diff --git a/.codefresh/Dockerfile.win-1809 b/.codefresh/Dockerfile.win-1809
new file mode 100644
index 0000000000..c5169f97eb
--- /dev/null
+++ b/.codefresh/Dockerfile.win-1809
@@ -0,0 +1,103 @@
+ARG core=mcr.microsoft.com/windows/servercore:1809
+ARG target=mcr.microsoft.com/powershell:windowsservercore-1809
+
+FROM $core as download
+
+ARG node_version=10.13.0
+ARG yarn_version=1.13.0
+
+SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"]
+
+ENV GPG_VERSION 2.3.4
+
+RUN Invoke-WebRequest $('https://files.gpg4win.org/gpg4win-vanilla-{0}.exe' -f $env:GPG_VERSION) -OutFile 'gpg4win.exe' -UseBasicParsing ; \
+    Start-Process .\gpg4win.exe -ArgumentList '/S' -NoNewWindow -Wait
+
+RUN @( \
+    '94AE36675C464D64BAFA68DD7434390BDBE9B9C5', \
+    'FD3A5288F042B6850C66B31F09FE44734EB7990E', \
+    '71DCFD284A79C3B38668286BC97EC7A07EDE3FC1', \
+    'DD8F2338BAE7501E3DD5AC78C273792F7D83545D', \
+    'C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8', \
+    'B9AE9905FFD7803F25714661B63B535A4C206CA9', \
+    '77984A986EBC2AA786BC0F66B01FBB92821C587A', \
+    '8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600', \
+    '4ED778F539E3634C779C87C6D7062848A1AB005C', \
+    'A48C2BEE680E841632CD4E44F07496B3EB3C1762', \
+    'B9E2F5981AA6E0CD28160D9FF13993A75599653C' \
+    ) | foreach { \
+      gpg --keyserver ha.pool.sks-keyservers.net --recv-keys $_ ; \
+    }
+
+ENV NODE_VERSION=$node_version
+
+RUN Invoke-WebRequest $('https://nodejs.org/dist/v{0}/SHASUMS256.txt.asc' -f $env:NODE_VERSION) -OutFile 'SHASUMS256.txt.asc' -UseBasicParsing ; \
+    gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc
+
+RUN Invoke-WebRequest $('https://nodejs.org/dist/v{0}/node-v{0}-win-x64.zip' -f $env:NODE_VERSION) -OutFile 'node.zip' -UseBasicParsing ; \
+    $sum = $(cat SHASUMS256.txt.asc | sls $('  node-v{0}-win-x64.zip' -f $env:NODE_VERSION)) -Split ' ' ; \
+    if ((Get-FileHash node.zip -Algorithm sha256).Hash -ne $sum[0]) { Write-Error 'SHA256 mismatch' } ; \
+    Expand-Archive node.zip -DestinationPath C:\ ; \
+    Rename-Item -Path $('C:\node-v{0}-win-x64' -f $env:NODE_VERSION) -NewName 'C:\nodejs'
+
+ENV YARN_VERSION=$yarn_version
+
+RUN [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 ; \
+    Invoke-WebRequest $('https://yarnpkg.com/downloads/{0}/yarn-{0}.msi' -f $env:YARN_VERSION) -OutFile yarn.msi -UseBasicParsing ; \
+    $sig = Get-AuthenticodeSignature yarn.msi ; \
+    if ($sig.Status -ne 'Valid') { Write-Error 'Authenticode signature is not valid' } ; \
+    Write-Output $sig.SignerCertificate.Thumbprint ; \
+    if (@( \
+      '7E253367F8A102A91D04829E37F3410F14B68A5F', \
+      'AF764E1EA56C762617BDC757C8B0F3780A0CF5F9' \
+      ) -notcontains $sig.SignerCertificate.Thumbprint) { Write-Error 'Unknown signer certificate' } ; \
+    Start-Process msiexec.exe -ArgumentList '/i', 'yarn.msi', '/quiet', '/norestart' -NoNewWindow -Wait
+
+ENV GIT_VERSION 2.20.1
+ENV GIT_DOWNLOAD_URL https://github.com/git-for-windows/git/releases/download/v${GIT_VERSION}.windows.1/MinGit-${GIT_VERSION}-busybox-64-bit.zip
+ENV GIT_SHA256 9817ab455d9cbd0b09d8664b4afbe4bbf78d18b556b3541d09238501a749486c
+
+RUN [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 ; \
+    Invoke-WebRequest -UseBasicParsing $env:GIT_DOWNLOAD_URL -OutFile git.zip; \
+    if ((Get-FileHash git.zip -Algorithm sha256).Hash -ne $env:GIT_SHA256) {exit 1} ; \
+    Expand-Archive git.zip -DestinationPath C:\git; \
+    Remove-Item git.zip
+
+FROM $target as baseimage
+
+ENV NPM_CONFIG_LOGLEVEL info
+
+COPY --from=download /nodejs /nodejs
+COPY --from=download [ "/Program Files (x86)/yarn", "/yarn" ]
+COPY --from=download /git /git
+
+ARG SETX=/M
+RUN setx %SETX% PATH "%PATH%;C:\nodejs;C:\yarn\bin;C:\git\cmd;C:\git\mingw64\bin;C:\git\usr\bin"
+
+CMD [ "node.exe" ]        
+
+FROM baseimage
+
+SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"]
+
+RUN Invoke-WebRequest -UseBasicParsing 'https://www.7-zip.org/a/7z1805-x64.exe' -OutFile 7z.exe; \
+    Start-Process -FilePath 'C:\\7z.exe' -ArgumentList '/S', '/D=C:\\7zip0' -NoNewWindow -Wait; \
+    Invoke-WebRequest -UseBasicParsing 'http://repo.msys2.org/distrib/x86_64/msys2-base-x86_64-20180531.tar.xz' -OutFile msys2.tar.xz; \
+    Start-Process -FilePath 'C:\\7zip\\7z' -ArgumentList 'e', 'msys2.tar.xz' -Wait; \
+    Start-Process -FilePath 'C:\\7zip\\7z' -ArgumentList 'x', 'msys2.tar', '-oC:\\' -Wait; \
+    Remove-Item msys2.tar.xz; \
+    Remove-Item msys2.tar; \
+    Remove-Item 7z.exe; \
+    Remove-Item -Recurse 7zip; \
+    [Environment]::SetEnvironmentVariable('Path', $env:Path + ';C:\msys64\usr\bin', [System.EnvironmentVariableTarget]::Machine); \
+    [Environment]::SetEnvironmentVariable('BAZEL_SH', 'C:\msys64\usr\bin\bash.exe', [System.EnvironmentVariableTarget]::Machine); \
+    Invoke-WebRequest -UseBasicParsing 'https://download.microsoft.com/download/9/3/F/93FCF1E7-E6A4-478B-96E7-D4B285925B00/vc_redist.x64.exe' -OutFile vc_redist.x64.exe; \
+    Start-Process 'c:\\vc_redist.x64.exe' -ArgumentList '/Install', '/Passive', '/NoRestart' -NoNewWindow -Wait; \
+    Remove-Item vc_redist.x64.exe
+
+# Add a fix for https://github.com/docker/for-win/issues/2920 as entry point to the container.
+SHELL ["cmd", "/c"]
+COPY "fix-msys64.cmd" "C:\\fix-msys64.cmd"
+ENTRYPOINT cmd /C C:\\fix-msys64.cmd && cmd /c
+
+CMD ["cmd.exe"]
\ No newline at end of file
diff --git a/.codefresh/README.md b/.codefresh/README.md
new file mode 100644
index 0000000000..88d0102a05
--- /dev/null
+++ b/.codefresh/README.md
@@ -0,0 +1,31 @@
+# CodeFresh configuration
+
+This folder contains configuration for the [CodeFresh](<https://codefresh.io/> based CI checks for this repository.
+
+## The build pipeline
+
+CodeFresh uses a several pipeline for each repository. The `codefresh.yml` file defines pipeline [build steps](https://codefresh.io/docs/docs/configure-ci-cd-pipeline/introduction-to-codefresh-pipelines/) for this repository.
+
+Run results can be seen in the GitHub checks interface and in the [public pipeline dashboard](https://g.codefresh.io/public/accounts/angular/pipelines/angular/angular/angular).
+
+Although most configuration is done via `pipeline.yml`, some options are only available in the online [pipeline settings](https://g.codefresh.io/pipelines/angular/services?repoOwner=angular&repoName=angular&project=angular%2Fangular&context=github&serviceName=angular%2Fangular), which needs a login to access.
+
+
+## Caretaker
+
+CodeFresh status can be found at <http://status.codefresh.io/>.
+
+Issues related to the CodeFresh setup should be escalated to the Tools Team via the current caretaker, followed by Alex Eagle and Filipe Silva.
+
+## Rollout strategy
+
+Currently it is only used for tests on Windows platforms, on the master branch, and without pushing user-facing reports. It's only possible to see current builds in the [public pipeline dashboard](https://g.codefresh.io/public/accounts/angular/pipelines/angular/angular/angular).
+
+After a week or two of running like this, we should reassess how stable and reliable it is. 
+
+Next steps include:
+- building PRs
+- showing build status publicly
+- blocking PRs that break the build
+- expanding the test suite
+
diff --git a/.codefresh/bazel.rc b/.codefresh/bazel.rc
new file mode 100644
index 0000000000..e4f8426a4f
--- /dev/null
+++ b/.codefresh/bazel.rc
@@ -0,0 +1,40 @@
+# These options are enabled when running on CI
+# We do this by copying this file to /etc/bazel.bazelrc at the start of the build.
+# See documentation in /docs/BAZEL.md
+
+# Save downloaded repositories in a location that can be cached by CodeFresh. This helps us
+# speeding up the analysis time significantly with Bazel managed node dependencies on the CI.
+# build --repository_cache=C:/codefresh/volume/bazel_repository_cache
+
+# Don't be spammy in the logs
+# TODO(gmagolan): Hide progress again once build performance improves
+# Presently, CircleCI can timeout during bazel test ... with the following
+# error: Too long with no output (exceeded 10m0s)
+# build --noshow_progress
+
+# Print all the options that apply to the build.
+# This helps us diagnose which options override others
+# (e.g. /etc/bazel.bazelrc vs. tools/bazel.rc)
+build --announce_rc
+
+# Workaround https://github.com/bazelbuild/bazel/issues/3645
+# Bazel doesn't calculate the memory ceiling correctly when running under Docker.
+# Limit Bazel to consuming resources that fit in CodeFresh VMs
+# TODO(filipesilva): determine the correct memory limit
+build --local_resources=8000,8.0,1.0
+
+# Retry in the event of flakes, eg. https://circleci.com/gh/angular/angular/31309
+test --flaky_test_attempts=2
+
+# More details on failures
+build --verbose_failures=true
+
+# Include PATH in Windows build/tests
+# https://github.com/bazelbuild/rules_typescript/pull/356
+build --action_env=PATH
+test --action_env=PATH --test_env=PATH
+
+# Exclude tests known to not work on Windows.
+
+# Chrome web tests are currently broken.
+test --test_tag_filters=-browser:chromium-local
diff --git a/.codefresh/codefresh.yml b/.codefresh/codefresh.yml
new file mode 100644
index 0000000000..9454a339fc
--- /dev/null
+++ b/.codefresh/codefresh.yml
@@ -0,0 +1,26 @@
+version: '1.0'
+
+steps:
+  BuildImage:
+    type: build
+    image_name: node-bazel-windows
+    working_directory: ./.codefresh
+    no_cf_cache: true
+    build_arguments:
+      - node_version=10.13.0
+      - yarn_version=1.13.0
+    dockerfile: ./Dockerfile.win-1809
+
+  RunTests:
+    title: Run Example
+    image: ${{BuildImage}}
+    commands:
+    # Install dependencies
+    - yarn install --frozen-lockfile --non-interactive --network-timeout 100000 --no-progress
+    # Create symlinks needed for Windows.
+    - scripts\windows\create-symlinks.cmd
+    # Add Bazel CI config
+    - copy .codefresh\bazel.rc %ProgramData%\bazel.bazelrc
+    # Run tests
+    - yarn bazel test //tools/ts-api-guardian:all
+    - yarn test-ivy-aot //packages/animations/test //packages/common/test //packages/forms/test //packages/http/test //packages/platform-browser/test //packages/platform-browser-dynamic/test //packages/router/test
diff --git a/.codefresh/fix-msys64.cmd b/.codefresh/fix-msys64.cmd
new file mode 100644
index 0000000000..3869596d08
--- /dev/null
+++ b/.codefresh/fix-msys64.cmd
@@ -0,0 +1,6 @@
+@echo off
+REM Fix for https://github.com/docker/for-win/issues/2920
+REM echo "Fixing msys64 folder..."
+REM Touch all .dll files inside C:\msys64\
+forfiles /p C:\msys64\ /s /m *.dll /c "cmd /c Copy /B @path+,, >NUL"
+REM echo "Fixed msys64 folder."
\ No newline at end of file
diff --git a/package.json b/package.json
index 23c4b83bb5..adfa9c2e0f 100644
--- a/package.json
+++ b/package.json
@@ -110,7 +110,7 @@
   "// 3": "when updating @bazel/bazel version you also need to update the RBE settings in .bazelrc (see https://github.com/angular/angular/pull/27935)",
   "devDependencies": {
     "@angular/cli": "^7.3.2",
-    "@bazel/bazel": "0.23.0",
+    "@bazel/bazel": "0.23.2",
     "@bazel/buildifier": "^0.19.2",
     "@bazel/ibazel": "~0.9.0",
     "@types/minimist": "^1.2.0",
diff --git a/scripts/windows/create-symlinks.cmd b/scripts/windows/create-symlinks.cmd
new file mode 100644
index 0000000000..4b93d90b60
--- /dev/null
+++ b/scripts/windows/create-symlinks.cmd
@@ -0,0 +1,2 @@
+move /Y packages\upgrade\static\src packages\upgrade\static\src.old
+mklink /D packages\upgrade\static\src ..\src
diff --git a/yarn.lock b/yarn.lock
index 6c8363320a..b9bc0a552e 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -80,29 +80,29 @@
     semver "5.6.0"
     symbol-observable "1.2.0"
 
-"@bazel/bazel-darwin_x64@0.23.0":
-  version "0.23.0"
-  resolved "https://registry.yarnpkg.com/@bazel/bazel-darwin_x64/-/bazel-darwin_x64-0.23.0.tgz#11f40d23d282e3034da5c223462f17924adc6c42"
-  integrity sha512-kEn+SzN9zK2dHeKpTpkZma4ZqZdlzEagYLf2EY7yqRWKpD8oW5MZ2S2JxwvR4w1ZrHCth/x4dFsxwPlNA585JQ==
+"@bazel/bazel-darwin_x64@0.23.2":
+  version "0.23.2"
+  resolved "https://registry.yarnpkg.com/@bazel/bazel-darwin_x64/-/bazel-darwin_x64-0.23.2.tgz#619544c9ef444af71d4f4603c0874da951ad1949"
+  integrity sha512-wLqOtUm9Lr5EMePLqimgePB3GLU9ZJ/FE0ZawcQbKWXROGaGB2cTkOCpPp13T5fGY0Y7tJ/jjzIMBqphfyebLA==
 
-"@bazel/bazel-linux_x64@0.23.0":
-  version "0.23.0"
-  resolved "https://registry.yarnpkg.com/@bazel/bazel-linux_x64/-/bazel-linux_x64-0.23.0.tgz#5c3a0ebc9e68fa3a4bb7a0d05367febca15897a2"
-  integrity sha512-B+FQOEcrRCM+D/w2hB5uh8j/HiZC2XN4+nthWvgkvdsgiKDXUf0oP/kLCVF/J7T5FAWafky97KDLPPcD6w1Fhg==
+"@bazel/bazel-linux_x64@0.23.2":
+  version "0.23.2"
+  resolved "https://registry.yarnpkg.com/@bazel/bazel-linux_x64/-/bazel-linux_x64-0.23.2.tgz#702d1e78bc12d9f0b8a00861f70e51c30e0f435c"
+  integrity sha512-b2CEoceQdaG5A2pXLbZcQZYk148wpPE141y6o4D9BL8JhbeW0TcnwtCziPVnSiW+nublDk9iNR3eVuNgsxgypw==
 
-"@bazel/bazel-win32_x64@0.23.0":
-  version "0.23.0"
-  resolved "https://registry.yarnpkg.com/@bazel/bazel-win32_x64/-/bazel-win32_x64-0.23.0.tgz#9956051d6f66ccf43ed74f0855522c8c673eff97"
-  integrity sha512-88RfiUwqulva7KmPmgqjYK7EPE1qOwi03jOeDs+U3tb+HUwkyr88t5DKtZU5KBsYjk1UbFFes+RVZtkPmKmcmQ==
+"@bazel/bazel-win32_x64@0.23.2":
+  version "0.23.2"
+  resolved "https://registry.yarnpkg.com/@bazel/bazel-win32_x64/-/bazel-win32_x64-0.23.2.tgz#3c48c8615c2c9c6ee8c67b8f302e94324db153e2"
+  integrity sha512-wjcgN3ecj47osfgX3asiRb37wBd0RNgaTXejOwc7ZUCHKazDUkZzQyYH5S/4RgLaj9sT+cMEXVo1RI4nNRMqIA==
 
-"@bazel/bazel@0.23.0":
-  version "0.23.0"
-  resolved "https://registry.yarnpkg.com/@bazel/bazel/-/bazel-0.23.0.tgz#22e71d55ccebfd76f6f0bd8a15076160adfac61f"
-  integrity sha512-6XQ51t4ssEpdCea0rquiGB6cPr5/1Hef4LyHOzYDI8UnLt3pFAKAfOwEqC7HPD21zX3+usa3zSHrID6oOADppg==
+"@bazel/bazel@0.23.2":
+  version "0.23.2"
+  resolved "https://registry.yarnpkg.com/@bazel/bazel/-/bazel-0.23.2.tgz#94ac42cc29c5bcb6b35fe112624d94c803dd78a8"
+  integrity sha512-FP7sPD13sf0B2c2484DzJl2WzonrYJL2fAKgKl4Of8nBwlgNymvm2JAr3tZE3Ew+s9UwnEBrBDuf3eLn8xC9eg==
   optionalDependencies:
-    "@bazel/bazel-darwin_x64" "0.23.0"
-    "@bazel/bazel-linux_x64" "0.23.0"
-    "@bazel/bazel-win32_x64" "0.23.0"
+    "@bazel/bazel-darwin_x64" "0.23.2"
+    "@bazel/bazel-linux_x64" "0.23.2"
+    "@bazel/bazel-win32_x64" "0.23.2"
 
 "@bazel/buildifier-darwin_x64@0.19.2":
   version "0.19.2"