From f273da352a7a8afd0f19ccc20a5ceb6dda356bf9 Mon Sep 17 00:00:00 2001
From: Andrew Murray <radarhere@users.noreply.github.com>
Date: Thu, 11 Dec 2025 08:19:24 +1100
Subject: [PATCH 1/3] Do not use cmd shell

---
 .github/workflows/test-windows.yml | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/test-windows.yml b/.github/workflows/test-windows.yml
index 3450de35556..03a10f52d43 100644
--- a/.github/workflows/test-windows.yml
+++ b/.github/workflows/test-windows.yml
@@ -187,8 +187,9 @@ jobs:
     # trim ~150MB for each job
     - name: Optimize build cache
       if: steps.build-cache.outputs.cache-hit != 'true'
-      run: rmdir /S /Q winbuild\build\src
-      shell: cmd
+      run: |
+        rm -rf winbuild\build\src
+      shell: bash
 
     - name: Build Pillow
       run: |
@@ -205,9 +206,7 @@ jobs:
 
     - name: Test Pillow
       run: |
-        path %GITHUB_WORKSPACE%\winbuild\build\bin;%PATH%
         .ci\test.cmd
-      shell: cmd
 
     - name: Prepare to upload errors
       if: failure()

From 80834f0b85d98a5fef7536616c1979fde2dcd32d Mon Sep 17 00:00:00 2001
From: Andrew Murray <radarhere@users.noreply.github.com>
Date: Fri, 5 Dec 2025 22:24:33 +1100
Subject: [PATCH 2/3] Revert "Disable
 https://docs.zizmor.sh/audits/#obfuscation"

This reverts commit 9342e209b2176bde761b321a74846857257ea78c.
---
 .github/zizmor.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/zizmor.yml b/.github/zizmor.yml
index e60c79441ca..b567097811a 100644
--- a/.github/zizmor.yml
+++ b/.github/zizmor.yml
@@ -1,8 +1,6 @@
 # Configuration for the zizmor static analysis tool, run via pre-commit in CI
 # https://docs.zizmor.sh/configuration/
 rules:
-  obfuscation:
-    disable: true
   unpinned-uses:
     config:
       policies:

From 44b90791a026dceaff26b65e97b4c83cffa069a9 Mon Sep 17 00:00:00 2001
From: Andrew Murray <radarhere@users.noreply.github.com>
Date: Thu, 11 Dec 2025 08:20:10 +1100
Subject: [PATCH 3/3] Moved cmd script into separate file

---
 .github/workflows/wheels-build.cmd | 18 ++++++++++++++++++
 .github/workflows/wheels.yml       | 20 +-------------------
 2 files changed, 19 insertions(+), 19 deletions(-)
 create mode 100644 .github/workflows/wheels-build.cmd

diff --git a/.github/workflows/wheels-build.cmd b/.github/workflows/wheels-build.cmd
new file mode 100644
index 00000000000..602d6a4fe5e
--- /dev/null
+++ b/.github/workflows/wheels-build.cmd
@@ -0,0 +1,18 @@
+setlocal EnableDelayedExpansion
+for %%f in (winbuild\build\license\*) do (
+  set x=%%~nf
+  rem Skip FriBiDi license, it is not included in the wheel.
+  set fribidi=!x:~0,7!
+  if NOT !fribidi!==fribidi (
+    rem Skip imagequant license, it is not included in the wheel.
+    set libimagequant=!x:~0,13!
+    if NOT !libimagequant!==libimagequant (
+      echo. >> LICENSE
+      echo ===== %%~nf ===== >> LICENSE
+      echo. >> LICENSE
+      type %%f >> LICENSE
+    )
+  )
+)
+call winbuild\\build\\build_env.cmd
+%pythonLocation%\python.exe -m cibuildwheel . --output-dir wheelhouse
diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml
index fb71ead37b5..c3899ab351c 100644
--- a/.github/workflows/wheels.yml
+++ b/.github/workflows/wheels.yml
@@ -186,24 +186,7 @@ jobs:
 
       - name: Build wheels
         run: |
-          setlocal EnableDelayedExpansion
-          for %%f in (winbuild\build\license\*) do (
-            set x=%%~nf
-            rem Skip FriBiDi license, it is not included in the wheel.
-            set fribidi=!x:~0,7!
-            if NOT !fribidi!==fribidi (
-              rem Skip imagequant license, it is not included in the wheel.
-              set libimagequant=!x:~0,13!
-              if NOT !libimagequant!==libimagequant (
-                echo. >> LICENSE
-                echo ===== %%~nf ===== >> LICENSE
-                echo. >> LICENSE
-                type %%f >> LICENSE
-              )
-            )
-          )
-          call winbuild\\build\\build_env.cmd
-          %pythonLocation%\python.exe -m cibuildwheel . --output-dir wheelhouse
+          .github\workflows\wheels-build.cmd
         env:
           CIBW_ARCHS: ${{ matrix.cibw_arch }}
           CIBW_BEFORE_ALL: "{package}\\winbuild\\build\\build_dep_all.cmd"
@@ -217,7 +200,6 @@ jobs:
             -e CI -e GITHUB_ACTIONS
             mcr.microsoft.com/windows/servercore:ltsc2022
             powershell C:\pillow\.github\workflows\wheels-test.ps1 %CD%\..\venv-test'
-        shell: cmd
 
       - name: Upload wheels
         uses: actions/upload-artifact@v5