From 10b86336e51c1320c108165028182ff3226bc92e Mon Sep 17 00:00:00 2001 From: Jeff Musgrave <1578618+JeffMusgrave@users.noreply.github.com> Date: Fri, 16 Oct 2026 23:06:11 +0000 Subject: [PATCH 1/2] Recognize pinned tools on Windows and cover the installed Rust release in CI Windows reports no execute permission bits, so the OSV-Scanner, ty and Python tool checks rejected installed tools and the 0.29.0-beta.1 Windows release build failed. Run the installed Rust fixture in ordinary Windows CI so release tags no longer carry its first execution. Prepare 0.29.0-beta.2. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 24 ++++++++++++++++++++++++ CHANGELOG.md | 9 +++++++++ VERSION | 2 +- internal/policymodule/toolpacks.go | 15 +++++++++------ internal/supplychain/supplychain.go | 3 ++- 5 files changed, 45 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5a1ab62a..7258d894 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -202,6 +202,30 @@ jobs: shell: pwsh run: .\tools\install-policy-tools.ps1 + - name: Exercise the installed native Rust release + shell: pwsh + run: | + $ErrorActionPreference = 'Stop' + Set-StrictMode -Version Latest + .\tools\initialize-windows-sdk.ps1 + $version = (Get-Content -LiteralPath VERSION -Raw).Trim() + $publicationDir = Join-Path $env:RUNNER_TEMP 'rust-publication' + .\scripts\build-release.ps1 -Output (Join-Path $env:RUNNER_TEMP 'rust-release.zip') -PublicationDirectory $publicationDir + $archive = Join-Path $publicationDir "code-polishy-$version-windows-x64.zip" + $descriptor = Join-Path $publicationDir "code-polishy-$version-windows-x64.release.json" + $archiveSha = [string](Get-Content -LiteralPath $descriptor -Raw | ConvertFrom-Json).archive.sha256 + $inspection = Join-Path $env:RUNNER_TEMP 'rust-release-inspection' + $installation = Join-Path $env:RUNNER_TEMP 'rust-release-installation' + Expand-Archive -LiteralPath $archive -DestinationPath $inspection + & (Join-Path $inspection 'bin\code-polishy.exe') --policy-root $inspection install-bundle --source $archive --sha256 $archiveSha --prefix $installation + if ($LASTEXITCODE -ne 0) { throw 'The fresh release installation failed.' } + $installedEngines = @(Get-ChildItem -LiteralPath (Join-Path $installation 'releases') -Filter 'code-polishy.exe' -File -Recurse) + if ($installedEngines.Count -ne 1) { throw 'The fresh installation did not contain exactly one release engine.' } + $installedRoot = Split-Path -Parent (Split-Path -Parent $installedEngines[0].FullName) + $bash = Join-Path $env:ProgramFiles 'Git\bin\bash.exe' + & $bash ./scripts/test-installed-release-rust.sh $installedRoot (Join-Path $installation 'bin\code-polishy.exe') (Join-Path $publicationDir "code-polishy-$version-rust-windows-x64.zip") + if ($LASTEXITCODE -ne 0) { throw 'The installed Rust fixture failed.' } + - name: Compile all Go packages and run native Windows contracts shell: pwsh run: | diff --git a/CHANGELOG.md b/CHANGELOG.md index b0d8e386..fe43d50b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,15 @@ ## Unreleased +## 0.29.0-beta.2 - 2026-10-16 + +- Recognize pinned OSV-Scanner, ty and Python tools on Windows, where files + carry no execute permission bits. Windows Cargo, Python and dependency + policy no longer reports installed tools as missing; the 0.29.0-beta.1 tag + was not published because its Windows release build failed this check. +- Exercise the installed native Rust release on Windows in ordinary CI before + a release tag depends on it. + ## 0.29.0-beta.1 - 2026-10-15 - Add native Rust beta support for contained Cargo projects: discovery, diff --git a/VERSION b/VERSION index f735712f..443690c1 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -0.29.0-beta.1 +0.29.0-beta.2 diff --git a/internal/policymodule/toolpacks.go b/internal/policymodule/toolpacks.go index 590f21eb..c4c9a7f1 100644 --- a/internal/policymodule/toolpacks.go +++ b/internal/policymodule/toolpacks.go @@ -3,6 +3,7 @@ package policymodule import ( "context" "os" + "runtime" "slices" "sort" "strings" @@ -158,9 +159,13 @@ func modulesForPythonFiles(repo repository.Repository, files []string) []string return slices.Compact(modules) } -func executableVersion(path string, acceptedLines ...string) bool { +func executableFile(path string) bool { info, err := os.Stat(path) - if err != nil || !info.Mode().IsRegular() || info.Mode()&0o111 == 0 { + return err == nil && info.Mode().IsRegular() && (runtime.GOOS == "windows" || info.Mode()&0o111 != 0) +} + +func executableVersion(path string, acceptedLines ...string) bool { + if !executableFile(path) { return false } output, err := runner.ToolOutput(path, "--version") @@ -176,8 +181,7 @@ func executableVersion(path string, acceptedLines ...string) bool { } func tyExecutableVersion(path, pin string) bool { - info, err := os.Stat(path) - if err != nil || !info.Mode().IsRegular() || info.Mode()&0o111 == 0 { + if !executableFile(path) { return false } output, err := runner.ToolOutput(path, "--version") @@ -213,8 +217,7 @@ func vultureRuntimeVersion(repo repository.Repository, pin string) bool { func pythonRuntimeOutput(repo repository.Repository, source string) string { command := repo.PythonCommand(source) path := command[0] - info, err := os.Stat(path) - if err != nil || !info.Mode().IsRegular() || info.Mode()&0o111 == 0 { + if !executableFile(path) { return "" } _, output, err := (runner.OSRunner{}).RunStructured(context.Background(), repo.Root, policy.Command{ diff --git a/internal/supplychain/supplychain.go b/internal/supplychain/supplychain.go index c5456208..d9a3198b 100644 --- a/internal/supplychain/supplychain.go +++ b/internal/supplychain/supplychain.go @@ -9,6 +9,7 @@ import ( "os" "path/filepath" "regexp" + "runtime" "slices" "sort" "strings" @@ -964,7 +965,7 @@ func safeName(value string) string { func isExecutable(path string) bool { info, err := os.Stat(path) - return err == nil && info.Mode().IsRegular() && info.Mode()&0o111 != 0 + return err == nil && info.Mode().IsRegular() && (runtime.GOOS == "windows" || info.Mode()&0o111 != 0) } func regularFile(path string) bool { From 5bca16e0fb3a73f8d93980bd1416321086e1de69 Mon Sep 17 00:00:00 2001 From: Jeff Musgrave <1578618+JeffMusgrave@users.noreply.github.com> Date: Sat, 17 Oct 2026 00:13:15 +0000 Subject: [PATCH 2/2] Keep the Visual Studio linker active in the Windows Rust fixture Git for Windows' bin\bash.exe launcher prepends its usr\bin directory, so the installed Rust fixture linked with coreutils link.exe instead of the linker the developer shell selected. Launch the fixture with usr\bin\bash.exe, which inherits PATH unchanged, and verify only the first link.exe on PATH. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 2 +- .github/workflows/release.yml | 2 +- tools/initialize-windows-sdk.ps1 | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7258d894..ac6115aa 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -222,7 +222,7 @@ jobs: $installedEngines = @(Get-ChildItem -LiteralPath (Join-Path $installation 'releases') -Filter 'code-polishy.exe' -File -Recurse) if ($installedEngines.Count -ne 1) { throw 'The fresh installation did not contain exactly one release engine.' } $installedRoot = Split-Path -Parent (Split-Path -Parent $installedEngines[0].FullName) - $bash = Join-Path $env:ProgramFiles 'Git\bin\bash.exe' + $bash = Join-Path $env:ProgramFiles 'Git\usr\bin\bash.exe' & $bash ./scripts/test-installed-release-rust.sh $installedRoot (Join-Path $installation 'bin\code-polishy.exe') (Join-Path $publicationDir "code-polishy-$version-rust-windows-x64.zip") if ($LASTEXITCODE -ne 0) { throw 'The installed Rust fixture failed.' } diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b097a295..5c883325 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -238,7 +238,7 @@ jobs: if ($LASTEXITCODE -ne 0 -or $reportedVersion -ne "code-polishy $env:RELEASE_VERSION") { throw "The fresh installation did not report Code Polishy $env:RELEASE_VERSION." } - $bash = Join-Path $env:ProgramFiles 'Git\bin\bash.exe' + $bash = Join-Path $env:ProgramFiles 'Git\usr\bin\bash.exe' if (-not (Test-Path -LiteralPath $bash -PathType Leaf)) { throw 'The native Rust fixture requires Git Bash.' } & $bash ./scripts/test-installed-release-rust.sh $installedRoot (Join-Path $installation 'bin\code-polishy.exe') (Join-Path $publicationDir "code-polishy-$env:RELEASE_VERSION-rust-$env:RELEASE_HOST.zip") if ($LASTEXITCODE -ne 0) { throw 'The installed Rust fixture failed.' } diff --git a/tools/initialize-windows-sdk.ps1 b/tools/initialize-windows-sdk.ps1 index 119c19d6..c99fd4c0 100644 --- a/tools/initialize-windows-sdk.ps1 +++ b/tools/initialize-windows-sdk.ps1 @@ -12,7 +12,7 @@ $developerShell = Join-Path $installation 'Common7\Tools\Launch-VsDevShell.ps1' if (-not $env:LIB -or -not $env:INCLUDE) { throw 'The Visual Studio developer shell did not initialize the native SDK libraries and headers.' } -$linker = (Get-Command link.exe -CommandType Application -ErrorAction Stop).Source +$linker = (Get-Command link.exe -CommandType Application -ErrorAction Stop | Select-Object -First 1).Source $installationPrefix = $installation.TrimEnd('\') + '\' if (-not $linker.StartsWith($installationPrefix, [System.StringComparison]::OrdinalIgnoreCase)) { throw "The active linker is outside the selected Visual Studio installation: $linker"