From 65094c8ff2148430d58f346f2516a5264c6a459e Mon Sep 17 00:00:00 2001
From: Paolo Salvatori <leprino@hotmail.com>
Date: Fri, 23 Oct 2026 15:51:32 +0200
Subject: [PATCH 01/18] Run the Python variant of web-app-cosmosdb-nosql-api in
 the samples CI

run-samples.sh registered 26 of the 27 sample variants that ship scripts; the Python variant of web-app-cosmosdb-nosql-api was the one missing, so CI only ever ran its .NET counterpart.
It is registered next to the .NET entry with the same deploy, validate and call steps, and, like it, is not added to ARM64_SAMPLE_DIRS.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DhZ2ojsEXd2SGMo7s9uiZh
---
 run-samples.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/run-samples.sh b/run-samples.sh
index 4cf1569..f78b461 100755
--- a/run-samples.sh
+++ b/run-samples.sh
@@ -38,6 +38,7 @@ SAMPLES=(
   "samples/function-app-storage-http/dotnet|bash scripts/deploy.sh|bash scripts/validate.sh && bash scripts/call-http-triggers.sh"
   "samples/web-app-cosmosdb-mongodb-api/python|bash scripts/deploy.sh|bash scripts/validate.sh && bash scripts/call-web-app.sh"
   "samples/web-app-cosmosdb-mongodb-api/dotnet|bash scripts/deploy.sh|bash scripts/validate.sh && bash scripts/call-web-app.sh"
+  "samples/web-app-cosmosdb-nosql-api/python|bash scripts/deploy.sh|bash scripts/validate.sh && bash scripts/call-web-app.sh"
   "samples/web-app-cosmosdb-nosql-api/dotnet|bash scripts/deploy.sh|bash scripts/validate.sh && bash scripts/call-web-app.sh"
   "samples/web-app-managed-identity/python|bash scripts/user-assigned.sh|bash scripts/validate.sh && bash scripts/call-web-app.sh"
   "samples/web-app-managed-identity/dotnet|bash scripts/user-assigned.sh|bash scripts/validate.sh && bash scripts/call-web-app.sh"

From ea91bb3ff92fae5827510de5d6f8b332f07b2824 Mon Sep 17 00:00:00 2001
From: Paolo Salvatori <leprino@hotmail.com>
Date: Fri, 23 Oct 2026 15:51:32 +0200
Subject: [PATCH 02/18] Run the scripts from Git Bash and MSYS2 with
 MSYS_NO_PATHCONV=1

Git Bash and MSYS2 shells rewrite every argument that looks like an absolute POSIX path before starting a Windows program, so Azure values such as the Cosmos DB partition key path /username, resource IDs and the Front Door origin path reached az as Windows paths (SMF-963).
The README now asks Windows users of these shells to export MSYS_NO_PATHCONV=1, which turns the rewriting off, and explains why.
With the rewriting off, the local files the scripts hand to Windows programs need their Windows form: the temporary files read by curl and jq, the Python checks of the Event Hubs samples, the API Management definition and policy, the downloaded blob and the QR code.
A native_path helper in each of these scripts returns that form through cygpath when it exists and the path unchanged otherwise, so Linux, macOS and WSL behave exactly as before.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DhZ2ojsEXd2SGMo7s9uiZh
---
 README.md                                     | 28 +++++++++++++++++++
 .../python/scripts/call-api.sh                | 16 +++++++++--
 .../python/scripts/deploy.sh                  | 14 +++++++++-
 .../python/scripts/validate.sh                | 16 +++++++++--
 .../python/scripts/run-pipeline.sh            | 15 ++++++++--
 .../python/scripts/validate.sh                | 13 ++++++++-
 .../eventhubs/python/scripts/run-pipeline.sh  | 17 +++++++++--
 samples/eventhubs/python/scripts/validate.sh  | 15 ++++++++--
 .../python/scripts/call-front-door.sh         | 16 +++++++++--
 .../python/scripts/validate.sh                | 16 +++++++++--
 .../python/scripts/test.sh                    | 12 ++++++++
 .../url-shortener/python/scripts/validate.sh  | 16 +++++++++--
 12 files changed, 175 insertions(+), 19 deletions(-)

diff --git a/README.md b/README.md
index 472c99f..20e1568 100644
--- a/README.md
+++ b/README.md
@@ -117,6 +117,34 @@ find . -name "*.sh" -exec sed -i 's/\r$//' {} +
 ```
 Or by installing and using `dos2unix`.
 
+### Windows: Git Bash and MSYS2
+
+The scripts are written for Bash and run unchanged on Linux, macOS and WSL.
+They also run on Windows from Git Bash or from an MSYS2 shell (for example MINGW64 or UCRT64), provided you first turn off the automatic path conversion of these shells:
+
+```bash
+export MSYS_NO_PATHCONV=1
+```
+
+When Git Bash or an MSYS2 shell starts a Windows program such as the Azure CLI, it rewrites every argument that looks like an absolute POSIX path into a Windows path.
+Azure values that only look like paths are rewritten too, and the commands that receive them fail:
+
+- `--partition-key-path /username` reaches `az` as `C:/Program Files/Git/username`, so creating the Cosmos DB container fails with an invalid partition key path error.
+- Resource IDs such as `/subscriptions/<subscription-id>/resourceGroups/...`, passed to `--scope`, `--ids` and similar options, become paths under the shell's installation folder, for example `C:/Program Files/Git/subscriptions/...`.
+- Paths such as the Front Door `--origin-path /api` are rewritten the same way.
+
+With `MSYS_NO_PATHCONV=1` set, these values reach the Azure CLI exactly as written.
+The scripts convert the paths of the local files they hand to Windows programs, such as the temporary files read by `curl` and `jq`, with `cygpath` when it is available, so they keep working with the variable set.
+On Linux and macOS `cygpath` does not exist, and the paths are left unchanged.
+
+Tips:
+
+- To set the variable in every new Git Bash window, add `export MSYS_NO_PATHCONV=1` to `~/.bash_profile`, or to `~/.bashrc` if your `.bash_profile` sources it.
+- `echo $MSYSTEM` prints a value such as `MINGW64` only in these shells.
+- Any value turns the conversion off, `0` included; run `unset MSYS_NO_PATHCONV` to turn it back on.
+- WSL runs Linux and needs no variable.
+- When you write a script that passes a local file to `az`, `curl`, `jq`, `python` or `docker`, convert its path with the `native_path` helper the existing scripts define.
+
 ## Configuration
 
 Follow the comprehensive setup guide in [LocalStack for Azure Quick Start](./docs/LOCALSTACK.md) to configure your LocalStack for Azure development environment.
diff --git a/samples/api-management-function-app/python/scripts/call-api.sh b/samples/api-management-function-app/python/scripts/call-api.sh
index 355a027..96ca401 100755
--- a/samples/api-management-function-app/python/scripts/call-api.sh
+++ b/samples/api-management-function-app/python/scripts/call-api.sh
@@ -11,9 +11,21 @@ APIM_NAME="${PREFIX}-inventory-apim-${SUFFIX}"
 APIM_API_VERSION='2022-08-01'
 API_PATH='inventory'
 APIM_SUBSCRIPTION_ID='partner-subscription'
+
+# On Windows, Git Bash and MSYS2 shells pass a path such as /tmp/... unconverted to Windows programs
+# (az, curl, jq, python, docker) when MSYS_NO_PATHCONV=1 is set, as the README asks. cygpath, which
+# those shells provide, returns the C:/... form those programs can open; elsewhere the path is unchanged.
+native_path() {
+	if command -v cygpath >/dev/null 2>&1; then
+		cygpath -m "$1"
+	else
+		echo "$1"
+	fi
+}
+
 # mktemp rather than fixed paths, as in validate.sh: parallel-safe, and cleaned up on exit.
-BODY_FILE="$(mktemp "${TMPDIR:-/tmp}/inventory_call.XXXXXX.json")"
-HEADERS_FILE="$(mktemp "${TMPDIR:-/tmp}/inventory_call_headers.XXXXXX.txt")"
+BODY_FILE="$(native_path "$(mktemp "${TMPDIR:-/tmp}/inventory_call.XXXXXX.json")")"
+HEADERS_FILE="$(native_path "$(mktemp "${TMPDIR:-/tmp}/inventory_call_headers.XXXXXX.txt")")"
 trap 'rm -f "$BODY_FILE" "$HEADERS_FILE"' EXIT
 
 # Retrieve the API Management service
diff --git a/samples/api-management-function-app/python/scripts/deploy.sh b/samples/api-management-function-app/python/scripts/deploy.sh
index 99c085b..4f7f71e 100755
--- a/samples/api-management-function-app/python/scripts/deploy.sh
+++ b/samples/api-management-function-app/python/scripts/deploy.sh
@@ -29,7 +29,19 @@ APIM_SUBSCRIPTION_ID='partner-subscription'
 NAMED_VALUE_ID='backend-secret'
 FUNCTION_ZIPFILE='inventory_function.zip'
 CURRENT_DIR="$(cd "$(dirname "$0")" && pwd)"
-APIM_DIR="$CURRENT_DIR/../apim"
+
+# On Windows, Git Bash and MSYS2 shells pass a path such as /tmp/... unconverted to Windows programs
+# (az, curl, jq, python, docker) when MSYS_NO_PATHCONV=1 is set, as the README asks. cygpath, which
+# those shells provide, returns the C:/... form those programs can open; elsewhere the path is unchanged.
+native_path() {
+	if command -v cygpath >/dev/null 2>&1; then
+		cygpath -m "$1"
+	else
+		echo "$1"
+	fi
+}
+
+APIM_DIR="$(native_path "$CURRENT_DIR/../apim")"
 
 # Get the current subscription
 SUBSCRIPTION_NAME=$(az account show --query name --output tsv)
diff --git a/samples/api-management-function-app/python/scripts/validate.sh b/samples/api-management-function-app/python/scripts/validate.sh
index e6025e2..ded8d0d 100755
--- a/samples/api-management-function-app/python/scripts/validate.sh
+++ b/samples/api-management-function-app/python/scripts/validate.sh
@@ -14,10 +14,22 @@ API_ID='inventory-api'
 API_PATH='inventory'
 APIM_SUBSCRIPTION_ID='partner-subscription'
 RATE_LIMIT_CALLS=10
+
+# On Windows, Git Bash and MSYS2 shells pass a path such as /tmp/... unconverted to Windows programs
+# (az, curl, jq, python, docker) when MSYS_NO_PATHCONV=1 is set, as the README asks. cygpath, which
+# those shells provide, returns the C:/... form those programs can open; elsewhere the path is unchanged.
+native_path() {
+	if command -v cygpath >/dev/null 2>&1; then
+		cygpath -m "$1"
+	else
+		echo "$1"
+	fi
+}
+
 # mktemp rather than fixed paths: two runs of this script must not write the same file, and
 # `curl -o` would follow a symlink a third party had left at a predictable name.
-BODY_FILE="$(mktemp "${TMPDIR:-/tmp}/inventory_body.XXXXXX.json")"
-HEADERS_FILE="$(mktemp "${TMPDIR:-/tmp}/inventory_headers.XXXXXX.txt")"
+BODY_FILE="$(native_path "$(mktemp "${TMPDIR:-/tmp}/inventory_body.XXXXXX.json")")"
+HEADERS_FILE="$(native_path "$(mktemp "${TMPDIR:-/tmp}/inventory_headers.XXXXXX.txt")")"
 trap 'rm -f "$BODY_FILE" "$HEADERS_FILE"' EXIT
 
 FAILED=0
diff --git a/samples/eventhubs-eventgrid/python/scripts/run-pipeline.sh b/samples/eventhubs-eventgrid/python/scripts/run-pipeline.sh
index ca569fa..b71e52d 100644
--- a/samples/eventhubs-eventgrid/python/scripts/run-pipeline.sh
+++ b/samples/eventhubs-eventgrid/python/scripts/run-pipeline.sh
@@ -20,6 +20,17 @@ CURRENT_DIR="$(cd "$(dirname "$0")" && pwd)"
 SRC_DIR="$(cd "$CURRENT_DIR/../src" && pwd)"
 PYTHON_BIN="${PYTHON_BIN:-python3}"
 
+# On Windows, Git Bash and MSYS2 shells pass a path such as /tmp/... unconverted to Windows programs
+# (az, curl, jq, python, docker) when MSYS_NO_PATHCONV=1 is set, as the README asks. cygpath, which
+# those shells provide, returns the C:/... form those programs can open; elsewhere the path is unchanged.
+native_path() {
+	if command -v cygpath >/dev/null 2>&1; then
+		cygpath -m "$1"
+	else
+		echo "$1"
+	fi
+}
+
 READING_COUNT="${READING_COUNT:-120}"
 DEVICE_COUNT="${DEVICE_COUNT:-6}"
 EXCURSION_DEVICE="${EXCURSION_DEVICE:-DEV-0003}"
@@ -123,7 +134,7 @@ step "Step 3/5 - Event Hubs raises CaptureFileCreated, Event Grid delivers it"
 echo "Reading '$NOTIFICATION_HUB_NAME', where the subscription's EventHub destination delivers..."
 NOTIFICATIONS=$(EVENTHUB_LISTEN_CONNECTION_STRING="$EVENTHUB_LISTEN_CONNECTION_STRING" \
 	EVENT_HUB_NAME="$NOTIFICATION_HUB_NAME" \
-	"$PYTHON_BIN" "$CURRENT_DIR/roundtrip_check.py" --partitions 2>/dev/null | tail -1)
+	"$PYTHON_BIN" "$(native_path "$CURRENT_DIR/roundtrip_check.py")" --partitions 2>/dev/null | tail -1)
 echo "  $NOTIFICATIONS"
 echo ""
 echo "Nothing polled Blob Storage and no webhook was exposed: the notification arrived as a"
@@ -138,7 +149,7 @@ SUMMARY_OUTPUT=""
 while [ $SECONDS -lt $DEADLINE ]; do
 	SUMMARY_OUTPUT=$(EVENTHUB_LISTEN_CONNECTION_STRING="$EVENTHUB_LISTEN_CONNECTION_STRING" \
 		CURATED_HUB_NAME="$CURATED_HUB_NAME" \
-		"$PYTHON_BIN" "$CURRENT_DIR/read_curated.py" 2>/dev/null)
+		"$PYTHON_BIN" "$(native_path "$CURRENT_DIR/read_curated.py")" 2>/dev/null)
 	if [[ "$SUMMARY_OUTPUT" == SUMMARIES_OK* ]]; then
 		break
 	fi
diff --git a/samples/eventhubs-eventgrid/python/scripts/validate.sh b/samples/eventhubs-eventgrid/python/scripts/validate.sh
index 50ea08d..3a8acb4 100644
--- a/samples/eventhubs-eventgrid/python/scripts/validate.sh
+++ b/samples/eventhubs-eventgrid/python/scripts/validate.sh
@@ -26,6 +26,17 @@ TELEMETRY_PARTITION_COUNT=4
 CURRENT_DIR="$(cd "$(dirname "$0")" && pwd)"
 PYTHON_BIN="${PYTHON_BIN:-python3}"
 
+# On Windows, Git Bash and MSYS2 shells pass a path such as /tmp/... unconverted to Windows programs
+# (az, curl, jq, python, docker) when MSYS_NO_PATHCONV=1 is set, as the README asks. cygpath, which
+# those shells provide, returns the C:/... form those programs can open; elsewhere the path is unchanged.
+native_path() {
+	if command -v cygpath >/dev/null 2>&1; then
+		cygpath -m "$1"
+	else
+		echo "$1"
+	fi
+}
+
 PASS_COUNT=0
 FAIL_COUNT=0
 
@@ -158,7 +169,7 @@ ROUNDTRIP=$(EVENTHUB_SEND_CONNECTION_STRING=$(az eventhubs eventhub authorizatio
 		--resource-group "$RESOURCE_GROUP_NAME" \
 		--query primaryConnectionString -o tsv --only-show-errors) \
 	EVENT_HUB_NAME="$TELEMETRY_HUB_NAME" \
-	"$PYTHON_BIN" "$CURRENT_DIR/roundtrip_check.py" 2>&1 | tail -1)
+	"$PYTHON_BIN" "$(native_path "$CURRENT_DIR/roundtrip_check.py")" 2>&1 | tail -1)
 if [[ "$ROUNDTRIP" == ROUNDTRIP_OK* ]]; then
 	echo "OK (${ROUNDTRIP#ROUNDTRIP_OK })"
 	PASS_COUNT=$((PASS_COUNT + 1))
diff --git a/samples/eventhubs/python/scripts/run-pipeline.sh b/samples/eventhubs/python/scripts/run-pipeline.sh
index f105b61..0d05122 100644
--- a/samples/eventhubs/python/scripts/run-pipeline.sh
+++ b/samples/eventhubs/python/scripts/run-pipeline.sh
@@ -21,6 +21,17 @@ CURRENT_DIR="$(cd "$(dirname "$0")" && pwd)"
 SRC_DIR="$(cd "$CURRENT_DIR/../src" && pwd)"
 PYTHON_BIN="${PYTHON_BIN:-python3}"
 
+# On Windows, Git Bash and MSYS2 shells pass a path such as /tmp/... unconverted to Windows programs
+# (az, curl, jq, python, docker) when MSYS_NO_PATHCONV=1 is set, as the README asks. cygpath, which
+# those shells provide, returns the C:/... form those programs can open; elsewhere the path is unchanged.
+native_path() {
+	if command -v cygpath >/dev/null 2>&1; then
+		cygpath -m "$1"
+	else
+		echo "$1"
+	fi
+}
+
 # Capture flushes on the interval configured in deploy.sh (60s); allow for the scan cycle.
 CAPTURE_WAIT_SECONDS="${CAPTURE_WAIT_SECONDS:-150}"
 PROCESSING_WAIT_SECONDS="${PROCESSING_WAIT_SECONDS:-420}"
@@ -85,7 +96,7 @@ fail() {
 count_events() {
 	EVENTHUB_LISTEN_CONNECTION_STRING="$EVENTHUB_NAMESPACE_CONNECTION_STRING" \
 		EVENT_HUB_NAME="$1" \
-		"$PYTHON_BIN" "$CURRENT_DIR/roundtrip_check.py" --partitions 2>/dev/null | tail -1
+		"$PYTHON_BIN" "$(native_path "$CURRENT_DIR/roundtrip_check.py")" --partitions 2>/dev/null | tail -1
 }
 
 # Number of events in a hub, as a bare integer. Returns non-zero when the hub cannot be
@@ -94,7 +105,7 @@ count_total() {
 	local total
 	total=$(EVENTHUB_LISTEN_CONNECTION_STRING="$EVENTHUB_NAMESPACE_CONNECTION_STRING" \
 		EVENT_HUB_NAME="$1" \
-		"$PYTHON_BIN" "$CURRENT_DIR/roundtrip_check.py" --total 2>/dev/null | tail -1)
+		"$PYTHON_BIN" "$(native_path "$CURRENT_DIR/roundtrip_check.py")" --total 2>/dev/null | tail -1)
 	[[ "$total" =~ ^[0-9]+$ ]] || return 1
 	echo "$total"
 }
@@ -279,7 +290,7 @@ echo "Decoding the newest archive:"
 # which would hide a decoder that failed.
 DECODED=$(STORAGE_CONNECTION_STRING="$STORAGE_CONNECTION_STRING" \
 	CAPTURE_CONTAINER_NAME="$CAPTURE_CONTAINER_NAME" \
-	"$PYTHON_BIN" "$CURRENT_DIR/read_capture.py" 2>&1) ||
+	"$PYTHON_BIN" "$(native_path "$CURRENT_DIR/read_capture.py")" 2>&1) ||
 	fail "the newest Capture archive could not be decoded as Avro: $(echo "$DECODED" | tail -3)"
 echo "$DECODED" | sed 's/^/  /'
 
diff --git a/samples/eventhubs/python/scripts/validate.sh b/samples/eventhubs/python/scripts/validate.sh
index 204eb4b..bce103b 100644
--- a/samples/eventhubs/python/scripts/validate.sh
+++ b/samples/eventhubs/python/scripts/validate.sh
@@ -39,6 +39,17 @@ APPLICATION_GROUP_NAME='pos-terminals'
 CURRENT_DIR="$(cd "$(dirname "$0")" && pwd)"
 PYTHON_BIN="${PYTHON_BIN:-python3}"
 
+# On Windows, Git Bash and MSYS2 shells pass a path such as /tmp/... unconverted to Windows programs
+# (az, curl, jq, python, docker) when MSYS_NO_PATHCONV=1 is set, as the README asks. cygpath, which
+# those shells provide, returns the C:/... form those programs can open; elsewhere the path is unchanged.
+native_path() {
+	if command -v cygpath >/dev/null 2>&1; then
+		cygpath -m "$1"
+	else
+		echo "$1"
+	fi
+}
+
 PASS_COUNT=0
 FAIL_COUNT=0
 
@@ -190,7 +201,7 @@ echo -n "  Checking an event survives a send/receive round trip... "
 ROUNDTRIP=$(EVENTHUB_SEND_CONNECTION_STRING="$SEND_CONNECTION" \
 	EVENTHUB_LISTEN_CONNECTION_STRING="$LISTEN_CONNECTION" \
 	EVENT_HUB_NAME="$EVENT_HUB_NAME" \
-	"$PYTHON_BIN" "$CURRENT_DIR/roundtrip_check.py" 2>&1 | tail -1)
+	"$PYTHON_BIN" "$(native_path "$CURRENT_DIR/roundtrip_check.py")" 2>&1 | tail -1)
 if [[ "$ROUNDTRIP" == ROUNDTRIP_OK* ]]; then
 	pass "${ROUNDTRIP#ROUNDTRIP_OK }"
 else
@@ -202,7 +213,7 @@ echo "[9] Runtime information"
 echo -n "  Checking partition runtime metadata is readable... "
 PARTITIONS=$(EVENTHUB_LISTEN_CONNECTION_STRING="$LISTEN_CONNECTION" \
 	EVENT_HUB_NAME="$EVENT_HUB_NAME" \
-	"$PYTHON_BIN" "$CURRENT_DIR/roundtrip_check.py" --partitions 2>&1 | tail -1)
+	"$PYTHON_BIN" "$(native_path "$CURRENT_DIR/roundtrip_check.py")" --partitions 2>&1 | tail -1)
 if [[ "$PARTITIONS" == PARTITIONS_OK* ]]; then
 	pass "${PARTITIONS#PARTITIONS_OK }"
 else
diff --git a/samples/function-app-front-door/python/scripts/call-front-door.sh b/samples/function-app-front-door/python/scripts/call-front-door.sh
index f7f3eea..c148047 100755
--- a/samples/function-app-front-door/python/scripts/call-front-door.sh
+++ b/samples/function-app-front-door/python/scripts/call-front-door.sh
@@ -6,8 +6,20 @@ SUFFIX="${SUFFIX:-test}"
 RESOURCE_GROUP_NAME="${PREFIX}-rg"
 PROFILE_NAME="${PREFIX}-catalog-afd-${SUFFIX}"
 ENDPOINT_NAME="${PREFIX}-catalog-${SUFFIX}"
-BODY_FILE="$(mktemp "${TMPDIR:-/tmp}/front_door_call.XXXXXX")"
-HEADERS_FILE="$(mktemp "${TMPDIR:-/tmp}/front_door_call_headers.XXXXXX")"
+
+# On Windows, Git Bash and MSYS2 shells pass a path such as /tmp/... unconverted to Windows programs
+# (az, curl, jq, python, docker) when MSYS_NO_PATHCONV=1 is set, as the README asks. cygpath, which
+# those shells provide, returns the C:/... form those programs can open; elsewhere the path is unchanged.
+native_path() {
+	if command -v cygpath >/dev/null 2>&1; then
+		cygpath -m "$1"
+	else
+		echo "$1"
+	fi
+}
+
+BODY_FILE="$(native_path "$(mktemp "${TMPDIR:-/tmp}/front_door_call.XXXXXX")")"
+HEADERS_FILE="$(native_path "$(mktemp "${TMPDIR:-/tmp}/front_door_call_headers.XXXXXX")")"
 trap 'rm -f "$BODY_FILE" "$HEADERS_FILE"' EXIT
 
 # Retrieve the Front Door profile
diff --git a/samples/function-app-front-door/python/scripts/validate.sh b/samples/function-app-front-door/python/scripts/validate.sh
index 803fe8f..66f59ed 100755
--- a/samples/function-app-front-door/python/scripts/validate.sh
+++ b/samples/function-app-front-door/python/scripts/validate.sh
@@ -8,8 +8,20 @@ PRIMARY_FUNCTION_APP_NAME="${PREFIX}-catalog-primary-${SUFFIX}"
 SECONDARY_FUNCTION_APP_NAME="${PREFIX}-catalog-secondary-${SUFFIX}"
 PROFILE_NAME="${PREFIX}-catalog-afd-${SUFFIX}"
 ENDPOINT_NAME="${PREFIX}-catalog-${SUFFIX}"
-BODY_FILE="$(mktemp "${TMPDIR:-/tmp}/front_door_body.XXXXXX")"
-HEADERS_FILE="$(mktemp "${TMPDIR:-/tmp}/front_door_headers.XXXXXX")"
+
+# On Windows, Git Bash and MSYS2 shells pass a path such as /tmp/... unconverted to Windows programs
+# (az, curl, jq, python, docker) when MSYS_NO_PATHCONV=1 is set, as the README asks. cygpath, which
+# those shells provide, returns the C:/... form those programs can open; elsewhere the path is unchanged.
+native_path() {
+	if command -v cygpath >/dev/null 2>&1; then
+		cygpath -m "$1"
+	else
+		echo "$1"
+	fi
+}
+
+BODY_FILE="$(native_path "$(mktemp "${TMPDIR:-/tmp}/front_door_body.XXXXXX")")"
+HEADERS_FILE="$(native_path "$(mktemp "${TMPDIR:-/tmp}/front_door_headers.XXXXXX")")"
 trap 'rm -f "$BODY_FILE" "$HEADERS_FILE"' EXIT
 
 FAILED=0
diff --git a/samples/function-app-managed-identity/python/scripts/test.sh b/samples/function-app-managed-identity/python/scripts/test.sh
index e62c1ae..8a65dc6 100755
--- a/samples/function-app-managed-identity/python/scripts/test.sh
+++ b/samples/function-app-managed-identity/python/scripts/test.sh
@@ -10,6 +10,17 @@ STORAGE_ACCOUNT_NAME="${PREFIX}storage${SUFFIX}"
 CURRENT_DIR="$(cd "$(dirname "$0")" && pwd)"
 TEMP_OUTPUT_FILE=""
 
+# On Windows, Git Bash and MSYS2 shells pass a path such as /tmp/... unconverted to Windows programs
+# (az, curl, jq, python, docker) when MSYS_NO_PATHCONV=1 is set, as the README asks. cygpath, which
+# those shells provide, returns the C:/... form those programs can open; elsewhere the path is unchanged.
+native_path() {
+	if command -v cygpath >/dev/null 2>&1; then
+		cygpath -m "$1"
+	else
+		echo "$1"
+	fi
+}
+
 cleanup() {
 	if [ -n "$TEMP_OUTPUT_FILE" ] && [ -f "$TEMP_OUTPUT_FILE" ]; then
 		rm -f "$TEMP_OUTPUT_FILE"
@@ -111,6 +122,7 @@ for ((i=1; i<=n; i++)); do
 	if [ "$BLOB_EXISTS" == "true" ]; then
 		echo "Processed file [$BLOB_NAME] found in the [$OUTPUT_CONTAINER_NAME] container."
 		TEMP_OUTPUT_FILE="$(mktemp "${TMPDIR:-/tmp}/processed-output.XXXXXX")" || { echo "Failed to create temporary file." >&2; exit 1; }
+		TEMP_OUTPUT_FILE="$(native_path "$TEMP_OUTPUT_FILE")"
 
 		az storage blob download \
 			--container-name "$OUTPUT_CONTAINER_NAME" \
diff --git a/samples/url-shortener/python/scripts/validate.sh b/samples/url-shortener/python/scripts/validate.sh
index e594ab3..159bf69 100755
--- a/samples/url-shortener/python/scripts/validate.sh
+++ b/samples/url-shortener/python/scripts/validate.sh
@@ -12,6 +12,17 @@ POSTGRES_DB_NAME='clicks'
 CURRENT_DIR="$(cd "$(dirname "$0")" && pwd)"
 STATE_FILE="$CURRENT_DIR/.last_deploy.env"
 
+# On Windows, Git Bash and MSYS2 shells pass a path such as /tmp/... unconverted to Windows programs
+# (az, curl, jq, python, docker) when MSYS_NO_PATHCONV=1 is set, as the README asks. cygpath, which
+# those shells provide, returns the C:/... form those programs can open; elsewhere the path is unchanged.
+native_path() {
+	if command -v cygpath >/dev/null 2>&1; then
+		cygpath -m "$1"
+	else
+		echo "$1"
+	fi
+}
+
 FAILED=0
 
 # Load the values persisted by deploy.sh (PostgreSQL credentials and endpoint)
@@ -117,9 +128,10 @@ fi
 # 5. Fetch the rendered QR code from the public blob container.
 QR_URL=$(curl -s "$WEB_APP_URL/api/links/$CLEAN_CODE" | jq -r .qr_url)
 echo "Fetching the QR code from [$QR_URL]..."
-QR_CONTENT_TYPE=$(curl -sk -o /tmp/urlshort_qr.svg -w "%{content_type}" "$QR_URL")
+QR_FILE="$(native_path /tmp/urlshort_qr.svg)"
+QR_CONTENT_TYPE=$(curl -sk -o "$QR_FILE" -w "%{content_type}" "$QR_URL")
 echo "QR content type: $QR_CONTENT_TYPE"
-if grep -q "<svg" /tmp/urlshort_qr.svg; then
+if grep -q "<svg" "$QR_FILE"; then
 	echo "QR code successfully fetched from Blob Storage"
 else
 	echo "Failed to fetch the QR code from Blob Storage"

From 299aec82d17460206eb31870c0fd87f1cc8ba288 Mon Sep 17 00:00:00 2001
From: Paolo Salvatori <leprino@hotmail.com>
Date: Fri, 23 Oct 2026 15:59:06 +0200
Subject: [PATCH 03/18] Hand zip a Windows path for the archives the Event Hubs
 scripts build

The Event Hubs and Event Hubs with Event Grid deployments write their function and dashboard archives to an absolute path under the scripts folder.
Git Bash ships no zip, and a zip.exe built for Windows cannot open a /c/... path once MSYS_NO_PATHCONV=1 is set, so the archive path now goes through native_path as well; a zip from MSYS2 accepts the C:/... form too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DhZ2ojsEXd2SGMo7s9uiZh
---
 README.md                                         |  2 +-
 .../eventhubs-eventgrid/python/bicep/deploy.sh    | 13 ++++++++++++-
 .../eventhubs-eventgrid/python/scripts/deploy.sh  | 13 ++++++++++++-
 .../python/terraform/deploy.sh                    | 13 ++++++++++++-
 samples/eventhubs/python/bicep/deploy.sh          | 15 +++++++++++++--
 samples/eventhubs/python/scripts/deploy.sh        | 15 +++++++++++++--
 samples/eventhubs/python/scripts/run-pipeline.sh  |  2 +-
 samples/eventhubs/python/terraform/deploy.sh      | 15 +++++++++++++--
 8 files changed, 77 insertions(+), 11 deletions(-)

diff --git a/README.md b/README.md
index 20e1568..13a58c6 100644
--- a/README.md
+++ b/README.md
@@ -143,7 +143,7 @@ Tips:
 - `echo $MSYSTEM` prints a value such as `MINGW64` only in these shells.
 - Any value turns the conversion off, `0` included; run `unset MSYS_NO_PATHCONV` to turn it back on.
 - WSL runs Linux and needs no variable.
-- When you write a script that passes a local file to `az`, `curl`, `jq`, `python` or `docker`, convert its path with the `native_path` helper the existing scripts define.
+- When you write a script that passes a local file to `az`, `curl`, `jq`, `python`, `docker` or `zip`, convert its path with the `native_path` helper the existing scripts define; Git Bash ships no `zip`, and a `zip.exe` built for Windows needs the converted path too.
 
 ## Configuration
 
diff --git a/samples/eventhubs-eventgrid/python/bicep/deploy.sh b/samples/eventhubs-eventgrid/python/bicep/deploy.sh
index 48a0cf5..33f6d68 100644
--- a/samples/eventhubs-eventgrid/python/bicep/deploy.sh
+++ b/samples/eventhubs-eventgrid/python/bicep/deploy.sh
@@ -14,6 +14,17 @@ FUNCTION_ZIP='capture_processor.zip'
 
 CURRENT_DIR="$(cd "$(dirname "$0")" && pwd)"
 SRC_DIR="$(cd "$CURRENT_DIR/../src" && pwd)"
+# On Windows, Git Bash and MSYS2 shells pass a path such as /tmp/... unconverted to Windows programs
+# (az, curl, jq, python, docker) when MSYS_NO_PATHCONV=1 is set, as the README asks. cygpath, which
+# those shells provide, returns the C:/... form those programs can open; elsewhere the path is unchanged.
+native_path() {
+	if command -v cygpath >/dev/null 2>&1; then
+		cygpath -m "$1"
+	else
+		echo "$1"
+	fi
+}
+
 cd "$CURRENT_DIR" || exit 1
 
 fail() {
@@ -120,7 +131,7 @@ echo "=== Publishing the application code ==="
 # -----------------------------------------------------------------------------
 cd "$SRC_DIR/functions" || fail "missing src/functions"
 rm -f "$CURRENT_DIR/$FUNCTION_ZIP"
-zip -r "$CURRENT_DIR/$FUNCTION_ZIP" function_app.py host.json requirements.txt 1>/dev/null
+zip -r "$(native_path "$CURRENT_DIR/$FUNCTION_ZIP")" function_app.py host.json requirements.txt 1>/dev/null
 cd "$CURRENT_DIR" || exit 1
 
 echo "Deploying the capture processor (the first run can take several minutes)..."
diff --git a/samples/eventhubs-eventgrid/python/scripts/deploy.sh b/samples/eventhubs-eventgrid/python/scripts/deploy.sh
index fa9447e..34c8722 100644
--- a/samples/eventhubs-eventgrid/python/scripts/deploy.sh
+++ b/samples/eventhubs-eventgrid/python/scripts/deploy.sh
@@ -51,6 +51,17 @@ FUNCTION_ZIP='capture_processor.zip'
 
 CURRENT_DIR="$(cd "$(dirname "$0")" && pwd)"
 SRC_DIR="$(cd "$CURRENT_DIR/../src" && pwd)"
+# On Windows, Git Bash and MSYS2 shells pass a path such as /tmp/... unconverted to Windows programs
+# (az, curl, jq, python, docker) when MSYS_NO_PATHCONV=1 is set, as the README asks. cygpath, which
+# those shells provide, returns the C:/... form those programs can open; elsewhere the path is unchanged.
+native_path() {
+	if command -v cygpath >/dev/null 2>&1; then
+		cygpath -m "$1"
+	else
+		echo "$1"
+	fi
+}
+
 cd "$CURRENT_DIR" || exit 1
 
 fail() {
@@ -314,7 +325,7 @@ echo "Configured function app settings."
 
 cd "$SRC_DIR/functions" || fail "missing src/functions"
 rm -f "$CURRENT_DIR/$FUNCTION_ZIP"
-zip -r "$CURRENT_DIR/$FUNCTION_ZIP" function_app.py host.json requirements.txt 1>/dev/null
+zip -r "$(native_path "$CURRENT_DIR/$FUNCTION_ZIP")" function_app.py host.json requirements.txt 1>/dev/null
 cd "$CURRENT_DIR" || exit 1
 
 echo "Deploying the processor (the first run pulls the build image and can take a few minutes)..."
diff --git a/samples/eventhubs-eventgrid/python/terraform/deploy.sh b/samples/eventhubs-eventgrid/python/terraform/deploy.sh
index bfedf15..46d702d 100644
--- a/samples/eventhubs-eventgrid/python/terraform/deploy.sh
+++ b/samples/eventhubs-eventgrid/python/terraform/deploy.sh
@@ -10,6 +10,17 @@ CURRENT_DIR="$(cd "$(dirname "$0")" && pwd)"
 SRC_DIR="$(cd "$CURRENT_DIR/../src" && pwd)"
 FUNCTION_ZIP='capture_processor.zip'
 
+# On Windows, Git Bash and MSYS2 shells pass a path such as /tmp/... unconverted to Windows programs
+# (az, curl, jq, python, docker) when MSYS_NO_PATHCONV=1 is set, as the README asks. cygpath, which
+# those shells provide, returns the C:/... form those programs can open; elsewhere the path is unchanged.
+native_path() {
+	if command -v cygpath >/dev/null 2>&1; then
+		cygpath -m "$1"
+	else
+		echo "$1"
+	fi
+}
+
 cd "$CURRENT_DIR" || exit 1
 
 fail() {
@@ -60,7 +71,7 @@ FUNCTION_APP_NAME=$(terraform output -raw function_app_name)
 
 cd "$SRC_DIR/functions" || fail "missing src/functions"
 rm -f "$CURRENT_DIR/$FUNCTION_ZIP"
-zip -r "$CURRENT_DIR/$FUNCTION_ZIP" function_app.py host.json requirements.txt 1>/dev/null
+zip -r "$(native_path "$CURRENT_DIR/$FUNCTION_ZIP")" function_app.py host.json requirements.txt 1>/dev/null
 cd "$CURRENT_DIR" || exit 1
 
 echo "Deploying the capture processor (the first run can take several minutes)..."
diff --git a/samples/eventhubs/python/bicep/deploy.sh b/samples/eventhubs/python/bicep/deploy.sh
index 2232205..84567f1 100644
--- a/samples/eventhubs/python/bicep/deploy.sh
+++ b/samples/eventhubs/python/bicep/deploy.sh
@@ -16,6 +16,17 @@ WEB_APP_ZIP="dashboard.zip"
 CURRENT_DIR="$(cd "$(dirname "$0")" && pwd)"
 SRC_DIR="$(cd "$CURRENT_DIR/../src" && pwd)"
 
+# On Windows, Git Bash and MSYS2 shells pass a path such as /tmp/... unconverted to Windows programs
+# (az, curl, jq, python, docker) when MSYS_NO_PATHCONV=1 is set, as the README asks. cygpath, which
+# those shells provide, returns the C:/... form those programs can open; elsewhere the path is unchanged.
+native_path() {
+	if command -v cygpath >/dev/null 2>&1; then
+		cygpath -m "$1"
+	else
+		echo "$1"
+	fi
+}
+
 cd "$CURRENT_DIR" || exit 1
 
 fail() {
@@ -142,7 +153,7 @@ echo "=== Publishing the application code ==="
 # -----------------------------------------------------------------------------
 cd "$SRC_DIR/functions" || fail "missing src/functions"
 rm -f "$CURRENT_DIR/$FUNCTION_ZIP"
-zip -r "$CURRENT_DIR/$FUNCTION_ZIP" function_app.py host.json requirements.txt 1>/dev/null
+zip -r "$(native_path "$CURRENT_DIR/$FUNCTION_ZIP")" function_app.py host.json requirements.txt 1>/dev/null
 cd "$CURRENT_DIR" || exit 1
 
 echo "Deploying the fraud detection function (the first run can take several minutes)..."
@@ -155,7 +166,7 @@ rm -f "$FUNCTION_ZIP"
 
 cd "$SRC_DIR/dashboard" || fail "missing src/dashboard"
 rm -f "$CURRENT_DIR/$WEB_APP_ZIP"
-zip -r "$CURRENT_DIR/$WEB_APP_ZIP" app.py gunicorn.conf.py requirements.txt templates static 1>/dev/null
+zip -r "$(native_path "$CURRENT_DIR/$WEB_APP_ZIP")" app.py gunicorn.conf.py requirements.txt templates static 1>/dev/null
 cd "$CURRENT_DIR" || exit 1
 
 echo "Deploying the dashboard..."
diff --git a/samples/eventhubs/python/scripts/deploy.sh b/samples/eventhubs/python/scripts/deploy.sh
index 3c87a9a..fe4d3dc 100644
--- a/samples/eventhubs/python/scripts/deploy.sh
+++ b/samples/eventhubs/python/scripts/deploy.sh
@@ -68,6 +68,17 @@ FRAUD_VELOCITY_WINDOW_SECONDS=60
 CURRENT_DIR="$(cd "$(dirname "$0")" && pwd)"
 SRC_DIR="$(cd "$CURRENT_DIR/../src" && pwd)"
 
+# On Windows, Git Bash and MSYS2 shells pass a path such as /tmp/... unconverted to Windows programs
+# (az, curl, jq, python, docker) when MSYS_NO_PATHCONV=1 is set, as the README asks. cygpath, which
+# those shells provide, returns the C:/... form those programs can open; elsewhere the path is unchanged.
+native_path() {
+	if command -v cygpath >/dev/null 2>&1; then
+		cygpath -m "$1"
+	else
+		echo "$1"
+	fi
+}
+
 cd "$CURRENT_DIR" || exit 1
 
 fail() {
@@ -455,7 +466,7 @@ echo "Configured function app settings."
 
 cd "$SRC_DIR/functions" || fail "missing src/functions"
 rm -f "$CURRENT_DIR/$FUNCTION_ZIP"
-zip -r "$CURRENT_DIR/$FUNCTION_ZIP" function_app.py host.json requirements.txt 1>/dev/null
+zip -r "$(native_path "$CURRENT_DIR/$FUNCTION_ZIP")" function_app.py host.json requirements.txt 1>/dev/null
 cd "$CURRENT_DIR" || exit 1
 
 echo "Deploying the function package (first run pulls the build image and can take a few minutes)..."
@@ -517,7 +528,7 @@ az webapp config set \
 
 cd "$SRC_DIR/dashboard" || fail "missing src/dashboard"
 rm -f "$CURRENT_DIR/$WEB_APP_ZIP"
-zip -r "$CURRENT_DIR/$WEB_APP_ZIP" app.py gunicorn.conf.py requirements.txt templates static 1>/dev/null
+zip -r "$(native_path "$CURRENT_DIR/$WEB_APP_ZIP")" app.py gunicorn.conf.py requirements.txt templates static 1>/dev/null
 cd "$CURRENT_DIR" || exit 1
 
 echo "Deploying the dashboard package..."
diff --git a/samples/eventhubs/python/scripts/run-pipeline.sh b/samples/eventhubs/python/scripts/run-pipeline.sh
index 0d05122..2f0d49e 100644
--- a/samples/eventhubs/python/scripts/run-pipeline.sh
+++ b/samples/eventhubs/python/scripts/run-pipeline.sh
@@ -215,7 +215,7 @@ echo "Alerts before restart: $ALERTS_BEFORE"
 echo "Restarting the processor by redeploying the function package..."
 cd "$SRC_DIR/functions" || fail "missing src/functions"
 rm -f "$CURRENT_DIR/fraud_function.zip"
-zip -r "$CURRENT_DIR/fraud_function.zip" function_app.py host.json requirements.txt 1>/dev/null
+zip -r "$(native_path "$CURRENT_DIR/fraud_function.zip")" function_app.py host.json requirements.txt 1>/dev/null
 cd "$CURRENT_DIR" || fail "could not return to the scripts directory"
 az functionapp deploy \
 	--resource-group "$RESOURCE_GROUP_NAME" \
diff --git a/samples/eventhubs/python/terraform/deploy.sh b/samples/eventhubs/python/terraform/deploy.sh
index 88242d9..9c033eb 100644
--- a/samples/eventhubs/python/terraform/deploy.sh
+++ b/samples/eventhubs/python/terraform/deploy.sh
@@ -11,6 +11,17 @@ SRC_DIR="$(cd "$CURRENT_DIR/../src" && pwd)"
 FUNCTION_ZIP="fraud_function.zip"
 WEB_APP_ZIP="dashboard.zip"
 
+# On Windows, Git Bash and MSYS2 shells pass a path such as /tmp/... unconverted to Windows programs
+# (az, curl, jq, python, docker) when MSYS_NO_PATHCONV=1 is set, as the README asks. cygpath, which
+# those shells provide, returns the C:/... form those programs can open; elsewhere the path is unchanged.
+native_path() {
+	if command -v cygpath >/dev/null 2>&1; then
+		cygpath -m "$1"
+	else
+		echo "$1"
+	fi
+}
+
 cd "$CURRENT_DIR" || exit 1
 
 fail() {
@@ -61,7 +72,7 @@ WEB_APP_NAME=$(terraform output -raw web_app_name)
 
 cd "$SRC_DIR/functions" || fail "missing src/functions"
 rm -f "$CURRENT_DIR/$FUNCTION_ZIP"
-zip -r "$CURRENT_DIR/$FUNCTION_ZIP" function_app.py host.json requirements.txt 1>/dev/null
+zip -r "$(native_path "$CURRENT_DIR/$FUNCTION_ZIP")" function_app.py host.json requirements.txt 1>/dev/null
 cd "$CURRENT_DIR" || exit 1
 
 echo "Deploying the fraud detection function (the first run can take several minutes)..."
@@ -74,7 +85,7 @@ rm -f "$FUNCTION_ZIP"
 
 cd "$SRC_DIR/dashboard" || fail "missing src/dashboard"
 rm -f "$CURRENT_DIR/$WEB_APP_ZIP"
-zip -r "$CURRENT_DIR/$WEB_APP_ZIP" app.py gunicorn.conf.py requirements.txt templates static 1>/dev/null
+zip -r "$(native_path "$CURRENT_DIR/$WEB_APP_ZIP")" app.py gunicorn.conf.py requirements.txt templates static 1>/dev/null
 cd "$CURRENT_DIR" || exit 1
 
 echo "Deploying the dashboard..."

From fbf1f3f38956937194ed79100cc81ef63ecd77cd Mon Sep 17 00:00:00 2001
From: Paolo Salvatori <leprino@hotmail.com>
Date: Fri, 23 Oct 2026 16:03:19 +0200
Subject: [PATCH 04/18] Run a few samples on a Windows runner from Git Bash

A manual run with the new windows input runs, instead of the Linux matrix, seven samples on windows-latest from Git Bash, with MSYS_NO_PATHCONV=1 set as the README asks Windows users to do: the samples whose scripts pass a Cosmos DB partition key, resource IDs, Front Door paths, or local files read by az, curl, jq, python and zip.
The emulator is a Linux image and Docker on the Windows runner runs Windows containers, so the job starts Docker Engine inside an Ubuntu WSL 2 distribution, runs the emulator there, and reaches it from Windows over ports WSL forwards to localhost.
lstk finds the running container by its name, so run-samples.sh drives each sample exactly as it does on Linux.
Git Bash ships no zip, so a shim hands zip -r to the 7-Zip the runner image ships.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DhZ2ojsEXd2SGMo7s9uiZh
---
 .github/workflows/run-samples.yml | 193 ++++++++++++++++++++++++++++++
 1 file changed, 193 insertions(+)

diff --git a/.github/workflows/run-samples.yml b/.github/workflows/run-samples.yml
index 34711d9..6781a4b 100644
--- a/.github/workflows/run-samples.yml
+++ b/.github/workflows/run-samples.yml
@@ -29,6 +29,11 @@ on:
           - amd64
           - arm64
         default: both
+      windows:
+        description: "Run only the Windows job, a few samples from Git Bash with MSYS_NO_PATHCONV=1, instead of the Linux matrix"
+        required: false
+        type: boolean
+        default: false
 
 # Defaults for pull_request events (change DEFAULT_RUN_MODE to 'changed' to only run affected tests)
 env:
@@ -42,6 +47,8 @@ jobs:
   # Lightweight job that builds the dynamic test matrix for the main test jobs
   setup:
     name: "Build Test Matrix"
+    # A manual run with the windows input runs the Windows job alone; skipping this job skips the matrix
+    if: github.event_name != 'workflow_dispatch' || !inputs.windows
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -338,3 +345,189 @@ jobs:
           else
             make logs
           fi
+
+  # Runs a few samples on Windows, from Git Bash with MSYS_NO_PATHCONV=1 set as the README asks Windows
+  # users to do, on manual runs with the windows input only. The emulator is a Linux image and Docker on
+  # the Windows runner runs Windows containers, so the emulator runs in Docker Engine inside a WSL 2
+  # distribution on the same runner; the Windows docker CLI and lstk reach that engine over TCP, which
+  # WSL forwards to the runner's localhost, and the samples reach the emulator the same way.
+  windows:
+    name: "Windows (Git Bash): ${{ matrix.sample }}"
+    if: github.event_name == 'workflow_dispatch' && inputs.windows
+    environment: AZURE
+    runs-on: windows-latest
+    timeout-minutes: 90
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        # Samples whose scripts hand Git Bash something it would rewrite: a Cosmos DB partition key,
+        # resource IDs, Front Door paths, or local files read by az, curl, jq, python and zip.
+        sample:
+          - web-app-cosmosdb-nosql-api/python/scripts
+          - web-app-cosmosdb-nosql-api/dotnet/scripts
+          - web-app-custom-image/python/scripts
+          - function-app-front-door/python/scripts
+          - api-management-function-app/python/scripts
+          - function-app-managed-identity/python/scripts
+          - eventhubs/python/scripts
+    defaults:
+      run:
+        shell: bash
+    env:
+      IMAGE: localstack/localstack-azure:latest
+      # The Docker Engine in WSL 2, for the Windows docker CLI and lstk
+      DOCKER_HOST: tcp://127.0.0.1:2375
+      # What the README asks Windows users of Git Bash and MSYS2 to export
+      MSYS_NO_PATHCONV: "1"
+      # A virtual environment on Windows has python.exe but no python3
+      PYTHON_BIN: python
+
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Configure WSL
+        # Once a step's wsl.exe session ends, WSL stops the idle distribution after 15 seconds, and
+        # dockerd with it; -1 keeps it running for the whole job. The memory leaves room for the backing
+        # containers the samples start.
+        shell: pwsh
+        run: |
+          Set-Content -Path "$env:USERPROFILE\.wslconfig" -Value "[wsl2]`nmemory=12GB`n`n[general]`ninstanceIdleTimeout=-1"
+          wsl --shutdown
+
+      - name: Set up Ubuntu in WSL 2
+        uses: Vampire/setup-wsl@d1da7f2c0322a5ee4f24975344f67fc0f5baf364 # v7.0.0
+        with:
+          distribution: Ubuntu-24.04
+          wsl-version: 2
+          wsl-shell-user: root
+          additional-packages: docker.io
+
+      - name: Start Docker Engine in WSL 2
+        # The Unix socket is what the emulator container mounts to start its backing containers; the TCP
+        # endpoint, bound to localhost, is what WSL forwards to Windows for the docker CLI and lstk.
+        shell: wsl-bash {0}
+        run: |
+          setsid nohup dockerd --host unix:///var/run/docker.sock --host tcp://127.0.0.1:2375 --tls=false \
+            > /var/log/dockerd.log 2>&1 < /dev/null &
+          for _ in $(seq 1 60); do
+            docker info > /dev/null 2>&1 && break
+            sleep 2
+          done
+          docker info --format 'Docker {{.ServerVersion}} on {{.OperatingSystem}}, kernel {{.KernelVersion}}'
+
+      - name: Check that the Windows docker CLI reaches it
+        run: docker version
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        with:
+          username: ${{ secrets.DOCKERHUB_PULL_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PULL_TOKEN }}
+
+      - name: Start LocalStack in WSL 2
+        # Started with the docker CLI rather than lstk: lstk on Windows would mount a Windows volume path,
+        # and no Docker socket, into the Linux engine. The two mounts are paths inside WSL, which
+        # MSYS_NO_PATHCONV keeps Git Bash from rewriting. run-samples.sh's own `lstk start` then finds the
+        # running container by its name, localstack-azure, and leaves it alone.
+        env:
+          LOCALSTACK_AUTH_TOKEN: ${{ secrets.TEST_LOCALSTACK_AUTH_TOKEN }}
+          GITHUB_API_TOKEN: ${{ github.token }}
+        run: |
+          docker pull "$IMAGE"
+          docker run --detach --name localstack-azure \
+            --publish 127.0.0.1:4566:4566 --publish 127.0.0.1:443:443 \
+            --publish 127.0.0.1:4510-4559:4510-4559 \
+            --volume /var/run/docker.sock:/var/run/docker.sock \
+            --volume /var/lib/localstack-azure:/var/lib/localstack \
+            --env LOCALSTACK_AUTH_TOKEN --env GITHUB_API_TOKEN \
+            --env MSSQL_ACCEPT_EULA=Y --env LS_LOG=debug --env DISABLE_EVENTS=1 --env DNS_ADDRESS=0 \
+            "$IMAGE"
+          for _ in $(seq 1 200); do
+            if curl --silent --fail --max-time 5 http://127.0.0.1:4566/_localstack/health > /dev/null; then
+              echo "Emulator ready"
+              exit 0
+            fi
+            sleep 2
+          done
+          echo "::error::The emulator did not answer on 127.0.0.1:4566 within 400s"
+          docker logs --tail 100 localstack-azure
+          exit 1
+
+      - name: Install lstk CLI
+        # The release the Linux job pins
+        run: npm install -g @localstack/lstk@1.4.0
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: '3.12'
+
+      - name: Set up .NET
+        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
+        with:
+          dotnet-version: '10.0'
+
+      - name: Install Terraform
+        # run-samples.sh refuses to start without it, whichever sample it runs
+        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
+        with:
+          terraform_version: "1.5.0"
+          terraform_wrapper: false
+
+      - name: Provide zip
+        # The scripts package apps with `zip -r ARCHIVE FILES...`, and Git Bash ships no zip. 7-Zip, which
+        # the runner image ships, writes the same archive; being a Windows program, it gets the Windows
+        # form of any absolute path.
+        run: |
+          mkdir -p "$RUNNER_TEMP/bin"
+          cat > "$RUNNER_TEMP/bin/zip" <<'EOF'
+          #!/bin/bash
+          seven_zip=$(command -v 7z || echo "/c/Program Files/7-Zip/7z.exe")
+          args=()
+          for arg in "$@"; do
+            case "$arg" in
+              -*) ;;
+              /*) args+=("$(cygpath -m "$arg")") ;;
+              *) args+=("$arg") ;;
+            esac
+          done
+          exec "$seven_zip" a -tzip -bso0 -bsp0 "${args[@]}"
+          EOF
+          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+
+      - name: Install the Python dependencies
+        run: |
+          python -m venv .venv
+          .venv/Scripts/python -m pip install --upgrade pip setuptools wheel
+          .venv/Scripts/python -m pip install -r requirements-dev.txt
+
+      - name: "Run: ${{ matrix.sample }}"
+        # run-samples.sh routes az to the emulator with `lstk az start-interception`, as on Linux, and runs
+        # exactly this sample when given its shard: its 1-based position in the full list.
+        env:
+          SAMPLE: ${{ matrix.sample }}
+          LOCALSTACK_AUTH_TOKEN: ${{ secrets.TEST_LOCALSTACK_AUTH_TOKEN }}
+        run: |
+          # The runner's jq.exe is a Windows program, which ends its lines with CRLF; the CR would stick to SPLITS
+          read -r SHARD SPLITS < <(bash ./run-samples.sh --list |
+            jq -r --arg name "$SAMPLE" '.[] | select(.name == $name) | "\(.shard) \(.splits)"' | tr -d '\r')
+          if [[ -z "$SHARD" ]]; then
+            echo "::error::[$SAMPLE] is not registered in run-samples.sh"
+            exit 1
+          fi
+          source .venv/Scripts/activate
+          bash ./run-samples.sh "$SHARD" "$SPLITS"
+
+      - name: Get LocalStack Logs
+        if: always()
+        run: docker logs localstack-azure 2>&1 | tail -n 500 || true
+
+      - name: Get the Docker Engine log
+        if: failure()
+        shell: wsl-bash {0}
+        run: tail -n 100 /var/log/dockerd.log || true

From 3d63d510e8fd84c576508592882872c43d523e69 Mon Sep 17 00:00:00 2001
From: Paolo Salvatori <leprino@hotmail.com>
Date: Fri, 23 Oct 2026 16:26:04 +0200
Subject: [PATCH 05/18] Remove the empty file whose name breaks checkouts on
 Windows

Git for Windows refuses to check out a path whose last component ends with a period, so a clone of this repository on Windows stops with "error: invalid path 'samples/web-app-cosmosdb-nosql-api/python/scripts/...'" and leaves no working tree.
The file named "..." is empty, nothing references it, and it arrived by accident in 0f07d42.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DhZ2ojsEXd2SGMo7s9uiZh
---
 samples/web-app-cosmosdb-nosql-api/python/scripts/... | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 delete mode 100644 samples/web-app-cosmosdb-nosql-api/python/scripts/...

diff --git a/samples/web-app-cosmosdb-nosql-api/python/scripts/... b/samples/web-app-cosmosdb-nosql-api/python/scripts/...
deleted file mode 100644
index e69de29..0000000

From 6cf3220bf3a848f37762d90a85a5976b4d9813ad Mon Sep 17 00:00:00 2001
From: Paolo Salvatori <leprino@hotmail.com>
Date: Fri, 23 Oct 2026 16:32:24 +0200
Subject: [PATCH 06/18] Start the Windows job's Docker Engine on TCP after
 stopping the packaged one

Installing docker.io in the WSL distribution already starts a Docker daemon on the Unix socket alone, so the daemon the job started with TCP port 2375 exited at once ("process with PID 1063 is still running"), the readiness check passed against the packaged daemon, and the Windows docker CLI found nothing on the port.
The step now stops the packaged daemon (its systemd units, or its PID file without systemd), starts its own, and waits on the TCP endpoint.
The Docker Engine log step runs only once WSL is set up, since its wsl-bash shell does not exist before that.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DhZ2ojsEXd2SGMo7s9uiZh
---
 .github/workflows/run-samples.yml | 29 ++++++++++++++++++++++++-----
 1 file changed, 24 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/run-samples.yml b/.github/workflows/run-samples.yml
index 6781a4b..22d5448 100644
--- a/.github/workflows/run-samples.yml
+++ b/.github/workflows/run-samples.yml
@@ -400,6 +400,7 @@ jobs:
           wsl --shutdown
 
       - name: Set up Ubuntu in WSL 2
+        id: wsl
         uses: Vampire/setup-wsl@d1da7f2c0322a5ee4f24975344f67fc0f5baf364 # v7.0.0
         with:
           distribution: Ubuntu-24.04
@@ -408,17 +409,34 @@ jobs:
           additional-packages: docker.io
 
       - name: Start Docker Engine in WSL 2
-        # The Unix socket is what the emulator container mounts to start its backing containers; the TCP
-        # endpoint, bound to localhost, is what WSL forwards to Windows for the docker CLI and lstk.
+        # Installing docker.io already started a daemon on the Unix socket alone, and a second one cannot
+        # start beside it, so it is stopped and replaced by one that also listens on TCP. The Unix socket
+        # is what the emulator container mounts to start its backing containers; the TCP endpoint, bound
+        # to localhost, is what WSL forwards to Windows for the docker CLI and lstk. The wait asks the TCP
+        # endpoint, so the step fails when that daemon did not start.
         shell: wsl-bash {0}
         run: |
+          if [ -d /run/systemd/system ]; then
+            systemctl disable --now docker.socket docker.service
+          elif [ -e /var/run/docker.pid ]; then
+            kill "$(cat /var/run/docker.pid)"
+          fi
+          for _ in $(seq 1 30); do
+            [ -e /var/run/docker.pid ] || break
+            sleep 1
+          done
+          if [ -e /var/run/docker.pid ]; then
+            echo "::error::The Docker daemon that installing docker.io started is still running"
+            exit 1
+          fi
           setsid nohup dockerd --host unix:///var/run/docker.sock --host tcp://127.0.0.1:2375 --tls=false \
             > /var/log/dockerd.log 2>&1 < /dev/null &
           for _ in $(seq 1 60); do
-            docker info > /dev/null 2>&1 && break
+            docker --host tcp://127.0.0.1:2375 info > /dev/null 2>&1 && break
             sleep 2
           done
-          docker info --format 'Docker {{.ServerVersion}} on {{.OperatingSystem}}, kernel {{.KernelVersion}}'
+          docker --host tcp://127.0.0.1:2375 info \
+            --format 'Docker {{.ServerVersion}} on {{.OperatingSystem}}, kernel {{.KernelVersion}}'
 
       - name: Check that the Windows docker CLI reaches it
         run: docker version
@@ -528,6 +546,7 @@ jobs:
         run: docker logs localstack-azure 2>&1 | tail -n 500 || true
 
       - name: Get the Docker Engine log
-        if: failure()
+        # The wsl-bash shell exists only once WSL is set up
+        if: failure() && steps.wsl.outcome == 'success'
         shell: wsl-bash {0}
         run: tail -n 100 /var/log/dockerd.log || true

From 7d43db91cae70c6a96ab9b8ae0b14592a7e26d14 Mon Sep 17 00:00:00 2001
From: Paolo Salvatori <leprino@hotmail.com>
Date: Fri, 23 Oct 2026 17:00:10 +0200
Subject: [PATCH 07/18] Run every sample in the Windows job

The Windows job takes its matrix from the setup job, which on a manual run with the windows input selects every sample on amd64, the architecture of the Windows runner, and the Linux matrix stays out of that run.
It now provides what the remaining samples need: Java for the Service Bus sample, the zip MSYS2 ships (the 7-Zip shim dropped zip's -x exclusions), psql from the PostgreSQL the image installs, and the Go sqlcmd release, pinned with its SHA-256.
As in the Linux job, a failed sample is retried once on a fresh emulator.
lstk 1.4.0 cannot register its Azure CLI cloud on Windows when the CLI sits under C:\\Program Files: cmd.exe cuts the command line that carries the cloud configuration's JSON at that space. A junction without spaces, first on the PATH, works around it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DhZ2ojsEXd2SGMo7s9uiZh
---
 .github/workflows/run-samples.yml | 175 ++++++++++++++++++++----------
 1 file changed, 117 insertions(+), 58 deletions(-)

diff --git a/.github/workflows/run-samples.yml b/.github/workflows/run-samples.yml
index 22d5448..23a4a86 100644
--- a/.github/workflows/run-samples.yml
+++ b/.github/workflows/run-samples.yml
@@ -30,7 +30,7 @@ on:
           - arm64
         default: both
       windows:
-        description: "Run only the Windows job, a few samples from Git Bash with MSYS_NO_PATHCONV=1, instead of the Linux matrix"
+        description: "Run only the Windows job, every sample from Git Bash with MSYS_NO_PATHCONV=1, instead of the Linux matrix (run_mode and arch do not apply)"
         required: false
         type: boolean
         default: false
@@ -47,8 +47,6 @@ jobs:
   # Lightweight job that builds the dynamic test matrix for the main test jobs
   setup:
     name: "Build Test Matrix"
-    # A manual run with the windows input runs the Windows job alone; skipping this job skips the matrix
-    if: github.event_name != 'workflow_dispatch' || !inputs.windows
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -68,9 +66,14 @@ jobs:
           # Untrusted dispatch inputs routed via env, not interpolated into the shell (template-injection)
           RUN_MODE_INPUT: ${{ github.event.inputs.run_mode }}
           ARCH_INPUT: ${{ github.event.inputs.arch }}
+          WINDOWS_INPUT: ${{ github.event.inputs.windows }}
         run: |
-          # Pick run mode and architecture: manual dispatch uses the dropdowns, PRs use the env defaults
-          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+          # Pick run mode and architecture: manual dispatch uses the dropdowns, PRs use the env defaults.
+          # A manual run with the windows input runs every sample on amd64, the architecture of the Windows runner.
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" && "${WINDOWS_INPUT}" == "true" ]]; then
+            RUN_MODE=all
+            ARCH=amd64
+          elif [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
             RUN_MODE="${RUN_MODE_INPUT}"
             ARCH="${ARCH_INPUT}"
           else
@@ -94,7 +97,8 @@ jobs:
   scripts:
     name: "Test: ${{ matrix.name }}"
     needs: setup
-    if: needs.setup.outputs.has_tests == 'true'  # Skip entirely when no tests match
+    # Skip entirely when no tests match, and on a manual run with the windows input, which runs the Windows job instead
+    if: needs.setup.outputs.has_tests == 'true' && !(github.event_name == 'workflow_dispatch' && inputs.windows)
     environment: AZURE
     strategy:
       fail-fast: false
@@ -346,14 +350,15 @@ jobs:
             make logs
           fi
 
-  # Runs a few samples on Windows, from Git Bash with MSYS_NO_PATHCONV=1 set as the README asks Windows
-  # users to do, on manual runs with the windows input only. The emulator is a Linux image and Docker on
-  # the Windows runner runs Windows containers, so the emulator runs in Docker Engine inside a WSL 2
-  # distribution on the same runner; the Windows docker CLI and lstk reach that engine over TCP, which
-  # WSL forwards to the runner's localhost, and the samples reach the emulator the same way.
+  # Runs every sample on Windows, from Git Bash with MSYS_NO_PATHCONV=1 set as the README asks Windows users to do,
+  # on manual runs with the windows input only. The emulator is a Linux image and Docker on the Windows runner runs
+  # Windows containers, so the emulator runs in Docker Engine inside a WSL 2 distribution on the same runner; the
+  # Windows docker CLI and lstk reach that engine over TCP, which WSL forwards to the runner's localhost, and the
+  # samples reach the emulator the same way.
   windows:
-    name: "Windows (Git Bash): ${{ matrix.sample }}"
-    if: github.event_name == 'workflow_dispatch' && inputs.windows
+    name: "Windows (Git Bash): ${{ matrix.name }}"
+    needs: setup
+    if: github.event_name == 'workflow_dispatch' && inputs.windows && needs.setup.outputs.has_tests == 'true'
     environment: AZURE
     runs-on: windows-latest
     timeout-minutes: 90
@@ -361,17 +366,8 @@ jobs:
       contents: read
     strategy:
       fail-fast: false
-      matrix:
-        # Samples whose scripts hand Git Bash something it would rewrite: a Cosmos DB partition key,
-        # resource IDs, Front Door paths, or local files read by az, curl, jq, python and zip.
-        sample:
-          - web-app-cosmosdb-nosql-api/python/scripts
-          - web-app-cosmosdb-nosql-api/dotnet/scripts
-          - web-app-custom-image/python/scripts
-          - function-app-front-door/python/scripts
-          - api-management-function-app/python/scripts
-          - function-app-managed-identity/python/scripts
-          - eventhubs/python/scripts
+      # Every sample: on a manual run with the windows input, the setup job selects all of them, on amd64
+      matrix: ${{ fromJSON(needs.setup.outputs.matrix) }}
     defaults:
       run:
         shell: bash
@@ -451,12 +447,14 @@ jobs:
         # Started with the docker CLI rather than lstk: lstk on Windows would mount a Windows volume path,
         # and no Docker socket, into the Linux engine. The two mounts are paths inside WSL, which
         # MSYS_NO_PATHCONV keeps Git Bash from rewriting. run-samples.sh's own `lstk start` then finds the
-        # running container by its name, localstack-azure, and leaves it alone.
+        # running container by its name, localstack-azure, and leaves it alone. The script stays in
+        # RUNNER_TEMP for the retry, which starts a fresh emulator the same way.
         env:
           LOCALSTACK_AUTH_TOKEN: ${{ secrets.TEST_LOCALSTACK_AUTH_TOKEN }}
           GITHUB_API_TOKEN: ${{ github.token }}
         run: |
-          docker pull "$IMAGE"
+          cat > "$RUNNER_TEMP/start-emulator.sh" <<'EOF'
+          #!/bin/bash
           docker run --detach --name localstack-azure \
             --publish 127.0.0.1:4566:4566 --publish 127.0.0.1:443:443 \
             --publish 127.0.0.1:4510-4559:4510-4559 \
@@ -464,7 +462,7 @@ jobs:
             --volume /var/lib/localstack-azure:/var/lib/localstack \
             --env LOCALSTACK_AUTH_TOKEN --env GITHUB_API_TOKEN \
             --env MSSQL_ACCEPT_EULA=Y --env LS_LOG=debug --env DISABLE_EVENTS=1 --env DNS_ADDRESS=0 \
-            "$IMAGE"
+            "$IMAGE" || exit 1
           for _ in $(seq 1 200); do
             if curl --silent --fail --max-time 5 http://127.0.0.1:4566/_localstack/health > /dev/null; then
               echo "Emulator ready"
@@ -475,6 +473,21 @@ jobs:
           echo "::error::The emulator did not answer on 127.0.0.1:4566 within 400s"
           docker logs --tail 100 localstack-azure
           exit 1
+          EOF
+          docker pull "$IMAGE"
+          bash "$RUNNER_TEMP/start-emulator.sh"
+
+      - name: Give lstk an Azure CLI path without spaces
+        # lstk sets up the Azure CLI with `az cloud register --cloud-config <JSON>`, run through az.cmd, and
+        # cmd.exe cuts that command line at the space of "C:\Program Files" once the JSON's quotes are in it
+        # ("'C:\Program' is not recognized"), so `lstk az start-interception` (lstk 1.4.0) fails wherever the
+        # Azure CLI sits in its default folder. A junction without spaces, first on the PATH, works around it
+        # until lstk passes the JSON another way; Git Bash runs the same Azure CLI through it.
+        shell: pwsh
+        run: |
+          $cliDir = Split-Path -Parent (Split-Path -Parent (Get-Command az.cmd).Source)
+          New-Item -ItemType Junction -Path C:\azure-cli -Target $cliDir | Out-Null
+          Add-Content -Path $env:GITHUB_PATH -Value 'C:\azure-cli\wbin'
 
       - name: Install lstk CLI
         # The release the Linux job pins
@@ -490,6 +503,13 @@ jobs:
         with:
           dotnet-version: '10.0'
 
+      - name: Set up Java
+        # The Service Bus sample builds its Java app with Maven, which the runner image ships
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          distribution: 'temurin'
+          java-version: '25'
+
       - name: Install Terraform
         # run-samples.sh refuses to start without it, whichever sample it runs
         uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
@@ -497,26 +517,43 @@ jobs:
           terraform_version: "1.5.0"
           terraform_wrapper: false
 
-      - name: Provide zip
-        # The scripts package apps with `zip -r ARCHIVE FILES...`, and Git Bash ships no zip. 7-Zip, which
-        # the runner image ships, writes the same archive; being a Windows program, it gets the Windows
-        # form of any absolute path.
+      - name: Install zip from MSYS2
+        # The samples package apps with zip, which Git Bash does not ship. The runner image has MSYS2, whose
+        # zip, like a zip.exe built for Windows, opens the C:/... paths the scripts hand it.
+        shell: pwsh
+        run: C:\msys64\usr\bin\bash.exe -lc 'pacman -Sy --noconfirm --needed zip'
+
+      - name: Put zip, psql and sqlcmd on the PATH
+        # zip runs from MSYS2's own folder, next to the libraries it was built with. psql comes with the
+        # PostgreSQL the runner image installs off the PATH; mysql is on it already. sqlcmd, which the Azure
+        # SQL Database sample seeds its database with, is the Go sqlcmd release, pinned with its SHA-256.
+        env:
+          SQLCMD_VERSION: v1.10.0
+          SQLCMD_SHA256: a4c28332fcc6e497d655e53ac8f4939f4ab170f9cfd32d0fa5081b60f4d9d691
         run: |
-          mkdir -p "$RUNNER_TEMP/bin"
-          cat > "$RUNNER_TEMP/bin/zip" <<'EOF'
-          #!/bin/bash
-          seven_zip=$(command -v 7z || echo "/c/Program Files/7-Zip/7z.exe")
-          args=()
-          for arg in "$@"; do
-            case "$arg" in
-              -*) ;;
-              /*) args+=("$(cygpath -m "$arg")") ;;
-              *) args+=("$arg") ;;
-            esac
-          done
-          exec "$seven_zip" a -tzip -bso0 -bsp0 "${args[@]}"
-          EOF
-          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+          bin_dir="$RUNNER_TEMP/bin"
+          mkdir -p "$bin_dir"
+          printf '#!/bin/bash\nexec /c/msys64/usr/bin/zip.exe "$@"\n' > "$bin_dir/zip"
+          curl --silent --show-error --fail --location --retry 3 --output "$RUNNER_TEMP/sqlcmd.zip" \
+            "https://github.com/microsoft/go-sqlcmd/releases/download/${SQLCMD_VERSION}/sqlcmd-windows-amd64.zip"
+          echo "${SQLCMD_SHA256}  $RUNNER_TEMP/sqlcmd.zip" | sha256sum --check
+          unzip -o -q -j "$RUNNER_TEMP/sqlcmd.zip" sqlcmd.exe -d "$bin_dir"
+          cygpath -w "$bin_dir" >> "$GITHUB_PATH"
+          echo "$PGBIN" >> "$GITHUB_PATH"
+
+      - name: Show the tool versions
+        run: |
+          zip -v | sed -n 2p
+          psql --version
+          mysql --version
+          sqlcmd --version
+          java -version 2>&1 | sed -n 1p
+          mvn -v | sed -n 1p
+          dotnet --version
+          terraform version | sed -n 1p
+          az version --output tsv --query '"azure-cli"'
+          jq --version
+          unzip -v | sed -n 1p
 
       - name: Install the Python dependencies
         run: |
@@ -524,26 +561,48 @@ jobs:
           .venv/Scripts/python -m pip install --upgrade pip setuptools wheel
           .venv/Scripts/python -m pip install -r requirements-dev.txt
 
-      - name: "Run: ${{ matrix.sample }}"
-        # run-samples.sh routes az to the emulator with `lstk az start-interception`, as on Linux, and runs
-        # exactly this sample when given its shard: its 1-based position in the full list.
+      - name: "Run: ${{ matrix.name }}"
+        # run-samples.sh routes az to the emulator with `lstk az start-interception`, as on Linux, and runs exactly
+        # this sample: SPLITS is the number of samples and SHARD its 1-based position among them.
+        id: initial_run
+        # As in the Linux job, a transient error fails a sample now and then, so a failure is retried once on a
+        # fresh emulator, and the retry decides the job's outcome: a sample that is really broken fails both.
+        continue-on-error: true
         env:
-          SAMPLE: ${{ matrix.sample }}
+          SHARD: ${{ matrix.shard }}
+          SPLITS: ${{ matrix.splits }}
           LOCALSTACK_AUTH_TOKEN: ${{ secrets.TEST_LOCALSTACK_AUTH_TOKEN }}
         run: |
-          # The runner's jq.exe is a Windows program, which ends its lines with CRLF; the CR would stick to SPLITS
-          read -r SHARD SPLITS < <(bash ./run-samples.sh --list |
-            jq -r --arg name "$SAMPLE" '.[] | select(.name == $name) | "\(.shard) \(.splits)"' | tr -d '\r')
-          if [[ -z "$SHARD" ]]; then
-            echo "::error::[$SAMPLE] is not registered in run-samples.sh"
-            exit 1
-          fi
+          source .venv/Scripts/activate
+          bash ./run-samples.sh "$SHARD" "$SPLITS"
+
+      - name: "Retry: ${{ matrix.name }}"
+        # The first emulator's logs are kept for the Get LocalStack Logs step. Removing every container also
+        # removes the backing containers the first emulator started, which the fresh one would collide with.
+        if: steps.initial_run.outcome == 'failure'
+        env:
+          MATRIX_NAME: ${{ matrix.name }}
+          SHARD: ${{ matrix.shard }}
+          SPLITS: ${{ matrix.splits }}
+          LOCALSTACK_AUTH_TOKEN: ${{ secrets.TEST_LOCALSTACK_AUTH_TOKEN }}
+          GITHUB_API_TOKEN: ${{ github.token }}
+        run: |
+          echo "::warning::${MATRIX_NAME} failed once; retrying on a fresh emulator."
+          docker logs localstack-azure > "$RUNNER_TEMP/localstack-azure-first-attempt.log" 2>&1 || true
+          docker ps --all --quiet | xargs --no-run-if-empty docker rm --force > /dev/null
+          bash "$RUNNER_TEMP/start-emulator.sh"
           source .venv/Scripts/activate
           bash ./run-samples.sh "$SHARD" "$SPLITS"
 
       - name: Get LocalStack Logs
         if: always()
-        run: docker logs localstack-azure 2>&1 | tail -n 500 || true
+        run: |
+          if [ -s "$RUNNER_TEMP/localstack-azure-first-attempt.log" ]; then
+            echo "===== First attempt ====="
+            tail -n 500 "$RUNNER_TEMP/localstack-azure-first-attempt.log"
+            echo "===== Retry ====="
+          fi
+          docker logs localstack-azure 2>&1 | tail -n 500 || true
 
       - name: Get the Docker Engine log
         # The wsl-bash shell exists only once WSL is set up

From 6d0b2211b6b59eb474e6758e557450033ae1c353 Mon Sep 17 00:00:00 2001
From: Paolo Salvatori <leprino@hotmail.com>
Date: Fri, 23 Oct 2026 17:05:36 +0200
Subject: [PATCH 08/18] Discard curl's responses through the NUL device in Git
 Bash and MSYS2

With MSYS_NO_PATHCONV=1 these shells no longer turn a /dev/null argument into nul for Windows programs, so a Windows curl given -o /dev/null cannot open its output and exits with code 23 as soon as a response has a body.
The MySQL readiness loops would then read HTTP_CODE as 200000, the status followed by their || echo "000" fallback, and never finish.
A null_device helper returns NUL for a Windows curl in these shells and /dev/null everywhere else, MSYS2's own curl included, and the 23 curl calls that discard a body in 11 scripts use it.
The README says so, and tells script authors to do the same.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DhZ2ojsEXd2SGMo7s9uiZh
---
 README.md                                     |  2 ++
 .../python/scripts/validate.sh                | 15 +++++++++--
 .../python/scripts/validate.sh                | 13 +++++++++-
 .../python/scripts/validate.sh                | 25 +++++++++++++------
 .../python/scripts/call-web-app.sh            | 15 +++++++++--
 .../url-shortener/python/scripts/validate.sh  | 15 +++++++++--
 .../dotnet/bicep/deploy.sh                    | 13 +++++++++-
 .../dotnet/scripts/deploy.sh                  | 13 +++++++++-
 .../dotnet/terraform/deploy.sh                | 13 +++++++++-
 .../python/bicep/deploy.sh                    | 13 +++++++++-
 .../python/scripts/deploy.sh                  | 13 +++++++++-
 .../python/terraform/deploy.sh                | 13 +++++++++-
 12 files changed, 143 insertions(+), 20 deletions(-)

diff --git a/README.md b/README.md
index 13a58c6..52a2adb 100644
--- a/README.md
+++ b/README.md
@@ -135,6 +135,7 @@ Azure values that only look like paths are rewritten too, and the commands that
 
 With `MSYS_NO_PATHCONV=1` set, these values reach the Azure CLI exactly as written.
 The scripts convert the paths of the local files they hand to Windows programs, such as the temporary files read by `curl` and `jq`, with `cygpath` when it is available, so they keep working with the variable set.
+They also hand `curl` the Windows `NUL` device instead of `/dev/null` for the responses they discard, because the variable stops these shells from making that conversion too.
 On Linux and macOS `cygpath` does not exist, and the paths are left unchanged.
 
 Tips:
@@ -144,6 +145,7 @@ Tips:
 - Any value turns the conversion off, `0` included; run `unset MSYS_NO_PATHCONV` to turn it back on.
 - WSL runs Linux and needs no variable.
 - When you write a script that passes a local file to `az`, `curl`, `jq`, `python`, `docker` or `zip`, convert its path with the `native_path` helper the existing scripts define; Git Bash ships no `zip`, and a `zip.exe` built for Windows needs the converted path too.
+- To discard what a Windows program writes to a file, such as `curl -o`, pass it `"$(null_device)"` rather than `/dev/null`, as the existing scripts do. Shell redirections such as `> /dev/null` need no change.
 
 ## Configuration
 
diff --git a/samples/api-management-function-app/python/scripts/validate.sh b/samples/api-management-function-app/python/scripts/validate.sh
index ded8d0d..1fa3e45 100755
--- a/samples/api-management-function-app/python/scripts/validate.sh
+++ b/samples/api-management-function-app/python/scripts/validate.sh
@@ -26,6 +26,17 @@ native_path() {
 	fi
 }
 
+# Where curl discards a response body. Git Bash and MSYS2 shells hand a Windows curl /dev/null
+# unchanged when MSYS_NO_PATHCONV=1 is set, as the README asks, and it cannot open that path, so it
+# gets the NUL device instead; MSYS2's own curl, under /usr/bin, opens /dev/null as on Linux and macOS.
+null_device() {
+	if command -v cygpath >/dev/null 2>&1 && [[ "$(command -v curl)" != /usr/bin/* ]]; then
+		echo NUL
+	else
+		echo /dev/null
+	fi
+}
+
 # mktemp rather than fixed paths: two runs of this script must not write the same file, and
 # `curl -o` would follow a symlink a third party had left at a predictable name.
 BODY_FILE="$(native_path "$(mktemp "${TMPDIR:-/tmp}/inventory_body.XXXXXX.json")")"
@@ -66,7 +77,7 @@ echo "Gateway URL: $API_URL"
 echo "Waiting for the [$FUNCTION_APP_NAME] function app to answer..."
 BACKEND_STATUS=""
 for i in $(seq 1 60); do
-	BACKEND_STATUS=$(curl -s -m 10 -o /dev/null -w "%{http_code}" "$BACKEND_URL/items")
+	BACKEND_STATUS=$(curl -s -m 10 -o "$(null_device)" -w "%{http_code}" "$BACKEND_URL/items")
 	[[ "$BACKEND_STATUS" == "401" ]] && break
 	sleep 5
 done
@@ -223,7 +234,7 @@ fi
 # so the preflight never reaches the API's cors policy. Asserted against Azure only.
 # TODO: assert this unconditionally once the emulator lets the gateway's cors policy answer.
 echo "Sending a CORS preflight to [$API_URL/items]..."
-PREFLIGHT_STATUS=$(curl -s -m 10 -o /dev/null -D "$HEADERS_FILE" -w "%{http_code}" \
+PREFLIGHT_STATUS=$(curl -s -m 10 -o "$(null_device)" -D "$HEADERS_FILE" -w "%{http_code}" \
 	-X OPTIONS \
 	-H "Origin: http://localhost:3000" \
 	-H "Access-Control-Request-Method: GET" \
diff --git a/samples/container-apps-blob-storage/python/scripts/validate.sh b/samples/container-apps-blob-storage/python/scripts/validate.sh
index 4017672..3028cef 100644
--- a/samples/container-apps-blob-storage/python/scripts/validate.sh
+++ b/samples/container-apps-blob-storage/python/scripts/validate.sh
@@ -8,6 +8,17 @@
 # replicas, the live HTTP ingress, and a revision update.
 # =============================================================================
 
+# Where curl discards a response body. Git Bash and MSYS2 shells hand a Windows curl /dev/null
+# unchanged when MSYS_NO_PATHCONV=1 is set, as the README asks, and it cannot open that path, so it
+# gets the NUL device instead; MSYS2's own curl, under /usr/bin, opens /dev/null as on Linux and macOS.
+null_device() {
+	if command -v cygpath >/dev/null 2>&1 && [[ "$(command -v curl)" != /usr/bin/* ]]; then
+		echo NUL
+	else
+		echo /dev/null
+	fi
+}
+
 # Variables (must match deploy.sh)
 PREFIX='local'
 LOCATION='eastus'
@@ -232,7 +243,7 @@ echo "[12] Guestbook Round Trip"
 ENTRY_AUTHOR="validate-sh"
 ENTRY_MESSAGE="Hello from validate.sh at $(date +%s)"
 echo -n "  Posting a guestbook entry... "
-HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" --max-time 10 \
+HTTP_CODE=$(curl -s -o "$(null_device)" -w "%{http_code}" --max-time 10 \
 	-X POST "$APP_URL/" \
 	--data-urlencode "author=$ENTRY_AUTHOR" \
 	--data-urlencode "message=$ENTRY_MESSAGE" 2>/dev/null)
diff --git a/samples/function-app-front-door/python/scripts/validate.sh b/samples/function-app-front-door/python/scripts/validate.sh
index 66f59ed..63b012c 100755
--- a/samples/function-app-front-door/python/scripts/validate.sh
+++ b/samples/function-app-front-door/python/scripts/validate.sh
@@ -20,6 +20,17 @@ native_path() {
 	fi
 }
 
+# Where curl discards a response body. Git Bash and MSYS2 shells hand a Windows curl /dev/null
+# unchanged when MSYS_NO_PATHCONV=1 is set, as the README asks, and it cannot open that path, so it
+# gets the NUL device instead; MSYS2's own curl, under /usr/bin, opens /dev/null as on Linux and macOS.
+null_device() {
+	if command -v cygpath >/dev/null 2>&1 && [[ "$(command -v curl)" != /usr/bin/* ]]; then
+		echo NUL
+	else
+		echo /dev/null
+	fi
+}
+
 BODY_FILE="$(native_path "$(mktemp "${TMPDIR:-/tmp}/front_door_body.XXXXXX")")"
 HEADERS_FILE="$(native_path "$(mktemp "${TMPDIR:-/tmp}/front_door_headers.XXXXXX")")"
 trap 'rm -f "$BODY_FILE" "$HEADERS_FILE"' EXIT
@@ -94,7 +105,7 @@ if [[ $FAILED != 0 ]]; then
 fi
 
 # The origins answer HEAD as well as GET, which is what the health probe sends.
-HEAD_STATUS=$(curl -s -m 10 -o /dev/null -w "%{http_code}" -I "$PRIMARY_URL/health")
+HEAD_STATUS=$(curl -s -m 10 -o "$(null_device)" -w "%{http_code}" -I "$PRIMARY_URL/health")
 echo "HEAD on the probe path: HTTP $HEAD_STATUS"
 if [[ "$HEAD_STATUS" == "200" ]]; then
 	echo "The origin answers the probe method Front Door uses"
@@ -187,7 +198,7 @@ fi
 
 # 6. The UrlRedirect rule answers at the edge: the origin is never called.
 echo "Calling [$ENDPOINT_URL/legacy]..."
-REDIRECT_STATUS=$(curl -s -m 20 -o /dev/null -D "$HEADERS_FILE" -w "%{http_code}" "$ENDPOINT_URL/legacy")
+REDIRECT_STATUS=$(curl -s -m 20 -o "$(null_device)" -D "$HEADERS_FILE" -w "%{http_code}" "$ENDPOINT_URL/legacy")
 LOCATION=$(grep -i "^location:" "$HEADERS_FILE" | tr -d '\r' | awk '{print $2}')
 echo "HTTP $REDIRECT_STATUS -> ${LOCATION:-(no Location header)}"
 if [[ "$REDIRECT_STATUS" == "302" && "$LOCATION" == */status ]]; then
@@ -220,7 +231,7 @@ echo "Purging /catalog/* so the cache starts empty..."
 purge_catalog
 
 echo "Requesting [$ENDPOINT_URL/catalog/3] twice..."
-curl -s -m 20 -o /dev/null -D "$HEADERS_FILE" "$ENDPOINT_URL/catalog/3"
+curl -s -m 20 -o "$(null_device)" -D "$HEADERS_FILE" "$ENDPOINT_URL/catalog/3"
 FIRST_CACHE=$(grep -i "^x-cache:" "$HEADERS_FILE" | tr -d '\r' | awk '{print $2}')
 if echo "$FIRST_CACHE" | grep -qi "hit"; then
 	echo "Expected the first request after a purge to reach the origin (got: $FIRST_CACHE)"
@@ -251,7 +262,7 @@ purge_catalog
 
 PURGED_CACHE=''
 for i in $(seq 1 $PROPAGATION_ATTEMPTS); do
-	curl -s -m 20 -o /dev/null -D "$HEADERS_FILE" "$ENDPOINT_URL/catalog/3"
+	curl -s -m 20 -o "$(null_device)" -D "$HEADERS_FILE" "$ENDPOINT_URL/catalog/3"
 	PURGED_CACHE=$(grep -i "^x-cache:" "$HEADERS_FILE" | tr -d '\r' | awk '{print $2}')
 	echo "$PURGED_CACHE" | grep -qi "hit" || break
 	sleep 5
@@ -265,7 +276,7 @@ else
 fi
 
 # A response the origin marks no-store is never cached, however often it is asked for.
-curl -s -m 20 -o /dev/null -D "$HEADERS_FILE" "$ENDPOINT_URL/whoami"
+curl -s -m 20 -o "$(null_device)" -D "$HEADERS_FILE" "$ENDPOINT_URL/whoami"
 curl -s -m 20 -o "$BODY_FILE" -D "$HEADERS_FILE" "$ENDPOINT_URL/whoami"
 NOSTORE_CACHE=$(grep -i "^x-cache:" "$HEADERS_FILE" | tr -d '\r' | awk '{print $2}')
 echo "A no-store response: X-Cache: ${NOSTORE_CACHE:-(none)}"
@@ -342,7 +353,7 @@ az afd endpoint update \
 
 DISABLED_STATUS=''
 for i in $(seq 1 $PROPAGATION_ATTEMPTS); do
-	DISABLED_STATUS=$(curl -s -m 20 -o /dev/null -w "%{http_code}" "$ENDPOINT_URL/status")
+	DISABLED_STATUS=$(curl -s -m 20 -o "$(null_device)" -w "%{http_code}" "$ENDPOINT_URL/status")
 	[[ "$DISABLED_STATUS" != "200" ]] && break
 	sleep 5
 done
@@ -363,7 +374,7 @@ az afd endpoint update \
 
 ENABLED_STATUS=''
 for i in $(seq 1 $PROPAGATION_ATTEMPTS); do
-	ENABLED_STATUS=$(curl -s -m 20 -o /dev/null -w "%{http_code}" "$ENDPOINT_URL/status")
+	ENABLED_STATUS=$(curl -s -m 20 -o "$(null_device)" -w "%{http_code}" "$ENDPOINT_URL/status")
 	[[ "$ENABLED_STATUS" == "200" ]] && break
 	sleep 5
 done
diff --git a/samples/url-shortener/python/scripts/call-web-app.sh b/samples/url-shortener/python/scripts/call-web-app.sh
index 3e36745..bc4e393 100755
--- a/samples/url-shortener/python/scripts/call-web-app.sh
+++ b/samples/url-shortener/python/scripts/call-web-app.sh
@@ -1,5 +1,16 @@
 #!/bin/bash
 
+# Where curl discards a response body. Git Bash and MSYS2 shells hand a Windows curl /dev/null
+# unchanged when MSYS_NO_PATHCONV=1 is set, as the README asks, and it cannot open that path, so it
+# gets the NUL device instead; MSYS2's own curl, under /usr/bin, opens /dev/null as on Linux and macOS.
+null_device() {
+	if command -v cygpath >/dev/null 2>&1 && [[ "$(command -v curl)" != /usr/bin/* ]]; then
+		echo NUL
+	else
+		echo /dev/null
+	fi
+}
+
 # Variables
 PREFIX='local'
 SUFFIX='test'
@@ -24,7 +35,7 @@ WEB_APP_URL="http://$WEB_APP_HOSTNAME"
 
 # Call the home page
 echo "Calling the [$WEB_APP_NAME] web app home page at [$WEB_APP_URL]..."
-HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$WEB_APP_URL/")
+HTTP_STATUS=$(curl -s -o "$(null_device)" -w "%{http_code}" "$WEB_APP_URL/")
 
 if [[ "$HTTP_STATUS" == "200" ]]; then
 	echo "Home page of the [$WEB_APP_NAME] web app successfully returned [$HTTP_STATUS]"
@@ -48,7 +59,7 @@ else
 fi
 
 echo "Following the short link [$WEB_APP_URL/l/$CODE]..."
-REDIRECT_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$WEB_APP_URL/l/$CODE")
+REDIRECT_STATUS=$(curl -s -o "$(null_device)" -w "%{http_code}" "$WEB_APP_URL/l/$CODE")
 
 if [[ "$REDIRECT_STATUS" == "302" ]]; then
 	echo "Short link [$CODE] successfully redirected with [$REDIRECT_STATUS]"
diff --git a/samples/url-shortener/python/scripts/validate.sh b/samples/url-shortener/python/scripts/validate.sh
index 159bf69..eda8689 100755
--- a/samples/url-shortener/python/scripts/validate.sh
+++ b/samples/url-shortener/python/scripts/validate.sh
@@ -23,6 +23,17 @@ native_path() {
 	fi
 }
 
+# Where curl discards a response body. Git Bash and MSYS2 shells hand a Windows curl /dev/null
+# unchanged when MSYS_NO_PATHCONV=1 is set, as the README asks, and it cannot open that path, so it
+# gets the NUL device instead; MSYS2's own curl, under /usr/bin, opens /dev/null as on Linux and macOS.
+null_device() {
+	if command -v cygpath >/dev/null 2>&1 && [[ "$(command -v curl)" != /usr/bin/* ]]; then
+		echo NUL
+	else
+		echo /dev/null
+	fi
+}
+
 FAILED=0
 
 # Load the values persisted by deploy.sh (PostgreSQL credentials and endpoint)
@@ -143,8 +154,8 @@ fi
 # without the fix from localstack/localstack-pro#8135 follow the redirect at the
 # gateway), so the assertion targets the effect: the click rows in PostgreSQL.
 echo "Following the short link twice..."
-curl -s -o /dev/null -w "First redirect: %{http_code} -> %{redirect_url}\n" "$WEB_APP_URL/l/$CLEAN_CODE"
-curl -s -o /dev/null -w "Second redirect: %{http_code} -> %{redirect_url}\n" "$WEB_APP_URL/l/$CLEAN_CODE"
+curl -s -o "$(null_device)" -w "First redirect: %{http_code} -> %{redirect_url}\n" "$WEB_APP_URL/l/$CLEAN_CODE"
+curl -s -o "$(null_device)" -w "Second redirect: %{http_code} -> %{redirect_url}\n" "$WEB_APP_URL/l/$CLEAN_CODE"
 sleep 3
 CLICKS=$(PGPASSWORD="$POSTGRES_ADMIN_PASSWORD" psql \
 	--host="$POSTGRES_HOST" \
diff --git a/samples/web-app-mysql-flexible-server/dotnet/bicep/deploy.sh b/samples/web-app-mysql-flexible-server/dotnet/bicep/deploy.sh
index 4d27607..48ba9a1 100755
--- a/samples/web-app-mysql-flexible-server/dotnet/bicep/deploy.sh
+++ b/samples/web-app-mysql-flexible-server/dotnet/bicep/deploy.sh
@@ -1,5 +1,16 @@
 #!/bin/bash
 
+# Where curl discards a response body. Git Bash and MSYS2 shells hand a Windows curl /dev/null
+# unchanged when MSYS_NO_PATHCONV=1 is set, as the README asks, and it cannot open that path, so it
+# gets the NUL device instead; MSYS2's own curl, under /usr/bin, opens /dev/null as on Linux and macOS.
+null_device() {
+	if command -v cygpath >/dev/null 2>&1 && [[ "$(command -v curl)" != /usr/bin/* ]]; then
+		echo NUL
+	else
+		echo /dev/null
+	fi
+}
+
 # Variables
 PREFIX="${PREFIX:-local}"
 SUFFIX="${SUFFIX:-test}"
@@ -310,7 +321,7 @@ echo "You can visit your app at: $WEB_APP_URL"
 echo "Pinging [$WEB_APP_URL] to verify the web app responds..."
 HTTP_CODE="000"
 for attempt in $(seq 1 12); do
-	HTTP_CODE=$(curl -s -o /dev/null -w '%{http_code}' --max-time 10 "$WEB_APP_URL" || echo "000")
+	HTTP_CODE=$(curl -s -o "$(null_device)" -w '%{http_code}' --max-time 10 "$WEB_APP_URL" || echo "000")
 	if [ "$HTTP_CODE" = "200" ]; then
 		echo "Web app responded with HTTP 200. Deployment verified successfully."
 		break
diff --git a/samples/web-app-mysql-flexible-server/dotnet/scripts/deploy.sh b/samples/web-app-mysql-flexible-server/dotnet/scripts/deploy.sh
index ade1ba2..6ec74f4 100755
--- a/samples/web-app-mysql-flexible-server/dotnet/scripts/deploy.sh
+++ b/samples/web-app-mysql-flexible-server/dotnet/scripts/deploy.sh
@@ -1,5 +1,16 @@
 #!/bin/bash
 
+# Where curl discards a response body. Git Bash and MSYS2 shells hand a Windows curl /dev/null
+# unchanged when MSYS_NO_PATHCONV=1 is set, as the README asks, and it cannot open that path, so it
+# gets the NUL device instead; MSYS2's own curl, under /usr/bin, opens /dev/null as on Linux and macOS.
+null_device() {
+	if command -v cygpath >/dev/null 2>&1 && [[ "$(command -v curl)" != /usr/bin/* ]]; then
+		echo NUL
+	else
+		echo /dev/null
+	fi
+}
+
 # Variables
 PREFIX="${PREFIX:-local}"
 SUFFIX="${SUFFIX:-test}"
@@ -1132,7 +1143,7 @@ echo "You can visit your app at: $WEB_APP_URL"
 echo "Pinging [$WEB_APP_URL] to verify the web app responds..."
 HTTP_CODE="000"
 for attempt in $(seq 1 12); do
-	HTTP_CODE=$(curl -s -o /dev/null -w '%{http_code}' --max-time 10 "$WEB_APP_URL" || echo "000")
+	HTTP_CODE=$(curl -s -o "$(null_device)" -w '%{http_code}' --max-time 10 "$WEB_APP_URL" || echo "000")
 	if [ "$HTTP_CODE" = "200" ]; then
 		echo "Web app responded with HTTP 200. Deployment verified successfully."
 		break
diff --git a/samples/web-app-mysql-flexible-server/dotnet/terraform/deploy.sh b/samples/web-app-mysql-flexible-server/dotnet/terraform/deploy.sh
index d07794d..5ef16f1 100755
--- a/samples/web-app-mysql-flexible-server/dotnet/terraform/deploy.sh
+++ b/samples/web-app-mysql-flexible-server/dotnet/terraform/deploy.sh
@@ -1,5 +1,16 @@
 #!/bin/bash
 
+# Where curl discards a response body. Git Bash and MSYS2 shells hand a Windows curl /dev/null
+# unchanged when MSYS_NO_PATHCONV=1 is set, as the README asks, and it cannot open that path, so it
+# gets the NUL device instead; MSYS2's own curl, under /usr/bin, opens /dev/null as on Linux and macOS.
+null_device() {
+	if command -v cygpath >/dev/null 2>&1 && [[ "$(command -v curl)" != /usr/bin/* ]]; then
+		echo NUL
+	else
+		echo /dev/null
+	fi
+}
+
 # Variables
 PREFIX="${PREFIX:-local}"
 SUFFIX="${SUFFIX:-test}"
@@ -263,7 +274,7 @@ echo "You can visit your app at: $WEB_APP_URL"
 echo "Pinging [$WEB_APP_URL] to verify the web app responds..."
 HTTP_CODE="000"
 for attempt in $(seq 1 12); do
-	HTTP_CODE=$(curl -s -o /dev/null -w '%{http_code}' --max-time 10 "$WEB_APP_URL" || echo "000")
+	HTTP_CODE=$(curl -s -o "$(null_device)" -w '%{http_code}' --max-time 10 "$WEB_APP_URL" || echo "000")
 	if [ "$HTTP_CODE" = "200" ]; then
 		echo "Web app responded with HTTP 200. Deployment verified successfully."
 		break
diff --git a/samples/web-app-mysql-flexible-server/python/bicep/deploy.sh b/samples/web-app-mysql-flexible-server/python/bicep/deploy.sh
index 9d9c056..556c63b 100755
--- a/samples/web-app-mysql-flexible-server/python/bicep/deploy.sh
+++ b/samples/web-app-mysql-flexible-server/python/bicep/deploy.sh
@@ -1,5 +1,16 @@
 #!/bin/bash
 
+# Where curl discards a response body. Git Bash and MSYS2 shells hand a Windows curl /dev/null
+# unchanged when MSYS_NO_PATHCONV=1 is set, as the README asks, and it cannot open that path, so it
+# gets the NUL device instead; MSYS2's own curl, under /usr/bin, opens /dev/null as on Linux and macOS.
+null_device() {
+	if command -v cygpath >/dev/null 2>&1 && [[ "$(command -v curl)" != /usr/bin/* ]]; then
+		echo NUL
+	else
+		echo /dev/null
+	fi
+}
+
 # Variables
 PREFIX="${PREFIX:-local}"
 SUFFIX="${SUFFIX:-test}"
@@ -310,7 +321,7 @@ echo "You can visit your app at: $WEB_APP_URL"
 echo "Pinging [$WEB_APP_URL] to verify the web app responds..."
 HTTP_CODE="000"
 for attempt in $(seq 1 12); do
-	HTTP_CODE=$(curl -s -o /dev/null -w '%{http_code}' --max-time 10 "$WEB_APP_URL" || echo "000")
+	HTTP_CODE=$(curl -s -o "$(null_device)" -w '%{http_code}' --max-time 10 "$WEB_APP_URL" || echo "000")
 	if [ "$HTTP_CODE" = "200" ]; then
 		echo "Web app responded with HTTP 200. Deployment verified successfully."
 		break
diff --git a/samples/web-app-mysql-flexible-server/python/scripts/deploy.sh b/samples/web-app-mysql-flexible-server/python/scripts/deploy.sh
index 9787b81..f4c35e7 100755
--- a/samples/web-app-mysql-flexible-server/python/scripts/deploy.sh
+++ b/samples/web-app-mysql-flexible-server/python/scripts/deploy.sh
@@ -1,5 +1,16 @@
 #!/bin/bash
 
+# Where curl discards a response body. Git Bash and MSYS2 shells hand a Windows curl /dev/null
+# unchanged when MSYS_NO_PATHCONV=1 is set, as the README asks, and it cannot open that path, so it
+# gets the NUL device instead; MSYS2's own curl, under /usr/bin, opens /dev/null as on Linux and macOS.
+null_device() {
+	if command -v cygpath >/dev/null 2>&1 && [[ "$(command -v curl)" != /usr/bin/* ]]; then
+		echo NUL
+	else
+		echo /dev/null
+	fi
+}
+
 # Variables
 PREFIX="${PREFIX:-local}"
 SUFFIX="${SUFFIX:-test}"
@@ -1132,7 +1143,7 @@ echo "You can visit your app at: $WEB_APP_URL"
 echo "Pinging [$WEB_APP_URL] to verify the web app responds..."
 HTTP_CODE="000"
 for attempt in $(seq 1 12); do
-	HTTP_CODE=$(curl -s -o /dev/null -w '%{http_code}' --max-time 10 "$WEB_APP_URL" || echo "000")
+	HTTP_CODE=$(curl -s -o "$(null_device)" -w '%{http_code}' --max-time 10 "$WEB_APP_URL" || echo "000")
 	if [ "$HTTP_CODE" = "200" ]; then
 		echo "Web app responded with HTTP 200. Deployment verified successfully."
 		break
diff --git a/samples/web-app-mysql-flexible-server/python/terraform/deploy.sh b/samples/web-app-mysql-flexible-server/python/terraform/deploy.sh
index d41747e..d7d02a1 100755
--- a/samples/web-app-mysql-flexible-server/python/terraform/deploy.sh
+++ b/samples/web-app-mysql-flexible-server/python/terraform/deploy.sh
@@ -1,5 +1,16 @@
 #!/bin/bash
 
+# Where curl discards a response body. Git Bash and MSYS2 shells hand a Windows curl /dev/null
+# unchanged when MSYS_NO_PATHCONV=1 is set, as the README asks, and it cannot open that path, so it
+# gets the NUL device instead; MSYS2's own curl, under /usr/bin, opens /dev/null as on Linux and macOS.
+null_device() {
+	if command -v cygpath >/dev/null 2>&1 && [[ "$(command -v curl)" != /usr/bin/* ]]; then
+		echo NUL
+	else
+		echo /dev/null
+	fi
+}
+
 # Variables
 PREFIX="${PREFIX:-local}"
 SUFFIX="${SUFFIX:-test}"
@@ -263,7 +274,7 @@ echo "You can visit your app at: $WEB_APP_URL"
 echo "Pinging [$WEB_APP_URL] to verify the web app responds..."
 HTTP_CODE="000"
 for attempt in $(seq 1 12); do
-	HTTP_CODE=$(curl -s -o /dev/null -w '%{http_code}' --max-time 10 "$WEB_APP_URL" || echo "000")
+	HTTP_CODE=$(curl -s -o "$(null_device)" -w '%{http_code}' --max-time 10 "$WEB_APP_URL" || echo "000")
 	if [ "$HTTP_CODE" = "200" ]; then
 		echo "Web app responded with HTTP 200. Deployment verified successfully."
 		break

From 850bb1f02054c9d303c4afeed68207d51e472906 Mon Sep 17 00:00:00 2001
From: Paolo Salvatori <leprino@hotmail.com>
Date: Fri, 23 Oct 2026 17:09:14 +0200
Subject: [PATCH 09/18] Run Maven with the path conversion back on in the
 Service Bus sample

Maven's mvn launcher is a shell script that hands its own paths, such as its classpath, to Java, a Windows program on Windows, and relies on Git Bash and MSYS2 converting them.
With MSYS_NO_PATHCONV=1 Java received the POSIX paths and stopped with "Could not find or load main class org.codehaus.plexus.classworlds.launcher.Launcher", as the Windows job showed.
The three deploy scripts of the Service Bus sample run mvn in a subshell that unsets the variable, and the README tells script authors to do the same for such launchers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DhZ2ojsEXd2SGMo7s9uiZh
---
 README.md                                   | 1 +
 samples/servicebus/java/bicep/deploy.sh     | 6 ++++--
 samples/servicebus/java/scripts/deploy.sh   | 6 ++++--
 samples/servicebus/java/terraform/deploy.sh | 6 ++++--
 4 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/README.md b/README.md
index 52a2adb..fc6d1a9 100644
--- a/README.md
+++ b/README.md
@@ -146,6 +146,7 @@ Tips:
 - WSL runs Linux and needs no variable.
 - When you write a script that passes a local file to `az`, `curl`, `jq`, `python`, `docker` or `zip`, convert its path with the `native_path` helper the existing scripts define; Git Bash ships no `zip`, and a `zip.exe` built for Windows needs the converted path too.
 - To discard what a Windows program writes to a file, such as `curl -o`, pass it `"$(null_device)"` rather than `/dev/null`, as the existing scripts do. Shell redirections such as `> /dev/null` need no change.
+- A launcher written as a shell script that hands its own paths to a Windows program, such as Maven's `mvn`, needs the conversion: run it as `(unset MSYS_NO_PATHCONV; mvn ...)`, as the Service Bus sample does. Setting the variable to an empty value is not enough, because any value turns the conversion off.
 
 ## Configuration
 
diff --git a/samples/servicebus/java/bicep/deploy.sh b/samples/servicebus/java/bicep/deploy.sh
index 079911c..bc8335d 100755
--- a/samples/servicebus/java/bicep/deploy.sh
+++ b/samples/servicebus/java/bicep/deploy.sh
@@ -131,6 +131,8 @@ else
 	exit 1
 fi
 
-# Start the Java application
+# Start the Java application. Maven's mvn launcher is a shell script that hands its own paths to Java,
+# a Windows program on Windows, and relies on Git Bash and MSYS2 converting them, so it runs with that
+# conversion back on even when MSYS_NO_PATHCONV is set, as the README asks.
 echo "Starting Java application..."
-cd "$CURRENT_DIR/../app" && mvn clean spring-boot:run
+cd "$CURRENT_DIR/../app" && (unset MSYS_NO_PATHCONV; mvn clean spring-boot:run)
diff --git a/samples/servicebus/java/scripts/deploy.sh b/samples/servicebus/java/scripts/deploy.sh
index b1daf46..7697b05 100755
--- a/samples/servicebus/java/scripts/deploy.sh
+++ b/samples/servicebus/java/scripts/deploy.sh
@@ -103,9 +103,11 @@ else
 	exit 1
 fi
 
-# Start the Java application
+# Start the Java application. Maven's mvn launcher is a shell script that hands its own paths to Java,
+# a Windows program on Windows, and relies on Git Bash and MSYS2 converting them, so it runs with that
+# conversion back on even when MSYS_NO_PATHCONV is set, as the README asks.
 echo "Starting Java application..."
-cd "$CURRENT_DIR/../app" && mvn clean spring-boot:run
+cd "$CURRENT_DIR/../app" && (unset MSYS_NO_PATHCONV; mvn clean spring-boot:run)
 
 # Optionally tear down all resources (uncomment to enable)
 # echo "Deleting resource group [$RESOURCE_GROUP_NAME]..."
diff --git a/samples/servicebus/java/terraform/deploy.sh b/samples/servicebus/java/terraform/deploy.sh
index e90cee4..4c9875a 100755
--- a/samples/servicebus/java/terraform/deploy.sh
+++ b/samples/servicebus/java/terraform/deploy.sh
@@ -63,7 +63,9 @@ else
 	exit 1
 fi
 
-# Start the Java application
+# Start the Java application. Maven's mvn launcher is a shell script that hands its own paths to Java,
+# a Windows program on Windows, and relies on Git Bash and MSYS2 converting them, so it runs with that
+# conversion back on even when MSYS_NO_PATHCONV is set, as the README asks.
 echo "Starting Java application..."
-cd "$CURRENT_DIR/../app" && mvn clean spring-boot:run
+cd "$CURRENT_DIR/../app" && (unset MSYS_NO_PATHCONV; mvn clean spring-boot:run)
 

From 113c9828765934d966c1092522722a111a8368c4 Mon Sep 17 00:00:00 2001
From: Paolo Salvatori <leprino@hotmail.com>
Date: Fri, 23 Oct 2026 17:09:18 +0200
Subject: [PATCH 10/18] Print Maven's version with the path conversion on, as
 the Service Bus sample runs it

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DhZ2ojsEXd2SGMo7s9uiZh
---
 .github/workflows/run-samples.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/run-samples.yml b/.github/workflows/run-samples.yml
index 23a4a86..6966dc9 100644
--- a/.github/workflows/run-samples.yml
+++ b/.github/workflows/run-samples.yml
@@ -548,7 +548,7 @@ jobs:
           mysql --version
           sqlcmd --version
           java -version 2>&1 | sed -n 1p
-          mvn -v | sed -n 1p
+          (unset MSYS_NO_PATHCONV; mvn -v) | sed -n 1p
           dotnet --version
           terraform version | sed -n 1p
           az version --output tsv --query '"azure-cli"'

From 2f9748ce30a0e95aea3eddde0a9d07331fbeeb24 Mon Sep 17 00:00:00 2001
From: Paolo Salvatori <leprino@hotmail.com>
Date: Fri, 23 Oct 2026 17:27:28 +0200
Subject: [PATCH 11/18] Tell Git Bash and MSYS2 users to drop the carriage
 returns of Windows programs

Windows programs such as the Azure CLI and jq end every line with a carriage return, which Bash keeps in $(...) and read, so a name or an ID read from az --output tsv carries a trailing \r.
In the Windows CI run, the App Configuration sample's private endpoint failed twice with ResourceNotFound for a key vault that existed, its name ending in that \r.
MSYS2's bash, which Git Bash ships, drops carriage returns from command substitution and read when its igncr option is on, and an exported SHELLOPTS passes the option to the scripts, so the README asks for set -o igncr and export SHELLOPTS next to MSYS_NO_PATHCONV=1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DhZ2ojsEXd2SGMo7s9uiZh
---
 README.md | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index fc6d1a9..acf83da 100644
--- a/README.md
+++ b/README.md
@@ -120,10 +120,12 @@ Or by installing and using `dos2unix`.
 ### Windows: Git Bash and MSYS2
 
 The scripts are written for Bash and run unchanged on Linux, macOS and WSL.
-They also run on Windows from Git Bash or from an MSYS2 shell (for example MINGW64 or UCRT64), provided you first turn off the automatic path conversion of these shells:
+They also run on Windows from Git Bash or from an MSYS2 shell (for example MINGW64 or UCRT64), provided you first turn off the automatic path conversion of these shells and make them drop the carriage returns Windows programs print:
 
 ```bash
 export MSYS_NO_PATHCONV=1
+set -o igncr
+export SHELLOPTS
 ```
 
 When Git Bash or an MSYS2 shell starts a Windows program such as the Azure CLI, it rewrites every argument that looks like an absolute POSIX path into a Windows path.
@@ -138,12 +140,16 @@ The scripts convert the paths of the local files they hand to Windows programs,
 They also hand `curl` the Windows `NUL` device instead of `/dev/null` for the responses they discard, because the variable stops these shells from making that conversion too.
 On Linux and macOS `cygpath` does not exist, and the paths are left unchanged.
 
+Windows programs such as the Azure CLI and `jq` also end every line they print with a carriage return, which Bash keeps when a script captures their output with `$(...)` or `read`.
+A name or an ID read from `az ... --output tsv` then carries an invisible `\r`, and the next command that receives it fails, for example with `ResourceNotFound` for a resource that exists.
+`set -o igncr` makes these shells drop carriage returns from captured output, and `export SHELLOPTS` passes the option on to the scripts you start.
+
 Tips:
 
-- To set the variable in every new Git Bash window, add `export MSYS_NO_PATHCONV=1` to `~/.bash_profile`, or to `~/.bashrc` if your `.bash_profile` sources it.
+- To apply these settings in every new Git Bash window, add the three lines to `~/.bash_profile`, or to `~/.bashrc` if your `.bash_profile` sources it.
 - `echo $MSYSTEM` prints a value such as `MINGW64` only in these shells.
-- Any value turns the conversion off, `0` included; run `unset MSYS_NO_PATHCONV` to turn it back on.
-- WSL runs Linux and needs no variable.
+- Any value turns the conversion off, `0` included; run `unset MSYS_NO_PATHCONV` to turn it back on, and `set +o igncr` to keep carriage returns again.
+- WSL runs Linux and needs none of these settings.
 - When you write a script that passes a local file to `az`, `curl`, `jq`, `python`, `docker` or `zip`, convert its path with the `native_path` helper the existing scripts define; Git Bash ships no `zip`, and a `zip.exe` built for Windows needs the converted path too.
 - To discard what a Windows program writes to a file, such as `curl -o`, pass it `"$(null_device)"` rather than `/dev/null`, as the existing scripts do. Shell redirections such as `> /dev/null` need no change.
 - A launcher written as a shell script that hands its own paths to a Windows program, such as Maven's `mvn`, needs the conversion: run it as `(unset MSYS_NO_PATHCONV; mvn ...)`, as the Service Bus sample does. Setting the variable to an empty value is not enough, because any value turns the conversion off.

From bf49df624b97c62cdf813c4f6ddbeab4b12bd3e7 Mon Sep 17 00:00:00 2001
From: Paolo Salvatori <leprino@hotmail.com>
Date: Fri, 23 Oct 2026 17:28:21 +0200
Subject: [PATCH 12/18] Drop the carriage returns of Windows programs in the
 Windows job, as the README asks

The README asks Windows users for set -o igncr and export SHELLOPTS. Exporting SHELLOPTS in a step would also hand the step's own -e and pipefail to the sample scripts, so the job turns the option on for every bash through BASH_ENV instead.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DhZ2ojsEXd2SGMo7s9uiZh
---
 .github/workflows/run-samples.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/workflows/run-samples.yml b/.github/workflows/run-samples.yml
index 6966dc9..d1bad9d 100644
--- a/.github/workflows/run-samples.yml
+++ b/.github/workflows/run-samples.yml
@@ -386,6 +386,15 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Drop the carriage returns of Windows programs
+        # The README asks Windows users for `set -o igncr` and `export SHELLOPTS`, so that the bash of Git Bash
+        # and MSYS2 drops the carriage returns the Azure CLI and jq print from $(...) and read. Exporting
+        # SHELLOPTS here would also hand each step's own -e and pipefail to the sample scripts, so every bash
+        # turns the option on through BASH_ENV instead; a bash without the option skips the line.
+        run: |
+          printf '(set -o igncr) 2>/dev/null && set -o igncr\n' > "$RUNNER_TEMP/igncr.sh"
+          echo "BASH_ENV=$(cygpath -m "$RUNNER_TEMP/igncr.sh")" >> "$GITHUB_ENV"
+
       - name: Configure WSL
         # Once a step's wsl.exe session ends, WSL stops the idle distribution after 15 seconds, and
         # dockerd with it; -1 keeps it running for the whole job. The memory leaves room for the backing

From 8baf8fc48f2d4668e3efb75b11c95c65d8f1f5ec Mon Sep 17 00:00:00 2001
From: Paolo Salvatori <leprino@hotmail.com>
Date: Fri, 23 Oct 2026 18:44:51 +0200
Subject: [PATCH 13/18] Strip the carriage return of the Azure CLI from the
 arrays mapfile fills

On Windows the Azure CLI ends every line with a carriage return, and bash's igncr option drops it from $(...) and read but not from mapfile.
The App Configuration samples read several fields at once with mapfile, so in the Windows CI the key vault ID kept its \r and the private endpoint failed with ResourceNotFound, and the AKS sample read the cluster's OIDC and workload identity flags as "true\r".
Every mapfile that reads az output, in those samples and in the AKS cluster scripts, now reads it through tr -d '\r', which changes nothing on Linux and macOS, and the README says igncr does not cover mapfile.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DhZ2ojsEXd2SGMo7s9uiZh
---
 README.md                                                | 3 ++-
 .../web-app-app-configuration/dotnet/scripts/deploy.sh   | 9 ++++++---
 .../web-app-app-configuration/python/scripts/deploy.sh   | 9 ++++++---
 3 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/README.md b/README.md
index acf83da..ebe15e8 100644
--- a/README.md
+++ b/README.md
@@ -142,7 +142,8 @@ On Linux and macOS `cygpath` does not exist, and the paths are left unchanged.
 
 Windows programs such as the Azure CLI and `jq` also end every line they print with a carriage return, which Bash keeps when a script captures their output with `$(...)` or `read`.
 A name or an ID read from `az ... --output tsv` then carries an invisible `\r`, and the next command that receives it fails, for example with `ResourceNotFound` for a resource that exists.
-`set -o igncr` makes these shells drop carriage returns from captured output, and `export SHELLOPTS` passes the option on to the scripts you start.
+`set -o igncr` makes these shells drop carriage returns from `$(...)` and `read`, and `export SHELLOPTS` passes the option on to the scripts you start.
+`mapfile` keeps them even then, so the scripts that fill an array from the Azure CLI strip them with `tr -d '\r'`.
 
 Tips:
 
diff --git a/samples/web-app-app-configuration/dotnet/scripts/deploy.sh b/samples/web-app-app-configuration/dotnet/scripts/deploy.sh
index 7ff5163..f152df7 100755
--- a/samples/web-app-app-configuration/dotnet/scripts/deploy.sh
+++ b/samples/web-app-app-configuration/dotnet/scripts/deploy.sh
@@ -459,12 +459,13 @@ fi
 
 # Retrieve the clientId, principalId and resource id of the user-assigned managed identity
 echo "Retrieving the clientId, principalId and resource id of the [$MANAGED_IDENTITY_NAME] managed identity..."
+# tr drops the carriage return the Azure CLI ends each line with on Windows: mapfile keeps it, even with bash's igncr option
 mapfile -t IDENTITY_FIELDS < <(az identity show \
 	--name "$MANAGED_IDENTITY_NAME" \
 	--resource-group "$RESOURCE_GROUP_NAME" \
 	--query "[clientId, principalId, id]" \
 	--output tsv \
-	--only-show-errors)
+	--only-show-errors | tr -d '\r')
 IDENTITY_CLIENT_ID="${IDENTITY_FIELDS[0]:-}"
 IDENTITY_PRINCIPAL_ID="${IDENTITY_FIELDS[1]:-}"
 IDENTITY_ID="${IDENTITY_FIELDS[2]:-}"
@@ -574,12 +575,13 @@ fi
 # the service and used verbatim by the web app: https://<store>.azconfig.io on Azure,
 # https://<store>.azure.localhost.localstack.cloud:4566 on the emulator.
 echo "Retrieving the endpoint and the resource id of the [$APP_CONFIG_NAME] App Configuration store..."
+# tr drops the carriage return the Azure CLI ends each line with on Windows: mapfile keeps it, even with bash's igncr option
 mapfile -t APP_CONFIG_FIELDS < <(az appconfig show \
 	--name "$APP_CONFIG_NAME" \
 	--resource-group "$RESOURCE_GROUP_NAME" \
 	--query "[endpoint, id]" \
 	--output tsv \
-	--only-show-errors)
+	--only-show-errors | tr -d '\r')
 APP_CONFIG_ENDPOINT="${APP_CONFIG_FIELDS[0]:-}"
 APP_CONFIG_ID="${APP_CONFIG_FIELDS[1]:-}"
 
@@ -661,12 +663,13 @@ fi
 # https://<vault>.vault.azure.net/ on Azure, https://<vault>.vault.azure.localhost.localstack.cloud:4566/ on
 # the emulator.
 echo "Retrieving the vault URI and the resource id of the [$KEY_VAULT_NAME] key vault..."
+# tr drops the carriage return the Azure CLI ends each line with on Windows: mapfile keeps it, even with bash's igncr option
 mapfile -t KEY_VAULT_FIELDS < <(az keyvault show \
 	--name "$KEY_VAULT_NAME" \
 	--resource-group "$RESOURCE_GROUP_NAME" \
 	--query "[properties.vaultUri, id]" \
 	--output tsv \
-	--only-show-errors)
+	--only-show-errors | tr -d '\r')
 KEY_VAULT_URI="${KEY_VAULT_FIELDS[0]:-}"
 KEY_VAULT_ID="${KEY_VAULT_FIELDS[1]:-}"
 
diff --git a/samples/web-app-app-configuration/python/scripts/deploy.sh b/samples/web-app-app-configuration/python/scripts/deploy.sh
index 929363a..99dec68 100644
--- a/samples/web-app-app-configuration/python/scripts/deploy.sh
+++ b/samples/web-app-app-configuration/python/scripts/deploy.sh
@@ -459,12 +459,13 @@ fi
 
 # Retrieve the clientId, principalId and resource id of the user-assigned managed identity
 echo "Retrieving the clientId, principalId and resource id of the [$MANAGED_IDENTITY_NAME] managed identity..."
+# tr drops the carriage return the Azure CLI ends each line with on Windows: mapfile keeps it, even with bash's igncr option
 mapfile -t IDENTITY_FIELDS < <(az identity show \
 	--name "$MANAGED_IDENTITY_NAME" \
 	--resource-group "$RESOURCE_GROUP_NAME" \
 	--query "[clientId, principalId, id]" \
 	--output tsv \
-	--only-show-errors)
+	--only-show-errors | tr -d '\r')
 IDENTITY_CLIENT_ID="${IDENTITY_FIELDS[0]:-}"
 IDENTITY_PRINCIPAL_ID="${IDENTITY_FIELDS[1]:-}"
 IDENTITY_ID="${IDENTITY_FIELDS[2]:-}"
@@ -574,12 +575,13 @@ fi
 # the service and used verbatim by the web app: https://<store>.azconfig.io on Azure,
 # https://<store>.azure.localhost.localstack.cloud:4566 on the emulator.
 echo "Retrieving the endpoint and the resource id of the [$APP_CONFIG_NAME] App Configuration store..."
+# tr drops the carriage return the Azure CLI ends each line with on Windows: mapfile keeps it, even with bash's igncr option
 mapfile -t APP_CONFIG_FIELDS < <(az appconfig show \
 	--name "$APP_CONFIG_NAME" \
 	--resource-group "$RESOURCE_GROUP_NAME" \
 	--query "[endpoint, id]" \
 	--output tsv \
-	--only-show-errors)
+	--only-show-errors | tr -d '\r')
 APP_CONFIG_ENDPOINT="${APP_CONFIG_FIELDS[0]:-}"
 APP_CONFIG_ID="${APP_CONFIG_FIELDS[1]:-}"
 
@@ -661,12 +663,13 @@ fi
 # https://<vault>.vault.azure.net/ on Azure, https://<vault>.vault.azure.localhost.localstack.cloud:4566/ on
 # the emulator.
 echo "Retrieving the vault URI and the resource id of the [$KEY_VAULT_NAME] key vault..."
+# tr drops the carriage return the Azure CLI ends each line with on Windows: mapfile keeps it, even with bash's igncr option
 mapfile -t KEY_VAULT_FIELDS < <(az keyvault show \
 	--name "$KEY_VAULT_NAME" \
 	--resource-group "$RESOURCE_GROUP_NAME" \
 	--query "[properties.vaultUri, id]" \
 	--output tsv \
-	--only-show-errors)
+	--only-show-errors | tr -d '\r')
 KEY_VAULT_URI="${KEY_VAULT_FIELDS[0]:-}"
 KEY_VAULT_ID="${KEY_VAULT_FIELDS[1]:-}"
 

From 3ed7db1e2f478f46551dc4ee767275b1ad4d5b20 Mon Sep 17 00:00:00 2001
From: Paolo Salvatori <leprino@hotmail.com>
Date: Fri, 23 Oct 2026 18:45:13 +0200
Subject: [PATCH 14/18] Turn off WSL's DNS tunneling in the Windows job

With DNS tunneling, on by default, the containers of the Docker Engine in WSL could not reach the 10.255.255.254 resolver WSL configures, so their lookups timed out: the Docker Engine log held dozens of "failed to query external DNS server" errors, and the Container Apps runtime could not pull the sample's image (ImagePullBackOff). Without tunneling, WSL hands out the NAT device on the host as the DNS server, which containers reach too (https://learn.microsoft.com/windows/wsl/troubleshooting#common-issues).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DhZ2ojsEXd2SGMo7s9uiZh
---
 .github/workflows/run-samples.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/run-samples.yml b/.github/workflows/run-samples.yml
index d1bad9d..246f1df 100644
--- a/.github/workflows/run-samples.yml
+++ b/.github/workflows/run-samples.yml
@@ -399,9 +399,12 @@ jobs:
         # Once a step's wsl.exe session ends, WSL stops the idle distribution after 15 seconds, and
         # dockerd with it; -1 keeps it running for the whole job. The memory leaves room for the backing
         # containers the samples start.
+        # DNS tunneling, on by default, answers DNS for WSL itself, but the containers of the Docker Engine
+        # in WSL cannot reach its 10.255.255.254 resolver, so their lookups time out; without it, WSL
+        # hands out the NAT device on the host, which containers reach too.
         shell: pwsh
         run: |
-          Set-Content -Path "$env:USERPROFILE\.wslconfig" -Value "[wsl2]`nmemory=12GB`n`n[general]`ninstanceIdleTimeout=-1"
+          Set-Content -Path "$env:USERPROFILE\.wslconfig" -Value "[wsl2]`nmemory=12GB`ndnsTunneling=false`n`n[general]`ninstanceIdleTimeout=-1"
           wsl --shutdown
 
       - name: Set up Ubuntu in WSL 2

From 8d3f85ca05541e68dc4fbd66a31133ff2b1dcac2 Mon Sep 17 00:00:00 2001
From: Paolo Salvatori <leprino@hotmail.com>
Date: Fri, 23 Oct 2026 19:29:39 +0200
Subject: [PATCH 15/18] Skip the SQL Database certificate check where the
 container IP is unreachable

call-web-app.sh compares the certificate the web app loaded from Key Vault with the one it serves on port 8443, and reaches that port through the container's IP address.
The host can reach that address only when Docker runs natively on Linux; with Docker Desktop on Windows and macOS, and in the Windows CI, the .NET script timed out and failed a deployment that worked.
Both scripts now record whether the earlier call through the container IP succeeded, and when it did not, they say so and skip the certificate check. On Linux the check runs as before, the .NET one failing when HTTPS on port 8443 is broken.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DhZ2ojsEXd2SGMo7s9uiZh
---
 .../web-app-sql-database/dotnet/scripts/call-web-app.sh  | 9 +++++++++
 .../web-app-sql-database/python/scripts/call-web-app.sh  | 9 +++++++++
 2 files changed, 18 insertions(+)

diff --git a/samples/web-app-sql-database/dotnet/scripts/call-web-app.sh b/samples/web-app-sql-database/dotnet/scripts/call-web-app.sh
index b48418c..5daec1d 100755
--- a/samples/web-app-sql-database/dotnet/scripts/call-web-app.sh
+++ b/samples/web-app-sql-database/dotnet/scripts/call-web-app.sh
@@ -206,12 +206,14 @@ call_web_app() {
 		echo "Failed to retrieve LocalStack proxy port"
 	fi
 	
+	container_ip_reachable=false
 	if [ -n "$container_ip" ] && [ -n "$container_port" ]; then
 		# Call the web app via the container IP address
 		echo "Calling web app [$web_app_name] via container IP address [$container_ip]..."
 		curl --max-time 10 -s "http://$container_ip:$container_port/" 1> /dev/null
 
 		if [ $? == 0 ]; then
+			container_ip_reachable=true
 			echo "Web app call via container IP address [$container_ip] succeeded."
 		else
 			echo "Web app call via container IP address [$container_ip] failed."
@@ -249,6 +251,13 @@ call_web_app() {
 	fi
 
 	echo "Validating certificate from Key Vault..."
+	if [[ $container_ip_reachable != true ]]; then
+		# The check reaches the app's HTTPS port through the container IP address, which the host can
+		# reach only when Docker runs natively on Linux: Docker Desktop on Windows and macOS does not
+		# route it. Say so and skip, rather than failing a deployment that works.
+		echo "The container IP address [$container_ip] is not reachable from this host; skipping the Key Vault certificate check."
+		return 0
+	fi
 	if ! KV_RESPONSE=$(curl --max-time 10 -fsSk "https://$container_ip:8443/api/certificate"); then
 		echo "Failed to call https://$container_ip:8443/api/certificate (is HTTPS on port 8443 enabled?)"
 		exit 1
diff --git a/samples/web-app-sql-database/python/scripts/call-web-app.sh b/samples/web-app-sql-database/python/scripts/call-web-app.sh
index 74bf6ff..9d7434f 100755
--- a/samples/web-app-sql-database/python/scripts/call-web-app.sh
+++ b/samples/web-app-sql-database/python/scripts/call-web-app.sh
@@ -206,12 +206,14 @@ call_web_app() {
 		echo "Failed to retrieve LocalStack proxy port"
 	fi
 	
+	container_ip_reachable=false
 	if [ -n "$container_ip" ] && [ -n "$container_port" ]; then
 		# Call the web app via the container IP address
 		echo "Calling web app [$web_app_name] via container IP address [$container_ip]..."
 		curl --max-time 10 -s "http://$container_ip:$container_port/" 1> /dev/null
 
 		if [ $? == 0 ]; then
+			container_ip_reachable=true
 			echo "Web app call via container IP address [$container_ip] succeeded."
 		else
 			echo "Web app call via container IP address [$container_ip] failed."
@@ -249,6 +251,13 @@ call_web_app() {
 	fi
 
 	echo "Validating certificate from Key Vault..."
+	if [[ $container_ip_reachable != true ]]; then
+		# The check reaches the app's HTTPS port through the container IP address, which the host can
+		# reach only when Docker runs natively on Linux: Docker Desktop on Windows and macOS does not
+		# route it. Say so and skip, rather than failing a deployment that works.
+		echo "The container IP address [$container_ip] is not reachable from this host; skipping the Key Vault certificate check."
+		return 0
+	fi
 	if ! KV_RESPONSE=$(curl --max-time 10 -fsSk "https://$container_ip:8443/api/certificate"); then
 		# Only reachable when the app serves HTTPS itself (python app.py); under gunicorn the port
 		# is closed. Say so and skip, rather than comparing two empty thumbprints as equal.

From 125a1342c8602d9a72a47cee6427a7bb683dd3c5 Mon Sep 17 00:00:00 2001
From: Paolo Salvatori <leprino@hotmail.com>
Date: Mon, 26 Oct 2026 14:50:21 +0100
Subject: [PATCH 16/18] Run the Bicep and Terraform variants of the
 custom-image web app sample in CI

samples/web-app-custom-image/{python,dotnet}/{bicep,terraform} had no entry in run-samples.sh, so
the Samples CI never deployed them. Each entry now deploys with the variant's deploy.sh, then checks
the resources with the sample's validate.sh and calls the app with call-web-app.sh, as the scripts
variant does: the Bicep and Terraform deployments use the same prefix, suffix and names. They run
on amd64 and arm64, like the scripts variant, through ARM64_SAMPLE_DIRS.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DhZ2ojsEXd2SGMo7s9uiZh
---
 run-samples.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/run-samples.sh b/run-samples.sh
index f78b461..41afee1 100755
--- a/run-samples.sh
+++ b/run-samples.sh
@@ -78,6 +78,8 @@ TERRAFORM_SAMPLES=(
   "samples/web-app-postgresql-flexible-server/dotnet/terraform|bash deploy.sh"
   "samples/web-app-app-configuration/python/terraform|bash deploy.sh"
   "samples/web-app-app-configuration/dotnet/terraform|bash deploy.sh"
+  "samples/web-app-custom-image/python/terraform|bash deploy.sh|bash ../scripts/validate.sh && bash ../scripts/call-web-app.sh"
+  "samples/web-app-custom-image/dotnet/terraform|bash deploy.sh|bash ../scripts/validate.sh && bash ../scripts/call-web-app.sh"
   "samples/aci-blob-storage/python/terraform|bash deploy.sh"
   "samples/container-apps-blob-storage/python/terraform|bash deploy.sh"
   "samples/url-shortener/python/terraform|bash deploy.sh|bash ../scripts/validate.sh"
@@ -104,6 +106,8 @@ BICEP_SAMPLES=(
   "samples/web-app-postgresql-flexible-server/dotnet/bicep|bash deploy.sh"
   "samples/web-app-app-configuration/python/bicep|bash deploy.sh"
   "samples/web-app-app-configuration/dotnet/bicep|bash deploy.sh"
+  "samples/web-app-custom-image/python/bicep|bash deploy.sh|bash ../scripts/validate.sh && bash ../scripts/call-web-app.sh"
+  "samples/web-app-custom-image/dotnet/bicep|bash deploy.sh|bash ../scripts/validate.sh && bash ../scripts/call-web-app.sh"
   "samples/aci-blob-storage/python/bicep|bash deploy.sh"
   "samples/container-apps-blob-storage/python/bicep|bash deploy.sh"
   "samples/url-shortener/python/bicep|bash deploy.sh|bash ../scripts/validate.sh"

From a14d69c2c4a6a96f7f83511cf96c8d7edcf5e226 Mon Sep 17 00:00:00 2001
From: Paolo Salvatori <leprino@hotmail.com>
Date: Mon, 26 Oct 2026 14:50:21 +0100
Subject: [PATCH 17/18] Choose Linux, Windows or both with a platform dropdown,
 as entries of one matrix

A manual run now picks where the selected tests run with the platform input: Linux (the default),
Windows, or all. build-matrix.sh puts one entry per test and platform in the matrix, a Windows
entry on the amd64 windows-latest runner whatever arch says, and one job runs them all, its
Windows-only and Linux-only steps gated on the entry's platform. GitHub lists a matrix job it skips
under its unexpanded name, so with a separate Windows job a pull request run showed
"Windows (Git Bash): ${{ matrix.name }}"; now a run lists only the jobs it runs, the Windows ones
as "Test: <sample> [Windows]". run_mode selects the tests on both platforms.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DhZ2ojsEXd2SGMo7s9uiZh
---
 .github/scripts/build-matrix.sh   |  58 ++++++++----
 .github/workflows/run-samples.yml | 145 +++++++++++++++++-------------
 2 files changed, 124 insertions(+), 79 deletions(-)

diff --git a/.github/scripts/build-matrix.sh b/.github/scripts/build-matrix.sh
index 092a94d..3e6ab30 100755
--- a/.github/scripts/build-matrix.sh
+++ b/.github/scripts/build-matrix.sh
@@ -2,22 +2,29 @@
 set -euo pipefail
 
 # Builds a dynamic GitHub Actions matrix for run-samples.yml.
-# Usage: build-matrix.sh <run_mode> [base_sha] [arch_filter]
+# Usage: build-matrix.sh <run_mode> [base_sha] [arch_filter] [platform]
 
 # "all" runs every test; "changed" only runs tests whose watch_folders have modified files
 RUN_MODE="${1:-all}"
 BASE_SHA="${2:-}"
-# "both" runs each test on every architecture it supports; "amd64"/"arm64" restrict it to one
+# "both" runs each test on every architecture it supports; "amd64"/"arm64" restrict it to one. It applies to
+# the Linux entries: the Windows runner is amd64, so a Windows entry always runs on amd64
 ARCH_FILTER="${3:-both}"
 case "$ARCH_FILTER" in
   both | amd64 | arm64) ;;
   *) echo "Invalid arch filter: '$ARCH_FILTER' (expected both, amd64 or arm64)" >&2; exit 1 ;;
 esac
+# "Linux" or "Windows" picks the runners the tests run on, "all" both: one entry per test and platform
+PLATFORM="${4:-Linux}"
+case "$PLATFORM" in
+  Linux | Windows | all) ;;
+  *) echo "Invalid platform: '$PLATFORM' (expected Linux, Windows or all)" >&2; exit 1 ;;
+esac
 
 # Get JSON metadata for all tests from run-samples.sh --list
 TEST_META=$(./run-samples.sh --list)
 TOTAL=$(echo "$TEST_META" | jq length)
-echo "Run mode: $RUN_MODE | Arch filter: $ARCH_FILTER | Total tests: $TOTAL"
+echo "Run mode: $RUN_MODE | Arch filter: $ARCH_FILTER | Platform: $PLATFORM | Total tests: $TOTAL"
 
 # Changes to these files affect all tests, so any modification triggers a full run
 INFRA_FILES="run-samples.sh Makefile .github/workflows/run-samples.yml .github/scripts/build-matrix.sh pyproject.toml requirements-dev.txt requirements-runtime.txt"
@@ -62,23 +69,40 @@ if [[ -z "${INDICES:-}" ]]; then
   MATRIX='{"include":[]}'
 else
   # Convert space-separated indices to JSON array, then build the matrix object.
-  # Each selected test is expanded into one entry per architecture it supports, so a
+  # Each selected test is expanded into one Linux entry per architecture it supports, so a
   # test that runs on both arches becomes two independent jobs. Tests that declare only
   # amd64 depend on an amd64-only container image — see run-samples.sh for the details.
+  # A Windows entry runs the test from Git Bash on the amd64 Windows runner: every test
+  # declares amd64, so each selected test gets one.
   IDX_JSON=$(echo "$INDICES" | tr ' ' '\n' | jq -R 'tonumber' | jq -s '.')
-  MATRIX=$(echo "$TEST_META" | jq -c --argjson idx "$IDX_JSON" --arg filter "$ARCH_FILTER" \
-    '{include: [
-        $idx[] as $i | .[$i] as $test |
-        $test.arches[] |
-        select($filter == "both" or . == $filter) |
-        {
-          shard:  $test.shard,
-          splits: $test.splits,
-          arch:   .,
-          runner: (if . == "arm64" then "ubuntu-22.04-arm" else "ubuntu-22.04" end),
-          name:   ($test.name + " [" + . + "]")
-        }
-      ]}')
+  MATRIX=$(echo "$TEST_META" | jq -c --argjson idx "$IDX_JSON" --arg filter "$ARCH_FILTER" --arg platform "$PLATFORM" \
+    '{include: (
+        (if $platform == "Windows" then [] else [
+          $idx[] as $i | .[$i] as $test |
+          $test.arches[] |
+          select($filter == "both" or . == $filter) |
+          {
+            shard:  $test.shard,
+            splits: $test.splits,
+            arch:   .,
+            os:     "linux",
+            runner: (if . == "arm64" then "ubuntu-22.04-arm" else "ubuntu-22.04" end),
+            name:   ($test.name + " [" + . + "]")
+          }
+        ] end)
+        + (if $platform == "Linux" then [] else [
+          $idx[] as $i | .[$i] as $test |
+          select($test.arches | index("amd64")) |
+          {
+            shard:  $test.shard,
+            splits: $test.splits,
+            arch:   "amd64",
+            os:     "windows",
+            runner: "windows-latest",
+            name:   ($test.name + " [Windows]")
+          }
+        ] end)
+      )}')
 fi
 
 # An arch filter can select tests that support no matching architecture, so decide
diff --git a/.github/workflows/run-samples.yml b/.github/workflows/run-samples.yml
index 246f1df..d0f6904 100644
--- a/.github/workflows/run-samples.yml
+++ b/.github/workflows/run-samples.yml
@@ -21,7 +21,7 @@ on:
           - changed
         default: changed
       arch:
-        description: "Architecture: 'both' runs every test on each architecture it supports"
+        description: "Architecture of the Linux jobs: 'both' runs every test on each architecture it supports; the Windows jobs always run on amd64"
         required: false
         type: choice
         options:
@@ -29,11 +29,15 @@ on:
           - amd64
           - arm64
         default: both
-      windows:
-        description: "Run only the Windows job, every sample from Git Bash with MSYS_NO_PATHCONV=1, instead of the Linux matrix (run_mode and arch do not apply)"
+      platform:
+        description: "Where the selected tests run: Linux, Windows (from Git Bash with MSYS_NO_PATHCONV=1, on amd64), or all (both, in parallel jobs of the same run)"
         required: false
-        type: boolean
-        default: false
+        type: choice
+        options:
+          - Windows
+          - Linux
+          - all
+        default: Linux
 
 # Defaults for pull_request events (change DEFAULT_RUN_MODE to 'changed' to only run affected tests)
 env:
@@ -66,19 +70,18 @@ jobs:
           # Untrusted dispatch inputs routed via env, not interpolated into the shell (template-injection)
           RUN_MODE_INPUT: ${{ github.event.inputs.run_mode }}
           ARCH_INPUT: ${{ github.event.inputs.arch }}
-          WINDOWS_INPUT: ${{ github.event.inputs.windows }}
+          PLATFORM_INPUT: ${{ github.event.inputs.platform }}
         run: |
-          # Pick run mode and architecture: manual dispatch uses the dropdowns, PRs use the env defaults.
-          # A manual run with the windows input runs every sample on amd64, the architecture of the Windows runner.
-          if [[ "${{ github.event_name }}" == "workflow_dispatch" && "${WINDOWS_INPUT}" == "true" ]]; then
-            RUN_MODE=all
-            ARCH=amd64
-          elif [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+          # Pick run mode, architecture and platform: manual dispatch uses the dropdowns, PRs use the env
+          # defaults and run on Linux alone.
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
             RUN_MODE="${RUN_MODE_INPUT}"
             ARCH="${ARCH_INPUT}"
+            PLATFORM="${PLATFORM_INPUT}"
           else
             RUN_MODE="${{ env.DEFAULT_RUN_MODE }}"
             ARCH="${{ env.DEFAULT_ARCH }}"
+            PLATFORM=Linux
           fi
 
           # In "changed" mode, determine the base commit to diff against
@@ -91,14 +94,19 @@ jobs:
             fi
           fi
 
-          .github/scripts/build-matrix.sh "$RUN_MODE" "$BASE_SHA" "$ARCH"
+          .github/scripts/build-matrix.sh "$RUN_MODE" "$BASE_SHA" "$ARCH" "$PLATFORM"
 
-  # Each test runs in its own job — one matrix entry per test/architecture from the setup job
+  # Each test runs in its own job: one matrix entry per test and platform from the setup job, a Linux test on
+  # each architecture it supports. A Windows entry runs the sample from Git Bash with MSYS_NO_PATHCONV=1 set as
+  # the README asks Windows users to do. The emulator is a Linux image and Docker on the Windows runner runs Windows
+  # containers, so there the emulator runs in Docker Engine inside a WSL 2 distribution on the same runner; the
+  # Windows docker CLI and lstk reach that engine over TCP, which WSL forwards to the runner's localhost, and the
+  # samples reach the emulator the same way. A step runs on both platforms unless its condition names one.
   scripts:
     name: "Test: ${{ matrix.name }}"
     needs: setup
-    # Skip entirely when no tests match, and on a manual run with the windows input, which runs the Windows job instead
-    if: needs.setup.outputs.has_tests == 'true' && !(github.event_name == 'workflow_dispatch' && inputs.windows)
+    # Skip entirely when no tests match
+    if: needs.setup.outputs.has_tests == 'true'
     environment: AZURE
     strategy:
       fail-fast: false
@@ -106,21 +114,27 @@ jobs:
     # A sample takes ~10-25 minutes; the bound covers a retry and stops a hung deployment from
     # holding a runner for GitHub's 6-hour default.
     timeout-minutes: 90
-    # ubuntu-22.04 for amd64, ubuntu-22.04-arm for arm64 — the matrix carries the label.
-    # GitHub-hosted arm64 runners are free for public repositories.
+    # ubuntu-22.04 for amd64, ubuntu-22.04-arm for arm64 and windows-latest for Windows: the matrix carries the
+    # label. GitHub-hosted arm64 runners are free for public repositories.
     runs-on: ${{ matrix.runner }}
 
     permissions:
       contents: read
 
+    defaults:
+      run:
+        # Git Bash on Windows, whose default shell is PowerShell
+        shell: bash
+
     env:
       IMAGE_NAME: localstack/localstack-azure
       DEFAULT_TAG: latest
       # lstk finds the container daemon on its own, and lstk 0.20.0 picked the socket of a
       # co-installed Podman instead of Docker's, then reported the running emulator as absent
       # (fixed in 0.20.1, localstack/lstk#422). DOCKER_HOST always wins over that detection,
-      # so every lstk call in this job talks to the Docker daemon the emulator runs on.
-      DOCKER_HOST: unix:///var/run/docker.sock
+      # so every lstk call in this job talks to the Docker daemon the emulator runs on: on Windows,
+      # the Docker Engine in WSL 2, which the Windows docker CLI and lstk reach over TCP.
+      DOCKER_HOST: ${{ matrix.os == 'windows' && 'tcp://127.0.0.1:2375' || 'unix:///var/run/docker.sock' }}
 
     steps:
       - name: Checkout repo
@@ -129,22 +143,26 @@ jobs:
           persist-credentials: false
 
       - name: Set up environment
+        if: matrix.os == 'linux'
         env:
           RUNNER_TEMP_DIR: ${{ runner.temp }}
         run: echo "AZURE_CONFIG_DIR=${RUNNER_TEMP_DIR}/azure-cli" >> "$GITHUB_ENV"
 
       - name: Set up Python
+        if: matrix.os == 'linux'
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: '3.12'
           cache: 'pip'
 
       - name: Set up .NET
+        if: matrix.os == 'linux'
         uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
         with:
           dotnet-version: '10.0'
 
       - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        if: matrix.os == 'linux'
         with:
           distribution: 'temurin'
           java-version: '25'
@@ -159,6 +177,7 @@ jobs:
         # postgresql-client: provides the `psql` CLI used by the PostgreSQL flexible-server and the
         #   App Configuration samples to create the application role and seed the database schema
         #   in the local emulator.
+        if: matrix.os == 'linux'
         run: |
           sudo apt-get update
           sudo apt-get install -y jq zip unixodbc-dev libsnappy-dev default-mysql-client postgresql-client
@@ -171,9 +190,11 @@ jobs:
         # mysql_flexible/apis/firewall_rules.py). Remove this pin once the released
         # emulator image parses the az 2.89 request shape. Both runner arches are
         # jammy, so one version string covers amd64 and arm64.
+        if: matrix.os == 'linux'
         run: sudo apt-get install -y --allow-downgrades azure-cli
 
       - name: Install Terraform
+        if: matrix.os == 'linux'
         uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
         with:
           terraform_version: "1.5.0"
@@ -182,6 +203,7 @@ jobs:
       - name: Install test dependencies
         # Mirroring the localstack-pro approach: install all Python dependencies
         # into a virtual environment to avoid system-level conflicts.
+        if: matrix.os == 'linux'
         run: make install
 
       - name: Install lstk CLI
@@ -191,6 +213,7 @@ jobs:
         # Pinned, like every action in this workflow: an unpinned install means an upstream
         # release lands in every run at once, with no commit to point at when things break.
         # Bump deliberately.
+        if: matrix.os == 'linux'
         env:
           LSTK_VERSION: "1.4.0"
         run: |
@@ -212,6 +235,7 @@ jobs:
       - name: Login to Docker Hub
         # Mandatory login to Docker Hub to benefit from higher rate limits for authenticated pulls.
         # This prevents '429 Too Many Requests' errors during the pull of large emulator images.
+        if: matrix.os == 'linux'
         uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           username: ${{ secrets.DOCKERHUB_PULL_USERNAME }}
@@ -220,6 +244,7 @@ jobs:
       - name: Free up disk space
         # Azure emulator images are large. Pruning unused Docker objects ensures enough
         # disk space is available on the GitHub runner for image pulls and sidecar containers.
+        if: matrix.os == 'linux'
         run: |
           docker system prune -af --volumes
           docker builder prune -af
@@ -227,6 +252,7 @@ jobs:
       - name: Pull LocalStack Azure Image
         # Explicitly pull the image before starting. This mirrors the "Build Docker Image"
         # step in localstack-pro and ensures the pull logic is separated from the start logic.
+        if: matrix.os == 'linux'
         run: docker pull ${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}
 
       - name: Start LocalStack
@@ -235,6 +261,7 @@ jobs:
         # code 55 - lstk prints the last lines of its output, so the reason shows up in this step.
         # A healthy emulator answers within seconds, so the generous timeout costs nothing on the
         # happy path. A start that fails or never becomes ready is retried on a fresh container.
+        if: matrix.os == 'linux'
         run: |
           attempts=3
           for attempt in $(seq 1 "${attempts}"); do
@@ -280,7 +307,7 @@ jobs:
         # initialize and verify the database schema in the local emulator.
         # amd64 only: the sample is backed by mcr.microsoft.com/mssql/server, which has
         # no arm64 image, so it never runs on the arm64 runners.
-        if: matrix.arch == 'amd64'
+        if: matrix.os == 'linux' && matrix.arch == 'amd64'
         run: |
           sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
           curl https://packages.microsoft.com/keys/microsoft.asc | sudo tee /etc/apt/trusted.gpg.d/microsoft.asc
@@ -297,6 +324,7 @@ jobs:
         # from a provisioning call, a slow container start) fails the whole sample - which is what
         # has been needing manual job re-runs. The retry step below decides this job's outcome, so a
         # genuinely broken sample still fails: it fails both attempts.
+        if: matrix.os == 'linux'
         continue-on-error: true
         run: make test SHARD="${SHARD}" SPLITS="${SPLITS}"
         env:
@@ -311,7 +339,7 @@ jobs:
         # retry runs against a fresh emulator instead of the half-provisioned state the failed
         # attempt left behind. run-samples.sh also discards the Terraform state that attempt left,
         # which no longer matches anything in the fresh emulator.
-        if: steps.initial_run.outcome == 'failure'
+        if: matrix.os == 'linux' && steps.initial_run.outcome == 'failure'
         run: |
           echo "::warning::${MATRIX_NAME} failed once; retrying on a fresh emulator."
           lstk stop --non-interactive || true
@@ -342,7 +370,7 @@ jobs:
         # The Start and Retry steps keep a copy of every emulator's logs, so a retried job shows the
         # emulator that failed as well as the one that ran the retry, and a container that removed
         # itself on exit still has its logs. make logs covers a job where no emulator came up.
-        if: always()
+        if: always() && matrix.os == 'linux'
         run: |
           if [ -s "${RUNNER_TEMP}/localstack-azure.log" ]; then
             cat "${RUNNER_TEMP}/localstack-azure.log"
@@ -350,47 +378,23 @@ jobs:
             make logs
           fi
 
-  # Runs every sample on Windows, from Git Bash with MSYS_NO_PATHCONV=1 set as the README asks Windows users to do,
-  # on manual runs with the windows input only. The emulator is a Linux image and Docker on the Windows runner runs
-  # Windows containers, so the emulator runs in Docker Engine inside a WSL 2 distribution on the same runner; the
-  # Windows docker CLI and lstk reach that engine over TCP, which WSL forwards to the runner's localhost, and the
-  # samples reach the emulator the same way.
-  windows:
-    name: "Windows (Git Bash): ${{ matrix.name }}"
-    needs: setup
-    if: github.event_name == 'workflow_dispatch' && inputs.windows && needs.setup.outputs.has_tests == 'true'
-    environment: AZURE
-    runs-on: windows-latest
-    timeout-minutes: 90
-    permissions:
-      contents: read
-    strategy:
-      fail-fast: false
-      # Every sample: on a manual run with the windows input, the setup job selects all of them, on amd64
-      matrix: ${{ fromJSON(needs.setup.outputs.matrix) }}
-    defaults:
-      run:
-        shell: bash
-    env:
-      IMAGE: localstack/localstack-azure:latest
-      # The Docker Engine in WSL 2, for the Windows docker CLI and lstk
-      DOCKER_HOST: tcp://127.0.0.1:2375
-      # What the README asks Windows users of Git Bash and MSYS2 to export
-      MSYS_NO_PATHCONV: "1"
-      # A virtual environment on Windows has python.exe but no python3
-      PYTHON_BIN: python
-
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
+      - name: Set the Windows environment
+        # What the README asks Windows users of Git Bash and MSYS2 to export, the image the steps below start
+        # with the docker CLI, and the interpreter a virtual environment on Windows has: python.exe, no python3
+        if: matrix.os == 'windows'
+        run: |
+          {
+            echo "MSYS_NO_PATHCONV=1"
+            echo "IMAGE=localstack/localstack-azure:latest"
+            echo "PYTHON_BIN=python"
+          } >> "$GITHUB_ENV"
 
       - name: Drop the carriage returns of Windows programs
         # The README asks Windows users for `set -o igncr` and `export SHELLOPTS`, so that the bash of Git Bash
         # and MSYS2 drops the carriage returns the Azure CLI and jq print from $(...) and read. Exporting
         # SHELLOPTS here would also hand each step's own -e and pipefail to the sample scripts, so every bash
         # turns the option on through BASH_ENV instead; a bash without the option skips the line.
+        if: matrix.os == 'windows'
         run: |
           printf '(set -o igncr) 2>/dev/null && set -o igncr\n' > "$RUNNER_TEMP/igncr.sh"
           echo "BASH_ENV=$(cygpath -m "$RUNNER_TEMP/igncr.sh")" >> "$GITHUB_ENV"
@@ -402,6 +406,7 @@ jobs:
         # DNS tunneling, on by default, answers DNS for WSL itself, but the containers of the Docker Engine
         # in WSL cannot reach its 10.255.255.254 resolver, so their lookups time out; without it, WSL
         # hands out the NAT device on the host, which containers reach too.
+        if: matrix.os == 'windows'
         shell: pwsh
         run: |
           Set-Content -Path "$env:USERPROFILE\.wslconfig" -Value "[wsl2]`nmemory=12GB`ndnsTunneling=false`n`n[general]`ninstanceIdleTimeout=-1"
@@ -409,6 +414,7 @@ jobs:
 
       - name: Set up Ubuntu in WSL 2
         id: wsl
+        if: matrix.os == 'windows'
         uses: Vampire/setup-wsl@d1da7f2c0322a5ee4f24975344f67fc0f5baf364 # v7.0.0
         with:
           distribution: Ubuntu-24.04
@@ -422,6 +428,7 @@ jobs:
         # is what the emulator container mounts to start its backing containers; the TCP endpoint, bound
         # to localhost, is what WSL forwards to Windows for the docker CLI and lstk. The wait asks the TCP
         # endpoint, so the step fails when that daemon did not start.
+        if: matrix.os == 'windows'
         shell: wsl-bash {0}
         run: |
           if [ -d /run/systemd/system ]; then
@@ -447,9 +454,11 @@ jobs:
             --format 'Docker {{.ServerVersion}} on {{.OperatingSystem}}, kernel {{.KernelVersion}}'
 
       - name: Check that the Windows docker CLI reaches it
+        if: matrix.os == 'windows'
         run: docker version
 
       - name: Login to Docker Hub
+        if: matrix.os == 'windows'
         uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           username: ${{ secrets.DOCKERHUB_PULL_USERNAME }}
@@ -461,6 +470,7 @@ jobs:
         # MSYS_NO_PATHCONV keeps Git Bash from rewriting. run-samples.sh's own `lstk start` then finds the
         # running container by its name, localstack-azure, and leaves it alone. The script stays in
         # RUNNER_TEMP for the retry, which starts a fresh emulator the same way.
+        if: matrix.os == 'windows'
         env:
           LOCALSTACK_AUTH_TOKEN: ${{ secrets.TEST_LOCALSTACK_AUTH_TOKEN }}
           GITHUB_API_TOKEN: ${{ github.token }}
@@ -495,6 +505,7 @@ jobs:
         # ("'C:\Program' is not recognized"), so `lstk az start-interception` (lstk 1.4.0) fails wherever the
         # Azure CLI sits in its default folder. A junction without spaces, first on the PATH, works around it
         # until lstk passes the JSON another way; Git Bash runs the same Azure CLI through it.
+        if: matrix.os == 'windows'
         shell: pwsh
         run: |
           $cliDir = Split-Path -Parent (Split-Path -Parent (Get-Command az.cmd).Source)
@@ -503,20 +514,24 @@ jobs:
 
       - name: Install lstk CLI
         # The release the Linux job pins
+        if: matrix.os == 'windows'
         run: npm install -g @localstack/lstk@1.4.0
 
       - name: Set up Python
+        if: matrix.os == 'windows'
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: '3.12'
 
       - name: Set up .NET
+        if: matrix.os == 'windows'
         uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
         with:
           dotnet-version: '10.0'
 
       - name: Set up Java
         # The Service Bus sample builds its Java app with Maven, which the runner image ships
+        if: matrix.os == 'windows'
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: 'temurin'
@@ -524,6 +539,7 @@ jobs:
 
       - name: Install Terraform
         # run-samples.sh refuses to start without it, whichever sample it runs
+        if: matrix.os == 'windows'
         uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
         with:
           terraform_version: "1.5.0"
@@ -532,6 +548,7 @@ jobs:
       - name: Install zip from MSYS2
         # The samples package apps with zip, which Git Bash does not ship. The runner image has MSYS2, whose
         # zip, like a zip.exe built for Windows, opens the C:/... paths the scripts hand it.
+        if: matrix.os == 'windows'
         shell: pwsh
         run: C:\msys64\usr\bin\bash.exe -lc 'pacman -Sy --noconfirm --needed zip'
 
@@ -539,6 +556,7 @@ jobs:
         # zip runs from MSYS2's own folder, next to the libraries it was built with. psql comes with the
         # PostgreSQL the runner image installs off the PATH; mysql is on it already. sqlcmd, which the Azure
         # SQL Database sample seeds its database with, is the Go sqlcmd release, pinned with its SHA-256.
+        if: matrix.os == 'windows'
         env:
           SQLCMD_VERSION: v1.10.0
           SQLCMD_SHA256: a4c28332fcc6e497d655e53ac8f4939f4ab170f9cfd32d0fa5081b60f4d9d691
@@ -554,6 +572,7 @@ jobs:
           echo "$PGBIN" >> "$GITHUB_PATH"
 
       - name: Show the tool versions
+        if: matrix.os == 'windows'
         run: |
           zip -v | sed -n 2p
           psql --version
@@ -568,6 +587,7 @@ jobs:
           unzip -v | sed -n 1p
 
       - name: Install the Python dependencies
+        if: matrix.os == 'windows'
         run: |
           python -m venv .venv
           .venv/Scripts/python -m pip install --upgrade pip setuptools wheel
@@ -576,9 +596,10 @@ jobs:
       - name: "Run: ${{ matrix.name }}"
         # run-samples.sh routes az to the emulator with `lstk az start-interception`, as on Linux, and runs exactly
         # this sample: SPLITS is the number of samples and SHARD its 1-based position among them.
-        id: initial_run
+        id: windows_initial_run
         # As in the Linux job, a transient error fails a sample now and then, so a failure is retried once on a
         # fresh emulator, and the retry decides the job's outcome: a sample that is really broken fails both.
+        if: matrix.os == 'windows'
         continue-on-error: true
         env:
           SHARD: ${{ matrix.shard }}
@@ -591,7 +612,7 @@ jobs:
       - name: "Retry: ${{ matrix.name }}"
         # The first emulator's logs are kept for the Get LocalStack Logs step. Removing every container also
         # removes the backing containers the first emulator started, which the fresh one would collide with.
-        if: steps.initial_run.outcome == 'failure'
+        if: matrix.os == 'windows' && steps.windows_initial_run.outcome == 'failure'
         env:
           MATRIX_NAME: ${{ matrix.name }}
           SHARD: ${{ matrix.shard }}
@@ -607,7 +628,7 @@ jobs:
           bash ./run-samples.sh "$SHARD" "$SPLITS"
 
       - name: Get LocalStack Logs
-        if: always()
+        if: always() && matrix.os == 'windows'
         run: |
           if [ -s "$RUNNER_TEMP/localstack-azure-first-attempt.log" ]; then
             echo "===== First attempt ====="
@@ -618,6 +639,6 @@ jobs:
 
       - name: Get the Docker Engine log
         # The wsl-bash shell exists only once WSL is set up
-        if: failure() && steps.wsl.outcome == 'success'
+        if: failure() && matrix.os == 'windows' && steps.wsl.outcome == 'success'
         shell: wsl-bash {0}
         run: tail -n 100 /var/log/dockerd.log || true

From 4b36a9c83a25e554e10fa363a8f2d033dfb75425 Mon Sep 17 00:00:00 2001
From: Paolo Salvatori <leprino@hotmail.com>
Date: Mon, 26 Oct 2026 16:03:08 +0100
Subject: [PATCH 18/18] Run the custom-image Terraform sample's push script
 with bash, so it also works on Windows

Terraform's local-exec hands its command to cmd.exe on Windows, and cmd.exe cannot run
./push_image.sh ("'.' is not recognized as an internal or external command"), so the Terraform
variants of web-app-custom-image never pushed their image from Git Bash. interpreter = ["bash"]
runs the script with bash everywhere; Linux and macOS behave as before.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DhZ2ojsEXd2SGMo7s9uiZh
---
 samples/web-app-custom-image/dotnet/terraform/main.tf | 4 +++-
 samples/web-app-custom-image/python/terraform/main.tf | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/samples/web-app-custom-image/dotnet/terraform/main.tf b/samples/web-app-custom-image/dotnet/terraform/main.tf
index ae6ad62..8de1402 100644
--- a/samples/web-app-custom-image/dotnet/terraform/main.tf
+++ b/samples/web-app-custom-image/dotnet/terraform/main.tf
@@ -177,7 +177,9 @@ resource "null_resource" "push_image" {
   count = (var.image_name != null && var.image_name != "" && var.image_tag != null && var.image_tag != "") ? 1 : 0
 
   provisioner "local-exec" {
-    command = "${path.root}/push_image.sh"
+    # Run the script with bash everywhere: on Windows, Terraform would otherwise hand it to cmd.exe, which cannot run it
+    command     = "${path.root}/push_image.sh"
+    interpreter = ["bash"]
     environment = {
       ACR_NAME         = local.acr_name
       ACR_LOGIN_SERVER = module.container_registry.login_server
diff --git a/samples/web-app-custom-image/python/terraform/main.tf b/samples/web-app-custom-image/python/terraform/main.tf
index ae6ad62..8de1402 100644
--- a/samples/web-app-custom-image/python/terraform/main.tf
+++ b/samples/web-app-custom-image/python/terraform/main.tf
@@ -177,7 +177,9 @@ resource "null_resource" "push_image" {
   count = (var.image_name != null && var.image_name != "" && var.image_tag != null && var.image_tag != "") ? 1 : 0
 
   provisioner "local-exec" {
-    command = "${path.root}/push_image.sh"
+    # Run the script with bash everywhere: on Windows, Terraform would otherwise hand it to cmd.exe, which cannot run it
+    command     = "${path.root}/push_image.sh"
+    interpreter = ["bash"]
     environment = {
       ACR_NAME         = local.acr_name
       ACR_LOGIN_SERVER = module.container_registry.login_server