ci(windows): run Windows MSVC tests on every PR and seed the cache from main

Prior to this change, the Windows MSVC lint and test job ran only on
pull-request mirrors labeled test:windows. Most PRs never ran it, and
main broke on Windows across five PRs before an unrelated labeled PR
exposed 15 failing tests (#4861). The job also ran cold every time: the
cache-seed job ran only on pushes to the windows branch, and GitHub
scopes caches by branch, so pull-request mirrors could never restore
that cache. Rust cache hits were 0% and each run took about 40 minutes.

Now, every pull-request mirror runs the Windows lint and test job
without a label. Pushes to main run the cache-seed job, which reports
failures normally there, so a Windows break on main shows up within one
merge. Main runs are not cancelled by later pushes, so each seed
finishes. Pull-request runs restore the main cache but no longer save
their own, since no other branch can restore it and saving it only
evicts the main cache. Release-binary builds stay on the windows
branch. The checks remain non-required for merging.

CI.md, the Windows build skill, the principal engineer reviewer agent,
and the gator gate skill no longer refer to the test:windows label.

Signed-off-by: Kris Hicks <khicks@nvidia.com>

Author: krishicks

.agents/skills/build-openshell-mxc-windows/SKILL.md

@@ -204,16 +204,16 @@ order:
 The GitHub Actions jobs layer architecture-specific `Swatinem/rust-cache`
 entries for Cargo registry and dependency target artifacts with sccache's GHA
 backend for cacheable Rust compiler outputs. Failed runs also save their usable
-dependency artifacts. Pull-request mirrors labeled `test:windows` run Clippy for the
-Windows-supported workspace and e2e crates plus Rust tests. Pushes to `windows` and
-manual dispatches on that branch run the same lint and test commands in a cache-seed job,
-followed by a dependent release-binary build job. The seed and PR jobs use the
-same cache namespaces, but pull-request mirrors cannot restore the
-`windows` branch cache because GitHub scopes caches by branch. Merge queues do
-not run this workflow. Release-branch seed
-and build jobs use job-level `continue-on-error: true`; opt-in PR jobs report
-failures normally. Applying the label alone does not start a run: re-run all
-jobs in the current mirror push run, or push a new mirrored commit. The binaries are not uploaded or published.
+dependency artifacts. Every pull-request mirror runs Clippy for the
+Windows-supported workspace and e2e crates plus Rust tests. Pushes to `main` and
+`windows` run the same lint and test commands in a cache-seed job; `windows`
+pushes and manual dispatches on that branch follow it with a dependent
+release-binary build job. GitHub scopes caches by branch, so pull-request
+mirrors restore the `main` cache and do not save their own. `main` runs are not
+cancelled by later pushes, so each seed finishes. Merge queues do not run this
+workflow. Release-branch seed and build jobs use job-level
+`continue-on-error: true`; `main` seed and PR jobs report failures normally. The
+binaries are not uploaded or published.
 
 The ARM64 check/build steps in this x64-host contract are cross-builds. The
 wrapper discovers and adds host-native LLVM and Ninja to `PATH`, requires the

.claude/agents/principal-engineer-reviewer.md

@@ -61,7 +61,7 @@ When reviewing code or diffs:
 6. When suggesting a change, show the concrete fix — don't just describe it.
 7. If something is good, say so briefly. Positive signal is useful too.
 8. When behavior, commands, or development workflows change, consult the `sync-agent-infra` maintenance map and verify that related skills were updated. Apply its full consistency checklist when the changes add, remove, or rename skills or crates; change workflow relationships or skill coverage; modify issue or PR templates; or change agent cross-references. Report missing companion updates or drift as a warning.
-9. For pull request reviews, determine whether the changes affect Windows support. Changes to Windows or MSVC CI and `mise` tasks, Windows lock-file platform entries, the MXC driver, or `cfg(windows)` implementations and tests require the `test:windows` label. Report that requirement explicitly to the caller so the PR workflow can apply the label; label routing is review metadata, not a code-review finding.
+9. For pull request reviews, determine whether the changes affect Windows support. Changes to Windows or MSVC CI and `mise` tasks, Windows lock-file platform entries, the MXC driver, or `cfg(windows)` implementations and tests require passing x64 and ARM64 `Windows MSVC` checks, which run on every PR but are not required for merging. Report that requirement explicitly to the caller; check routing is review metadata, not a code-review finding.
 10. When the task includes a prior review feedback ledger, treat trusted resolved
    or explicitly waived findings as durable across later revisions. Do not
    re-raise the same finding with different wording unless the new diff

.github/workflows/windows-msvc.yml

@@ -3,6 +3,7 @@ name: Windows MSVC
 on:
   push:
     branches:
+      - main
       - windows
       - "pull-request/[0-9]+"
   workflow_dispatch:
@@ -12,7 +13,8 @@ permissions:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  # Let main runs finish so they seed the cache that pull-request mirrors restore.
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
 env:
   # sccache cannot cache incremental Rust compilations, and rust-cache removes
@@ -27,21 +29,20 @@ jobs:
       contents: read
       pull-requests: read
     outputs:
-      should_run: ${{ github.ref == 'refs/heads/windows' || steps.gate.outputs.should_run == 'true' }}
+      should_run: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/windows' || steps.gate.outputs.should_run == 'true' }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - id: gate
-        if: github.ref != 'refs/heads/windows'
+        if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/windows'
         uses: ./.github/actions/pr-gate
-        with:
-          required_label: test:windows
 
   pr-check:
     name: PR lint and test (${{ matrix.arch }})
     needs: pr_metadata
     if: >-
       needs.pr_metadata.outputs.should_run == 'true' &&
+      github.ref != 'refs/heads/main' &&
       github.ref != 'refs/heads/windows' &&
       github.event_name != 'workflow_dispatch'
     strategy:
@@ -92,7 +93,9 @@ jobs:
         with:
           shared-key: windows-msvc-${{ matrix.arch }}
           cache-targets: "true"
-          cache-on-failure: "true"
+          # Other mirrors cannot restore this branch's cache, so saving it only
+          # evicts the main cache they do restore.
+          save-if: "false"
           cache-bin: "false"
       - name: Lint Windows-supported crates
         run: mise run --skip-tools windows:lint:${{ matrix.arch }}
@@ -105,11 +108,11 @@ jobs:
   cache-seed:
     name: Seed cache (${{ matrix.arch }})
     # Keep release-branch Windows validation advisory while the lane matures.
-    continue-on-error: true
+    continue-on-error: ${{ github.ref == 'refs/heads/windows' }}
     needs: pr_metadata
     if: >-
       needs.pr_metadata.outputs.should_run == 'true' &&
-      github.ref == 'refs/heads/windows'
+      (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/windows')
     strategy:
       fail-fast: false
       matrix:
@@ -156,7 +159,7 @@ jobs:
           cache-bin: "false"
       - name: Lint Windows-supported crates
         # Keep the seed workload identical to the pull-request workload so the
-        # windows-branch cache reflects the same lint and test commands.
+        # seeded cache reflects the same lint and test commands.
         run: mise run --skip-tools windows:lint:${{ matrix.arch }}
       - name: Test
         run: mise run --skip-tools windows:test:${{ matrix.arch }}
@@ -168,6 +171,7 @@ jobs:
     name: Build binaries (${{ matrix.arch }})
     continue-on-error: true
     needs: cache-seed
+    if: github.ref == 'refs/heads/windows'
     strategy:
       fail-fast: false
       matrix:

CI.md

@@ -67,11 +67,12 @@ For an intentional minor-train incompatibility, record the Buf finding,
 linked issue, consumer impact, and migration plan in the PR. Keep the finding
 visible; do not disable the job or add a broad Buf ignore rule.
 
-Windows PR checks are opt-in: add `test:windows`, then select **Re-run all jobs**
-on the current Windows MSVC run. Subsequent mirrored commits run them automatically.
-Windows checks are not required for merging and do not run in merge queues.
-Main and manual runs also build release binaries, with `continue-on-error: true`
-so Windows failures do not fail the workflow.
+Windows MSVC lint and tests run on every mirrored PR commit. They are not
+required for merging and do not run in merge queues. Pushes to `main` run the
+same lint and tests to seed the Rust caches that PR runs restore; PR runs do not
+save caches. Pushes to `windows` and manual runs on that branch also build
+release binaries, with `continue-on-error: true` so Windows failures do not fail
+the workflow.
 
 ### Advisory compatibility review
 

scripts/agents/gator/bin/review_feedback_ledger_test.sh

@@ -449,9 +449,9 @@ rg -q 'alone is not a process blocker' \
     "$GATOR_DIR/skills/gator-gate/SKILL.md"
 rg -q '`test_dispatch_required`' \
     "$GATOR_DIR/skills/gator-gate/SKILL.md"
-rg -q 'Apply `test:windows` whenever a PR affects Windows support' \
+rg -q 'treat both Windows checks as required gates' \
     "$GATOR_DIR/skills/gator-gate/SKILL.md"
-rg -q 'require the `test:windows` label' \
+rg -q 'require passing x64 and ARM64 `Windows MSVC` checks' \
     "$GATOR_DIR/../../../.claude/agents/principal-engineer-reviewer.md"
 rg -q 'attacker_or_operator_prerequisite' \
     "$GATOR_DIR/skills/gator-gate/references/review-findings-schema.md"

scripts/agents/gator/skills/gator-gate/SKILL.md

@@ -944,7 +944,7 @@ Use `test:e2e` for Helm, Agent Sandbox CRDs, Kubernetes scheduling, namespace, w
 
 Add `test:e2e-kubernetes` for gateway high availability or Kubernetes Secrets and Vault credential driver storage. It runs only the HA and credential-driver suites, so apply it alongside `test:e2e` when other Kubernetes coverage is also needed.
 
-Apply `test:windows` whenever a PR affects Windows support. This includes Windows or MSVC CI and `mise` tasks, Windows lock-file platform entries, the MXC driver, and `cfg(windows)` implementations or tests in otherwise cross-platform crates. Apply it alongside any applicable E2E label; it is not a substitute for runtime coverage.
+Windows MSVC checks run on every PR without a label. When a PR affects Windows support, treat both Windows checks as required gates. This includes Windows or MSVC CI and `mise` tasks, Windows lock-file platform entries, the MXC driver, and `cfg(windows)` implementations or tests in otherwise cross-platform crates. The Windows checks are not a substitute for runtime coverage.
 
 After applying a `test:*` label, read the bot comment that is posted by the E2E Label Help workflow and follow its instructions.
 
@@ -996,7 +996,7 @@ Required gates include at least:
 - `OpenShell / Trivy Changes`
 - `OpenShell / E2E` when `test:e2e` is applied
 - `OpenShell / GPU E2E` when `test:e2e-gpu` is applied
-- Both x64 and ARM64 `Windows MSVC / PR lint and test` checks when `test:windows` is applied
+- Both x64 and ARM64 `Windows MSVC / PR lint and test` checks when the PR affects Windows support
 
 If checks are pending, wait a reasonable interval and re-check.