enhance: test on Windows and fix what it found (#1348)

Adds a weekly and on-demand workflow that runs the cross-compiled tests on Windows Server 2025 Core in a [dockur/windows](https://github.com/dockur/windows) QEMU VM, and fixes the Windows bugs it found in host and UNC paths, env handling, shell quoting, post-task scripts, health checks, checkout, action symlinks, step summaries, Git client certificates and docker mode from a Windows host.

Host-mode steps now emit UTF-8, `bash` falls back to Git's bash instead of the WSL launcher, the runner can run as a native Windows service, steps can keep background helpers with `RUNNER_TRACKING_ID`, and Windows arm64 binaries are released.

Fixes: https://gitea.com/gitea/runner/issues/1339
Fixes: https://gitea.com/gitea/runner/issues/637
Fixes: https://gitea.com/gitea/runner/issues/1172
Fixes: https://gitea.com/gitea/runner/issues/347
Reviewed-on: https://gitea.com/gitea/runner/pulls/1348
Reviewed-by: bircni <[email protected]>

internal/app/run/health_check.go

@@ -59,9 +59,8 @@ func (r *Runner) checkConfiguredHealth(ctx context.Context) (bool, string) {
 func executeHealthCheck(ctx context.Context, script string, timeout time.Duration, env map[string]string) error {
 	checkCtx, cancel := context.WithTimeout(ctx, timeout)
 	defer cancel()
-	cmd := exec.CommandContext(checkCtx, script)
+	cmd := scriptCommand(checkCtx, script)
 	cmd.Env = envListFromMap(env)
-	cmd.SysProcAttr = process.SysProcAttr(script, false)
 	writer := common.NewLineWriter(func(line string) bool {
 		line = strings.TrimRight(line, "\r\n")
 		if line != "" {

internal/app/run/health_check_windows_test.go

@@ -0,0 +1,25 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package run
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestExecuteHealthCheckExeAndBatchPathsWithSpace(t *testing.T) {
+	whoami, err := os.ReadFile(filepath.Join(os.Getenv("SystemRoot"), "System32", "whoami.exe"))
+	require.NoError(t, err)
+	dir := filepath.Join(t.TempDir(), "health check")
+	require.NoError(t, os.MkdirAll(dir, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "probe.exe"), whoami, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "probe.cmd"), []byte("@exit /b 0\r\n"), 0o755))
+	for _, name := range []string{"probe.exe", "probe.cmd"} {
+		require.NoError(t, executeHealthCheck(t.Context(), filepath.Join(dir, name), time.Minute, nil))
+	}
+}

internal/app/run/post_task_script.go

@@ -8,6 +8,8 @@ import (
 	"errors"
 	"io"
 	"os/exec"
+	"path/filepath"
+	"runtime"
 	"strconv"
 	"strings"
 	"time"
@@ -39,9 +41,8 @@ func (r *Runner) runPostTaskScript(ctx context.Context, reporter *report.Reporte
 	env := r.postTaskScriptEnv(reporter, task, workdir)
 	logging.Infof("running post-task script %q for task %d", script, task.Id)
 
-	cmd := exec.CommandContext(scriptCtx, script)
+	cmd := scriptCommand(scriptCtx, script)
 	cmd.Env = envListFromMap(env)
-	cmd.SysProcAttr = process.SysProcAttr(script, false)
 
 	stdout := postTaskScriptLogWriter("stdout")
 	stderr := postTaskScriptLogWriter("stderr")
@@ -75,6 +76,17 @@ func (r *Runner) runPostTaskScript(ctx context.Context, reporter *report.Reporte
 	}
 }
 
+func scriptCommand(ctx context.Context, script string) *exec.Cmd { // Windows batch files need cmd.exe, CreateProcess cannot start them
+	if ext := strings.ToLower(filepath.Ext(script)); runtime.GOOS == "windows" && (ext == ".bat" || ext == ".cmd") {
+		cmd := exec.CommandContext(ctx, "cmd.exe")
+		cmd.SysProcAttr = process.SysProcAttr(`cmd.exe /d /s /c ""`+script+`""`, false)
+		return cmd
+	}
+	cmd := exec.CommandContext(ctx, script)
+	cmd.SysProcAttr = process.SysProcAttr("", false)
+	return cmd
+}
+
 func postTaskScriptContext(ctx context.Context, timeout time.Duration) (context.Context, context.CancelFunc) {
 	// Detach from the task context's deadline and cancellation: the task has
 	// already finished by the time the post-task script runs, so the script must

internal/app/run/post_task_script_test.go

@@ -7,10 +7,12 @@ import (
 	"context"
 	"os"
 	"path/filepath"
+	"runtime"
 	"testing"
 	"time"
 
 	"gitea.com/gitea/runner/act/common/logging"
+	"gitea.com/gitea/runner/act/common/logging/logtest"
 	"gitea.com/gitea/runner/internal/pkg/config"
 	"gitea.com/gitea/runner/internal/pkg/metrics"
 	"gitea.com/gitea/runner/internal/pkg/report"
@@ -39,9 +41,15 @@ func TestRunPostTaskScriptSkippedWhenEmpty(t *testing.T) {
 }
 
 func TestRunPostTaskScriptNonZeroExitDoesNotPanic(t *testing.T) {
+	hook := logtest.SetDefault(t)
 	dir := t.TempDir()
 	scriptPath := filepath.Join(dir, "fail.sh")
-	require.NoError(t, os.WriteFile(scriptPath, []byte("#!/bin/sh\nexit 2\n"), 0o700))
+	script := "#!/bin/sh\nexit 2\n"
+	if runtime.GOOS == "windows" {
+		scriptPath = filepath.Join(dir, "fail.cmd")
+		script = "@exit /b 2\r\n"
+	}
+	require.NoError(t, os.WriteFile(scriptPath, []byte(script), 0o700))
 
 	cfg, err := config.LoadDefault("")
 	require.NoError(t, err)
@@ -59,6 +67,8 @@ func TestRunPostTaskScriptNonZeroExitDoesNotPanic(t *testing.T) {
 	require.NotPanics(t, func() {
 		r.runPostTaskScript(ctx, reporter, task, "/workspace/owner/repo")
 	})
+	require.NotNil(t, hook.LastRecord())
+	assert.Contains(t, hook.LastRecord().Message, "exited with code 2")
 }
 
 func TestPostTaskScriptContextUsesFullTimeout(t *testing.T) {
@@ -113,10 +123,15 @@ func TestPostTaskScriptEnv(t *testing.T) {
 }
 
 func TestRunPostTaskScriptIntegration(t *testing.T) {
-	dir := t.TempDir()
+	dir := filepath.Join(t.TempDir(), "script directory")
+	require.NoError(t, os.Mkdir(dir, 0o700))
 	outFile := filepath.Join(dir, "out.txt")
 	scriptPath := filepath.Join(dir, "post-task.sh")
 	script := "#!/bin/sh\nprintf '%s %s %s' \"$GITEA_TASK_ID\" \"$GITEA_JOB_RESULT\" \"$CUSTOM\" > \"" + outFile + "\"\n"
+	if runtime.GOOS == "windows" {
+		scriptPath = filepath.Join(dir, "post-task.cmd")
+		script = "@echo off\r\n<nul set /p \"=%GITEA_TASK_ID% %GITEA_JOB_RESULT% %CUSTOM%\" > \"" + outFile + "\"\r\nexit /b 0\r\n"
+	}
 	require.NoError(t, os.WriteFile(scriptPath, []byte(script), 0o700))
 
 	cfg, err := config.LoadDefault("")

internal/app/run/runner.go

@@ -168,7 +168,7 @@ func (r *Runner) OnIdle(ctx context.Context) {
 	}
 	// Bind-workdir mode: reclaim stale per-task workspace dirs (numeric task IDs).
 	if r.cfg.Container.BindWorkdir {
-		r.cleanupStaleDirs(ctx, filepath.FromSlash("/"+strings.TrimLeft(r.cfg.Container.WorkdirParent, "/")), isTaskIDDir)
+		r.cleanupStaleDirs(ctx, containerWorkdirRoot(r.cfg.Container.WorkdirParent), isTaskIDDir)
 	}
 	// Host mode: reclaim per-job scratch dirs left behind when HostEnvironment
 	// cleanup timed out (e.g. a delete stalled by an AV/EDR filter driver). They
@@ -557,12 +557,12 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report.
 		actionCloneDepth = 0
 	}
 
-	workdirParent := strings.TrimLeft(r.cfg.Container.WorkdirParent, "/")
+	workdirParent := containerWorkdirRoot(r.cfg.Container.WorkdirParent)
 	if r.cfg.Container.BindWorkdir {
 		// Append the task ID to isolate concurrent jobs from the same repo.
-		workdirParent = fmt.Sprintf("%s/%d", workdirParent, task.Id)
+		workdirParent = filepath.Join(workdirParent, strconv.FormatInt(task.Id, 10))
 	}
-	workdir := filepath.FromSlash(fmt.Sprintf("/%s/%s", workdirParent, preset.Repository))
+	workdir := filepath.Join(workdirParent, filepath.FromSlash(preset.Repository))
 	if runtime.GOOS == "windows" {
 		if abs, err := filepath.Abs(workdir); err == nil {
 			workdir = abs
@@ -648,10 +648,8 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report.
 	reporter.SetOutputs(job.Outputs)
 
 	if r.cfg.Container.BindWorkdir {
-		// Remove the entire task-specific directory (e.g. /workspace/<task_id>).
-		taskDir := filepath.FromSlash("/" + workdirParent)
-		if err := os.RemoveAll(taskDir); err != nil {
-			logging.Warnf("failed to clean up workspace %s: %v", taskDir, err)
+		if err := os.RemoveAll(workdirParent); err != nil {
+			logging.Warnf("failed to clean up workspace %s: %v", workdirParent, err)
 		}
 	}
 
@@ -821,7 +819,7 @@ func (r *Runner) setHealthStatus(ready bool, reason string) {
 func checkFreeDisk(cfg *config.Config) (bool, string) {
 	root := cfg.Host.WorkdirParent
 	if cfg.Container.BindWorkdir {
-		root = filepath.FromSlash("/" + strings.TrimLeft(cfg.Container.WorkdirParent, "/"))
+		root = containerWorkdirRoot(cfg.Container.WorkdirParent)
 	}
 	root = nearestExistingPath(root)
 	available, err := disk.FreeBytes(root)
@@ -835,6 +833,13 @@ func checkFreeDisk(cfg *config.Config) (bool, string) {
 	return true, "ok"
 }
 
+func containerWorkdirRoot(parent string) string {
+	if filepath.IsAbs(parent) {
+		return filepath.Clean(parent)
+	}
+	return filepath.Join(string(filepath.Separator), parent)
+}
+
 func nearestExistingPath(path string) string {
 	for path != "" {
 		if _, err := os.Stat(path); err == nil {

internal/app/run/runner_idle_cleanup_test.go

@@ -241,9 +241,6 @@ func TestRunnerShouldRunIdleCleanupSkipsWhenDisabled(t *testing.T) {
 	})
 }
 
-// TestRunnerOnIdleIntegratesCleanup wires the full OnIdle entry point and
-// confirms it walks workdir_parent (after the leading-slash trim that
-// matches the production path construction) and removes stale numeric dirs.
 func TestRunnerOnIdleIntegratesCleanup(t *testing.T) {
 	now := time.Date(2026, time.April, 29, 20, 0, 0, 0, time.UTC)
 	root := t.TempDir()
@@ -255,7 +252,7 @@ func TestRunnerOnIdleIntegratesCleanup(t *testing.T) {
 		cfg: &config.Config{
 			Container: config.Container{
 				BindWorkdir:   true,
-				WorkdirParent: root, // leading slash absent, OnIdle reattaches it
+				WorkdirParent: root,
 			},
 			Runner: config.Runner{
 				WorkdirCleanupAge:   24 * time.Hour,
@@ -371,3 +368,16 @@ func TestRunnerOnIdleRemovesOrphanNetworks(t *testing.T) {
 	assert.Equal(t, []string{"a1b2c3d4e5f6", ""}, detached)
 	assert.Equal(t, []string{"runner-1"}, sweptPods)
 }
+
+func TestContainerWorkdirRoot(t *testing.T) {
+	absolute := t.TempDir()
+	rooted := filepath.Join(string(filepath.Separator), "workspace")
+	for input, want := range map[string]string{
+		"workspace":          rooted,
+		"/workspace/":        rooted,
+		absolute:             absolute,
+		absolute + "/nested": filepath.Join(absolute, "nested"),
+	} {
+		assert.Equal(t, want, containerWorkdirRoot(input), input)
+	}
+}