ci: derive cache-stable Windows Bazel PATH (#19161)

## Why

The BuildBuddy runs for PR #19086 and the later `main` build had the
same source tree, but their Windows Bazel action and test cache keys did
not line up. Comparing the downloaded execution logs showed the full
GitHub-hosted Windows runner `PATH` had changed from
`apache-maven-3.9.14` to `apache-maven-3.9.15`.

This repo is not using Maven; the Maven entry was just ambient
hosted-runner state. The problem was that Windows Bazel CI was still
forwarding the whole runner `PATH` into Bazel via `--action_env=PATH`,
`--host_action_env=PATH`, and `--test_env=PATH`, which made otherwise
reusable cache entries sensitive to unrelated runner image churn.

After discussion with the Bazel and BuildBuddy folks, the better shape
for this change was to stop asking Bazel to inherit the ambient Windows
`PATH` and instead compute one explicit cache-stable `PATH` in the
Windows setup action that already prepares the CI toolchain environment.

## What

- remove Windows `PATH` passthrough from `.bazelrc`
- export `CODEX_BAZEL_WINDOWS_PATH` from
`.github/actions/setup-bazel-ci/action.yml`
- move the PATH derivation logic into
`.github/scripts/compute-bazel-windows-path.ps1` so the allow-list is
easier to review and document
- keep only the Windows tool locations these Bazel jobs actually need:
MSVC and SDK paths, Git, PowerShell, Node, DotSlash, and the standard
Windows system directories
- update `.github/scripts/run-bazel-ci.sh` to require that explicit
value and forward it to Bazel action, host action, and test environments
- log the derived `CODEX_BAZEL_WINDOWS_PATH` in the setup step to
simplify cache-key debugging

## Verification

- `bash -n .github/scripts/run-bazel-ci.sh`
- `ruby -e 'require "yaml"; YAML.load_file(ARGV[0])'
.github/actions/setup-bazel-ci/action.yml`
- PowerShell parse check for
`.github/scripts/compute-bazel-windows-path.ps1`
- simulated a representative Windows `PATH` in PowerShell; the
allow-list retained MSVC, Git, PowerShell, Node, Windows, and DotSlash
entries while dropping Maven

.github/scripts/compute-bazel-windows-path.ps1

@@ -0,0 +1,105 @@
+<#
+BuildBuddy cache keys include the action and test environment, so Bazel should
+not inherit the full hosted-runner PATH on Windows. That PATH includes volatile
+tool entries, such as Maven, that can change independently of this repo and
+cause avoidable cache misses.
+
+This script derives a smaller, cache-stable PATH that keeps the Windows
+toolchain entries Bazel-backed CI tasks need: MSVC and Windows SDK paths, Git,
+PowerShell, Node, Python, DotSlash, and the standard Windows system
+directories.
+`setup-bazel-ci` runs this after exporting the MSVC environment, and the script
+publishes the result via `GITHUB_ENV` as `CODEX_BAZEL_WINDOWS_PATH` so later
+steps can pass that explicit PATH to Bazel.
+#>
+
+$stablePathEntries = New-Object System.Collections.Generic.List[string]
+$seenEntries = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+$windowsAppsPath = if ([string]::IsNullOrWhiteSpace($env:LOCALAPPDATA)) {
+  $null
+} else {
+  "$($env:LOCALAPPDATA)\Microsoft\WindowsApps"
+}
+$windowsDir = if ($env:WINDIR) {
+  $env:WINDIR
+} elseif ($env:SystemRoot) {
+  $env:SystemRoot
+} else {
+  $null
+}
+
+function Add-StablePathEntry {
+  param([string]$PathEntry)
+
+  if ([string]::IsNullOrWhiteSpace($PathEntry)) {
+    return
+  }
+
+  if ($seenEntries.Add($PathEntry)) {
+    [void]$stablePathEntries.Add($PathEntry)
+  }
+}
+
+foreach ($pathEntry in ($env:PATH -split ';')) {
+  if ([string]::IsNullOrWhiteSpace($pathEntry)) {
+    continue
+  }
+
+  if (
+    $pathEntry -like '*Microsoft Visual Studio*' -or
+    $pathEntry -like '*Windows Kits*' -or
+    $pathEntry -like '*Microsoft SDKs*' -or
+    $pathEntry -like 'C:\Program Files\Git\*' -or
+    $pathEntry -like 'C:\Program Files\PowerShell\*' -or
+    $pathEntry -like 'C:\hostedtoolcache\windows\node\*' -or
+    $pathEntry -like 'C:\hostedtoolcache\windows\Python\*' -or
+    $pathEntry -eq 'D:\a\_temp\install-dotslash\bin' -or
+    ($windowsDir -and ($pathEntry -eq $windowsDir -or $pathEntry -like "${windowsDir}\*"))
+  ) {
+    Add-StablePathEntry $pathEntry
+  }
+}
+
+$gitCommand = Get-Command git -ErrorAction SilentlyContinue
+if ($gitCommand) {
+  Add-StablePathEntry (Split-Path $gitCommand.Source -Parent)
+}
+
+$nodeCommand = Get-Command node -ErrorAction SilentlyContinue
+if ($nodeCommand) {
+  Add-StablePathEntry (Split-Path $nodeCommand.Source -Parent)
+}
+
+$python3Command = Get-Command python3 -ErrorAction SilentlyContinue
+if ($python3Command) {
+  Add-StablePathEntry (Split-Path $python3Command.Source -Parent)
+}
+
+$pythonCommand = Get-Command python -ErrorAction SilentlyContinue
+if ($pythonCommand) {
+  Add-StablePathEntry (Split-Path $pythonCommand.Source -Parent)
+}
+
+$pwshCommand = Get-Command pwsh -ErrorAction SilentlyContinue
+if ($pwshCommand) {
+  Add-StablePathEntry (Split-Path $pwshCommand.Source -Parent)
+}
+
+if ($windowsAppsPath) {
+  Add-StablePathEntry $windowsAppsPath
+}
+
+if ($stablePathEntries.Count -eq 0) {
+  throw 'Failed to derive cache-stable Windows PATH.'
+}
+
+if ([string]::IsNullOrWhiteSpace($env:GITHUB_ENV)) {
+  throw 'GITHUB_ENV must be set.'
+}
+
+$stablePath = $stablePathEntries -join ';'
+Write-Host 'Derived CODEX_BAZEL_WINDOWS_PATH entries:'
+foreach ($pathEntry in $stablePathEntries) {
+  Write-Host "  $pathEntry"
+}
+"CODEX_BAZEL_WINDOWS_PATH=$stablePath" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append

.github/scripts/run-bazel-ci.sh

@@ -306,7 +306,6 @@ if [[ "${RUNNER_OS:-}" == "Windows" ]]; then
     INCLUDE
     LIB
     LIBPATH
-    PATH
     UCRTVersion
     UniversalCRTSdkDir
     VCINSTALLDIR
@@ -323,6 +322,17 @@ if [[ "${RUNNER_OS:-}" == "Windows" ]]; then
       post_config_bazel_args+=("--action_env=${env_var}" "--host_action_env=${env_var}")
     fi
   done
+
+  if [[ -z "${CODEX_BAZEL_WINDOWS_PATH:-}" ]]; then
+    echo "CODEX_BAZEL_WINDOWS_PATH must be set for Windows Bazel CI." >&2
+    exit 1
+  fi
+
+  post_config_bazel_args+=(
+    "--action_env=PATH=${CODEX_BAZEL_WINDOWS_PATH}"
+    "--host_action_env=PATH=${CODEX_BAZEL_WINDOWS_PATH}"
+    "--test_env=PATH=${CODEX_BAZEL_WINDOWS_PATH}"
+  )
 fi
 
 bazel_console_log="$(mktemp)"