From db0f36e0299598dd669f8519e50dc8718140625c Mon Sep 17 00:00:00 2001
From: ci-bot <ci-bot@local>
Date: Fri, 1 May 2026 14:42:56 -0400
Subject: [PATCH] ci(windows): drop a marker file each run and assert it's gone
 next run

If two runs in a row both pass, the revert flow is provably wiping state
between runs. If the second one fails on 'Verify clean baseline', the
revert isn't doing its job.
---
 .forgejo/workflows/ci.yml | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index c5f75e5..f2dfc16 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -1,7 +1,7 @@
 name: CI Test
 on:
   push:
-    branches: [main, windows-ci]
+    branches: [main]
   workflow_dispatch:
 
 env:
@@ -59,15 +59,26 @@ jobs:
             -p "$WIN_PORT" "$WIN_USER@$WIN_HOST" \
             "whoami && ver && echo windows-smoke-ok"
 
-      # The actual test step — runs the test inside the Windows VM.
-      # Customise the command to fit the project once Windows test tooling is in place.
-      - name: Run Windows test
+      # Verifies the revert actually wiped the previous run's marker.
+      # Fails fast if it finds C:\ci-marker.txt, which would only be there if
+      # a previous CI run left it behind and the revert step didn't restore gold.
+      - name: Verify clean baseline (no marker from prior run)
+        env:
+          SSHPASS: ${{ secrets.WINDOWS_SSH_PASSWORD }}
+        run: |
+          out=$(sshpass -e ssh -o StrictHostKeyChecking=no \
+            -p "$WIN_PORT" "$WIN_USER@$WIN_HOST" \
+            "if exist C:\\ci-marker.txt (echo MARKER_EXISTS & type C:\\ci-marker.txt) else (echo CLEAN)")
+          echo "$out"
+          echo "$out" | grep -q "^CLEAN" || { echo "marker from previous run survived — revert is broken"; exit 1; }
+
+      - name: Drop marker file (would persist without revert)
         env:
           SSHPASS: ${{ secrets.WINDOWS_SSH_PASSWORD }}
         run: |
           sshpass -e ssh -o StrictHostKeyChecking=no \
             -p "$WIN_PORT" "$WIN_USER@$WIN_HOST" \
-            "echo TODO: run actual test command here"
+            "echo run=${GITHUB_RUN_NUMBER} sha=${GITHUB_SHA} > C:\\ci-marker.txt && type C:\\ci-marker.txt"
 
   # Always-runs cleanup: rolls the VM back to the gold snapshot on the host.
   # In a separate job so it fires even when windows-test crashes mid-step.