diag: token-state and file-creation tests across PowerShell/Cygwin

Investigational workflow that replaces the test matrix with a
single diag-token job to isolate why the outer git clone
produces Administrators-owned dirs while subsequent submodule
operations under the same runneradmin account produce
runneradmin-owned dirs.

The job runs both PowerShell-side and Cygwin-side tests:
- whoami /all from each side (token state)
- NoDefaultAdminOwner registry check
- A: PowerShell New-Item directory
- B: PowerShell-spawned git init
- C: cmd.exe-spawned mkdir
- D: Cygwin mkdir
- E: Cygwin-spawned (Cygwin) git init
- F: Cygwin-spawned Git for Windows git init
- G: Cygwin-spawned PowerShell New-Item

Each test reports the NTFS Owner of the resulting directory
(via Get-Acl on the PowerShell side, stat -c '%U(%u)' on the
Cygwin side) so we can see which code paths produce
BUILTIN\Administrators ownership versus runneradmin ownership.

This branch (claude/cygwin-diag-token) is for investigation
only and is not part of the fix chain.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: EliahKagan

.github/workflows/cygwin-test.yml

@@ -6,131 +6,108 @@ permissions:
   contents: read
 
 jobs:
-  test:
-    strategy:
-      matrix:
-        selection: [fast, perf]
-        include:
-        - selection: fast
-          additional-pytest-args: --ignore=test/performance
-        - selection: perf
-          additional-pytest-args: test/performance
-
-      fail-fast: false
-
+  diag-token:
     runs-on: windows-latest
 
-    env: &cygwin-env
+    env:
       CHERE_INVOKING: "1"
       CYGWIN_NOWINPATH: "1"
 
-    defaults: &cygwin-defaults
+    defaults:
       run:
         shell: C:\cygwin\bin\bash.exe --login --norc -eo pipefail -o igncr "{0}"
 
     steps:
-    - &force-lf
-      name: Force LF line endings
+    - name: Force LF line endings
       run: |
-        git config --global core.autocrlf false  # Affects the non-Cygwin git.
-      shell: pwsh  # Do this outside Cygwin, to affect actions/checkout.
+        git config --global core.autocrlf false
+      shell: pwsh
 
-    - &checkout
-      uses: actions/checkout@v6
+    - uses: actions/checkout@v6
       with:
         fetch-depth: 0
 
-    - &install-cygwin
-      name: Install Cygwin
+    - name: Install Cygwin
       uses: cygwin/cygwin-install-action@v6
       with:
-        packages: git python39 python-pip-wheel python-setuptools-wheel python-wheel-wheel
-        add-to-path: false  # No need to change $PATH outside the Cygwin environment.
-
-    - &verbose-output
-      name: Arrange for verbose output
-      run: |
-        # Arrange for verbose output but without shell environment setup details.
-        echo 'set -x' >~/.bash_profile
-
-    - &safe-directory
-      name: Special configuration for Cygwin git
-      run: |
-        git config --global --add safe.directory "$(pwd)"
-        git config --global --add safe.directory "$(pwd)/.git"
-        git config --global --add safe.directory "$(pwd)/git/ext/gitdb"
-        git config --global --add safe.directory "$(pwd)/git/ext/gitdb/gitdb/ext/smmap"
-        git config --global core.autocrlf false
-
-    - &prepare-repo
-      name: Prepare this repo for tests
-      run: |
-        ./init-tests-after-clone.sh
-
-    - &git-identity
-      name: Set git user identity and command aliases for the tests
-      run: |
-        git config --global user.email "travis@ci.com"
-        git config --global user.name "Travis Runner"
-        # If we rewrite the user's config by accident, we will mess it up
-        # and cause subsequent tests to fail
-        cat test/fixtures/.gitconfig >> ~/.gitconfig
-
-    - &setup-venv
-      name: Set up virtual environment
-      run: |
-        python3.9 -m venv .venv
-        echo 'BASH_ENV=.venv/bin/activate' >>"$GITHUB_ENV"
+        packages: git
+        add-to-path: false
 
-    - &update-pypa
-      name: Update PyPA packages
+    - name: PowerShell-side token state and file-creation tests
+      shell: pwsh
       run: |
-        python -m pip install -U pip 'setuptools; python_version<"3.12"' wheel
-
-    - &install-deps
-      name: Install project and test dependencies
-      run: |
-        pip install '.[test]'
-
-    - name: Show version and platform information
-      run: |
-        uname -a
-        command -v git python
-        git version
-        python --version
-        python -c 'import os, sys; print(f"sys.platform={sys.platform!r}, os.name={os.name!r}")'
-
-    - name: Test with pytest (${{ matrix.additional-pytest-args }})
-      run: |
-        pytest --color=yes -p no:sugar --instafail -vv ${{ matrix.additional-pytest-args }}
-
-  reproduce-safe-dir:
-    strategy:
-      matrix:
-        run: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 192, 193, 194, 195, 196, 197, 198, 199, 200, 201, 202, 203, 204, 205, 206, 207, 208, 209, 210, 211, 212, 213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, 229, 230, 231, 232, 233, 234, 235, 236, 237, 238, 239, 240, 241, 242, 243, 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254, 255, 256]
-      fail-fast: false
-
-    runs-on: windows-latest
-
-    env: *cygwin-env
-
-    defaults: *cygwin-defaults
-
-    steps:
-    - *force-lf
-    - *checkout
-    - *install-cygwin
-    - *verbose-output
-    - *safe-directory
-    - *prepare-repo
-    - *git-identity
-    - *setup-venv
-    - *update-pypa
-    - *install-deps
-
-    - name: Run submodule tests
+        $repo = "D:\a\GitPython\GitPython"
+        Write-Host "==================== whoami /all (PowerShell) ===================="
+        whoami /all
+        Write-Host ""
+        Write-Host "==================== System policy: NoDefaultAdminOwner ===================="
+        try {
+          $val = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Lsa' -Name NoDefaultAdminOwner -ErrorAction Stop).NoDefaultAdminOwner
+          Write-Host "NoDefaultAdminOwner = $val (0=Admin-owner, 1=Object-creator)"
+        } catch {
+          Write-Host "NoDefaultAdminOwner not set (default applies)"
+        }
+        Write-Host ""
+        Write-Host "==================== Test A: PowerShell New-Item directory ===================="
+        $td = "$repo\test-pwsh-mkdir"
+        New-Item -ItemType Directory -Path $td -Force | Out-Null
+        $acl = Get-Acl -LiteralPath $td
+        Write-Host "Owner of $td : $($acl.Owner)"
+        Remove-Item $td -Force
+        Write-Host ""
+        Write-Host "==================== Test B: PowerShell-spawned git init ===================="
+        $td2 = "$repo\test-pwsh-gitinit"
+        New-Item -ItemType Directory -Path $td2 -Force | Out-Null
+        Push-Location $td2
+        & "C:\Program Files\Git\bin\git.exe" init 2>&1 | Out-Null
+        Pop-Location
+        $acl1 = Get-Acl -LiteralPath $td2
+        $acl2 = Get-Acl -LiteralPath "$td2\.git"
+        Write-Host "Owner of $td2 (PowerShell-created)        : $($acl1.Owner)"
+        Write-Host "Owner of $td2\.git (git-init-created)     : $($acl2.Owner)"
+        Remove-Item $td2 -Recurse -Force
+        Write-Host ""
+        Write-Host "==================== Test C: cmd.exe-spawned mkdir ===================="
+        $td3 = "$repo\test-cmd-mkdir"
+        cmd.exe /c "mkdir `"$td3`""
+        $acl = Get-Acl -LiteralPath $td3
+        Write-Host "Owner of $td3 : $($acl.Owner)"
+        Remove-Item $td3 -Force
+
+    - name: Cygwin-side token state and file-creation tests
       run: |
-        python -m pytest -vv \
-          test/test_docs.py::Tutorials::test_submodules \
-          test/test_repo.py::TestRepo::test_submodules \
-          test/test_submodule.py::TestSubmodule::test_root_module
+        set +e
+        echo "==================== id (Cygwin) ===================="
+        id
+        echo
+        echo "==================== whoami /all (called from Cygwin) ===================="
+        /cygdrive/c/Windows/System32/whoami.exe /all 2>&1 | head -50
+        echo
+        echo "==================== Test D: Cygwin mkdir ===================="
+        td="$(pwd)/test-cygwin-mkdir"
+        mkdir "$td"
+        echo "Owner: $(stat -c '%U(%u)' "$td")"
+        rmdir "$td"
+        echo
+        echo "==================== Test E: Cygwin-spawned git init ===================="
+        td2="$(pwd)/test-cygwin-gitinit"
+        mkdir "$td2"
+        ( cd "$td2" && git init -q )
+        echo "Owner of $td2 (Cygwin-mkdir):     $(stat -c '%U(%u)' "$td2")"
+        echo "Owner of $td2/.git (cygwin-git):  $(stat -c '%U(%u)' "$td2/.git")"
+        rm -rf "$td2"
+        echo
+        echo "==================== Test F: Cygwin-spawned Windows git init ===================="
+        td3="$(pwd)/test-cygwin-spawns-wingit"
+        mkdir "$td3"
+        ( cd "$td3" && /cygdrive/c/Program\ Files/Git/bin/git.exe init -q )
+        echo "Owner of $td3 (Cygwin-mkdir):           $(stat -c '%U(%u)' "$td3")"
+        echo "Owner of $td3/.git (Cygwin->WinGit):    $(stat -c '%U(%u)' "$td3/.git")"
+        rm -rf "$td3"
+        echo
+        echo "==================== Test G: Cygwin-spawned PowerShell mkdir ===================="
+        td4="$(pwd)/test-cygwin-spawns-pwsh"
+        powershell.exe -Command "New-Item -ItemType Directory -Path '$(cygpath -w "$td4")' -Force" | head -2
+        echo "Owner: $(stat -c '%U(%u)' "$td4")"
+        rm -rf "$td4"
+        true