From 2946c86e47f4e95a976602e951ff54665d073ac8 Mon Sep 17 00:00:00 2001
From: scottf <scottfauerbach@gmail.com>
Date: Tue, 25 Aug 2026 11:17:40 -0400
Subject: [PATCH 1/2] Add a Windows build workflow

Runs the full test suite on windows-latest against a nats-server built
from the tip of main, on every push to main. Windows has never had CI
coverage here, and several of the server bugs found through the Java
tests over the years were specific to the Windows environment.

The shared synadia-io/workflows install action is bash and unix-only, so
this workflow installs the server itself rather than making that action
cross platform. It builds nats-server.exe and hands the absolute path to
the test harness through the nats_server_path environment variable,
which NatsRunnerUtils.getResolvedServerPath() reads - that keeps PATH
and PATHEXT out of the picture on a platform where an extensionless
binary is not resolvable as a command.

Java 8 only, matching the other builds. No jacoco, coveralls, javadoc or
publishing: those are covered on Linux and would only add runtime and
failure surface. Test reports upload as an artifact on failure, since
triaging Windows failures from raw console output is painful.
---
 .github/workflows/build-windows.yml | 69 +++++++++++++++++++++++++++++
 1 file changed, 69 insertions(+)
 create mode 100644 .github/workflows/build-windows.yml

diff --git a/.github/workflows/build-windows.yml b/.github/workflows/build-windows.yml
new file mode 100644
index 000000000..d0a4c4f49
--- /dev/null
+++ b/.github/workflows/build-windows.yml
@@ -0,0 +1,69 @@
+name: Build Windows
+
+# Windows coverage for the client. The Linux workflows gate pull requests; this one
+# runs after a merge to main to catch problems that only appear in the Windows
+# environment - in the client, in the test harness, or in the server itself, which
+# is built here from the tip of nats-server main.
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+# A burst of merges should test the resulting state once rather than rebuild and
+# retest the same server several times over.
+concurrency:
+  group: build-windows
+  cancel-in-progress: true
+
+jobs:
+  build:
+    if: github.repository == 'nats-io/nats.java'
+    runs-on: windows-latest
+    timeout-minutes: 90
+    env:
+      BUILD_EVENT: ${{ github.event_name }}
+    steps:
+      - name: Setup JDK
+        uses: actions/setup-java@v5
+        with:
+          java-version: '8'
+          distribution: 'temurin'
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v5
+        with:
+          gradle-version: '8.14' # Quotes required to prevent YAML converting to number
+      - name: Install Nats Server
+        shell: pwsh
+        # The shared synadia-io/workflows install action is bash and unix-only, so
+        # Windows builds its own. Go is preinstalled on the runner image, and
+        # GOTOOLCHAIN is left at its default of 'auto' so the build can fetch the
+        # toolchain that nats-server's go.mod asks for.
+        run: |
+          git clone --depth 1 https://github.com/nats-io/nats-server.git "$env:RUNNER_TEMP\nats-server-src"
+          Set-Location "$env:RUNNER_TEMP\nats-server-src"
+          go build -o "$env:RUNNER_TEMP\nats-server.exe"
+          & "$env:RUNNER_TEMP\nats-server.exe" -v
+          # NatsRunnerUtils.getResolvedServerPath() reads this environment variable.
+          # An absolute path keeps PATH and PATHEXT out of the picture entirely.
+          "nats_server_path=$env:RUNNER_TEMP\nats-server.exe" >> $env:GITHUB_ENV
+      - name: Check out code
+        uses: actions/checkout@v5
+      - name: Build and Test
+        run: .\gradlew.bat clean test
+      - name: Upload test reports
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: windows-test-reports
+          path: |
+            build/reports/tests/test
+            build/test-results/test
+          retention-days: 14
+      - name: Clean up
+        if: always()
+        shell: pwsh
+        run: |
+          Get-Process nats-server -ErrorAction SilentlyContinue | Stop-Process -Force
+          exit 0

From 91c34874fc9ce7d6b7ab87973a9c56305db43fc9 Mon Sep 17 00:00:00 2001
From: scottf <scottfauerbach@gmail.com>
Date: Tue, 25 Aug 2026 11:53:58 -0400
Subject: [PATCH 2/2] Limit GITHUB_TOKEN permissions in the Windows workflow

CodeQL flagged the missing permissions block. Nothing in this workflow
writes: checkout needs contents read, and upload-artifact has no
GITHUB_TOKEN input - it uses the Actions runtime token.
---
 .github/workflows/build-windows.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/build-windows.yml b/.github/workflows/build-windows.yml
index d0a4c4f49..e21ba89eb 100644
--- a/.github/workflows/build-windows.yml
+++ b/.github/workflows/build-windows.yml
@@ -5,6 +5,11 @@ name: Build Windows
 # environment - in the client, in the test harness, or in the server itself, which
 # is built here from the tip of nats-server main.
 
+# Nothing here writes: checkout reads the repo, and upload-artifact uses the runtime
+# token rather than GITHUB_TOKEN.
+permissions:
+  contents: read
+
 on:
   push:
     branches: