Recognize pinned tools on Windows for 0.29.0-beta.2

.github/workflows/ci.yml

@@ -202,6 +202,30 @@ jobs:
         shell: pwsh
         run: .\tools\install-policy-tools.ps1
 
+      - name: Exercise the installed native Rust release
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          Set-StrictMode -Version Latest
+          .\tools\initialize-windows-sdk.ps1
+          $version = (Get-Content -LiteralPath VERSION -Raw).Trim()
+          $publicationDir = Join-Path $env:RUNNER_TEMP 'rust-publication'
+          .\scripts\build-release.ps1 -Output (Join-Path $env:RUNNER_TEMP 'rust-release.zip') -PublicationDirectory $publicationDir
+          $archive = Join-Path $publicationDir "code-polishy-$version-windows-x64.zip"
+          $descriptor = Join-Path $publicationDir "code-polishy-$version-windows-x64.release.json"
+          $archiveSha = [string](Get-Content -LiteralPath $descriptor -Raw | ConvertFrom-Json).archive.sha256
+          $inspection = Join-Path $env:RUNNER_TEMP 'rust-release-inspection'
+          $installation = Join-Path $env:RUNNER_TEMP 'rust-release-installation'
+          Expand-Archive -LiteralPath $archive -DestinationPath $inspection
+          & (Join-Path $inspection 'bin\code-polishy.exe') --policy-root $inspection install-bundle --source $archive --sha256 $archiveSha --prefix $installation
+          if ($LASTEXITCODE -ne 0) { throw 'The fresh release installation failed.' }
+          $installedEngines = @(Get-ChildItem -LiteralPath (Join-Path $installation 'releases') -Filter 'code-polishy.exe' -File -Recurse)
+          if ($installedEngines.Count -ne 1) { throw 'The fresh installation did not contain exactly one release engine.' }
+          $installedRoot = Split-Path -Parent (Split-Path -Parent $installedEngines[0].FullName)
+          $bash = Join-Path $env:ProgramFiles 'Git\usr\bin\bash.exe'
+          & $bash ./scripts/test-installed-release-rust.sh $installedRoot (Join-Path $installation 'bin\code-polishy.exe') (Join-Path $publicationDir "code-polishy-$version-rust-windows-x64.zip")
+          if ($LASTEXITCODE -ne 0) { throw 'The installed Rust fixture failed.' }
+
       - name: Compile all Go packages and run native Windows contracts
         shell: pwsh
         run: |

.github/workflows/release.yml

@@ -238,7 +238,7 @@ jobs:
           if ($LASTEXITCODE -ne 0 -or $reportedVersion -ne "code-polishy $env:RELEASE_VERSION") {
             throw "The fresh installation did not report Code Polishy $env:RELEASE_VERSION."
           }
-          $bash = Join-Path $env:ProgramFiles 'Git\bin\bash.exe'
+          $bash = Join-Path $env:ProgramFiles 'Git\usr\bin\bash.exe'
           if (-not (Test-Path -LiteralPath $bash -PathType Leaf)) { throw 'The native Rust fixture requires Git Bash.' }
           & $bash ./scripts/test-installed-release-rust.sh $installedRoot (Join-Path $installation 'bin\code-polishy.exe') (Join-Path $publicationDir "code-polishy-$env:RELEASE_VERSION-rust-$env:RELEASE_HOST.zip")
           if ($LASTEXITCODE -ne 0) { throw 'The installed Rust fixture failed.' }

CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## Unreleased
 
+## 0.29.0-beta.2 - 2026-10-16
+
+- Recognize pinned OSV-Scanner, ty and Python tools on Windows, where files
+  carry no execute permission bits. Windows Cargo, Python and dependency
+  policy no longer reports installed tools as missing; the 0.29.0-beta.1 tag
+  was not published because its Windows release build failed this check.
+- Exercise the installed native Rust release on Windows in ordinary CI before
+  a release tag depends on it.
+
 ## 0.29.0-beta.1 - 2026-10-15
 
 - Add native Rust beta support for contained Cargo projects: discovery,

VERSION

@@ -1 +1 @@
-0.29.0-beta.1
+0.29.0-beta.2

internal/policymodule/toolpacks.go

@@ -3,6 +3,7 @@ package policymodule
 import (
 	"context"
 	"os"
+	"runtime"
 	"slices"
 	"sort"
 	"strings"
@@ -158,9 +159,13 @@ func modulesForPythonFiles(repo repository.Repository, files []string) []string
 	return slices.Compact(modules)
 }
 
-func executableVersion(path string, acceptedLines ...string) bool {
+func executableFile(path string) bool {
 	info, err := os.Stat(path)
-	if err != nil || !info.Mode().IsRegular() || info.Mode()&0o111 == 0 {
+	return err == nil && info.Mode().IsRegular() && (runtime.GOOS == "windows" || info.Mode()&0o111 != 0)
+}
+
+func executableVersion(path string, acceptedLines ...string) bool {
+	if !executableFile(path) {
 		return false
 	}
 	output, err := runner.ToolOutput(path, "--version")
@@ -176,8 +181,7 @@ func executableVersion(path string, acceptedLines ...string) bool {
 }
 
 func tyExecutableVersion(path, pin string) bool {
-	info, err := os.Stat(path)
-	if err != nil || !info.Mode().IsRegular() || info.Mode()&0o111 == 0 {
+	if !executableFile(path) {
 		return false
 	}
 	output, err := runner.ToolOutput(path, "--version")
@@ -213,8 +217,7 @@ func vultureRuntimeVersion(repo repository.Repository, pin string) bool {
 func pythonRuntimeOutput(repo repository.Repository, source string) string {
 	command := repo.PythonCommand(source)
 	path := command[0]
-	info, err := os.Stat(path)
-	if err != nil || !info.Mode().IsRegular() || info.Mode()&0o111 == 0 {
+	if !executableFile(path) {
 		return ""
 	}
 	_, output, err := (runner.OSRunner{}).RunStructured(context.Background(), repo.Root, policy.Command{

internal/supplychain/supplychain.go

@@ -9,6 +9,7 @@ import (
 	"os"
 	"path/filepath"
 	"regexp"
+	"runtime"
 	"slices"
 	"sort"
 	"strings"
@@ -964,7 +965,7 @@ func safeName(value string) string {
 
 func isExecutable(path string) bool {
 	info, err := os.Stat(path)
-	return err == nil && info.Mode().IsRegular() && info.Mode()&0o111 != 0
+	return err == nil && info.Mode().IsRegular() && (runtime.GOOS == "windows" || info.Mode()&0o111 != 0)
 }
 
 func regularFile(path string) bool {

tools/initialize-windows-sdk.ps1

@@ -12,7 +12,7 @@ $developerShell = Join-Path $installation 'Common7\Tools\Launch-VsDevShell.ps1'
 if (-not $env:LIB -or -not $env:INCLUDE) {
   throw 'The Visual Studio developer shell did not initialize the native SDK libraries and headers.'
 }
-$linker = (Get-Command link.exe -CommandType Application -ErrorAction Stop).Source
+$linker = (Get-Command link.exe -CommandType Application -ErrorAction Stop | Select-Object -First 1).Source
 $installationPrefix = $installation.TrimEnd('\') + '\'
 if (-not $linker.StartsWith($installationPrefix, [System.StringComparison]::OrdinalIgnoreCase)) {
   throw "The active linker is outside the selected Visual Studio installation: $linker"