fix pipeline

Author: daveshanley

arazzo/engine_coverage_test.go

@@ -1550,9 +1550,12 @@ func TestEnsureResolvedPathWithinRoots_PathOutsideRoots(t *testing.T) {
 	assert.Contains(t, err.Error(), "outside configured roots")
 }
 
-func TestEnsureResolvedPathWithinRoots_EvalSymlinksNotExist(t *testing.T) {
-	// If the path doesn't exist, EvalSymlinks returns ErrNotExist => return nil
-	err := ensureResolvedPathWithinRoots("/nonexistent/path/file.yaml", []string{"/some/root"})
+func TestEnsureResolvedPathWithinRoots_MissingPathInsideRoot(t *testing.T) {
+	root := t.TempDir()
+	canonicalRoot, err := filepath.EvalSymlinks(root)
+	require.NoError(t, err)
+	path := filepath.Join(root, "missing", "file.yaml")
+	err = ensureResolvedPathWithinRoots(path, []string{canonicalRoot})
 	assert.NoError(t, err)
 }
 

arazzo/resolve.go

@@ -481,11 +481,8 @@ func canonicalizeRoots(roots []string) []string {
 }
 
 func ensureResolvedPathWithinRoots(path string, roots []string) error {
-	resolvedPath, err := filepath.EvalSymlinks(path)
+	resolvedPath, err := resolvePathForContainment(path)
 	if err != nil {
-		if errors.Is(err, os.ErrNotExist) {
-			return nil
-		}
 		return err
 	}
 	if !isPathWithinRoots(resolvedPath, roots) {
@@ -494,6 +491,44 @@ func ensureResolvedPathWithinRoots(path string, roots []string) error {
 	return nil
 }
 
+// resolvePathForContainment resolves every existing path component, preserving any
+// missing tail for the final containment check. filepath.EvalSymlinks returns
+// os.ErrNotExist for the whole path when its final component is missing, which would
+// otherwise hide a symlinked parent that escapes the configured roots.
+func resolvePathForContainment(path string) (string, error) {
+	candidate := filepath.Clean(path)
+	var missing []string
+
+	for {
+		resolved, err := filepath.EvalSymlinks(candidate)
+		if err == nil {
+			if len(missing) > 0 {
+				info, statErr := os.Stat(resolved)
+				if statErr != nil {
+					return "", statErr
+				}
+				if !info.IsDir() {
+					return "", fmt.Errorf("path component %q is not a directory", candidate)
+				}
+			}
+			for i := len(missing) - 1; i >= 0; i-- {
+				resolved = filepath.Join(resolved, missing[i])
+			}
+			return resolved, nil
+		}
+		if !errors.Is(err, os.ErrNotExist) {
+			return "", err
+		}
+
+		parent := filepath.Dir(candidate)
+		if parent == candidate {
+			return "", err
+		}
+		missing = append(missing, filepath.Base(candidate))
+		candidate = parent
+	}
+}
+
 func containsFold(values []string, value string) bool {
 	for _, v := range values {
 		if strings.EqualFold(v, value) {

arazzo_test.go

@@ -10,6 +10,7 @@ import (
 	"log/slog"
 	"os"
 	"reflect"
+	"strings"
 	"sync"
 	"testing"
 	"unsafe"
@@ -313,7 +314,9 @@ func TestNewArazzoDocument_Arazzo10GoldenRenderCompatibility(t *testing.T) {
 	require.NoError(t, err)
 	rendered, err := document.Render()
 	require.NoError(t, err)
-	assert.Equal(t, string(fixture), string(rendered))
+	// Git may check the fixture out with CRLF on Windows, while yaml.Marshal
+	// deliberately emits LF. Compare the serialized content, not checkout policy.
+	assert.Equal(t, strings.ReplaceAll(string(fixture), "\r\n", "\n"), string(rendered))
 	assert.NotContains(t, string(rendered), "$self")
 	assert.NotContains(t, string(rendered), "channelPath")
 	assert.NotContains(t, string(rendered), "targetSelectorType")