fix: repair cross-platform CI gates

Normalize explicit Windows platform overrides, scope macOS credential tests to the ephemeral keychain, write redirected PowerShell test input as BOM-free UTF-8, and install a checksum-pinned kcov build on Ubuntu 24.04.

Author: multi-cli

.github/workflows/ci.yml

@@ -181,7 +181,7 @@ jobs:
               exec bash tests/run-bats.sh
             '
           else
-            bash tests/run-bats.sh
+            env MULTICLI_MACOS_KEYCHAIN="$MULTICLI_CI_KEYCHAIN" bash tests/run-bats.sh
           fi
 
       - name: Run the real POSIX OS-user lifecycle
@@ -205,8 +205,15 @@ jobs:
       - uses: actions/checkout@v4
       - name: Install coverage dependencies
         run: |
+          KCOV_VERSION=v40
+          KCOV_SHA256=5914803b8b84150b8c4a92f89d49edd870bf451d3d610040152d3cb31104b000
+          KCOV_ARCHIVE="$RUNNER_TEMP/kcov-amd64.tar.gz"
           sudo apt-get update -y
-          sudo apt-get install -y kcov bats jq libsecret-tools gnome-keyring dbus-x11 acl
+          sudo apt-get install -y bats jq libsecret-tools gnome-keyring dbus-x11 acl
+          curl -fsSL "https://github.com/SimonKagstrom/kcov/releases/download/$KCOV_VERSION/kcov-amd64.tar.gz" -o "$KCOV_ARCHIVE"
+          printf '%s  %s\n' "$KCOV_SHA256" "$KCOV_ARCHIVE" | sha256sum --check --strict
+          sudo tar -xzf "$KCOV_ARCHIVE" -C /
+          kcov --version
       - name: Enforce Bash coverage
         env:
           COVERAGE_BASELINE: ${{ github.event.pull_request.base.sha || github.event.before || 'HEAD^' }}

docs/testing.md

@@ -62,4 +62,6 @@ bash tests/coverage/run-bash-coverage.sh
 powershell -NoProfile -ExecutionPolicy Bypass -File tests/coverage/Run-PowerShellCoverage.ps1
 ```
 
+The Bash gate requires `kcov` and Python 3. CI installs the pinned kcov v40 release archive after verifying SHA-256 because Ubuntu 24.04 does not publish a `kcov` package. The PowerShell gate requires Pester 3.4.
+
 Both gates read `COVERAGE_BASELINE` when CI supplies it and otherwise compare with `HEAD^`. They write machine-readable changed-line reports under `tests/coverage/out/` and fail when a changed production file has no coverage data.

lib/credential-store.sh

@@ -160,10 +160,11 @@ mc_cred_mac_require_security() {
 }
 
 mc_cred_mac_present() {
-  local target="$1" rc=0 errors
+  local target="$1" rc=0 errors keychain_args=()
   mc_cred_mac_require_security
+  [ -n "${MULTICLI_MACOS_KEYCHAIN:-}" ] && keychain_args=("$MULTICLI_MACOS_KEYCHAIN")
   # stderr is captured for the not-found check; stdout holds no diagnostics.
-  errors="$(security find-generic-password -s "$target" -a multicli 2>&1 >/dev/null)" || rc=$?
+  errors="$(security find-generic-password -s "$target" -a multicli "${keychain_args[@]+"${keychain_args[@]}"}" 2>&1 >/dev/null)" || rc=$?
   case "$rc" in
     0) return 0 ;;
     *)
@@ -175,29 +176,35 @@ mc_cred_mac_present() {
 }
 
 mc_cred_mac_set() {
-  local target="$1" secret="$2"
+  local target="$1" secret="$2" keychain_args=()
   mc_cred_mac_require_security
+  [ -n "${MULTICLI_MACOS_KEYCHAIN:-}" ] && keychain_args=("$MULTICLI_MACOS_KEYCHAIN")
   # `security` has no stdin secret channel; -U updates an existing item.
-  security add-generic-password -s "$target" -a multicli -w "$secret" -U >/dev/null
+  security add-generic-password -s "$target" -a multicli -w "$secret" -U \
+    "${keychain_args[@]+"${keychain_args[@]}"}" >/dev/null
 }
 
 mc_cred_mac_get() {
-  local target="$1" rc=0
+  local target="$1" rc=0 keychain_args=()
   mc_cred_mac_require_security
+  [ -n "${MULTICLI_MACOS_KEYCHAIN:-}" ] && keychain_args=("$MULTICLI_MACOS_KEYCHAIN")
   mc_cred_mac_present "$target" || rc=$?
   case "$rc" in
-    0) security find-generic-password -s "$target" -a multicli -w ;;
+    0) security find-generic-password -s "$target" -a multicli -w \
+         "${keychain_args[@]+"${keychain_args[@]}"}" ;;
     1) return 1 ;;
     *) return "$rc" ;;
   esac
 }
 
 mc_cred_mac_clear() {
-  local target="$1" rc=0
+  local target="$1" rc=0 keychain_args=()
   mc_cred_mac_require_security
+  [ -n "${MULTICLI_MACOS_KEYCHAIN:-}" ] && keychain_args=("$MULTICLI_MACOS_KEYCHAIN")
   mc_cred_mac_present "$target" || rc=$?
   case "$rc" in
-    0) security delete-generic-password -s "$target" -a multicli >/dev/null ;;
+    0) security delete-generic-password -s "$target" -a multicli \
+         "${keychain_args[@]+"${keychain_args[@]}"}" >/dev/null ;;
     1) return 0 ;;
     *) return "$rc" ;;
   esac

multi-cli

@@ -46,7 +46,7 @@ platform() {
   case "$raw" in
     darwin|macos|mac|osx) printf 'macos\n' ;;
     linux)                printf 'linux\n' ;;
-    mingw*|msys*|cygwin*) printf 'windows\n' ;;
+    mingw*|msys*|cygwin*|windows*) printf 'windows\n' ;;
     *)                    abort "unsupported platform '$raw'" ;;
   esac
 }

tests/ProfileSafety.Tests.ps1

@@ -25,7 +25,10 @@ function Invoke-ProfileLauncher {
         MULTICLI_OVERRIDE_BINARY = (Get-Command powershell.exe).Source
     }.GetEnumerator()) { $startInfo.EnvironmentVariables[$entry.Key] = $entry.Value }
     $process = [System.Diagnostics.Process]::Start($startInfo)
-    if ($null -ne $StdinText) { $process.StandardInput.WriteLine($StdinText) }
+    if ($null -ne $StdinText) {
+        $inputBytes = [Text.Encoding]::UTF8.GetBytes($StdinText + "`n")
+        $process.StandardInput.BaseStream.Write($inputBytes, 0, $inputBytes.Length)
+    }
     $process.StandardInput.Close()
     $stdoutTask = $process.StandardOutput.ReadToEndAsync()
     $stderrTask = $process.StandardError.ReadToEndAsync()

tests/adapter_schema.bats

@@ -241,9 +241,12 @@ JSON
   [[ "$output" == *"share.linkable path 'auth.json' overlaps share.neverLink path 'auth.json'"* ]]
 }
 
-@test "macOS platform normalization matches schema binary keys" {
+@test "platform normalization matches schema binary keys" {
   run bash -c "set -- help; source '$MULTICLI_BIN' >/dev/null 2>&1; MULTICLI_PLATFORM=darwin platform"
-
   [ "$status" -eq 0 ]
   [ "$output" = "macos" ]
+
+  run bash -c "set -- help; source '$MULTICLI_BIN' >/dev/null 2>&1; MULTICLI_PLATFORM=windows platform"
+  [ "$status" -eq 0 ]
+  [ "$output" = "windows" ]
 }

tests/credential_store.bats

@@ -209,13 +209,51 @@ write_security_stub_absent() {
   mkdir -p "$bin_dir"
   cat > "$bin_dir/security" <<'STUB'
 #!/usr/bin/env bash
+if [ -n "${SECURITY_ARGUMENT_CAPTURE:-}" ]; then
+  printf '%s\n' "$@" > "$SECURITY_ARGUMENT_CAPTURE"
+fi
 echo "security: SecKeychainSearchCopyNext: The specified item could not be found in the keychain." >&2
 exit 44
 STUB
   chmod +x "$bin_dir/security"
   printf '%s\n' "$bin_dir"
 }
 
+@test "macos backend restricts every operation to the configured keychain" {
+  local bin_dir capture keychain
+  bin_dir="$(write_security_stub_absent)"
+  capture="$MULTICLI_SCRATCH/security-arguments"
+  keychain="$MULTICLI_SCRATCH/multicli-ci.keychain-db"
+
+  run env PATH="$bin_dir:$PATH" MULTICLI_PLATFORM=macos MULTICLI_MACOS_KEYCHAIN="$keychain" SECURITY_ARGUMENT_CAPTURE="$capture" bash -c '
+    source "$CRED_STORE_LIB"
+    "$1" "multi-cli/tests/absent/MCLI_BATS_TOKEN" "test-secret"
+  ' _ mc_cred_mac_present
+  [ "$status" -eq 1 ]
+  [ "$(tail -n 1 "$capture")" = "$keychain" ]
+
+  run env PATH="$bin_dir:$PATH" MULTICLI_PLATFORM=macos MULTICLI_MACOS_KEYCHAIN="$keychain" SECURITY_ARGUMENT_CAPTURE="$capture" bash -c '
+    source "$CRED_STORE_LIB"
+    "$1" "multi-cli/tests/absent/MCLI_BATS_TOKEN" "test-secret"
+  ' _ mc_cred_mac_set
+  [ "$status" -eq 44 ]
+  [ "$(tail -n 1 "$capture")" = "$keychain" ]
+
+  run env PATH="$bin_dir:$PATH" MULTICLI_PLATFORM=macos MULTICLI_MACOS_KEYCHAIN="$keychain" SECURITY_ARGUMENT_CAPTURE="$capture" bash -c '
+    source "$CRED_STORE_LIB"
+    "$1" "multi-cli/tests/absent/MCLI_BATS_TOKEN" "test-secret"
+  ' _ mc_cred_mac_get
+  [ "$status" -eq 1 ]
+  [ "$(tail -n 1 "$capture")" = "$keychain" ]
+
+  run env PATH="$bin_dir:$PATH" MULTICLI_PLATFORM=macos MULTICLI_MACOS_KEYCHAIN="$keychain" SECURITY_ARGUMENT_CAPTURE="$capture" bash -c '
+    source "$CRED_STORE_LIB"
+    "$1" "multi-cli/tests/absent/MCLI_BATS_TOKEN" "test-secret"
+  ' _ mc_cred_mac_clear
+  [ "$status" -eq 0 ]
+  [ "$(tail -n 1 "$capture")" = "$keychain" ]
+}
+
 @test "macos backend treats an absent item as not-present (not an error)" {
   local bin_dir
   bin_dir="$(write_security_stub_absent)"