fix: run workflow gates portably on Windows

Author: srinitude

.github/scripts/verify-workflows.mjs

@@ -0,0 +1,48 @@
+import { spawnSync } from "node:child_process";
+import { readdir } from "node:fs/promises";
+import { resolve } from "node:path";
+
+const root = resolve(import.meta.dirname, "../..");
+const generated = [
+	".github/workflows/pi-runtime-review.lock.yml",
+	".github/workflows/pi-upstream-lockstep.lock.yml",
+	".github/workflows/agentics-maintenance.yml",
+];
+
+function result(command, args, stdio = "inherit") {
+	return spawnSync(command, args, { cwd: root, stdio, env: process.env });
+}
+
+function run(command, args) {
+	const child = result(command, args);
+	if (child.error) throw child.error;
+	if (child.status !== 0) process.exit(child.status ?? 1);
+}
+
+function canRun(command, args) {
+	const child = result(command, args, "ignore");
+	return !child.error && child.status === 0;
+}
+
+async function conventionalWorkflows() {
+	const directory = resolve(root, ".github/workflows");
+	const files = await readdir(directory);
+	return files
+		.filter((file) => file.endsWith(".yml") && !file.endsWith(".lock.yml"))
+		.map((file) => `.github/workflows/${file}`);
+}
+
+function verifyGeneratedFiles() {
+	if (canRun("git", ["diff", "--quiet", "--", ...generated])) return;
+	console.error("Compiled gh-aw workflows are stale. Run mise run workflows and commit them.");
+	run("git", ["diff", "--stat", "--", ...generated]);
+	process.exit(1);
+}
+
+run("gh-aw", ["compile", "--strict"]);
+run(process.execPath, [".github/scripts/patch-gh-aw-lock.mjs"]);
+if (canRun("docker", ["info"])) run("gh-aw", ["lint"]);
+else console.log("Docker unavailable; strict gh-aw compile completed (generated lint runs on Docker-capable matrix jobs).");
+run("actionlint", await conventionalWorkflows());
+run("bun", ["test", "tests/workflows"]);
+verifyGeneratedFiles();

mise.toml

@@ -78,22 +78,7 @@ run = "node tests/structure/check.mjs"
 
 [tasks.workflows]
 description = "Compile, patch, lint, and test trusted workflow policy"
-run = """
-gh-aw compile --strict
-node .github/scripts/patch-gh-aw-lock.mjs
-if docker info >/dev/null 2>&1; then
-  gh-aw lint
-else
-  echo 'Docker unavailable; strict gh-aw compile completed (generated lint runs on Docker-capable matrix jobs).'
-fi
-find .github/workflows -name '*.yml' ! -name '*.lock.yml' -print0 | xargs -0 actionlint
-bun test tests/workflows
-if ! git diff --quiet -- .github/workflows/*.lock.yml .github/workflows/agentics-maintenance.yml; then
-  echo 'Compiled gh-aw workflows are stale. Run mise run workflows and commit them.'
-  git diff --stat -- .github/workflows/*.lock.yml .github/workflows/agentics-maintenance.yml
-  exit 1
-fi
-"""
+run = "node .github/scripts/verify-workflows.mjs"
 
 # ---- Convenience composites ------------------------------------------------
 

tests/workflows/invariants.test.ts

@@ -102,10 +102,15 @@ describe("Pi lockstep agentic workflows", () => {
 	});
 
 	test("keeps workflow validation portable when Docker is unavailable", async () => {
-		const source = await readFile(resolve(root, "mise.toml"), "utf8");
-		expect(source).toContain("if docker info >/dev/null 2>&1; then");
-		expect(source).toContain("gh-aw lint");
-		expect(source).toContain("Docker unavailable; strict gh-aw compile completed");
+		const mise = await readFile(resolve(root, "mise.toml"), "utf8");
+		const runner = await readFile(
+			resolve(root, ".github/scripts/verify-workflows.mjs"),
+			"utf8",
+		);
+		expect(mise).toContain('run = "node .github/scripts/verify-workflows.mjs"');
+		expect(runner).toContain('run("gh-aw", ["compile", "--strict"])');
+		expect(runner).toContain('canRun("docker", ["info"])');
+		expect(runner).toContain("Docker unavailable; strict gh-aw compile completed");
 	});
 
 	test("serializes generated workflow writes before the full test suite", async () => {