CI: add windows-latest job, matching the claimed Windows classifier

pyproject.toml classifies Operating System :: Microsoft :: Windows, but
testing.yaml's matrix only ran ubuntu-latest, and the one test that behaves
differently on Windows (test_autoread_dotenv_unreadable_file_warns, which
relies on chmod-based permission denial) is skipif'd there - so that path
was never actually exercised on the one platform it differs most on.

Adds a single windows-latest job (Python 3.14) via matrix.include, rather
than crossing all 7 Python versions with it, to keep the added job count
small; it's free either way since this is a public repo (GitHub Actions
minutes are unlimited for public repos on every runner OS).

Two changes were needed to make the job actually work rather than just
exist:
- The ubuntu-remove-global-sitecustomize step is Linux-specific (sudo rm),
  so it's now gated behind `if: runner.os == 'Linux'`.
- The job now forces `shell: bash` as the default, so the existing
  ${VAR}-style run steps use Windows' bundled Git Bash instead of falling
  back to pwsh's incompatible variable syntax.

Verified: zizmor and the YAML parses cleanly; the justfile's install/build
recipes already have [unix]/[windows] variants for the OS-sensitive steps
(symlink creation, dir creation), so no changes were needed there.

Author: woutervh

.github/workflows/testing.yaml

@@ -55,6 +55,12 @@ jobs:
         name: python
         runs-on: ${{ matrix.os }}
         timeout-minutes: 10
+        defaults:
+            run:
+                # Force bash everywhere (incl. windows-latest, which ships Git Bash) so the
+                # ${VAR}-style shell steps below behave identically across the matrix instead of
+                # falling back to pwsh's incompatible syntax on Windows.
+                shell: bash
         strategy:
             fail-fast: false
             matrix:
@@ -68,6 +74,13 @@ jobs:
                     - "3.11"
                     - "3.10"
                     - "3.9"
+                include:
+                    # Exercise the Windows-specific code paths at least once per run - e.g. the
+                    # permission-error handling in autoread_dotenv.utils, whose chmod-based test is
+                    # skipped under sys.platform == "win32" on other OSes - matching the
+                    # "Operating System :: Microsoft :: Windows" classifier in pyproject.toml.
+                    - os: windows-latest
+                      python-version: "3.14"
 
         steps:
 
@@ -114,11 +127,16 @@ jobs:
               PYTHON_VERSION: ${{ matrix.python-version }}
           run: uv python install "${PYTHON_VERSION}"
 
+        - name: Remove global sitecustomize.py
+          # Ubuntu-only: unblocks our own sitecustomize entrypoint from the one preinstalled on
+          # the runner image. Nothing equivalent exists to remove on windows-latest.
+          if: runner.os == 'Linux'
+          run: just ubuntu-remove-global-sitecustomize
+
         - name: Install project + dependencies
           env:
               PYTHON_VERSION: ${{ matrix.python-version }}
           run: |
-              just ubuntu-remove-global-sitecustomize
               just uv-set-python-version "${PYTHON_VERSION}"
               just install
 

docs/changes.md

@@ -4,6 +4,15 @@ All notable changes to this project will be documented in this file.
 
 ## Unreleased
 
+- Add a `windows-latest` job (Python 3.14) to the `testing.yaml` CI matrix. The
+  `Operating System :: Microsoft :: Windows` classifier was previously unbacked by any CI
+  run: only `ubuntu-latest` was tested, and the one permission-related test that differs on
+  Windows (`test_autoread_dotenv_unreadable_file_warns`) is `skipif`'d there, so that path
+  was untested on the platform it'd differ from most. Gates the ubuntu-only
+  `ubuntu-remove-global-sitecustomize` step behind `runner.os == 'Linux'` and forces `bash`
+  as the default shell so the existing `${VAR}`-style steps work identically on Windows'
+  Git Bash instead of falling back to incompatible pwsh syntax.
+
 - Remove stale `# pragma: no cover` markers on `get_metadata_package()`'s `ValueError`/
   `PackageNotFoundError` fallbacks in `about.py`. Both branches are already exercised by
   `tests/test_about.py` and hit 100% coverage on their own; the pragmas were just masking