🌱 Run unit tests on Windows in CI

.gitattributes

@@ -0,0 +1,3 @@
+# Keep LF line endings on every platform so Windows checkouts (core.autocrlf=true) don't rewrite files;
+# test fixtures are compared byte-for-byte.
+* text=auto eol=lf

.github/workflows/main.yml

@@ -83,6 +83,35 @@ jobs:
        with:
          files: "*e2e-coverage.out"
          verbose: true
+  unit-test-windows:
+    # Repo paths are slash-separated and Windows cannot delete open files, so this catches bugs that
+    # are invisible on Linux. `make` is not guaranteed on the Windows image, so run go test directly.
+    name: unit-test (windows)
+    runs-on: windows-latest
+    permissions:
+      contents: read
+    steps:
+     - name: Harden Runner
+       uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
+       with:
+         egress-policy: audit # Windows runners support audit mode only
+     - name: Keep LF line endings
+       # Must run before checkout: test fixtures are compared byte-for-byte.
+       run: |
+        git config --global core.autocrlf false
+        git config --global core.eol lf
+     - name: Clone the code
+       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+     - name: Setup Go
+       uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+       with:
+         go-version: ${{ env.GO_VERSION }}
+         check-latest: true
+     - name: Run unit-tests
+       shell: bash
+       env:
+         SKIP_GINKGO: 1
+       run: go test -race -covermode=atomic $(go list ./...)
   generate-mocks:
     name: generate-mocks
     runs-on: ubuntu-latest

checks/fileparser/github_workflow.go

@@ -17,7 +17,6 @@ package fileparser
 import (
 	"fmt"
 	"path"
-	"path/filepath"
 	"regexp"
 	"strings"
 
@@ -305,7 +304,7 @@ func IsWorkflowFile(pathfn string) bool {
 	// "Workflow files use YAML syntax, and must have either a .yml or .yaml file extension."
 	switch path.Ext(pathfn) {
 	case ".yml", ".yaml":
-		return filepath.Dir(strings.ToLower(pathfn)) == ".github/workflows"
+		return path.Dir(strings.ToLower(pathfn)) == ".github/workflows"
 	default:
 		return false
 	}

checks/raw/pinned_dependencies.go

@@ -18,7 +18,7 @@ import (
 	"bytes"
 	"errors"
 	"fmt"
-	"path/filepath"
+	"path"
 	"reflect"
 	"regexp"
 	"strings"
@@ -323,7 +323,7 @@ func collectDockerfileInsecureDownloads(c *checker.CheckRequest, r *checker.Pinn
 }
 
 func fileIsInVendorDir(pathfn string) bool {
-	cleanedPath := filepath.Clean(pathfn)
+	cleanedPath := path.Clean(pathfn)
 	splitCleanedPath := strings.Split(cleanedPath, "/")
 
 	for _, d := range splitCleanedPath {

checks/raw/pinned_dependencies_test.go

@@ -475,7 +475,7 @@ func TestDockerfilePinning(t *testing.T) {
 			}
 
 			var r checker.PinningDependenciesData
-			_, err = validateDockerfilesPinning(filepath.Join("testdata", tt.filename), content, &r)
+			_, err = validateDockerfilesPinning(filepath.ToSlash(filepath.Join("testdata", tt.filename)), content, &r)
 			if !errCmp(err, tt.err) {
 				t.Error(cmp.Diff(err, tt.err, cmpopts.EquateErrors()))
 			}

clients/azuredevopsrepo/zip_test.go

@@ -58,6 +58,8 @@ func setup(inputFile string) (zipHandler, error) {
 	if err != nil {
 		return zipHandler{}, fmt.Errorf("unable to open testfile: %w", err)
 	}
+	defer tempFile.Close()
+	defer testFile.Close()
 	if _, err := io.Copy(tempFile, testFile); err != nil {
 		return zipHandler{}, fmt.Errorf("unable to do io.Copy: %w", err)
 	}
@@ -203,6 +205,7 @@ func TestExtractZip(t *testing.T) {
 				}
 				if getcontenttest.err == nil {
 					content, err := io.ReadAll(f)
+					f.Close()
 					if err != nil {
 						t.Fatalf("unexpected error: %v", err)
 					}

clients/githubrepo/tarball.go

@@ -167,6 +167,7 @@ func (handler *tarballHandler) extractTarball() error {
 	if err != nil {
 		return fmt.Errorf("os.OpenFile: %w", err)
 	}
+	defer in.Close()
 	gz, err := gzip.NewReader(in)
 	if err != nil {
 		return fmt.Errorf("%w: gzip.NewReader %v %w", errTarballCorrupted, handler.tempTarFile, err)

clients/githubrepo/tarball_test.go

@@ -63,6 +63,8 @@ func setup(inputFile string) (tarballHandler, error) {
 	if err != nil {
 		return tarballHandler{}, fmt.Errorf("unable to open testfile: %w", err)
 	}
+	defer tempFile.Close()
+	defer testFile.Close()
 	if _, err := io.Copy(tempFile, testFile); err != nil {
 		return tarballHandler{}, fmt.Errorf("unable to do io.Copy: %w", err)
 	}
@@ -165,6 +167,7 @@ func TestExtractTarball(t *testing.T) {
 				}
 				if getcontenttest.err == nil {
 					content, err := io.ReadAll(f)
+					f.Close()
 					if err != nil {
 						t.Fatalf("unexpected error: %v", err)
 					}

clients/gitlabrepo/tarball.go

@@ -210,6 +210,7 @@ func (handler *tarballHandler) extractTarball() error {
 	if err != nil {
 		return fmt.Errorf("os.OpenFile: %w", err)
 	}
+	defer in.Close()
 	gz, err := gzip.NewReader(in)
 	if err != nil {
 		return fmt.Errorf("%w: gzip.NewReader %v %w", errTarballCorrupted, handler.tempTarFile, err)

clients/gitlabrepo/tarball_test.go

@@ -56,6 +56,8 @@ func setup(inputFile string) (tarballHandler, error) {
 	if err != nil {
 		return tarballHandler{}, fmt.Errorf("unable to open testfile: %w", err)
 	}
+	defer tempFile.Close()
+	defer testFile.Close()
 	if _, err := io.Copy(tempFile, testFile); err != nil {
 		return tarballHandler{}, fmt.Errorf("unable to do io.Copy: %w", err)
 	}
@@ -158,6 +160,7 @@ func TestExtractTarball(t *testing.T) {
 				}
 				if getcontenttest.err == nil {
 					content, err := io.ReadAll(f)
+					f.Close()
 					if err != nil {
 						t.Fatalf("unexpected error: %v", err)
 					}

clients/localdir/client.go

@@ -23,7 +23,6 @@ import (
 	"io"
 	"io/fs"
 	"os"
-	"path"
 	"path/filepath"
 	"strings"
 	"sync"
@@ -85,9 +84,11 @@ func isDir(p string) (bool, error) {
 }
 
 func trimPrefix(pathfn, clientPath string) string {
-	cleanPath := path.Clean(pathfn)
-	prefix := fmt.Sprintf("%s%s", clientPath, string(os.PathSeparator))
-	return strings.TrimPrefix(cleanPath, prefix)
+	rel, err := filepath.Rel(clientPath, pathfn)
+	if err != nil {
+		return filepath.ToSlash(filepath.Clean(pathfn))
+	}
+	return filepath.ToSlash(rel)
 }
 
 func listFiles(clientPath string, logger *log.Logger) ([]string, error) {

internal/gitfile/gitfile_test.go

@@ -52,9 +52,8 @@ func TestHandler(t *testing.T) {
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
-	t.Cleanup(func() { r.Close() })
-
 	contents, err := io.ReadAll(r)
+	r.Close()
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}

pkg/scorecard/json_test.go

@@ -19,7 +19,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"os"
-	"path"
+	"path/filepath"
 	"strings"
 	"testing"
 	"time"
@@ -473,7 +473,7 @@ func TestJSONOutput(t *testing.T) {
 	if err != nil {
 		t.Fatalf("os.Getwd: %s", err)
 	}
-	schemaLoader := gojsonschema.NewReferenceLoader(fmt.Sprintf("file://%s", path.Join(cwd, "json.v2.schema")))
+	schemaLoader := gojsonschema.NewReferenceLoader(fileURL(filepath.Join(cwd, "json.v2.schema")))
 	schema, err := gojsonschema.NewSchema(schemaLoader)
 	if err != nil {
 		t.Fatalf("gojsonschema.NewSchema: %s", err)
@@ -531,7 +531,7 @@ func TestJSONOutput(t *testing.T) {
 			}
 
 			// Validate schema.
-			docLoader := gojsonschema.NewReferenceLoader(fmt.Sprintf("file://%s", path.Join(cwd, tt.expected)))
+			docLoader := gojsonschema.NewReferenceLoader(fileURL(filepath.Join(cwd, tt.expected)))
 			rr, err := schema.Validate(docLoader)
 			if err != nil {
 				t.Fatalf("%s: Validate error: %s", tt.name, err.Error())
@@ -586,3 +586,12 @@ func TestExperimentalFromJSON2_time(t *testing.T) {
 		})
 	}
 }
+
+// fileURL builds a valid file URL on every OS (Windows paths need a leading slash).
+func fileURL(p string) string {
+	p = filepath.ToSlash(p)
+	if !strings.HasPrefix(p, "/") {
+		p = "/" + p
+	}
+	return "file://" + p
+}