ci: cross-compile Windows tests and CLI binaries on Linux with cargo-xwin

[fengmk2]

Summary

Build the Windows test binaries and the CLI/binding once on a Linux runner with cargo-xwin, then just run them on Windows (download-only). Same approach as voidzero-dev/vite-task#443.

Cache-miss comparison

Run	Wall time
main (cache miss)	34m45s
this PR (Windows CLI binary-cache miss)	17m09s

Net: 17m36s faster, about 51% less wall time. Both runs include the Socket Firewall Free job. The PR run missed the windows-cli-xwin binary cache after the reviewed cache-key/path refactors; the Windows SDK and package-manager caches were warm.

Latest binary-cache-miss breakdown:

• build-windows-tests: 2m45s, followed by the download-only Windows test job in 3m05s.
• build-windows-cli: 7m46s, followed by the slowest download-only Windows consumer tail in 6m52s.
• All Windows test, CLI E2E, snapshot, SFW, and ecosystem jobs passed using the Linux-built artifacts.

Warm-cache comparison

Run	Wall time
Before: main (NAPI binding cache hit)	11m57s
After: this PR (windows-cli-xwin cache hit)	7m13s

Net: 4m44s faster, about 40% less wall time. These are full successful CI executions with the native caches already populated. In the PR run, build-windows-cli restored the exact binary cache, skipped native compilation, re-uploaded the artifact, and completed in 9s.

Why this is faster:

• Linux is a much faster place to cross-compile the Windows binaries (cargo-xwin + clang-cl/lld-link against the cached MSVC CRT / Windows SDK), instead of every Windows job rebuilding the same ~24-minute release binding + CLI binaries.
• Before, the run was gated by the single slowest Windows job (~30m, each doing its own full build); after, the native work is performed once on Linux and the Windows jobs only download and execute the resulting artifacts.
• The Windows jobs (Test, CLI E2E, CLI snap, sfw) now download a prebuilt artifact and skip native compilation, so they need no Rust toolchain or dev drive.
• test's Windows leg runs from a nextest archive (build-windows-tests) with no toolchain at all.
• Releases are unaffected and keep building natively on Windows (their cache keys differ via RELEASE_BUILD/VERSION). CI Windows binaries are clang-cl/lld-link-built; the e2e/snap suites still run them on real Windows.

flowchart LR
  subgraph Before["Before: every Windows job rebuilds the workspace"]
    B1["Windows jobs x5"] --> B2["Compile binding + vp on Windows<br/>~24m each"]
    B2 --> B3["Install vp"]
    B3 --> B4["Run e2e / snap / sfw"]
  end

  subgraph After["After: build once on Linux, run on Windows"]
    A1["Linux: build-windows-cli"] --> A2["vp.exe + binding artifact"]
    A2 --> A3["CLI E2E / snap / sfw (Windows)<br/>download + run, no toolchain"]
    A4["Linux: build-windows-tests"] --> A5["nextest archive"]
    A5 --> A6["Test (Windows)<br/>run-only"]
  end

Loading

[netlify]

✅ Deploy Preview for viteplus-preview canceled.

Name	Link
🔨 Latest commit	d6f692d
🔍 Latest deploy log	https://app.netlify.com/projects/viteplus-preview/deploys/6a477962511e2400076a39a0

[fengmk2]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: e51ee80388

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".