commit
+          git config --global user.name "CI Automation"
+          git config --global user.email "ci@zenable.io"
+
+          # Generate a project with all defaults using cookiecutter
+          uvx --with gitpython cookiecutter . --no-input --output-dir "$env:RUNNER_TEMP"
+      - name: Verify generated project
+        shell: pwsh
+        run: |
+          $project = Join-Path $env:RUNNER_TEMP "replace-me"
+
+          # Verify the project directory was created
+          if (-not (Test-Path $project)) {
+            Write-Error "Project directory not found at $project"
+            exit 1
+          }
+
+          # Verify key files exist
+          $requiredFiles = @(
+            "pyproject.toml",
+            "Taskfile.yml",
+            "Dockerfile",
+            "CLAUDE.md",
+            ".github/project.yml",
+            ".github/workflows/ci.yml"
+          )
+          foreach ($file in $requiredFiles) {
+            $filePath = Join-Path $project $file
+            if (-not (Test-Path $filePath)) {
+              Write-Error "Required file missing: $file"
+              exit 1
+            }
+          }
+
+          # Verify no unrendered cookiecutter variables remain
+          $pattern = '\{\{\s*cookiecutter\.'
+          $matches = Get-ChildItem -Path $project -Recurse -File -Exclude '.git' |
+            Where-Object { $_.FullName -notmatch '[\\/]\.git[\\/]' } |
+            Select-String -Pattern $pattern
+          if ($matches) {
+            Write-Error "Unrendered cookiecutter variables found:"
+            $matches | ForEach-Object { Write-Error $_.ToString() }
+            exit 1
+          }
+
+          # Verify git repo was initialized and has a commit
+          $gitDir = Join-Path $project ".git"
+          if (-not (Test-Path $gitDir)) {
+            Write-Error "Git repository not initialized"
+            exit 1
+          }
+
+          Push-Location $project
+          $commitCount = git rev-list --count HEAD 2>$null
+          Pop-Location
+          if ($commitCount -lt 1) {
+            Write-Error "No commits found in generated project"
+            exit 1
+          }
+
+          Write-Host "Windows smoke test passed: project generated and verified successfully"
   finalizer:
     # This gives us something to set as required in the repo settings. Some projects use dynamic fan-outs using matrix strategies and the fromJSON function, so
     # you can't hard-code what _should_ run vs not. Having a finalizer simplifies that so you can just check that the finalizer succeeded, and if so, your
@@ -110,7 +193,7 @@ jobs:
     name: Finalize the pipeline
     runs-on: ubuntu-24.04
     # Keep this aligned with the above jobs
-    needs: [lint, test]
+    needs: [lint, test, windows-smoke-test]
     if: always()  # Ensure it runs even if "needs" fails or is cancelled
     steps:
       - name: Check for failed or cancelled jobs
