Use MSVC for web-runner on Windows

Author: jayvdb

.github/workflows/test-msvc.yaml

@@ -0,0 +1,72 @@
+---
+name: test-msvc
+
+# Deliberately does NOT use mise, which uses gnullvm target. Instead manually targets the default MSVC.
+# And only runs the web-runner tests, as web-runner doesnt work under gnullvm.
+"on":
+  pull_request:
+  push:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# this allows a subsequently queued workflow run to interrupt previous runs in pull requests only
+concurrency:
+  group: "${{ github.workflow }}-${{ github.ref }}"
+  cancel-in-progress: ${{ startsWith(github.ref, 'refs/pull/') }}
+
+defaults:
+  run:
+    shell: bash --noprofile --norc -euo pipefail {0}
+
+jobs:
+  web-runner-msvc:
+    runs-on: windows-latest
+    timeout-minutes: 90
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Install Rust (x86_64-pc-windows-msvc)
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install NASM
+        # aws-lc-sys (deno_node_crypto -> ... -> aws-lc-sys) assembles BoringSSL's x86_64 .asm with NASM.
+        uses: ilammy/setup-nasm@v1
+
+      - name: Install .NET SDK
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.0.300"
+
+      - name: Build dotnet-data1 WASM module
+        run: |
+          set -xeuo pipefail
+          cd services/ws-modules/dotnet-data1
+          dotnet workload install wasm-tools --skip-manifest-update
+          # MSBuild's BrowserWasmApp.targets link step calls bare `emcc` and relies on PATH.
+          # Surface the workload's emcc dir + EmscriptenLocation ourselves (same approach as the mise build task).
+          packs="${DOTNET_ROOT:-/c/Program Files/dotnet}/packs"
+          emcc_bat="$(find "$packs" -name emcc.bat 2>/dev/null | head -1)"
+          if [ -z "$emcc_bat" ]; then
+            emcc_bat="$(find "/c/Program Files/dotnet/packs" -name emcc.bat 2>/dev/null | head -1)"
+          fi
+          test -n "$emcc_bat" || { echo "emcc.bat not found under dotnet packs"; exit 1; }
+          emcc_dir="$(dirname "$emcc_bat")"
+          emsdk_loc="$(dirname "$(dirname "$emcc_dir")")/Sdk"
+          export PATH="$(cygpath -u "$emcc_dir"):$PATH"
+          dotnet publish -c Release -p:EmscriptenLocation="$(cygpath -w "$emsdk_loc")"
+          publish=bin/Release/net10.0/publish/wwwroot/_framework
+          cp "$publish"/*.js "$publish"/*.wasm "$publish"/*.dat pkg/
+
+      - name: Run web-runner dotnet-data1 test
+        # Filter by the `dotnet` substring, not a positional `case_N_` name, so cargo auto-finds the dotnet case(s).
+        # rstest numbers cases by declaration order, so a hard-coded index would silently repoint at the wrong test
+        # when a module is inserted before it.
+        env:
+          MISE_ENV: dotnet
+        run: cargo test -p et-ws-web-runner dotnet -- --nocapture

.mise/config.dotnet.toml

@@ -27,19 +27,6 @@ description = "Format .NET sources"
 description = "Build the dotnet-data1 C# WASM workflow module"
 dir = "services/ws-modules/dotnet-data1"
 run = '''
-# The Windows lane is skipped: no lever the .NET WebAssembly SDK exposes works.
-# Neither routes bare-`emcc` in the link <Exec> to the workload-installed pack. MSBuild's BrowserWasmApp.targets
-# link step's `<Exec Command="emcc @rsp">` does NOT inherit the bash-level PATH prepend (validated empirically
-# -- the emcc-debug step in test.yaml shows `cmd.exe %PATH%` sees the emscripten dir after the prepend, yet the
-# link still trips `'emcc' is not recognized` / MSB3073 exit 9009), and `-p:EmscriptenLocation=...\Sdk` fixes
-# the compile target but not the link. tests/modules.rs's `dotnet_data1_pkg_built()` matches this skip so the
-# downstream test on Windows logs `skipping ...: pkg/ not built` instead of failing. Drop this guard once
-# .NET's SDK either honors PATH or documents a property that overrides the link <Exec> command.
-if [ "${OS:-}" = "Windows_NT" ]; then
-    echo "build-ws-dotnet-data1-module: skipped on Windows (MSBuild link <Exec> ignores our PATH; emcc unresolvable)"
-    exit 0
-fi
-
 # `set -x` so every command is echoed to the log.
 # That covers the find / dirname chain that resolves $(EmscriptenLocation), the final dotnet publish invocation
 # with its -p:EmscriptenLocation=... arg, and the cp of the publish artefacts. The Windows path of this task is

.mise/config.toml

@@ -599,15 +599,18 @@ description = "Run conftest OPA/Rego policies over the GitHub Actions workflow +
 # per-file rules (gha, no_trailing_backslash) over workflow YAML; --combine rules (gha_combined) over
 # workflow YAML for cross-cutting invariants where the rule has to compare each workflow's parsed body
 # against its own filename (the `paths:` self-reference check; conftest's per-file mode has no `input.path`);
-# and gha_action over the composite actions under .github/actions/*/action.yaml (different schema, so its
-# own namespace).
+# gha_action over the composite actions under .github/actions/*/action.yaml (different schema, so its
+# own namespace); and gha_mise over the workflow YAML combined with .mise (auto-detected parsers) so a rule can
+# cross-check a hard-coded action-input version against the matching mise [tools] pin (setup-dotnet's
+# dotnet-version vs the `dotnet` pin).
 run = """
 ns="--namespace gha --namespace no_trailing_backslash"
 # $ns expands to repeated `--namespace <n>` pairs; word-splitting is intentional.
 # shellcheck disable=SC2086
 conftest test --parser yaml $ns -p config/conftest/policy .github/workflows
 conftest test --parser yaml --combine --namespace gha_combined -p config/conftest/policy .github/workflows
 conftest test --parser yaml --namespace gha_action -p config/conftest/policy .github/actions/*/action.yaml
+conftest test --combine --namespace gha_mise -p config/conftest/policy .github/workflows .mise
 """
 shell = "bash -euo pipefail -c"
 

README.md

@@ -16,8 +16,8 @@ Please install [`mise`](https://mise.jdx.dev/) (2026.6.5 or later), including th
 for all use of this repository.
 
 The `mise` configuration lives under [`.mise/`](.mise/): the always-loaded [`.mise/config.toml`](.mise/config.toml)
-holds the Rust/Node tooling and shared tasks, and per-language `.mise/config.<lang>.toml` files (dart, dotnet, java,
-python, zig) are selected via `MISE_ENV` so a dev can work on one language without installing the others -- e.g.
+holds the Rust/Node tooling and shared tasks, and per-language `.mise/config.<lang>.toml` files are selected via
+`MISE_ENV` so a dev can work on one language without installing the others -- e.g.
 `MISE_ENV=dart mise install`. CI runs every language; `mise run check-all` (and `install-all`, `test-all`, ...) act
 on all of them at once.
 
@@ -63,6 +63,9 @@ mise.exe links the Microsoft VC++ runtime (`vcruntime140.dll`), so it must be pr
 preinstalled on Windows 10/11 and Server, so you already have it -- only Nano Server omits it, and there the
 Docker build installs the [VC++ Redistributable](https://aka.ms/vs/17/release/vc_redist.x64.exe).
 
+mise-powered builds use the `x86_64-pc-windows-gnullvm` Rust target (llvm-mingw), which needs no MSVC toolchain or
+Windows SDK on disk. The native `x86_64-pc-windows-msvc` target can also be used.
+
 ### Windows shell
 
 On Windows, install the shell:
@@ -209,15 +212,23 @@ Modules target one of three runners.
 
 ### Browser runner ([ws-web-runner](services/ws-web-runner))
 
-Modules loaded by a web browser, or natively under Deno by `et-ws-web-runner`. Most are Rust built with
-`wasm-pack build --target web`; other languages:
+Modules loaded by a web browser, or using Deno as the "web browser" in `et-ws-web-runner`.
+
+Most are Rust built with `wasm-pack build --target web`; other languages:
 
 - Dart
 - Java
 - .Net C#
 - Python, using [pyodide](https://pyodide.org/) and [RustPython](https://rustpython.github.io/)
 - Zig, including C code
 
+On Windows `et-ws-web-runner` must be built with the MSVC target (`x86_64-pc-windows-msvc`), not the gnullvm
+default the rest of the repo uses. It embeds V8 through `deno_core` and the `v8` crate, and gnullvm cannot be
+built: there is no `x86_64-pc-windows-gnullvm` `librusty_v8` prebuilt, the gnullvm build path in `rusty_v8` is
+still unfinished (open PRs [denoland/rusty_v8#1880](https://github.com/denoland/rusty_v8/pull/1880) and
+[#1957](https://github.com/denoland/rusty_v8/pull/1957)), and the MSVC prebuilt can't be linked into a gnullvm
+binary because the two ABIs are incompatible.
+
 ### WASI runner ([ws-wasi-runner](services/ws-wasi-runner))
 
 Modules built as WASI Preview 2 components and run under wasmtime:

config/conftest/policy/gha/gha.rego

@@ -34,8 +34,9 @@ step_shell_allowed(step) if {
 
 # Every workflow must declare MISE_ENV at the workflow level so the set of loaded language envs is visible at a glance.
 # This avoids per-job `mise run print-all-langs` runtime resolution. The matching `Show MISE_ENV` step in each job
-# echoes the value into the CI log.
+# echoes the value into the CI log. Carve-out: test-msvc deliberately doesn't use mise.
 deny contains msg if {
+	input.name != "test-msvc"
 	not input.env.MISE_ENV
 	msg := "workflow must set top-level env.MISE_ENV (the comma-separated language list)"
 }

config/conftest/policy/gha_mise/gha_mise.rego

@@ -0,0 +1,29 @@
+# Cross-checks for GitHub Actions workflows against the .mise/config*.toml pins, run with `--namespace gha_mise`.
+# Evaluated over the workflow YAML plus the .mise/config*.toml files combined (--combine, auto-detected parsers).
+# A workflow that hard-codes a toolchain version via an action input (test-msvc.yaml installs the .NET SDK with
+# actions/setup-dotnet's `dotnet-version`, deliberately bypassing mise) must match the matching mise [tools] pin, so
+# the CI runner SDK and the mise-built modules compile against the same toolchain.
+package gha_mise
+
+import data.mise
+
+# The mise-managed .NET SDK pin (.mise/config.dotnet.toml: dotnet = "<ver>").
+dotnet_pin := version if {
+	some file in input
+	mise.is_mise(file)
+	version := file.contents.tools.dotnet
+}
+
+# Every setup-dotnet `dotnet-version` must equal the mise `dotnet` pin.
+deny contains msg if {
+	some file in input
+	endswith(file.path, ".yaml")
+	some job in file.contents.jobs
+	some step in job.steps
+	declared := step.with["dotnet-version"]
+	declared != dotnet_pin
+	msg := sprintf(
+		"%s: setup-dotnet dotnet-version %q must match the mise dotnet pin %q in .mise/config.dotnet.toml",
+		[file.path, declared, dotnet_pin],
+	)
+}