ci: run Windows merge queue tests on ECS

.github/actions/configure-windows-runner/action.yml

@@ -0,0 +1,21 @@
+name: 'Configure Windows self-hosted runner'
+description: 'Tunes a self-hosted Windows runner for the test gates: exports the Linux gates'' C.UTF-8 locale env (inert on Windows, where Node collates through ICU), redirects TEMP/TMP to RUNNER_TEMP, and puts Git Bash on PATH for bash-shell steps. Runs after actions/checkout because repository-local actions resolve from the workspace; callers turn off autocrlf before the checkout itself. Shared by the Windows merge-queue gate and the runner smoke workflow so both always run an identical configuration.'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: 'Configure Windows test environment'
+      # Self-hosted runners have Windows PowerShell, not necessarily pwsh.
+      # Force UTF-8 so GITHUB_ENV/GITHUB_PATH are not written as UTF-16LE.
+      shell: 'powershell'
+      run: |-
+        $ErrorActionPreference = 'Stop'
+        "TEMP=$env:RUNNER_TEMP" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+        "TMP=$env:RUNNER_TEMP" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+        "LC_ALL=C.UTF-8" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+        $gitBash = 'C:\Program Files\Git\bin'
+        if (!(Test-Path $gitBash)) {
+          Write-Output "::error::Git Bash not found at $gitBash"
+          exit 1
+        }
+        $gitBash | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append

.github/actions/self-hosted-node/action.yml

@@ -0,0 +1,17 @@
+name: 'Self-hosted Node.js preflight'
+description: 'Preflight for self-hosted runners that reuse their pre-installed Node.js instead of downloading one on ECS, where nodejs.org may be unreachable through the egress proxy: fails the job when Node is missing and warns when the major version is not 22.'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: 'Use pre-installed Node.js'
+      shell: 'bash'
+      run: |-
+        if ! command -v node >/dev/null 2>&1; then
+          echo "::error::Node.js is not on PATH for this self-hosted runner. Provision Node 22.x or set the MAINTAINER_ECS_RUNNER_DISABLED repository variable to 'true' to route this gate back to hosted runners."
+          exit 1
+        fi
+        echo "Using pre-installed Node $(node -v) / npm $(npm -v)"
+        if [[ "$(node -p 'process.versions.node.split(".")[0]')" != "22" ]]; then
+          echo "::warning::Expected Node 22.x but found $(node -v); tests will run against the runner's Node."
+        fi

.github/actions/verify-checkout-head/action.yml

@@ -0,0 +1,21 @@
+name: 'Verify Checkout Head'
+description: 'Fails the job when the checked-out tree does not contain the expected head commit, so a stale checkout (e.g. a caching egress proxy serving an old ref) is never silently tested into a merge. Cheap: one merge-base, sub-second.'
+
+inputs:
+  expected_sha:
+    description: 'Commit SHA that must be an ancestor of the checked-out HEAD.'
+    required: true
+
+runs:
+  using: 'composite'
+  steps:
+    - name: 'Verify checkout includes expected head commit'
+      shell: 'bash'
+      env:
+        EXPECTED_SHA: '${{ inputs.expected_sha }}'
+      run: |-
+        if ! git merge-base --is-ancestor "${EXPECTED_SHA}" HEAD; then
+          echo "::error::Checked out ref does not contain expected head ${EXPECTED_SHA}."
+          git log --oneline --decorate -5
+          exit 1
+        fi

.github/workflows/ci.yml

@@ -252,14 +252,9 @@ jobs:
       # ECS/squid, a wrong-tree pass would merge bad code.
       - name: 'Verify checkout includes expected head commit'
         if: "${{ needs.classify_pr.outputs.skip_ci != 'true' && (github.event_name == 'pull_request' || github.event_name == 'merge_group') }}"
-        env:
-          EXPECTED_SHA: "${{ github.event_name == 'merge_group' && github.event.merge_group.head_sha || github.event.pull_request.head.sha }}"
-        run: |-
-          if ! git merge-base --is-ancestor "${EXPECTED_SHA}" HEAD; then
-            echo "::error::Checked out ref does not contain expected head ${EXPECTED_SHA}."
-            git log --oneline --decorate -5
-            exit 1
-          fi
+        uses: './.github/actions/verify-checkout-head'
+        with:
+          expected_sha: "${{ github.event_name == 'merge_group' && github.event.merge_group.head_sha || github.event.pull_request.head.sha }}"
 
       - name: 'Classify CI profile'
         id: 'ci_profile'
@@ -302,7 +297,8 @@ jobs:
           node scripts/lint.js --yamllint
           node --test ${{ env.HELPER_TESTS }}
 
-      # Self-hosted can't reach nodejs.org reliably; reuse the machine's Node.
+      # Avoid setup-node downloads on ECS, where nodejs.org may be unreachable
+      # through the egress proxy; reuse the machine's Node instead.
       - name: 'Set up Node.js 22.x (hosted)'
         if: "${{ needs.classify_pr.outputs.skip_ci != 'true' && steps.ci_profile.outputs.ci_profile == 'full' && runner.environment == 'github-hosted' }}"
         uses: 'actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e' # v6.4.0
@@ -314,15 +310,7 @@ jobs:
 
       - name: 'Use pre-installed Node.js (self-hosted)'
         if: "${{ needs.classify_pr.outputs.skip_ci != 'true' && steps.ci_profile.outputs.ci_profile == 'full' && runner.environment == 'self-hosted' }}"
-        run: |-
-          if ! command -v node >/dev/null 2>&1; then
-            echo "::error::Node.js is not on PATH for this self-hosted runner. Provision Node 22.x or set the MAINTAINER_ECS_RUNNER_DISABLED repository variable to 'true' to route PRs back to hosted runners."
-            exit 1
-          fi
-          echo "Using pre-installed Node $(node -v) / npm $(npm -v)"
-          if [[ "$(node -p 'process.versions.node.split(".")[0]')" != "22" ]]; then
-            echo "::warning::Expected Node 22.x but found $(node -v); tests will run against the runner's Node."
-          fi
+        uses: './.github/actions/self-hosted-node'
 
       - name: 'Configure persistent npm cache (self-hosted)'
         if: "${{ needs.classify_pr.outputs.skip_ci != 'true' && steps.ci_profile.outputs.ci_profile == 'full' && runner.environment == 'self-hosted' }}"
@@ -632,14 +620,9 @@ jobs:
 
       - name: 'Verify checkout includes expected head commit'
         if: "${{ github.event_name == 'pull_request' }}"
-        env:
-          EXPECTED_SHA: '${{ github.event.pull_request.head.sha }}'
-        run: |-
-          if ! git merge-base --is-ancestor "${EXPECTED_SHA}" HEAD; then
-            echo "::error::Checked out ref does not contain expected head ${EXPECTED_SHA}."
-            git log --oneline --decorate -5
-            exit 1
-          fi
+        uses: './.github/actions/verify-checkout-head'
+        with:
+          expected_sha: '${{ github.event.pull_request.head.sha }}'
 
       # Self-hosted can't reach nodejs.org reliably; reuse the machine's Node.
       - name: 'Set up Node.js 22.x (hosted)'
@@ -653,15 +636,7 @@ jobs:
 
       - name: 'Use pre-installed Node.js (self-hosted)'
         if: "${{ runner.environment == 'self-hosted' }}"
-        run: |-
-          if ! command -v node >/dev/null 2>&1; then
-            echo "::error::Node.js is not on PATH for this self-hosted runner. Provision Node 22.x or set the MAINTAINER_ECS_RUNNER_DISABLED repository variable to 'true' to route PRs back to hosted runners."
-            exit 1
-          fi
-          echo "Using pre-installed Node $(node -v) / npm $(npm -v)"
-          if [[ "$(node -p 'process.versions.node.split(".")[0]')" != "22" ]]; then
-            echo "::warning::Expected Node 22.x but found $(node -v); web-shell smoke tests will run against the runner's Node."
-          fi
+        uses: './.github/actions/self-hosted-node'
 
       - name: 'Configure persistent npm cache (self-hosted)'
         if: "${{ runner.environment == 'self-hosted' }}"
@@ -773,33 +748,84 @@ jobs:
           node -e "const fs = require('node:fs'); for (const key of ['HOME', 'USERPROFILE']) { const dir = process.env[key]; if (dir) fs.mkdirSync(dir, { recursive: true }); }"
           npm run test:ci
 
-  # Windows counterpart of test_macos (see that job's note). Runner is
-  # windows-2022; the check name keeps the windows-latest label so it matches
-  # the required-status-check context.
+  # Windows counterpart of test_macos (see that job's note). ECS is the default
+  # with a windows-2022 kill-switch fallback; the check name stays unchanged so
+  # it matches the required-status-check context. The job is merge_group-only,
+  # so code reaching it is post-approval; maintainers can still queue fork PRs.
+  # The runs-on expression therefore needs only the kill switch. ECS-only
+  # tuning is gated on runner.environment; the hosted fallback is the pre-ECS
+  # job plus the checkout guard and a job-level timeout-minutes.
   test_windows:
     name: 'Test (windows-latest, Node 22.x)'
     needs: 'classify_pr'
     if: "${{ !cancelled() && github.event_name == 'merge_group' }}"
-    runs-on: 'windows-2022'
+    runs-on: '${{ vars.MAINTAINER_ECS_RUNNER_DISABLED != ''true'' && fromJSON(''["self-hosted", "Windows", "X64", "ecs-win"]'') || fromJSON(''["windows-2022"]'') }}'
+    timeout-minutes: 60
     permissions:
       contents: 'read'
     steps:
+      # Belt-and-braces alongside .gitattributes' `eol=lf`: turn autocrlf off
+      # before the checkout so even a freshly provisioned runner that defaults
+      # autocrlf on checks out LF-only files. Repository-local `./` actions
+      # resolve from the job workspace, so the checkout must precede them;
+      # the rest of the self-hosted tuning runs after the checkout via the
+      # configure-windows-runner action, shared verbatim with
+      # windows-runner-smoke.yml so the runner-validation smoke exercises
+      # exactly what this gate uses. LC_ALL mirrors the Linux gates' locale
+      # env (inert on Windows, where Node collates through ICU), and Git Bash
+      # goes on PATH so the remaining steps can run under the workflow-level
+      # bash default.
+      - name: 'Disable Git CRLF conversion (self-hosted)'
+        if: "${{ needs.classify_pr.outputs.skip_ci != 'true' && runner.environment == 'self-hosted' }}"
+        shell: 'powershell'
+        run: 'git config --global core.autocrlf false'
+
       - name: 'Checkout'
         id: 'checkout'
         if: "${{ needs.classify_pr.outputs.skip_ci != 'true' }}"
         uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # v6.0.3
         with:
           ref: "${{ github.event.inputs.branch_ref || (github.event_name == 'pull_request' && format('refs/pull/{0}/head', github.event.pull_request.number)) || (github.event_name == 'merge_group' && github.event.merge_group.head_sha) || github.ref }}"
 
-      - name: 'Set up Node.js 22.x'
+      - name: 'Configure self-hosted Windows test environment'
+        if: "${{ needs.classify_pr.outputs.skip_ci != 'true' && runner.environment == 'self-hosted' }}"
+        uses: './.github/actions/configure-windows-runner'
+
+      # Same stale-checkout guard as the Ubuntu gate: this job now runs on ECS,
+      # so fail loud if the checkout lacks the merge-queue head rather than
+      # silently testing the wrong tree into a merge.
+      - name: 'Verify checkout includes expected head commit'
         if: "${{ needs.classify_pr.outputs.skip_ci != 'true' }}"
+        uses: './.github/actions/verify-checkout-head'
+        with:
+          expected_sha: '${{ github.event.merge_group.head_sha }}'
+
+      # Avoid setup-node downloads on ECS, where nodejs.org may be unreachable
+      # through the egress proxy; reuse the machine's Node instead.
+      - name: 'Set up Node.js 22.x (hosted)'
+        if: "${{ needs.classify_pr.outputs.skip_ci != 'true' && runner.environment != 'self-hosted' }}"
         uses: 'actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e' # v6.4.0
         with:
           node-version: '22.x'
           cache: 'npm'
           cache-dependency-path: 'package-lock.json'
           registry-url: 'https://registry.npmjs.org/'
 
+      - name: 'Use pre-installed Node.js (self-hosted)'
+        if: "${{ needs.classify_pr.outputs.skip_ci != 'true' && runner.environment == 'self-hosted' }}"
+        uses: './.github/actions/self-hosted-node'
+
+      - name: 'Configure persistent npm cache (self-hosted)'
+        if: "${{ needs.classify_pr.outputs.skip_ci != 'true' && runner.environment == 'self-hosted' }}"
+        run: |-
+          cache_dir="${HOME}/.cache/qwen-code/npm"
+          # Coreutils like mkdir are not guaranteed on a Git-Bash-only PATH,
+          # so create the directory through the Node the preflight verified.
+          node -e "require('node:fs').mkdirSync(process.argv[1], { recursive: true })" "${cache_dir}"
+          echo "NPM_CONFIG_CACHE=${cache_dir}" >> "${GITHUB_ENV}"
+          echo "Using persistent npm cache at ${cache_dir}"
+          du -sh "${cache_dir}" 2>/dev/null || true
+
       - name: 'Configure npm for rate limiting'
         if: "${{ needs.classify_pr.outputs.skip_ci != 'true' }}"
         run: |-
@@ -984,14 +1010,9 @@ jobs:
       # via classify_pr, so fail loud if the checkout lacks the merge-queue head
       # rather than silently testing the wrong tree into a merge.
       - name: 'Verify checkout includes expected head commit'
-        env:
-          EXPECTED_SHA: '${{ github.event.merge_group.head_sha }}'
-        run: |-
-          if ! git merge-base --is-ancestor "${EXPECTED_SHA}" HEAD; then
-            echo "::error::Checked out ref does not contain expected head ${EXPECTED_SHA}."
-            git log --oneline --decorate -5
-            exit 1
-          fi
+        uses: './.github/actions/verify-checkout-head'
+        with:
+          expected_sha: '${{ github.event.merge_group.head_sha }}'
 
       # Hosted downloads Node; self-hosted ECS reuses its pre-installed Node 22
       # (it can't reach nodejs.org reliably). Mirrors the Ubuntu gate.
@@ -1005,15 +1026,7 @@ jobs:
 
       - name: 'Use pre-installed Node.js (self-hosted)'
         if: "${{ runner.environment == 'self-hosted' }}"
-        run: |-
-          if ! command -v node >/dev/null 2>&1; then
-            echo "::error::Node.js is not on PATH for this self-hosted runner. Provision Node 22.x or set the MAINTAINER_ECS_RUNNER_DISABLED repository variable to 'true' to route the merge queue back to hosted runners."
-            exit 1
-          fi
-          echo "Using pre-installed Node $(node -v) / npm $(npm -v)"
-          if [[ "$(node -p 'process.versions.node.split(".")[0]')" != "22" ]]; then
-            echo "::warning::Expected Node 22.x but found $(node -v); integration tests will run against the runner's Node."
-          fi
+        uses: './.github/actions/self-hosted-node'
 
       - name: 'Configure persistent npm cache (self-hosted)'
         if: "${{ runner.environment == 'self-hosted' }}"

.github/workflows/windows-runner-smoke.yml

@@ -11,24 +11,30 @@ jobs:
     name: 'Validate runner'
     runs-on: ['self-hosted', 'Windows', 'X64', 'ecs-win']
     timeout-minutes: 60
-    env:
-      # LC_ALL overrides LANG, so set only LC_ALL. C.UTF-8 keeps deterministic
-      # C collation while preserving UTF-8 output for any non-ASCII assertions.
-      LC_ALL: 'C.UTF-8'
     steps:
-      - name: 'Configure Windows test environment'
-        # The self-hosted runner has Windows PowerShell, not necessarily pwsh.
-        # Force UTF-8 so GITHUB_ENV is not written as UTF-16LE.
+      # Mirrors the Windows merge-queue gate in ci.yml, so this smoke validates
+      # exactly the configuration that gate runs: autocrlf off before the
+      # checkout, then the shared configure action after it (repository-local
+      # `./` actions resolve from the job workspace, so the checkout must
+      # precede them).
+      - name: 'Disable Git CRLF conversion'
         shell: 'powershell'
-        run: |-
-          $ErrorActionPreference = 'Stop'
-          git config --global core.autocrlf false
-          "TEMP=$env:RUNNER_TEMP" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
-          "TMP=$env:RUNNER_TEMP" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+        run: 'git config --global core.autocrlf false'
 
       - name: 'Checkout'
         uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # v6.0.3
 
+      - name: 'Configure Windows test environment'
+        uses: './.github/actions/configure-windows-runner'
+
+      # Same stale-checkout guard as the gate: the smoke runs behind the same
+      # caching egress proxy, so fail loud if the checkout lacks the
+      # dispatched head instead of silently validating the wrong tree.
+      - name: 'Verify checkout includes expected head commit'
+        uses: './.github/actions/verify-checkout-head'
+        with:
+          expected_sha: '${{ github.sha }}'
+
       - name: 'Verify tools'
         shell: 'powershell'
         run: |-
@@ -66,28 +72,40 @@ jobs:
             Remove-Item $root -Recurse -Force -ErrorAction SilentlyContinue
           }
 
-      - name: 'Set up Node.js 22.x'
-        uses: 'actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e' # v6.4.0
-        with:
-          node-version: '22.x'
-          cache: 'npm'
-          cache-dependency-path: 'package-lock.json'
-          registry-url: 'https://registry.npmjs.org/'
+      # Same Node path as the gate's self-hosted side: avoid setup-node
+      # downloads on ECS, where nodejs.org may be unreachable through the
+      # egress proxy.
+      - name: 'Use pre-installed Node.js'
+        uses: './.github/actions/self-hosted-node'
+
+      - name: 'Configure persistent npm cache (self-hosted)'
+        shell: 'bash'
+        run: |-
+          cache_dir="${HOME}/.cache/qwen-code/npm"
+          # Coreutils like mkdir are not guaranteed on a Git-Bash-only PATH,
+          # so create the directory through the Node the preflight verified.
+          node -e "require('node:fs').mkdirSync(process.argv[1], { recursive: true })" "${cache_dir}"
+          echo "NPM_CONFIG_CACHE=${cache_dir}" >> "${GITHUB_ENV}"
+          echo "Using persistent npm cache at ${cache_dir}"
+          du -sh "${cache_dir}" 2>/dev/null || true
 
+      # ci.yml's workflow-level defaults run the gate's steps under bash, so
+      # pin the same shell here: smoke evidence only transfers to the gate
+      # when both execute these commands the same way.
       - name: 'Configure npm for rate limiting'
-        shell: 'powershell'
+        shell: 'bash'
         run: |-
           npm config set fetch-retry-mintimeout 20000
           npm config set fetch-retry-maxtimeout 120000
           npm config set fetch-retries 5
           npm config set fetch-timeout 300000
 
       - name: 'Install dependencies'
-        shell: 'powershell'
+        shell: 'bash'
         run: 'npm ci --prefer-offline --no-audit --progress=false'
 
       - name: 'Run tests and generate reports'
-        shell: 'powershell'
+        shell: 'bash'
         env:
           NO_COLOR: true
           HOME: '${{ runner.temp }}/qwen-ci-home'
@@ -97,10 +115,6 @@ jobs:
           QWEN_API_KEY: ''
           GEMINI_API_KEY: ''
           QWEN_DEFAULT_AUTH_TYPE: ''
-          NODE_OPTIONS: '--max-old-space-size=3072'
         run: |-
           node -e "const fs = require('node:fs'); for (const key of ['HOME', 'USERPROFILE']) { const dir = process.env[key]; if (dir) fs.mkdirSync(dir, { recursive: true }); }"
-          # Root test:scripts exercises bash-only workflow scripts; Linux CI covers it.
-          # npm has no --parallel (a pnpm/lerna flag) and ignores it, so the
-          # workspaces run serially; kept for parity with the root test:ci script.
-          npm run test:ci --workspaces --if-present --parallel
+          npm run test:ci