fix(windows): CI matrix, zip archives, and NTFS ACL for sensitive files

.github/workflows/pr.yml

@@ -7,7 +7,11 @@ on:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout
         uses: actions/checkout@v6

.goreleaser.yaml

@@ -25,6 +25,9 @@ archives:
       {{- if eq .Arch "386" }}i386
       {{- else }}{{ .Arch }}{{ end }}
       {{- if .Arm }}v{{ .Arm }}{{ end }}
+    format_overrides:
+      - goos: windows
+        formats: [zip]
 
 checksum:
   name_template: "{{ .ProjectName }}-checksums.txt"

README.md

@@ -50,6 +50,17 @@ Or use simple script to install it:
 curl -sSL https://github.com/cozystack/talm/raw/refs/heads/main/hack/install.sh | sh -s
 ```
 
+### Windows
+
+Windows is supported. Download the `talm-windows-*.zip` archive from the
+[releases page](https://github.com/cozystack/talm/releases/latest) and
+extract `talm.exe`. On Windows, template paths passed to the `-t` /
+`--template` flag accept either `\` or `/` separators, so
+`-t templates\controlplane.yaml` and `-t templates/controlplane.yaml`
+are equivalent. Other path flags (`--talosconfig`, `-f` / `--file`)
+are delegated to the underlying OS file loader and follow standard
+Windows path rules.
+
 ## Getting Started
 
 Create new project

go.mod

@@ -77,7 +77,7 @@ require (
 	golang.org/x/net v0.53.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
 	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.43.0 // indirect
+	golang.org/x/sys v0.43.0
 	golang.org/x/term v0.42.0 // indirect
 	golang.org/x/text v0.36.0 // indirect
 	golang.org/x/time v0.15.0 // indirect

pkg/age/age.go

@@ -26,6 +26,8 @@ import (
 
 	"filippo.io/age"
 	"gopkg.in/yaml.v3"
+
+	"github.com/cozystack/talm/pkg/secureperm"
 )
 
 const (
@@ -65,7 +67,7 @@ func GenerateKey(rootDir string) (*age.X25519Identity, bool, error) {
 	keyData += fmt.Sprintf("# public key: %s\n", publicKey)
 	keyData += identity.String() + "\n"
 
-	if err := os.WriteFile(keyFile, []byte(keyData), 0o600); err != nil {
+	if err := secureperm.WriteFile(keyFile, []byte(keyData)); err != nil {
 		return nil, false, fmt.Errorf("failed to write key file: %w", err)
 	}
 
@@ -263,7 +265,7 @@ func DecryptSecretsFile(rootDir string) error {
 	}
 
 	// Write decrypted file with secure permissions
-	if err := os.WriteFile(secretsFile, decryptedData, 0o600); err != nil {
+	if err := secureperm.WriteFile(secretsFile, decryptedData); err != nil {
 		return fmt.Errorf("failed to write decrypted file: %w", err)
 	}
 
@@ -652,7 +654,7 @@ func DecryptYAMLFile(rootDir, encryptedFile, plainFile string) error {
 	}
 
 	// Write decrypted file with secure permissions
-	if err := os.WriteFile(plainFilePath, decryptedData, 0o600); err != nil {
+	if err := secureperm.WriteFile(plainFilePath, decryptedData); err != nil {
 		return fmt.Errorf("failed to write decrypted file: %w", err)
 	}
 

pkg/age/age_unix_test.go

@@ -0,0 +1,54 @@
+//go:build !windows
+
+// Copyright Cozystack Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package age_test
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/cozystack/talm/pkg/age"
+)
+
+// TestGenerateKey_Mode0600_Unix pins that the age private key file
+// is written with owner-only permissions. The file contains the raw
+// X25519 private key that protects every encrypted secret in the
+// project — if a future refactor ever swaps secureperm.WriteFile
+// back to os.WriteFile with a different mode, this test fails.
+func TestGenerateKey_Mode0600_Unix(t *testing.T) {
+	dir := t.TempDir()
+
+	identity, created, err := age.GenerateKey(dir)
+	if err != nil {
+		t.Fatalf("GenerateKey: %v", err)
+	}
+	if !created {
+		t.Fatal("expected GenerateKey to create a new key in an empty dir")
+	}
+	if identity == nil {
+		t.Fatal("nil identity from GenerateKey")
+	}
+
+	keyPath := filepath.Join(dir, "talm.key")
+	info, err := os.Stat(keyPath)
+	if err != nil {
+		t.Fatalf("Stat: %v", err)
+	}
+	if got := info.Mode().Perm(); got != 0o600 {
+		t.Errorf("talm.key mode = %o, want 0600", got)
+	}
+}

pkg/commands/apply.go

@@ -420,6 +420,15 @@ func wrapWithNodeContext(f func(ctx context.Context, c *client.Client) error) fu
 	}
 }
 
+// isOutsideRoot reports whether a cleaned relative path escapes the
+// project root. A HasPrefix(".." ) test would misclassify sibling
+// directories whose first path element merely starts with "..", such
+// as "..templates/controlplane.yaml"; we match a full path element
+// instead.
+func isOutsideRoot(relPath string) bool {
+	return relPath == ".." || strings.HasPrefix(relPath, ".."+string(filepath.Separator))
+}
+
 // resolveTemplatePaths resolves template file paths relative to the project root,
 // normalizing them for the Helm engine (forward slashes).
 // Relative paths from the modeline are resolved against rootDir, not CWD.
@@ -461,7 +470,7 @@ func resolveTemplatePaths(templates []string, rootDir string) []string {
 			continue
 		}
 		relPath = filepath.Clean(relPath)
-		if strings.HasPrefix(relPath, "..") {
+		if isOutsideRoot(relPath) {
 			// Path goes outside project root — use original path as-is
 			resolved[i] = engine.NormalizeTemplatePath(templatePath)
 			continue

pkg/commands/apply_test.go

@@ -114,6 +114,18 @@ func TestResolveTemplatePaths(t *testing.T) {
 	if err := os.MkdirAll(filepath.Join(tmpRoot, "templates"), 0o755); err != nil {
 		t.Fatalf("failed to create templates dir: %v", err)
 	}
+	// A sibling directory whose name literally starts with "..". A naive
+	// HasPrefix(relPath, "..") check would misclassify it as outside-root;
+	// the resolver must treat ".." as a full path element, not a prefix.
+	if err := os.MkdirAll(filepath.Join(tmpRoot, "..templates"), 0o755); err != nil {
+		t.Fatalf("failed to create ..templates dir: %v", err)
+	}
+
+	// Build a platform-portable absolute path outside tmpRoot.
+	// filepath.VolumeName is "" on POSIX (yielding e.g. "/other/...") and
+	// "C:" on Windows (yielding "C:\other\..."). Both are absolute and
+	// definitely outside tmpRoot (which lives under the user temp dir).
+	absOutside := filepath.Join(filepath.VolumeName(tmpRoot), string(filepath.Separator), "other", "project", "templates", "controlplane.yaml")
 
 	tests := []struct {
 		name      string
@@ -146,10 +158,23 @@ func TestResolveTemplatePaths(t *testing.T) {
 			want:      []string{"templates/controlplane.yaml"},
 		},
 		{
+			// Constructed to be absolute on both POSIX and Windows so the
+			// filepath.IsAbs branch is exercised on both CI runners. The
+			// resolver normalizes outside-root paths via filepath.ToSlash,
+			// so the expected output is the forward-slash form.
 			name:      "path outside rootDir is kept as-is",
-			templates: []string{"/other/project/templates/controlplane.yaml"},
+			templates: []string{absOutside},
+			rootDir:   tmpRoot,
+			want:      []string{filepath.ToSlash(absOutside)},
+		},
+		{
+			// Directory name literally starting with "..". If the
+			// outside-root check used HasPrefix("..") it would wrongly
+			// drop this path back to the original input.
+			name:      "sibling dir whose name starts with .. is inside rootDir",
+			templates: []string{"..templates/controlplane.yaml"},
 			rootDir:   tmpRoot,
-			want:      []string{"/other/project/templates/controlplane.yaml"},
+			want:      []string{"..templates/controlplane.yaml"},
 		},
 	}
 
@@ -715,3 +740,33 @@ machine:
 	// itself. The modeline round-trip tests in pkg/modeline surface a
 	// regression that would wire MergeFileAsPatch into generateOutput.
 }
+
+// TestIsOutsideRoot pins the contract that distinguishes a path that
+// truly escapes the project root (".." or a first element of "..")
+// from a path whose first element merely *starts* with ".." but is
+// itself a valid sibling-directory name (e.g. "..templates"). The
+// distinction matters wherever a caller routes inside-root paths
+// differently from outside-root ones; a HasPrefix("..") test
+// silently misclassifies the latter as outside-root.
+func TestIsOutsideRoot(t *testing.T) {
+	cases := []struct {
+		relPath string
+		want    bool
+	}{
+		{"..", true},
+		{".." + string(filepath.Separator) + "foo", true},
+		{".." + string(filepath.Separator) + "foo" + string(filepath.Separator) + "bar", true},
+		{"..foo", false},
+		{"..foo" + string(filepath.Separator) + "bar", false},
+		{"..templates" + string(filepath.Separator) + "controlplane.yaml", false},
+		{"..mykube", false},
+		{"foo", false},
+		{"foo" + string(filepath.Separator) + "..bar", false},
+		{".", false},
+	}
+	for _, c := range cases {
+		if got := isOutsideRoot(c.relPath); got != c.want {
+			t.Errorf("isOutsideRoot(%q) = %v, want %v", c.relPath, got, c.want)
+		}
+	}
+}

pkg/commands/apply_windows_test.go

@@ -0,0 +1,97 @@
+//go:build windows
+
+// Copyright Cozystack Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package commands
+
+import (
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// TestResolveTemplatePaths_BackslashInput pins that users running
+// `talm apply` from PowerShell with template arguments that use
+// backslash separators (e.g. "templates\worker.yaml") end up with
+// forward-slash paths. The downstream helm engine only looks up
+// templates by forward-slash map keys, so anything else fails with
+// "template not found".
+func TestResolveTemplatePaths_BackslashInput(t *testing.T) {
+	rootDir := t.TempDir()
+	absRoot, err := filepath.Abs(rootDir)
+	if err != nil {
+		t.Fatalf("abs root: %v", err)
+	}
+
+	tests := []struct {
+		name  string
+		input string
+		want  string
+	}{
+		{
+			name:  "relative with backslash",
+			input: `templates\controlplane.yaml`,
+			want:  "templates/controlplane.yaml",
+		},
+		{
+			name:  "relative nested backslashes",
+			input: `templates\nested\worker.yaml`,
+			want:  "templates/nested/worker.yaml",
+		},
+		{
+			name:  "mixed separators",
+			input: `templates\nested/worker.yaml`,
+			want:  "templates/nested/worker.yaml",
+		},
+		{
+			name:  "absolute path inside root",
+			input: filepath.Join(absRoot, "templates", "controlplane.yaml"),
+			want:  "templates/controlplane.yaml",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := resolveTemplatePaths([]string{tt.input}, rootDir)
+			if len(got) != 1 {
+				t.Fatalf("expected 1 result, got %d", len(got))
+			}
+			if got[0] != tt.want {
+				t.Errorf("resolveTemplatePaths(%q) = %q, want %q", tt.input, got[0], tt.want)
+			}
+		})
+	}
+}
+
+// TestResolveTemplatePaths_OutsideRoot_Backslash asserts that a
+// backslash path resolving outside rootDir still emerges without any
+// backslashes — the helm engine only looks up templates by forward-
+// slash map keys, so regardless of which internal branch the function
+// takes (Rel-success, Rel-failure, prefix-checks), the result must be
+// backslash-free. Constructing `outside` via filepath.Join on rootDir
+// keeps the test on the same drive as t.TempDir() and works on any
+// GitHub Actions runner image.
+func TestResolveTemplatePaths_OutsideRoot_Backslash(t *testing.T) {
+	rootDir := t.TempDir()
+	outside := filepath.Join(rootDir, "..", "..", "..", "elsewhere", "templates", "foo.yaml")
+
+	got := resolveTemplatePaths([]string{outside}, rootDir)
+	if len(got) != 1 {
+		t.Fatalf("expected 1 result, got %d", len(got))
+	}
+	if strings.ContainsRune(got[0], '\\') {
+		t.Errorf("result still contains backslash: %q", got[0])
+	}
+}