fix: make rules lock cross-platform for Windows release builds (#252)

Split acquireRulesLock into OS-specific implementations with build
tags. Unix keeps syscall.Flock, Windows uses O_CREATE|O_EXCL lockfile.
Add CI cross-build check for Windows amd64/arm64 with enterprise tag.

Author: luckyPipewrench

.github/workflows/ci.yaml

@@ -121,3 +121,8 @@ jobs:
 
       - name: Verify enterprise binary runs
         run: ./pipelock-enterprise --version
+
+      - name: Cross-build Windows binaries (enterprise)
+        run: |
+          GOOS=windows GOARCH=amd64 go build -tags enterprise -trimpath -o /tmp/pipelock-windows-amd64.exe ./cmd/pipelock
+          GOOS=windows GOARCH=arm64 go build -tags enterprise -trimpath -o /tmp/pipelock-windows-arm64.exe ./cmd/pipelock

CHANGELOG.md

@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+- Windows release builds: `pipelock rules` now uses an OS-specific lock implementation so the CLI cross-compiles cleanly for Windows targets. CI now cross-builds the enterprise CLI for Windows to catch release-only breakage before tagging.
+
 ## [1.4.0] - 2026-03-17
 
 ### Added

internal/cli/rules.go

@@ -16,7 +16,6 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
-	"syscall"
 	"time"
 
 	"github.com/spf13/cobra"
@@ -79,28 +78,9 @@ func rulesCmd() *cobra.Command {
 	return cmd
 }
 
-// acquireRulesLock acquires an advisory file lock for mutating operations.
-// Returns a release function and an error. The caller must call the release
-// function when done.
-func acquireRulesLock(rulesDir string) (func(), error) {
-	lockPath := filepath.Join(rulesDir, ".rules.lock")
-
-	f, err := os.OpenFile(filepath.Clean(lockPath), os.O_CREATE|os.O_RDWR, 0o600)
-	if err != nil {
-		return nil, fmt.Errorf("opening lock file: %w", err)
-	}
-
-	fd := int(f.Fd()) //nolint:gosec // G115: file descriptors always fit in int
-	if err := syscall.Flock(fd, syscall.LOCK_EX|syscall.LOCK_NB); err != nil {
-		_ = f.Close()
-		return nil, fmt.Errorf("another rules command is running (lock: %s)", lockPath)
-	}
-
-	return func() {
-		_ = syscall.Flock(fd, syscall.LOCK_UN)
-		_ = f.Close()
-	}, nil
-}
+// acquireRulesLock is defined in rules_lock_unix.go and rules_lock_windows.go.
+// It acquires an advisory file lock for mutating operations. Returns a release
+// function and an error. The caller must call the release function when done.
 
 // ensureDir creates a directory with 0o750 permissions if it does not exist.
 func ensureDir(path string) error {

internal/cli/rules_lock_unix.go

@@ -0,0 +1,39 @@
+// Copyright 2026 Josh Waldrep
+// SPDX-License-Identifier: Apache-2.0
+
+//go:build !windows
+
+package cli
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"syscall"
+)
+
+// acquireRulesLock acquires an advisory file lock using flock(2).
+// Returns a release function and an error.
+func acquireRulesLock(rulesDir string) (func(), error) {
+	lockPath := filepath.Join(rulesDir, ".rules.lock")
+
+	f, err := os.OpenFile(filepath.Clean(lockPath), os.O_CREATE|os.O_RDWR, 0o600)
+	if err != nil {
+		return nil, fmt.Errorf("opening lock file: %w", err)
+	}
+
+	fd := int(f.Fd()) //nolint:gosec // G115: file descriptors always fit in int
+	if err := syscall.Flock(fd, syscall.LOCK_EX|syscall.LOCK_NB); err != nil {
+		_ = f.Close()
+		if errors.Is(err, syscall.EWOULDBLOCK) || errors.Is(err, syscall.EAGAIN) {
+			return nil, fmt.Errorf("another rules command is running (lock: %s)", lockPath)
+		}
+		return nil, fmt.Errorf("acquiring rules lock: %w", err)
+	}
+
+	return func() {
+		_ = syscall.Flock(fd, syscall.LOCK_UN)
+		_ = f.Close()
+	}, nil
+}

internal/cli/rules_lock_windows.go

@@ -0,0 +1,56 @@
+// Copyright 2026 Josh Waldrep
+// SPDX-License-Identifier: Apache-2.0
+
+//go:build windows
+
+package cli
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"syscall"
+)
+
+const (
+	errSharingViolation = syscall.Errno(32)
+	errLockViolation    = syscall.Errno(33)
+)
+
+// acquireRulesLock acquires an exclusive lock file handle for mutating
+// operations. On Windows, opening a file with share mode 0 prevents other
+// processes from opening the same path until the handle is closed.
+func acquireRulesLock(rulesDir string) (func(), error) {
+	lockPath := filepath.Join(rulesDir, ".rules.lock")
+
+	pathp, err := syscall.UTF16PtrFromString(lockPath)
+	if err != nil {
+		return nil, fmt.Errorf("encoding lock file path: %w", err)
+	}
+
+	handle, err := syscall.CreateFile(
+		pathp,
+		syscall.GENERIC_READ|syscall.GENERIC_WRITE,
+		0,
+		nil,
+		syscall.OPEN_ALWAYS,
+		syscall.FILE_ATTRIBUTE_NORMAL,
+		0,
+	)
+	if err != nil {
+		if err == errSharingViolation || err == errLockViolation {
+			return nil, fmt.Errorf("another rules command is running (lock: %s)", lockPath)
+		}
+		return nil, fmt.Errorf("opening lock file: %w", err)
+	}
+
+	f := os.NewFile(uintptr(handle), lockPath)
+	if f == nil {
+		_ = syscall.CloseHandle(handle)
+		return nil, fmt.Errorf("creating lock file handle: %s", lockPath)
+	}
+
+	return func() {
+		_ = f.Close()
+	}, nil
+}