chore: Fix noisy errors in Windows CI build logs

[danskmt]

Pull Request Submission Checklist

• Follows CONTRIBUTING guidelines
• Commit messages are release-note ready, emphasizing what was changed, not how.
• Includes detailed description of changes
• Contains risk assessment (Low | Medium | High)
• Highlights breaking API changes (if applicable)
• Links to automated tests covering new functionality
• Includes manual testing instructions (if necessary)
• Updates relevant GitBook documentation (PR link: ___)
• Includes product update to be announced in the next stable release notes

What does this PR do?

Fixes four categories of noisy error messages that appear in the build windows amd64 CI logs. None were breaking the build, but they were confusing and one masked a latent issue with the bash PATH setup.

1. export: command not found — PowerShell Out-File -Encoding UTF8 writes a UTF-8 BOM that breaks bash source. Replaced with [System.IO.File]::AppendAllText() using BOM-free UTF-8 in all scripts that write to snyk-env.sh.

2. CreateProcess(NULL, python3 --version, ...) failed + pipe: Bad file descriptor — Root Makefile unconditionally runs python3 --version via $(shell ...), which fails on Windows (no python3.exe). Moved the probe inside an ifneq ($(GOHOSTOS), windows) guard.

3. File not found - *.go — cliv2/Makefile uses Unix find to populate SRCS, but Windows resolves find to its built-in text-search tool. Replaced with $(GOCMD) list which is cross-platform.

4. Cache key bump — Bumped windows-tools-cache-v4 → v5 to flush any cached BOM-prefixed snyk-env.sh files.

Where should the reviewer start?

• Makefile — python3 probe guard (smallest change)
• cliv2/Makefile — SRCS now uses go list instead of Unix find
• scripts/windows/install-*.ps1 — BOM-free writing pattern
• .circleci/config.yml — BOM fix in install-go + cache key bump

How should this be manually tested?

The changes are CI-only. Validation:

1. Merge and let the build windows amd64 job run
2. Verify the error messages no longer appear in the build logs
3. Verify the build still succeeds

What's the product update that needs to be communicated to CLI users?

None. Internal CI build cleanup with no user-facing changes.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Semantic Change in File Tracking 🟠 [major] The transition from find to go list ./... for populating the SRCS variable changes which files are tracked by the build system. go list excludes files based on current build tags (e.g., linux-only files on a windows host) and excludes all _test.go files. If SRCS is used for linting, formatting, or as a dependency for cross-compiled builds, this change will cause relevant files to be ignored or result in stale binaries when cross-compiling from a host where those files are excluded by build constraints. SRCS = $(shell $(GOCMD) list -f '{{range .GoFiles}}{{$$.Dir}}/{{.}} {{end}}' ./...)

📚 Repository Context Analyzed This review considered 15 relevant code sections from 9 files (average relevance: 0.37) scripts/windows/install-node.ps1 (lines 1-70) dangerfile.js (lines 1-111) CONTRIBUTING.md (3 segments, lines 1-218) release-scripts/write-ls-protocol-version.go (lines 1-298) scripts/windows/install-dotnet-sdk.ps1 (lines 1-100) scripts/windows/install-maven.ps1 (2 segments, lines 1-100) scripts/windows/install-python3.ps1 (2 segments, lines 1-100) ... and 2 more file(s)