[fix] isolate Unix-only process-group syscalls behind build tags (#247)

* [fix] isolate Unix-only process-group syscalls behind build tags

Extract the Setpgid/SIGKILL process-group setup from hooks.go and
manager.go into configureProcessGroup, implemented in proc_unix.go
(unix build tag) and a no-op proc_windows.go (windows build tag).

Fixes GOOS=windows cross-compilation: syscall.SysProcAttr.Setpgid and
syscall.Kill are absent on Windows, causing the build to fail. Unix
runtime behaviour is unchanged.

* [ci] add Windows cross-compile guard to CI

Add a build-cross job that cross-compiles for windows/amd64 and
windows/arm64 on every push and PR. This mirrors the goreleaser release
targets and ensures a Unix-only syscall regression cannot reach the
release stage again.

* [ci] set CGO_ENABLED=0 for Windows cross-compile steps

Pure-Go cross-compilation requires CGO_ENABLED=0 on a Linux host without
a Windows cross-compiler. Makes the intent explicit and prevents a latent
failure if cgo is ever introduced.

* [ci] extend build-cross matrix to all goreleaser targets

Add linux/arm64, darwin/amd64, and darwin/arm64 to the build-cross CI
job so it fully mirrors the goreleaser release matrix (not just Windows).
Addresses reviewer feedback on PR #247.

Author: lugassawan

.github/workflows/ci.yml

@@ -80,6 +80,21 @@ jobs:
           cache: true
       - run: make test-race
 
+  build-cross:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+      - run: CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build ./...
+      - run: CGO_ENABLED=0 GOOS=windows GOARCH=arm64 go build ./...
+      - run: CGO_ENABLED=0 GOOS=linux   GOARCH=arm64 go build ./...
+      - run: CGO_ENABLED=0 GOOS=darwin  GOARCH=amd64 go build ./...
+      - run: CGO_ENABLED=0 GOOS=darwin  GOARCH=arm64 go build ./...
+
   vuln:
     runs-on: ubuntu-latest
     timeout-minutes: 15

internal/deps/hooks.go

@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"os/exec"
 	"strings"
-	"syscall"
 
 	"github.com/lugassawan/rimba/internal/progress"
 )
@@ -30,15 +29,7 @@ func RunPostCreateHooks(ctx context.Context, worktreeDir string, hooks []string,
 
 		cmd := exec.CommandContext(ctx, "sh", "-c", hook) //nolint:gosec // hook commands come from user config
 		cmd.Dir = worktreeDir
-		// Put the subprocess in its own process group so that cancellation kills
-		// sh and all children it may have forked (e.g. sh -c sleep 30 on Linux).
-		cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
-		cmd.Cancel = func() error {
-			if cmd.Process != nil {
-				_ = syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
-			}
-			return nil
-		}
+		configureProcessGroup(cmd)
 
 		var buf bytes.Buffer
 		cmd.Stdout = &buf

internal/deps/manager.go

@@ -10,7 +10,6 @@ import (
 	"runtime"
 	"strings"
 	"sync/atomic"
-	"syscall"
 
 	"github.com/lugassawan/rimba/internal/config"
 	"github.com/lugassawan/rimba/internal/debug"
@@ -206,16 +205,7 @@ func runInstall(ctx context.Context, worktreePath string, mod Module) error {
 
 	cmd := exec.CommandContext(ctx, "sh", "-c", mod.InstallCmd) //nolint:gosec // install commands come from user config
 	cmd.Dir = dir
-	// Put the subprocess in its own process group so cancellation kills sh and
-	// all children (e.g. npm spawns node children that would otherwise keep
-	// stdout/stderr pipes open and block cmd.Wait).
-	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
-	cmd.Cancel = func() error {
-		if cmd.Process != nil {
-			_ = syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
-		}
-		return nil
-	}
+	configureProcessGroup(cmd)
 
 	var buf bytes.Buffer
 	cmd.Stdout = &buf

internal/deps/proc_unix.go

@@ -0,0 +1,21 @@
+//go:build unix
+
+package deps
+
+import (
+	"os/exec"
+	"syscall"
+)
+
+// configureProcessGroup puts the subprocess in its own process group so that
+// context cancellation kills the shell and all children it may have forked
+// (e.g. `sh -c "sleep 30"` or npm spawning node children).
+func configureProcessGroup(cmd *exec.Cmd) {
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+	cmd.Cancel = func() error {
+		if cmd.Process != nil {
+			_ = syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
+		}
+		return nil
+	}
+}

internal/deps/proc_windows.go

@@ -0,0 +1,9 @@
+//go:build windows
+
+package deps
+
+import "os/exec"
+
+// configureProcessGroup is a no-op on Windows, which has no POSIX process
+// groups. exec.CommandContext's default cancellation (Process.Kill) is used.
+func configureProcessGroup(cmd *exec.Cmd) {}