Add free-disk-space-windows action; narrow CI to test.yaml-windows to verify

A new local composite action at .github/actions/free-disk-space-windows
removes safely-unused preinstalled software (Android SDK, old Python /
JDK / .NET SDK versions, misc DB SDKs) from the GHA Windows runner's
C:\ before docker work. Counterpart to jlumbroso/free-disk-space on
Linux, which has no Windows path. All five categories are individual
inputs defaulting to true so callers can opt out per category. Steps
run under Git Bash with `/c/...` paths (no PowerShell) so they
satisfy the new gha_action shell-policy below.

Wired into both docker-windows.yaml (before the existing
docker-prune cleanup) and test.yaml (after the Linux jlumbroso step,
gated on `if: runner.os == 'Windows'`).

New conftest policy at config/conftest/policy/gha_action/gha_action.rego:
composite-action `run:` steps must use shell `bash --noprofile --norc
-euo pipefail {0}` exactly (matching the workflow `defaults.run.shell`
invariant in the existing gha rule). All three composite actions
(install-mise, install-mise-tools, free-disk-space-windows) migrated
to the explicit form. The conftest-check-yaml task gains a third pass
to enforce the rule across `.github/actions/*/action.yaml`.

Audit of other workflow-only tooling and extension to actions:
- action-validator: now validates both
- zizmor: now scans both; the github-env false positive on
  install-mise's deterministic $GITHUB_PATH append is suppressed via
  inline `# zizmor: ignore[github-env]` (config-file ignore doesn't
  work for composite actions per zizmor docs)
- ast-grep gha-no-folded-strip: extended to actions; gained a
  `description:` carve-out (action.yaml description fields ARE long
  folded paragraphs by design)
- Other gha-* ast-grep rules stay workflow-only (job/strategy/
  concurrency are workflow shape; not relevant to actions)

CI temporarily narrowed: check.yaml, dependencies.yaml,
docker-linux.yaml, docker-windows.yaml all parked with `if: false`;
test.yaml PR matrix narrowed to windows-latest only. Drop the
TEMPORARY blocks (4 file-pairs total) and restore test.yaml's
4-OS PR matrix once the new action is confirmed to free disk space
as expected on a real CI run.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: jayvdb

.github/actions/free-disk-space-windows/action.yaml

@@ -0,0 +1,101 @@
+---
+name: Free disk space
+description: >-
+  Remove safely-unused preinstalled software from the GHA Windows runner's
+  `C:\` to give downstream `docker build` (which stages HCS layer scratch
+  on `C:\Windows\SystemTemp`) more headroom. Counterpart to
+  jlumbroso/free-disk-space on Linux, which doesn't have a Windows path.
+  Logs disk-free before + after so the reclaimed space is visible.
+
+  Caller is responsible for the `if: runner.os == 'Windows'` guard --
+  every step here uses Git Bash with `C:\` mounted at `/c`; running this
+  on a non-Windows runner will silently no-op (no /c mount) at best.
+
+inputs:
+  android:
+    description: "Remove Android SDK trees (~12 GB)."
+    required: false
+    default: "true"
+  hostedtoolcache-old-pythons:
+    description: >-
+      Remove Python 3.9/3.10/3.11/3.12 versions from `hostedtoolcache`
+      (~2 GB). The repo uses mise's pinned 3.13.
+    required: false
+    default: "true"
+  hostedtoolcache-old-jdks:
+    description: >-
+      Remove JDK 8/11/17/21 versions from `hostedtoolcache\Java`
+      (~1 GB). The repo uses mise's pinned Java 26.
+    required: false
+    default: "true"
+  old-dotnet-sdks:
+    description: >-
+      Remove .NET SDK 6.0.x and 7.0.x trees (~1-2 GB). The repo
+      installs current dotnet via mise.
+    required: false
+    default: "true"
+  misc-sdks:
+    description: >-
+      Remove unused preinstalled SDKs (Heroku, MongoDB, PostgreSQL,
+      Strawberry Perl) -- ~1 GB combined.
+    required: false
+    default: "true"
+
+runs:
+  using: composite
+  steps:
+    - name: before
+      shell: bash --noprofile --norc -euo pipefail {0}
+      run: df -h /c
+
+    - name: Android SDK
+      if: inputs.android == 'true'
+      shell: bash --noprofile --norc -euo pipefail {0}
+      run: |
+        for p in "/c/Android" "/c/Program Files (x86)/Android"; do
+          [ -e "$p" ] && { echo "removing $p"; rm -rf -- "$p"; } || true
+        done
+
+    - name: hostedtoolcache old Pythons
+      if: inputs.hostedtoolcache-old-pythons == 'true'
+      shell: bash --noprofile --norc -euo pipefail {0}
+      run: |
+        shopt -s nullglob
+        for p in /c/hostedtoolcache/Python/3.{9,10,11,12}*; do
+          echo "removing $p"
+          rm -rf -- "$p"
+        done
+
+    - name: hostedtoolcache old JDKs
+      if: inputs.hostedtoolcache-old-jdks == 'true'
+      shell: bash --noprofile --norc -euo pipefail {0}
+      run: |
+        shopt -s nullglob
+        for p in /c/hostedtoolcache/Java_Adopt_jdk/{8,11,17,21}.*; do
+          echo "removing $p"
+          rm -rf -- "$p"
+        done
+
+    - name: old .NET SDKs
+      if: inputs.old-dotnet-sdks == 'true'
+      shell: bash --noprofile --norc -euo pipefail {0}
+      run: |
+        shopt -s nullglob
+        for p in "/c/Program Files/dotnet/sdk/"{6,7}.0.*; do
+          echo "removing $p"
+          rm -rf -- "$p"
+        done
+
+    - name: misc SDKs
+      if: inputs.misc-sdks == 'true'
+      shell: bash --noprofile --norc -euo pipefail {0}
+      run: |
+        pf="/c/Program Files"
+        pf86="/c/Program Files (x86)"
+        for p in "$pf/MongoDB" "$pf/PostgreSQL" "$pf86/Heroku" "/c/Strawberry"; do
+          [ -e "$p" ] && { echo "removing $p"; rm -rf -- "$p"; } || true
+        done
+
+    - name: after
+      shell: bash --noprofile --norc -euo pipefail {0}
+      run: df -h /c

.github/actions/install-mise-tools/action.yaml

@@ -34,7 +34,7 @@ runs:
         extra-tools: ${{ inputs.extra-tools }}
 
     - name: Show MISE_ENV
-      shell: bash
+      shell: bash --noprofile --norc -euo pipefail {0}
       run: echo "MISE_ENV=$MISE_ENV"
 
     # Optional npm backend, installed before the main `mise install`.
@@ -45,13 +45,13 @@ runs:
     - name: Install aube (optional npm backend, allowed to fail)
       if: contains(env.MISE_ENV, 'js')
       continue-on-error: true
-      shell: bash
+      shell: bash --noprofile --norc -euo pipefail {0}
       env:
         GITHUB_TOKEN: ${{ inputs.github-token }}
       run: mise run setup-aube
 
     - name: Install mise tools
-      shell: bash
+      shell: bash --noprofile --norc -euo pipefail {0}
       env:
         GITHUB_TOKEN: ${{ inputs.github-token }}
       run: |
@@ -67,7 +67,7 @@ runs:
     # that's the step that creates the shims.
     - name: Remove self-recursive mise.cmd shim on Windows
       if: runner.os == 'Windows'
-      shell: bash
+      shell: bash --noprofile --norc -euo pipefail {0}
       run: |
         shims="$LOCALAPPDATA/mise/shims"
         rm -fv "$shims/mise.cmd" "$shims/mise"

.github/actions/install-mise/action.yaml

@@ -36,13 +36,16 @@ runs:
     # this problem (each .cmd shim invokes `mise exec --` plainly via cmd).
     - name: Add mise shims dir to PATH on Windows
       if: runner.os == 'Windows'
-      shell: bash
-      run: echo "$LOCALAPPDATA\mise\shims" >> "$GITHUB_PATH"
+      shell: bash --noprofile --norc -euo pipefail {0}
+      # The appended value is a hardcoded mise install-dir constant under
+      # our control -- no user input flows in -- so the github-env audit's
+      # arbitrary-code-execution shape doesn't apply.
+      run: echo "$LOCALAPPDATA\mise\shims" >> "$GITHUB_PATH" # zizmor: ignore[github-env]
 
     # Marks the checked-out .mise/config*.toml as trusted so subsequent mise
     # invocations don't error out with "Config files are not trusted". The
     # caller must run actions/checkout BEFORE this composite action so the
     # config files are on disk.
     - name: Trust mise config
-      shell: bash
+      shell: bash --noprofile --norc -euo pipefail {0}
       run: mise trust

.github/workflows/check.yaml

@@ -23,6 +23,10 @@ env:
 
 jobs:
   check:
+    # TEMPORARY: `if: false` parks the job so PR runner capacity goes to the
+    # test.yaml windows-only matrix while we verify the new
+    # free-disk-space-windows action. Drop this once the action is confirmed.
+    if: false
     runs-on: ubuntu-latest
     timeout-minutes: 25
     steps:

.github/workflows/dependencies.yaml

@@ -29,6 +29,10 @@ env:
 
 jobs:
   dependencies:
+    # TEMPORARY: `if: false` parks the job so PR runner capacity goes to the
+    # test.yaml windows-only matrix while we verify the new
+    # free-disk-space-windows action. Drop this once the action is confirmed.
+    if: false
     # `ubuntu-latest`, not `ubuntu-slim`: although every step in this workflow
     # is metadata/network-bound (no Rust compile), `taiki-e/install-action`
     # itself assumes a standard runner-image FHS (e.g. ~/.cargo/bin) and

.github/workflows/docker-linux.yaml

@@ -24,6 +24,10 @@ env:
 
 jobs:
   build:
+    # TEMPORARY: `if: false` parks the job so PR runner capacity goes to the
+    # test.yaml windows-only matrix while we verify the new
+    # free-disk-space-windows action. Drop this once the action is confirmed.
+    if: false
     runs-on: ubuntu-latest
     timeout-minutes: 120
     strategy:

.github/workflows/docker-windows.yaml

@@ -4,6 +4,7 @@ name: docker-windows
 "on":
   pull_request:
     paths:
+      - .github/actions/free-disk-space-windows/**
       - .github/workflows/docker-windows.yaml
       - Dockerfile.nanoserver
       - Dockerfile.windows
@@ -25,6 +26,10 @@ env:
 
 jobs:
   build:
+    # TEMPORARY: `if: false` parks the job so PR runner capacity goes to the
+    # test.yaml windows-only matrix while we verify the new
+    # free-disk-space-windows action. Drop this once the action is confirmed.
+    if: false
     runs-on: ${{ matrix.runner }}
     strategy:
       fail-fast: false
@@ -74,6 +79,15 @@ jobs:
           sc query docker | grep -q RUNNING || net start docker
           docker version
 
+      # Reclaim runner C:\ before any docker work. Windows `docker build`
+      # stages HCS layer scratch under `C:\Windows\SystemTemp`, so every GB
+      # we free here is a GB that doesn't go to disk-pressure failures
+      # inside the build. Preinstalled trees we never touch (Android, old
+      # Python / JDK versions, old .NET SDKs, misc DB SDKs) come out first;
+      # the docker-prune step below clears any layer-cache leftovers.
+      - name: Free disk space on Windows runner
+        uses: ./.github/actions/free-disk-space-windows
+
       # Free runner disk before the build. The Server Core lane has been hitting
       # "There is not enough space on the disk" during the conda-clang-tools
       # install inside `mise install`. `docker system prune -af` clears any

.github/workflows/test.yaml

@@ -86,12 +86,16 @@ jobs:
           || github.event.inputs.os == 'windows-latest' && '[{"os":"windows-latest","timeout":60}]'
           || github.event.inputs.os == 'windows-11-arm' && '[{"os":"windows-11-arm","timeout":60}]'
           )
-          || format('[{0},{1},{2},{3}]',
-          '{"os":"ubuntu-latest","timeout":40}',
-          '{"os":"ubuntu-24.04-arm","timeout":40}',
-          '{"os":"macos-latest","timeout":45}',
-          '{"os":"windows-latest","timeout":60}')
+          || '[{"os":"windows-latest","timeout":60}]'
           ) }}
+    # TEMPORARY: PR matrix narrowed to windows-latest only while we verify
+    # the new free-disk-space-windows action. Restore the canonical 4-OS
+    # PR matrix once the action is confirmed:
+    #   || format('[{0},{1},{2},{3}]',
+    #     '{"os":"ubuntu-latest","timeout":40}',
+    #     '{"os":"ubuntu-24.04-arm","timeout":40}',
+    #     '{"os":"macos-latest","timeout":45}',
+    #     '{"os":"windows-latest","timeout":60}')
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -103,6 +107,10 @@ jobs:
         if: runner.os == 'Linux'
         uses: jlumbroso/free-disk-space@v1.3.1
 
+      - name: Free disk space on Windows runner
+        if: runner.os == 'Windows'
+        uses: ./.github/actions/free-disk-space-windows
+
       - name: Install Mesa Vulkan drivers (lavapipe)
         if: runner.os == 'Linux'
         run: |
@@ -128,7 +136,10 @@ jobs:
           echo "=== Git Bash perspective ==="
           echo "  HOME=[$HOME] USERPROFILE=[$USERPROFILE]"
           echo "=== cmd.exe perspective ==="
-          cmd.exe /c "echo   HOME=[%HOME%] USERPROFILE=[%USERPROFILE%]"
+          # `cmd //c` (double slash) -- the single-slash form is rewritten by
+          # MSYS path-translation as a Unix path, dropping cmd into interactive
+          # mode and skipping the echo.
+          cmd //c "echo   HOME=[%HOME%] USERPROFILE=[%USERPROFILE%]"
 
       # mise's Tera renderer expects $HOME to be set when evaluating env.HOME
       # in [vars] (config.toml has e.g. `conda_openssl = "{{ env.HOME }}/.local

.mise/config.toml

@@ -543,14 +543,14 @@ depends = ["fix:*"]
 description = "Apply all lint-fix passes: fix:rust + any loaded guest fix:<lang>"
 
 [tasks.action-validator]
-description = "Validate GitHub Actions workflow YAML"
-run = "action-validator .github/workflows/*.yaml"
+description = "Validate GitHub Actions workflow + composite-action YAML"
+run = "action-validator .github/workflows/*.yaml .github/actions/*/action.yaml"
 
 [tasks.zizmor-check]
-description = "Audit GitHub Actions workflows for security issues (zizmor)"
+description = "Audit GitHub Actions workflows + composite actions for security issues (zizmor)"
 # --offline so it needs no GH token and stays deterministic; config/zizmor.yaml
 # turns off the hash-pin policy (we pin actions by tag, not commit).
-run = "zizmor --offline --no-progress -c config/zizmor.yaml .github/workflows"
+run = "zizmor --offline --no-progress -c config/zizmor.yaml .github/workflows .github/actions"
 
 [tasks.ls-lint-check]
 description = "Lint file and directory naming conventions (ls-lint)"
@@ -647,19 +647,21 @@ git ls-files '*Cargo.toml' '.mise/config*.toml' '*pyproject.toml' Cargo.lock con
 shell = "bash -euo pipefail -c"
 
 [tasks.conftest-check-yaml]
-description = "Run conftest OPA/Rego policies over the GitHub Actions workflow YAML"
-# Two passes: per-file rules (gha, no_trailing_backslash) for shape/content
-# checks that don't need a file path; --combine rules (gha_combined) for
-# cross-cutting invariants where the rule has to compare each workflow's
-# parsed body against its own filename (the `paths:` self-reference check).
-# Conftest's per-file mode has no `input.path`, so `gha_combined` lives in
-# its own pass.
+description = "Run conftest OPA/Rego policies over the GitHub Actions workflow + action YAML"
+# Three passes: per-file rules (gha, no_trailing_backslash) over workflow
+# YAML; --combine rules (gha_combined) over workflow YAML for cross-cutting
+# invariants where the rule has to compare each workflow's parsed body
+# against its own filename (the `paths:` self-reference check; conftest's
+# per-file mode has no `input.path`); and gha_action over the composite
+# actions under .github/actions/*/action.yaml (different schema, so its
+# own namespace).
 run = """
 ns="--namespace gha --namespace no_trailing_backslash"
 # $ns expands to repeated `--namespace <n>` pairs; word-splitting is intentional.
 # shellcheck disable=SC2086
 conftest test --parser yaml $ns -p config/conftest/policy .github/workflows
 conftest test --parser yaml --combine --namespace gha_combined -p config/conftest/policy .github/workflows
+conftest test --parser yaml --namespace gha_action -p config/conftest/policy .github/actions/*/action.yaml
 """
 shell = "bash -euo pipefail -c"
 

config/ast-grep/rules/gha-no-folded-strip.yaml

@@ -11,21 +11,28 @@ message: |
   - a literal block `run: |` (which preserves newlines verbatim).
 files:
   - .github/workflows/*.yaml
+  - .github/actions/*/action.yaml
 # tree-sitter parses every block scalar (folded `>`, literal `|`, both with
 # their chomping variants `+` / `-`) as a single `block_scalar` node whose
 # leading characters carry the header. Regex-match only the `>-` form so `>`,
 # `|`, and `|-` continue to pass; `^>-` anchors at the start of the node text
 # so we don't accidentally match a `>-` that appears inside the scalar body.
 #
-# Carve-out: `shell: >-` is fine. The rule's whitespace concern is about
-# `run:` bodies losing newlines; `shell:` values are command-line strings
-# that NEED whitespace folding (a multi-line `${{ ... && ... || ... }}`
-# ternary must fold to a single command line). Match the parent
-# block_mapping_pair's text starting with `shell:` to skip just that key.
+# Carve-outs: `shell: >-` is fine because shell values are command-line
+# strings that NEED whitespace folding (a multi-line `${{ ... && ... ||
+# ... }}` ternary must fold to one command line). `description: >-` is
+# fine because action.yaml documentation fields ARE long folded
+# paragraphs by design -- newline loss is the wanted behavior, not the
+# feared one.
 rule:
-  kind: block_scalar
-  regex: "^>-"
-  not:
-    inside:
-      pattern: "shell: $VAL"
-      stopBy: end
+  all:
+    - kind: block_scalar
+    - regex: "^>-"
+    - not:
+        any:
+          - inside:
+              pattern: "shell: $VAL"
+              stopBy: end
+          - inside:
+              pattern: "description: $VAL"
+              stopBy: end