enhance: test on Windows and fix what it found (#1348)

Adds a weekly and on-demand workflow that runs the cross-compiled tests on Windows Server 2025 Core in a [dockur/windows](https://github.com/dockur/windows) QEMU VM, and fixes the Windows bugs it found in host and UNC paths, env handling, shell quoting, post-task scripts, health checks, checkout, action symlinks, step summaries, Git client certificates and docker mode from a Windows host.

Host-mode steps now emit UTF-8, `bash` falls back to Git's bash instead of the WSL launcher, the runner can run as a native Windows service, steps can keep background helpers with `RUNNER_TRACKING_ID`, and Windows arm64 binaries are released.

Fixes: https://gitea.com/gitea/runner/issues/1339
Fixes: https://gitea.com/gitea/runner/issues/637
Fixes: https://gitea.com/gitea/runner/issues/1172
Fixes: https://gitea.com/gitea/runner/issues/347
Reviewed-on: https://gitea.com/gitea/runner/pulls/1348
Reviewed-by: bircni <[email protected]>

act/lookpath/git_bash.go

@@ -0,0 +1,25 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package lookpath
+
+import (
+	"path/filepath"
+	"strings"
+)
+
+func lookPathWindows(file string, env map[string]string, lookup func(string, map[string]string) (string, error)) (string, error) {
+	found, err := lookup(file, env)
+	isBash := strings.EqualFold(file, "bash") || strings.EqualFold(file, "bash.exe")
+	if !isBash || err == nil && !strings.EqualFold(filepath.Base(filepath.Dir(found)), "System32") { // System32's bash is the WSL launcher, Git's bash replaces it
+		return found, err
+	}
+	if git, gitErr := lookup("git.exe", env); gitErr == nil {
+		for _, relative := range []string{"../bin/bash.exe", "../usr/bin/bash.exe", "bash.exe"} {
+			if bash, bashErr := lookup(filepath.Join(filepath.Dir(git), relative), env); bashErr == nil {
+				return bash, nil
+			}
+		}
+	}
+	return found, err
+}

act/lookpath/git_bash_test.go

@@ -0,0 +1,56 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package lookpath
+
+import (
+	"io/fs"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestLookPathWindowsFallsBackToGitBash(t *testing.T) {
+	root := "C:" + string(filepath.Separator)
+	system32 := filepath.Join(root, "Windows", "System32")
+	gitCmd, gitBin := filepath.Join(root, "Git", "cmd"), filepath.Join(root, "Git", "bin")
+	msys := filepath.Join(root, "msys64", "usr", "bin")
+	for _, test := range []struct {
+		name, command, want string
+		path                []string
+	}{
+		{"wsl launcher first", "bash", filepath.Join(gitBin, "bash.exe"), []string{system32, gitCmd}},
+		{"no bash on path", "BASH.EXE", filepath.Join(gitBin, "bash.exe"), []string{gitCmd}},
+		{"own bash first", "bash", filepath.Join(msys, "bash.exe"), []string{msys, system32, gitCmd}},
+		{"no git", "bash", filepath.Join(system32, "bash.exe"), []string{system32}},
+		{"other command", "sh", filepath.Join(system32, "sh.exe"), []string{system32, gitCmd}},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			files := map[string]bool{
+				filepath.Join(system32, "bash.exe"): true, filepath.Join(system32, "sh.exe"): true,
+				filepath.Join(gitCmd, "git.exe"): true, filepath.Join(gitBin, "bash.exe"): true, filepath.Join(msys, "bash.exe"): true,
+			}
+			lookup := func(file string, env map[string]string) (string, error) {
+				candidates := []string{file}
+				if !strings.ContainsAny(file, `:\/`) {
+					candidates = nil
+					for directory := range strings.SplitSeq(env["PATH"], ";") {
+						candidates = append(candidates, filepath.Join(directory, strings.TrimSuffix(strings.ToLower(file), ".exe")+".exe"))
+					}
+				}
+				for _, candidate := range candidates {
+					if files[filepath.Clean(candidate)] {
+						return filepath.Clean(candidate), nil
+					}
+				}
+				return "", fs.ErrNotExist
+			}
+			got, err := lookPathWindows(test.command, map[string]string{"PATH": strings.Join(test.path, ";")}, lookup)
+			require.NoError(t, err)
+			assert.Equal(t, test.want, got)
+		})
+	}
+}

act/lookpath/lp_windows.go

@@ -53,6 +53,10 @@ func findExecutable(file string, exts []string) (string, error) {
 // a suitable candidate.
 // The result may be an absolute path or a path relative to the current directory.
 func LookPath2(file string, env map[string]string) (string, error) {
+	return lookPathWindows(file, env, lookPath)
+}
+
+func lookPath(file string, env map[string]string) (string, error) {
 	var exts []string
 	x := getenv(env, `PATHEXT`)
 	if x != "" {