Prepare Windows natives with scoped compiler settings and measure servicing (#28881)

* Scope Windows native compiler setup and measure ARM inbox preparation

* Add a controlled Windows native preparation comparison

* Test native preparation through an injected process runner

* Guard reviewed Windows native batch runners

.github/workflows/ci-cache-warmup-platform-jobs.yml

@@ -54,6 +54,7 @@ jobs:
         run: node config/scripts/ensure-native-runtime.mjs --check-only
 
       - name: Cache Windows CLI launcher
+        if: runner.arch == 'X64'
         uses: actions/cache@v5
         with:
           path: |
@@ -65,6 +66,7 @@ jobs:
           key: windows-cli-launcher-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('native/windows-cli-launcher/**', 'native/windows-agent-hook/**', 'config/scripts/build-windows-cli-launcher.mjs', 'config/scripts/build-windows-agent-hook.mjs', 'config/scripts/windows-rust-executable-build.mjs', 'resources/build/icon.ico', 'package.json') }}
 
       - name: Build the Windows native executables
+        if: runner.arch == 'X64'
         shell: pwsh
         run: |
           if (-not (Get-Command cargo -ErrorAction SilentlyContinue)) {
@@ -76,6 +78,12 @@ jobs:
           node config/scripts/build-windows-cli-launcher.mjs
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
+      - name: Warm the Windows ARM server launcher
+        if: runner.arch == 'ARM64'
+        uses: ./.github/actions/prepare-windows-cli-launcher
+        with:
+          arches: arm64
+
   warm-linux-package-fixtures:
     concurrency:
       group: ci-cache-warmup-linux-package-fixtures-${{ github.event.pull_request.number || github.ref }}

.github/workflows/ci-cache-warmup-platforms.yml

@@ -10,6 +10,7 @@ on:
       - '.github/actions/install-node-dependencies/**'
       - '.github/actions/restore-pnpm-verification/**'
       - '.github/actions/prepare-native-runtime/**'
+      - '.github/actions/prepare-windows-cli-launcher/**'
       - '.github/actions/prepare-git-compatibility/**'
       - '.github/actions/prepare-linux-package-fixture/**'
       - 'config/docker/headless-serve-shutdown/**'
@@ -21,6 +22,8 @@ on:
       - '.npmrc'
       - '.pnpmfile.cjs'
       - 'config/scripts/ensure-native-runtime.mjs'
+      - 'config/scripts/initialize-windows-native-toolchain.mjs'
+      - 'config/scripts/capture-windows-native-environment.cmd'
       - 'config/scripts/rebuild-native-deps.mjs'
       - 'config/scripts/node-pty-job-ownership.cjs'
       - 'config/scripts/windows-pe-machine.cjs'

.github/workflows/ci-cache-warmup.yml

@@ -14,6 +14,7 @@ on:
       - '.github/actions/install-node-dependencies/**'
       - '.github/actions/restore-pnpm-verification/**'
       - '.github/actions/prepare-native-runtime/**'
+      - '.github/actions/prepare-windows-cli-launcher/**'
       - '.github/actions/prepare-git-compatibility/**'
       - '.github/actions/prepare-headless-compiler/**'
       - 'config/scripts/headless-detector-compiler-cache.mjs'
@@ -30,6 +31,8 @@ on:
       - '.npmrc'
       - '.pnpmfile.cjs'
       - 'config/scripts/ensure-native-runtime.mjs'
+      - 'config/scripts/initialize-windows-native-toolchain.mjs'
+      - 'config/scripts/capture-windows-native-environment.cmd'
       - 'config/scripts/rebuild-native-deps.mjs'
       - 'config/scripts/node-pty-job-ownership.cjs'
       - 'config/scripts/windows-pe-machine.cjs'

.github/workflows/ssh-windows-hosts.yml

@@ -62,12 +62,23 @@ on:
         description: Comma-separated cell ids from src/main/ssh/ssh-windows-host-cells.ts; empty runs the default set (orcad-cli-* cells run only when named).
         required: false
         default: ''
+      preparation_mode:
+        description: Compare inbox capability preparation overlapping builds or running after them.
+        type: choice
+        options: [overlap, serial]
+        required: false
+        default: overlap
+      arm_inbox_only:
+        description: Run only the native ARM inbox lane for a preparation timing comparison.
+        type: boolean
+        required: false
+        default: false
 
 permissions:
   contents: read
 
 concurrency:
-  group: ssh-windows-hosts-${{ github.event.pull_request.number || github.ref }}
+  group: ssh-windows-hosts-${{ github.event.pull_request.number || github.ref }}${{ github.event_name == 'workflow_dispatch' && inputs.arm_inbox_only && format('-{0}', inputs.preparation_mode || 'overlap') || '' }}
   cancel-in-progress: true
 
 jobs:
@@ -77,21 +88,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        include:
-          - arch: x64
-            runner: windows-2022
-            server: inbox
-          - arch: x64
-            runner: windows-2022
-            server: preview
-            archive: OpenSSH-Win64.zip
-          - arch: arm64
-            runner: windows-11-arm
-            server: inbox
-          - arch: arm64
-            runner: windows-11-arm
-            server: preview
-            archive: OpenSSH-ARM64.zip
+        include: >-
+          ${{ fromJSON(github.event_name == 'workflow_dispatch' && inputs.arm_inbox_only &&
+          '[{"arch":"arm64","runner":"windows-11-arm","server":"inbox"}]' ||
+          '[{"arch":"x64","runner":"windows-2022","server":"inbox"},{"arch":"x64","runner":"windows-2022","server":"preview","archive":"OpenSSH-Win64.zip"},{"arch":"arm64","runner":"windows-11-arm","server":"inbox"},{"arch":"arm64","runner":"windows-11-arm","server":"preview","archive":"OpenSSH-ARM64.zip"}]') }}
     runs-on: ${{ matrix.runner }}
     # Installing the inbox capability alone can take several minutes on a fresh image; the CLI matrix
     # cells launch the e2e app several times each.
@@ -99,6 +99,7 @@ jobs:
     env:
       ORCA_BACKGROUND_LAUNCH: '1'
       ORCA_ISOLATED_SSH_CI: '1'
+      INBOX_PREPARATION_MODE: ${{ github.event_name == 'workflow_dispatch' && inputs.preparation_mode == 'serial' && 'serial' || 'overlap' }}
     steps:
       - uses: actions/checkout@v6
         with:
@@ -127,11 +128,11 @@ jobs:
         background: true
         shell: pwsh
         run: |
-          if('${{ matrix.server }}' -eq 'inbox' -and '${{ matrix.arch }}' -eq 'arm64'){
+          if('${{ matrix.server }}' -eq 'inbox' -and '${{ matrix.arch }}' -eq 'arm64' -and $env:INBOX_PREPARATION_MODE -eq 'overlap'){
             $receipts=Join-Path $pwd '.build/ssh-windows-host-receipts'
             New-Item -ItemType Directory -Force -Path $receipts | Out-Null
             . config/ci/windows-ssh-provider/preview-ssh/windows-ssh-capability.ps1
-            Initialize-WindowsInboxSshCapability -Arch '${{ matrix.arch }}' -Receipt (Join-Path $receipts 'inbox-capability-preparation.json')
+            Initialize-WindowsInboxSshCapability -Arch '${{ matrix.arch }}' -Receipt (Join-Path $receipts 'inbox-capability-preparation.json') -PreparationMode $env:INBOX_PREPARATION_MODE
           }
       - uses: ./.github/actions/install-node-dependencies
         id: dependencies
@@ -164,6 +165,14 @@ jobs:
           pnpm build:orcad-prebuilds --require-slots "win32-${{ matrix.arch }}"
           node config/scripts/build-orcad-template.mjs --targets "win32-${{ matrix.arch }}"
       - wait: inbox-capability
+      - name: Prepare the Windows inbox SSH capability after the builds
+        if: ${{ matrix.server == 'inbox' && matrix.arch == 'arm64' && env.INBOX_PREPARATION_MODE == 'serial' }}
+        shell: pwsh
+        run: |
+          $receipts=Join-Path $pwd '.build/ssh-windows-host-receipts'
+          New-Item -ItemType Directory -Force -Path $receipts | Out-Null
+          . config/ci/windows-ssh-provider/preview-ssh/windows-ssh-capability.ps1
+          Initialize-WindowsInboxSshCapability -Arch '${{ matrix.arch }}' -Receipt (Join-Path $receipts 'inbox-capability-preparation.json') -PreparationMode $env:INBOX_PREPARATION_MODE
       - name: Run the Windows host cells against a private ${{ matrix.server }} sshd
         shell: pwsh
         timeout-minutes: ${{ contains(github.event.inputs.cells || '', 'orcad-cli') && 130 || 50 }}

.github/workflows/windows-native-preparation-benchmark.yml

@@ -0,0 +1,64 @@
+name: Windows native preparation comparison
+
+on:
+  workflow_dispatch:
+    inputs:
+      source_sha:
+        description: Exact commit containing this benchmark and the Windows compiler candidate.
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: windows-native-preparation-comparison-${{ github.ref }}
+  cancel-in-progress: false
+
+env:
+  ORCA_BACKGROUND_LAUNCH: '1'
+
+jobs:
+  compare:
+    name: Native preparation comparison (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      max-parallel: 2
+      matrix:
+        os: [windows-2022, windows-11-arm]
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.source_sha }}
+          persist-credentials: false
+      - name: Record measurement start and validate source
+        shell: bash
+        env:
+          SOURCE_SHA: ${{ inputs.source_sha }}
+        run: |
+          [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]
+          test "$(git rev-parse HEAD)" = "$SOURCE_SHA"
+          mkdir -p .build/windows-native-benchmark
+          node -e 'require("node:fs").writeFileSync(".build/windows-native-benchmark/job-start.json", JSON.stringify({startedAt:new Date().toISOString()}))'
+      - uses: ./.github/actions/install-node-dependencies
+        with:
+          node-version: '24.21.0'
+          native-runtime: none
+          cache-pnpm-store: 'false'
+          cache-pnpm-verification: 'false'
+      - name: Compare isolated cold and same-build warm preparation
+        shell: bash
+        env:
+          SOURCE_SHA: ${{ inputs.source_sha }}
+          BENCHMARK_RUNNER: ${{ matrix.os }}
+        run: node config/scripts/benchmark-windows-native-preparation.mjs
+      - uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: windows-native-preparation-${{ matrix.os }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: .build/windows-native-benchmark/
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14