fix(tests): adapt tests for windows CI runner

Two failure modes surfaced only after windows-latest joined the test
matrix:

1. apply_test.go::TestResolveTemplatePaths/path_outside_rootDir_is_kept_as-is
   hardcoded /other/project/templates/controlplane.yaml as the
   outside-root input. That string is absolute on POSIX but not on
   Windows (no drive letter), so the resolver treated it as relative,
   joined it with tmpRoot, and produced 'other/project/...' instead of
   keeping it as-is. Construct the absolute path via
   filepath.VolumeName + filepath.Separator so it is absolute on both
   OSes, and expect filepath.ToSlash(absOutside) as the normalized
   result.

2. DACL assertions in secureperm_windows_test.go and
   template_windows_test.go used strings.Contains(sddl, fullSid) to
   verify the trustee. On GitHub Actions windows-latest the runner's
   RID-500 admin account is emitted as the SDDL alias 'LA' rather than
   the literal SID, so the substring check failed. Extract the ACE
   trustee via regex and resolve it through windows.StringToSid (which
   accepts both literal SIDs and well-known aliases), then compare
   against the current user SID with windows.EqualSid.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>

Author: lexfrei

pkg/commands/apply_test.go

@@ -96,6 +96,12 @@ func TestResolveTemplatePaths(t *testing.T) {
 		t.Fatalf("failed to create templates dir: %v", err)
 	}
 
+	// Build a platform-portable absolute path outside tmpRoot.
+	// filepath.VolumeName is "" on POSIX (yielding e.g. "/other/...") and
+	// "C:" on Windows (yielding "C:\other\..."). Both are absolute and
+	// definitely outside tmpRoot (which lives under the user temp dir).
+	absOutside := filepath.Join(filepath.VolumeName(tmpRoot), string(filepath.Separator), "other", "project", "templates", "controlplane.yaml")
+
 	tests := []struct {
 		name      string
 		templates []string
@@ -127,10 +133,14 @@ func TestResolveTemplatePaths(t *testing.T) {
 			want:      []string{"templates/controlplane.yaml"},
 		},
 		{
+			// Constructed to be absolute on both POSIX and Windows so the
+			// filepath.IsAbs branch is exercised on both CI runners. The
+			// resolver normalizes outside-root paths via filepath.ToSlash,
+			// so the expected output is the forward-slash form.
 			name:      "path outside rootDir is kept as-is",
-			templates: []string{"/other/project/templates/controlplane.yaml"},
+			templates: []string{absOutside},
 			rootDir:   tmpRoot,
-			want:      []string{"/other/project/templates/controlplane.yaml"},
+			want:      []string{filepath.ToSlash(absOutside)},
 		},
 	}
 

pkg/commands/template_windows_test.go

@@ -19,6 +19,7 @@ package commands
 import (
 	"os"
 	"path/filepath"
+	"regexp"
 	"strings"
 	"testing"
 
@@ -119,15 +120,34 @@ func TestWriteInplaceRendered_ProtectedDACL_Windows(t *testing.T) {
 	if err != nil {
 		t.Fatalf("GetTokenUser: %v", err)
 	}
-	wantSid := tu.User.Sid.String()
 
 	if !strings.Contains(sddl, "D:P") {
 		t.Errorf("DACL not protected; SDDL=%q", sddl)
 	}
 	if got := strings.Count(sddl, "(A;"); got != 1 {
 		t.Errorf("DACL has %d Allow ACEs, want 1; SDDL=%q", got, sddl)
 	}
-	if !strings.Contains(sddl, wantSid) {
-		t.Errorf("DACL does not reference current user SID %q; SDDL=%q", wantSid, sddl)
+
+	// SDDL emits well-known SIDs as aliases (e.g. the RID-500 admin on
+	// GitHub Actions runners comes back as "LA" rather than the full
+	// "S-1-5-21-...-500"). Resolve the trustee string back through
+	// StringToSid and compare with EqualSid to get a robust match.
+	re := regexp.MustCompile(`\(A;([^)]+)\)`)
+	m := re.FindStringSubmatch(sddl)
+	if len(m) < 2 {
+		t.Fatalf("no Allow ACE found in SDDL %q", sddl)
+	}
+	fields := strings.Split(m[1], ";")
+	if len(fields) < 5 {
+		t.Fatalf("unexpected ACE shape %q", m[1])
+	}
+	trusteeStr := fields[4]
+	aceSid, err := windows.StringToSid(trusteeStr)
+	if err != nil {
+		t.Fatalf("StringToSid(%q): %v", trusteeStr, err)
+	}
+	if !windows.EqualSid(aceSid, tu.User.Sid) {
+		t.Errorf("ACE trustee %q (SID %s) != current user SID %s",
+			trusteeStr, aceSid.String(), tu.User.Sid.String())
 	}
 }

pkg/secureperm/secureperm_windows_test.go

@@ -19,6 +19,7 @@ package secureperm_test
 import (
 	"os"
 	"path/filepath"
+	"regexp"
 	"strings"
 	"testing"
 
@@ -27,6 +28,52 @@ import (
 	"github.com/cozystack/talm/pkg/secureperm"
 )
 
+// extractAllowACETrustee pulls the trustee string out of the first
+// Allow ACE in a SDDL string. SDDL ACE shape:
+//
+//	(ace_type;ace_flags;rights;object_guid;inherit_object_guid;account_sid)
+//
+// The returned string may be a literal SID ("S-1-5-21-...") or a
+// well-known alias ("LA", "BA", "SY", ...) — caller feeds it to
+// windows.StringToSid which accepts both forms.
+func extractAllowACETrustee(sddl string) (string, error) {
+	re := regexp.MustCompile(`\(A;([^)]+)\)`)
+	m := re.FindStringSubmatch(sddl)
+	if len(m) < 2 {
+		return "", &sddlParseError{sddl: sddl, reason: "no Allow ACE"}
+	}
+	fields := strings.Split(m[1], ";")
+	// After the leading "A;" that lives in the regex literal, the inner
+	// fields are: ace_flags, rights, object_guid, inherit_object_guid,
+	// account_sid[, resource_attribute]. Minimum 5 fields.
+	if len(fields) < 5 {
+		return "", &sddlParseError{sddl: sddl, reason: "ACE has fewer than 5 fields"}
+	}
+	return fields[4], nil
+}
+
+type sddlParseError struct{ sddl, reason string }
+
+func (e *sddlParseError) Error() string { return e.reason + ": " + e.sddl }
+
+// assertTrusteeMatches resolves the ACE trustee string (literal SID or
+// SDDL alias) to a SID and compares to wantSid via EqualSid. SDDL
+// output on GitHub Actions runners returns the RID-500 admin as the
+// alias "LA" rather than the literal SID, so a string-contains check
+// against wantSid.String() is not robust. Resolving both sides to
+// canonical *SID and comparing with EqualSid is.
+func assertTrusteeMatches(t *testing.T, trusteeStr string, wantSid *windows.SID) {
+	t.Helper()
+	aceSid, err := windows.StringToSid(trusteeStr)
+	if err != nil {
+		t.Fatalf("StringToSid(%q): %v", trusteeStr, err)
+	}
+	if !windows.EqualSid(aceSid, wantSid) {
+		t.Errorf("ACE trustee %q (SID %s) != current user SID %s",
+			trusteeStr, aceSid.String(), wantSid.String())
+	}
+}
+
 // assertProtectedOwnerOnlyDACL reads the security descriptor back and
 // asserts it is structurally D:P(A;;FA;;;<current-user-SID>) — a
 // protected DACL with exactly one Allow ACE naming the current user.
@@ -58,17 +105,18 @@ func assertProtectedOwnerOnlyDACL(t *testing.T, path string) {
 	if err != nil {
 		t.Fatalf("GetTokenUser: %v", err)
 	}
-	wantSid := tu.User.Sid.String()
 
 	if !strings.Contains(sddl, "D:P") {
 		t.Errorf("DACL is not protected (missing D:P flag); SDDL=%q", sddl)
 	}
 	if got := strings.Count(sddl, "(A;"); got != 1 {
 		t.Errorf("DACL has %d Allow ACEs, want exactly 1; SDDL=%q", got, sddl)
 	}
-	if !strings.Contains(sddl, wantSid) {
-		t.Errorf("DACL does not reference current user SID %q; SDDL=%q", wantSid, sddl)
+	trusteeStr, err := extractAllowACETrustee(sddl)
+	if err != nil {
+		t.Fatalf("extract trustee: %v", err)
 	}
+	assertTrusteeMatches(t, trusteeStr, tu.User.Sid)
 }
 
 // TestWriteFile_NewFile_DACL_Windows pins the happy path: a brand-new