test(zcode): verify rollback with real Windows file permissions

2026-10-31 00:57:45 +00:00 · 2026-10-10 16:24:14 -07:00
parent 1f6ab26ec6
commit 6de900fcc6
2 changed files with 175 additions and 0 deletions
@@ -0,0 +1,34 @@
+name: Coding Plan credential contract
+on:
+  pull_request:
+    paths:
+      - 'src/main/zcode/**'
+      - 'src/shared/secure-file*'
+      - 'src/shared/secure-path-windows-acl*'
+      - 'src/shared/windows-security-descriptor*'
+      - '.github/workflows/zcode-credential-contract.yml'
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: coding-plan-contract-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+jobs:
+  credential-files:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-22.04, macos-15, windows-2022]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    env:
+      ORCA_BACKGROUND_LAUNCH: '1'
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/install-node-dependencies
+        with:
+          native-runtime: node
+      - name: Verify rollback and native Windows permissions
+        run: pnpm test src/main/zcode/zcode-plan-api-key-store.test.ts src/main/zcode/zcode-plan-api-key-store-plaintext-rollback.test.ts src/main/zcode/zcode-plan-api-key-store-publication-race.test.ts src/main/zcode/zcode-plan-api-key-store-native-windows.test.ts src/shared/secure-file.test.ts