docker windows test

Author: jayvdb

.github/workflows/docker-windows.yaml

@@ -165,10 +165,35 @@ jobs:
           docker run --rm "$IMAGE_TAG" cmd /c "mise exec -- rustpython -c \"print('et-rp ok')\""
           echo "::endgroup::"
 
-      - name: Build stage precompile
+      # Build target depends on base: nanoserver stops at `precompile` (no
+      # python/dotnet/test-runtime; the test stage doesn't exist there),
+      # servercore goes all the way through `test` so the next two steps can
+      # `docker run` the suite. Both targets compose with the precompile-stage
+      # layer cache from the build-minimal step above.
+      - name: Build stage precompile (nanoserver) / test (servercore)
         env:
           DOCKERFILE: ${{ steps.dockerfile.outputs.dockerfile }}
         run: |
+          if [ "${{ matrix.base }}" = "servercore" ]; then
+            target=test
+            tag="-t et-windows-test"
+          else
+            target=precompile
+            tag=""
+          fi
           args="-f $DOCKERFILE ${{ matrix.build_arg }} --build-arg MISE_ENV"
-          args="$args --target precompile"
+          args="$args --target $target $tag"
           docker build $args .
+
+      # Run the test suite split the same way docker-linux does: cargo-test-other
+      # (workspace minus et-ws-web-runner) and test-ws-web-runner (Deno-runtime
+      # gated, self-skips on hosts that can't satisfy it). Each runs in a fresh
+      # container so the per-phase compile target/ doesn't share the writable
+      # layer with the other phase. servercore-only -- Nano has no test stage.
+      - name: Run cargo-test-other
+        if: matrix.base == 'servercore'
+        run: docker run --rm et-windows-test mise run cargo-test-other
+
+      - name: Run test-ws-web-runner
+        if: matrix.base == 'servercore'
+        run: docker run --rm et-windows-test mise run test-ws-web-runner

.github/workflows/test.yaml

@@ -41,13 +41,9 @@ jobs:
     # use the busybox-w32 ash that mise installs in `_setup_all` (the same
     # shell `MISE_BASH_PATH` already points at for `shell = "bash"` tasks on
     # the Windows Docker images). Avoids Git Bash's MSYS fork-emulation
-    # cygheap pathology -- see OLD_NOTES.md for the captured error
-    # signatures and the diagnostic harness that found the root cause. The
-    # path matches the version pin in `.mise/config.windows.toml`'s
-    # [tools."http:busybox"] entry. The `Set HOME = USERPROFILE on Windows`
-    # step below explicitly overrides back to `shell: bash` because it
-    # runs BEFORE `Install mise + tools` (which is what installs
-    # busybox-w32). All later run-bodies use ash.
+    # cygheap pathology on long-running mise task chains. The path matches
+    # the version pin in `.mise/config.windows.toml`'s [tools."http:busybox"]
+    # entry.
     defaults:
       run:
         shell: >-
@@ -117,48 +113,6 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y mesa-vulkan-drivers
 
-      # Empirical probe: does the GHA windows-latest VM populate HOME in its
-      # default env, or is the next step (Pre-mise: HOME = USERPROFILE)
-      # genuinely load-bearing? Prints HOME/USERPROFILE from both Git Bash
-      # (which auto-sets HOME from USERPROFILE on its own) and cmd (which
-      # doesn't, so its output reflects only what the parent env has).
-      # cmd resolves an unset var by leaving the literal `%HOME%` token in
-      # the output, so `HOME=[%HOME%]` is the unambiguous "unset" signal;
-      # `HOME=[]` means defined-but-empty; `HOME=[C:\Users\...]` means set.
-      # Remove this step once the answer is captured in OLD_NOTES.md.
-      - name: "Pre-mise: probe HOME on Windows"
-        if: runner.os == 'Windows'
-        timeout-minutes: 1
-        # Same `shell:` rationale as the next step -- runs before
-        # `Install mise + tools` so we can't use the job's busybox default.
-        shell: bash --noprofile --norc -euo pipefail {0}
-        run: |
-          echo "=== Git Bash perspective ==="
-          echo "  HOME=[$HOME] USERPROFILE=[$USERPROFILE]"
-          echo "=== cmd.exe perspective ==="
-          # `cmd //c` (double slash) -- the single-slash form is rewritten by
-          # MSYS path-translation as a Unix path, dropping cmd into interactive
-          # mode and skipping the echo.
-          cmd //c "echo   HOME=[%HOME%] USERPROFILE=[%USERPROFILE%]"
-
-      # mise's Tera renderer expects $HOME to be set when evaluating env.HOME
-      # in [vars] (config.toml has e.g. `conda_openssl = "{{ env.HOME }}/.local
-      # /share/mise/installs/conda-openssl/3"`). MSYS bash auto-sets HOME from
-      # USERPROFILE; pwsh and cmd do not, so mise tasks invoked from a pwsh
-      # step fail with `Variable env.HOME not found in context while rendering
-      # __tera_one_off`. Plumb HOME = USERPROFILE so every subsequent step
-      # (incl. our pwsh diagnostic ones) sees it.
-      - name: "Pre-mise: HOME = USERPROFILE on Windows"
-        if: false
-        # runner.os == 'Windows'
-        timeout-minutes: 1
-        # Explicit `shell: bash` because the job-level defaults point at the
-        # busybox ash that's installed by the next step (Install mise +
-        # tools), so we can't use it here yet. Git Bash is on the runner
-        # image by default.
-        shell: bash --noprofile --norc -euo pipefail {0}
-        run: echo "HOME=$USERPROFILE" >> "$GITHUB_ENV"
-
       - name: Install mise + tools
         uses: ./.github/actions/install-mise-tools
         timeout-minutes: 20

Dockerfile.windows

@@ -40,14 +40,8 @@ RUN curl -fsSL -o vc_redist.exe https://aka.ms/vs/17/release/vc_redist.x64.exe &
     (vc_redist.exe /install /quiet /norestart || ver>nul) && `
     del vc_redist.exe
 
-# Empirical probe: confirms Server Core leaves HOME unset by default
-# (USERPROFILE is set). cmd resolves an unset var by leaving the literal
-# `%HOME%` token in the output, so `HOME=[%HOME%]` is the unambiguous
-# "unset" signal here. Counterpart to the `Pre-mise: probe HOME on
-# Windows` step in test.yaml -- one captures the GHA windows-latest VM
-# state, this one captures the Server Core container base-image state.
-# Remove once the result is documented in OLD_NOTES.md.
-RUN echo before-env: HOME=[%HOME%] USERPROFILE=[%USERPROFILE%]
+# Should show literal `%HOME%` token in the output as HOME is unset.
+RUN echo HOME=[%HOME%] USERPROFILE=[%USERPROFILE%]
 
 # Set HOME to the admin profile so the container has a sane home (Server Core
 # sets USERPROFILE but leaves HOME unset by default).
@@ -170,3 +164,12 @@ RUN (if exist C:\token\gh_token set /p GITHUB_TOKEN=<C:\token\gh_token) & `
 # --- precompile: build the WASM/JS modules. ---
 FROM prefetch AS precompile
 RUN mise run build-modules && if exist target rmdir /s /q target
+
+# --- test: the full suite (Rust + every loaded guest language). ---
+# Compiled AND run at `docker run` time (precompile keeps no target/), so the
+# multi-GB debug test binaries never bake into a layer -- they live in the
+# ephemeral container and vanish when it exits. Sister to the Linux Dockerfile's
+# `test` stage; wgpu compute on Windows resolves through DX12 / WARP, so no
+# extra runtime packages are needed here.
+FROM precompile AS test
+CMD ["mise", "run", "test"]

README.md

@@ -175,6 +175,10 @@ images when their respective `Dockerfile` is modified.
 
 [`Dockerfile.nanoserver`](Dockerfile.nanoserver) starts from **Nano Server**
 (the smallest Windows base, ~120 MB) — which has no installer stack, or shell.
+Python and .Net do not work on this base.
+
+[`Dockerfile.windows`](Dockerfile.windows) is the **Server Core** variant
+(~1.25 GB base) — the fuller Windows image, and all languages are supported.
 
 A `gh_token` file (a GitHub token) in the build context is **optional** for a
 manual `Dockerfile.nanoserver` build — without it, mise uses GitHub's anonymous

config/ast-grep/rules/gha-no-step-shell.yaml

@@ -5,13 +5,11 @@ message: |
   Don't set `shell:` on a workflow step. Every workflow defaults to bash
   (defaults.run.shell) and steps must use it -- write the step in bash (e.g.
   `sc`/`net`/`printf` instead of PowerShell cmdlets, even on Windows runners,
-  which have Git Bash) rather than overriding the shell per step. Carve-outs:
-  (1) steps whose `name:` starts with `Pre-mise:` (steps that run BEFORE
-  `Install mise + tools` and so can't use the mise-managed default shell --
-  e.g. setting HOME from USERPROFILE on Windows); (2) `shell: msys2 {0}`
-  (the wrapper that msys2/setup-msys2 requires for steps running inside
-  its MINGW64 env -- Git Bash isn't a substitute). The matching conftest
-  rule in `config/conftest/policy/gha/gha.rego` applies the same allow-list.
+  which have Git Bash) rather than overriding the shell per step. One
+  carve-out: `shell: msys2 {0}` (the wrapper that msys2/setup-msys2 requires
+  for steps running inside its MINGW64 env -- Git Bash isn't a substitute).
+  The matching conftest rule in `config/conftest/policy/gha/gha.rego`
+  applies the same allow-list.
 files:
   - .github/workflows/*.yaml
 rule:
@@ -20,16 +18,7 @@ rule:
     - inside:
         kind: block_sequence
         stopBy: end
+    # `shell: msys2 {0}` is the wrapper msys2/setup-msys2 documents
+    # as the shell entry for steps that run inside its MINGW64 env.
     - not:
-        any:
-          # Tightly scoped to the IMMEDIATE step's block_mapping (no
-          # `stopBy: end`), so a single `Pre-mise:`-named step elsewhere
-          # in the file doesn't whitewash unrelated step-shell overrides.
-          - inside:
-              kind: block_mapping
-              has:
-                kind: block_mapping_pair
-                regex: '^name:\s*"?Pre-mise:'
-          # `shell: msys2 {0}` is the wrapper msys2/setup-msys2 documents
-          # as the shell entry for steps that run inside its MINGW64 env.
-          - regex: '^shell:\s*msys2\b'
+        regex: '^shell:\s*msys2\b'

config/conftest/policy/gha/gha.rego

@@ -17,17 +17,13 @@ deny contains msg if {
 }
 
 # Steps must not override the shell -- rely on the workflow default (write the
-# step in bash rather than switching to PowerShell on Windows runners). Two
-# carve-outs: (1) `name:` prefix `Pre-mise:` (steps that run BEFORE
-# `Install mise + tools` and so can't use the mise-managed default shell --
-# e.g. setting HOME from USERPROFILE on Windows); (2) `shell: msys2 {0}`
-# (the wrapper msys2/setup-msys2 requires for steps running inside its
-# MINGW64 env -- Git Bash isn't a substitute).
+# step in bash rather than switching to PowerShell on Windows runners). One
+# carve-out: `shell: msys2 {0}` (the wrapper msys2/setup-msys2 requires for
+# steps running inside its MINGW64 env -- Git Bash isn't a substitute).
 deny contains msg if {
 	some name, job in input.jobs
 	some step in job.steps
 	step.shell
-	not startswith(step.name, "Pre-mise:")
 	not startswith(step.shell, "msys2 ")
 	msg := sprintf("job %q sets shell: on a step; use the workflow default", [name])
 }