Windows CI: clcache fails with "[WinError 5] Access is denied" on stats.txt

[P4suta]

node-compile-windows has been failing since 2026-09-11 with:

Error: [WinError 5] Access is denied: 'C:\Users\Administrator\clcache\stats.txt.new' -> 'C:\Users\Administrator\clcache\stats.txt'

Scope

Per the reliability reports this first appears on 2026-09-11 and has recurred every day since — 20 PRs over 6 days, on all six test-rackspace-win2022_vs2022-x64-* machines and all four compile configs (win-vs2022, -x86, -arm64, and node-compile-windows-debug). The v22.23.3 proposal (nodejs/node#65448) is among the affected runs.

Reports: 09-11 · 09-12 · 09-13 · 09-14 · 09-15 · 09-16

Where it fails

# clcache/__main__.py
@contextlib.contextmanager
def atomicWrite(fileName):
    tempFileName = fileName + '.new'
    with open(tempFileName, 'w') as f:
        yield f
    os.replace(tempFileName, fileName)   # <- WinError 5

Known upstream bug, and upstream is archived

frerich/clcache#342 reports the identical error. It is still open, and the repository was archived on 2019-12-11, so no upstream fix is coming. All 81 forks are stale too.

The trigger, though, is on our side

That thread identifies the cause as the cache living under the user profile, and the confirmed workaround is to point CLCACHE_DIR elsewhere:

you should move clcache dir, not clcache binary. It can be configured through CLCACHE_DIR environment

It works with threads > 4 after I set CLCACHE_DIR=C:\clcache_dir

jenkins/scripts/windows/compile.cmd sets CLCACHE_BASEDIR (path normalisation) but never CLCACHE_DIR, so the cache defaults to %USERPROFILE%\clcache = C:\Users\Administrator\clcache — exactly the path in the error.

Possibly related: clcache creates its lock in the session-local namespace ('Local\\' + mutexName) while the cache directory is shared machine-wide.

Options

1. DISABLE_CLCACHE=1 — immediate stop-gap; the opt-out already exists in compile.cmd.
2. Set CLCACHE_DIR outside the profile — the upstream-verified workaround. PR: jenkins,win: move clcache cache out of user profile #4472
3. Longer term, move MSVC builds to ccache. The pieces look like they may already be in place: the ansible role installs C:\ccache\cl.exe "for MSVC", vcbuild.bat ccache <path> is not clang-specific, and tools/msvs/props_4_ccache.props exists — compile.cmd just gates ccache behind if %not_clang% equ 0. Is there a reason MSVC was kept on clcache? You'll know better than me.

Not verified

I can't read ci.nodejs.org console logs (anonymous access is denied), so this is reconstructed from the reliability reports and the clcache sources — I haven't seen a full traceback. I also don't know how many executors run per Windows machine, which would matter for the concurrency theory.

[P4suta]

Disclosure: I used Claude Code to sweep the reliability reports and trace the failure into the clcache sources. I verified each claim against the linked reports, compile.cmd, and the upstream issue before posting. I have not been able to check the Jenkins console logs, as noted above.