From 3abb62ed2935592c5046621da304e4aa1f171c7a Mon Sep 17 00:00:00 2001
From: Andrew Murray <radarhere@users.noreply.github.com>
Date: Thu, 11 Dec 2025 08:19:24 +1100
Subject: [PATCH 1/3] Do not use cmd shell

---
 .github/workflows/test-windows.yml | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/test-windows.yml b/.github/workflows/test-windows.yml
index e864763da21..913d6a23cb9 100644
--- a/.github/workflows/test-windows.yml
+++ b/.github/workflows/test-windows.yml
@@ -188,8 +188,9 @@ jobs:
     # trim ~150MB for each job
     - name: Optimize build cache
       if: steps.build-cache.outputs.cache-hit != 'true'
-      run: rmdir /S /Q winbuild\build\src
-      shell: cmd
+      run: |
+        rm -rf winbuild\build\src
+      shell: bash
 
     - name: Build Pillow
       run: |
@@ -206,9 +207,7 @@ jobs:
 
     - name: Test Pillow
       run: |
-        path %GITHUB_WORKSPACE%\winbuild\build\bin;%PATH%
         .ci\test.cmd
-      shell: cmd
 
     - name: Prepare to upload errors
       if: failure()

From 79357a271866050776ac587b1871c6841e2505d2 Mon Sep 17 00:00:00 2001
From: Andrew Murray <radarhere@users.noreply.github.com>
Date: Fri, 5 Dec 2025 22:24:33 +1100
Subject: [PATCH 2/3] Revert "Disable
 https://docs.zizmor.sh/audits/#obfuscation"

This reverts commit 9342e209b2176bde761b321a74846857257ea78c.
---
 .github/zizmor.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/zizmor.yml b/.github/zizmor.yml
index e60c79441ca..b567097811a 100644
--- a/.github/zizmor.yml
+++ b/.github/zizmor.yml
@@ -1,8 +1,6 @@
 # Configuration for the zizmor static analysis tool, run via pre-commit in CI
 # https://docs.zizmor.sh/configuration/
 rules:
-  obfuscation:
-    disable: true
   unpinned-uses:
     config:
       policies:

From 72931475f2ba773d42b550b17ac10c19ae4a505c Mon Sep 17 00:00:00 2001
From: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
Date: Mon, 29 Dec 2025 14:44:32 +0200
Subject: [PATCH 3/3] Replace shell: cmd with shell: bash

---
 .github/workflows/wheels.yml | 32 +++++++++++++-------------------
 1 file changed, 13 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml
index fb71ead37b5..c9a738db3f2 100644
--- a/.github/workflows/wheels.yml
+++ b/.github/workflows/wheels.yml
@@ -186,24 +186,18 @@ jobs:
 
       - name: Build wheels
         run: |
-          setlocal EnableDelayedExpansion
-          for %%f in (winbuild\build\license\*) do (
-            set x=%%~nf
-            rem Skip FriBiDi license, it is not included in the wheel.
-            set fribidi=!x:~0,7!
-            if NOT !fribidi!==fribidi (
-              rem Skip imagequant license, it is not included in the wheel.
-              set libimagequant=!x:~0,13!
-              if NOT !libimagequant!==libimagequant (
-                echo. >> LICENSE
-                echo ===== %%~nf ===== >> LICENSE
-                echo. >> LICENSE
-                type %%f >> LICENSE
-              )
-            )
-          )
-          call winbuild\\build\\build_env.cmd
-          %pythonLocation%\python.exe -m cibuildwheel . --output-dir wheelhouse
+          for f in winbuild/build/license/*; do
+            name=$(basename "${f%.*}")
+            # Skip FriBiDi license, it is not included in the wheel.
+            [[ $name == fribidi* ]] && continue
+            # Skip imagequant license, it is not included in the wheel.
+            [[ $name == libimagequant* ]] && continue
+            echo "" >> LICENSE
+            echo "===== $name =====" >> LICENSE
+            echo "" >> LICENSE
+            cat "$f" >> LICENSE
+          done
+          cmd //c "winbuild\\build\\build_env.cmd && $pythonLocation\\python.exe -m cibuildwheel . --output-dir wheelhouse"
         env:
           CIBW_ARCHS: ${{ matrix.cibw_arch }}
           CIBW_BEFORE_ALL: "{package}\\winbuild\\build\\build_dep_all.cmd"
@@ -217,7 +211,7 @@ jobs:
             -e CI -e GITHUB_ACTIONS
             mcr.microsoft.com/windows/servercore:ltsc2022
             powershell C:\pillow\.github\workflows\wheels-test.ps1 %CD%\..\venv-test'
-        shell: cmd
+        shell: bash
 
       - name: Upload wheels
         uses: actions/upload-artifact@v5