#152 fix(ci): add a Windows CI leg and fix cross-drive key-path test

[Anonymous]

Originally created by: harshitagrawal2O

The default fingerprint key path and the repo can live on different Windows drives (e.g. key under C:\Users...\AppData, checkout on D:), where os.path.commonpath raises ValueError — the only failing test on multi-drive Windows. Treat a cross-drive result as proof the key is outside the repo.

Also add one windows-latest CI leg (guarding OS-specific code like the O_BINARY key-write path) and pin the job shell to bash so the grep-based standalone-guarantee step behaves identically on Windows.

Pull Request

Slice

• Repo: doberman-core | doberman-enterprise
• Feature / Slice: <id> — <title></li> <li>Plan reference: doberman_implementation_plan.md</li> </ul> <h2 id="h-what-this-pr-does">What this PR does</h2> <h2 id="h-tests-added-run-in-ci">Tests added (run in CI)</h2> <p>-</p> <h2 id="h-public-release-safety-doberman-core-only">Public-release safety (doberman-core only)</h2> <ul> <li><span>[ ]</span> Contains nothing from the "not allowed" list: no enterprise/hosted code, no proprietary detection, no customer data, no secrets, no commercial-license code</li> <li><span>[ ]</span> Core still builds/tests/runs with NO enterprise package installed</li> </ul> <h2 id="h-security-checklist">Security checklist</h2> <ul> <li><span>[ ]</span> Fails closed on error / uncertainty</li> <li><span>[ ]</span> No secret, full file, or unredacted prompt logged or committed</li> <li><span>[ ]</span> Any guardrail/learning change is raise-only (no silent loosening)</li> <li><span>[ ]</span> Every BLOCK/AUTH carries reason codes + a human explanation</li> <li><span>[ ]</span> doberman-core does not import doberman_enterprise</li> </ul> <h2 id="h-edge-cases-covered-deviations-from-plan-risks-introduced">Edge cases covered / Deviations from plan / Risks introduced</h2> <p>-</p></title></id>

[Anonymous]

Ticket changed by: fu351

• status: open --> closed

[Anonymous]

Originally posted by: fu351

Thanks for tracking down the cross-drive key-path bug and adding the windows-latest CI leg — that's exactly the kind of platform-specific fix that's easy to miss and painful to debug blind. I've left detailed review feedback on your open PR [#164], so I'll let that comment do the talking there.