v6: Ensure Chmod behaviour across BoundOS and ChrootOS

.github/workflows/bench-regression.yml

@@ -0,0 +1,135 @@
+name: Benchmarks
+
+on:
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'Pull Request number'
+        required: true
+        type: number
+
+permissions: {}
+
+jobs:
+  benchmark:
+    name: Compare Benchmarks
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+      - name: Get PR base ref
+        id: pr-info
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          base_ref=$(gh pr view ${{ inputs.pr_number }} --repo ${{ github.repository }} --json baseRefName --jq .baseRefName)
+          echo "base_ref=$base_ref" >> $GITHUB_OUTPUT
+
+      - name: Checkout PR branch
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          ref: refs/pull/${{ inputs.pr_number }}/head
+          path: new
+
+      - name: Checkout base branch
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          ref: ${{ steps.pr-info.outputs.base_ref }}
+          path: old
+
+      - name: Set up Go
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+        with:
+          go-version: stable
+          cache-dependency-path: new/go.sum
+
+      - name: Install benchstat
+        # renovate: datasource=go depName=golang.org/x/perf/cmd/benchstat
+        run: go install golang.org/x/perf/cmd/benchstat@v0.0.0-20260211190930-8161c38c6cdc
+
+      - name: Run base branch benchmarks
+        id: base-bench
+        working-directory: old
+        run: go test -run='^$' -bench=. -benchmem -count=1 ./test/... > ../base.txt 2>&1
+        continue-on-error: true
+
+      - name: Run PR branch benchmarks
+        id: pr-bench
+        working-directory: new
+        run: go test -run='^$' -bench=. -benchmem -count=1 ./test/... > ../pr.txt 2>&1
+        continue-on-error: true
+
+      - name: Compare and report
+        if: always()
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ inputs.pr_number }}
+          REPO: ${{ github.repository }}
+          BASE_OUTCOME: ${{ steps.base-bench.outcome }}
+          PR_OUTCOME: ${{ steps.pr-bench.outcome }}
+        run: |
+          if [ "$BASE_OUTCOME" != "success" ] || [ "$PR_OUTCOME" != "success" ]; then
+            {
+              echo "## ⚠️ Benchmark Run Failed"
+              echo ""
+              echo "One or more benchmark runs did not complete successfully."
+              echo "Please check the workflow logs for details."
+              echo ""
+              echo "| Step | Outcome |"
+              echo "| --- | --- |"
+              echo "| Base branch benchmarks | \`${BASE_OUTCOME}\` |"
+              echo "| PR branch benchmarks   | \`${PR_OUTCOME}\` |"
+            } > comment.md
+          else
+            benchstat base.txt pr.txt > stat.txt 2>&1
+
+            # Extract lines with regressions greater than 5% on any metric.
+            # Also capture infinite regressions (+∞ / +Inf) that appear when the
+            # baseline measurement was zero.
+            awk '
+              /\+∞/ || /\+Inf/ { print; next }
+              match($0, /\+[0-9]+\.?[0-9]*%/) {
+                pct = substr($0, RSTART + 1, RLENGTH - 2)
+                if (pct + 0 > 5) print
+              }
+            ' stat.txt > regressions.txt
+
+            if [ -s regressions.txt ]; then
+              {
+                echo "## ⚠️ Benchmark Regressions Detected (>5%)"
+                echo ""
+                echo "The following benchmarks have degraded by more than 5% in time, memory, or allocations:"
+                echo ""
+                echo "\`\`\`"
+                cat regressions.txt
+                echo "\`\`\`"
+                echo ""
+                echo "<details>"
+                echo "<summary>Full benchmark comparison (<code>benchstat</code>)</summary>"
+                echo ""
+                echo "\`\`\`"
+                cat stat.txt
+                echo "\`\`\`"
+                echo "</details>"
+              } > comment.md
+            else
+              {
+                echo "## ✅ No Benchmark Regressions"
+                echo ""
+                echo "No benchmark regressions greater than 5% were detected."
+                echo ""
+                echo "<details>"
+                echo "<summary>Full benchmark comparison (<code>benchstat</code>)</summary>"
+                echo ""
+                echo "\`\`\`"
+                cat stat.txt
+                echo "\`\`\`"
+                echo "</details>"
+              } > comment.md
+            fi
+          fi
+
+          gh pr comment "$PR_NUMBER" --edit-last --create-if-none --body-file comment.md --repo "$REPO"

.github/workflows/test.yml

@@ -10,7 +10,7 @@ jobs:
   test:
     strategy:
       matrix:
-        go-version: [1.24.x,1.25.x]
+        go-version: [oldstable, stable]
         platform: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.platform }}
     steps:

.github/workflows/test_wasip1.yml

@@ -11,7 +11,7 @@ jobs:
   test:
     strategy:
       matrix:
-        go-version: [1.24.x,1.25.x]
+        go-version: [oldstable, stable]
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code

Makefile

@@ -8,7 +8,7 @@ COVERAGE_REPORT := coverage.out
 COVERAGE_MODE := count
 
 # renovate: datasource=github-tags depName=golangci/golangci-lint
-GOLANGCI_VERSION ?= v2.8.0
+GOLANGCI_VERSION ?= v2.10.0
 TOOLS_BIN := $(shell mkdir -p build/tools && realpath build/tools)
 
 GOLANGCI = $(TOOLS_BIN)/golangci-lint-$(GOLANGCI_VERSION)

helper/polyfill/polyfill_test.go

@@ -46,6 +46,14 @@ func TestChroot(t *testing.T) {
 	assert.ErrorIs(t, err, billy.ErrNotSupported)
 }
 
+func TestChmod(t *testing.T) {
+	ch, ok := helper.(billy.Chmod)
+	assert.True(t, ok)
+
+	err := ch.Chmod("", 0o444)
+	assert.ErrorIs(t, err, billy.ErrNotSupported)
+}
+
 func TestRoot(t *testing.T) {
 	assert.Equal(t, string(filepath.Separator), helper.Root())
 }

osfs/os_bound.go

@@ -153,6 +153,14 @@ func (fs *BoundOS) TempFile(dir, prefix string) (billy.File, error) {
 		if err != nil {
 			return nil, err
 		}
+
+		_, err = os.Stat(dir)
+		if err != nil && os.IsNotExist(err) {
+			err = os.MkdirAll(dir, defaultDirectoryMode)
+			if err != nil {
+				return nil, err
+			}
+		}
 	}
 
 	return tempFile(dir, prefix)

osfs/os_bound_test.go

@@ -279,18 +279,22 @@ func TestTempFile(t *testing.T) {
 	require.NoError(t, f.Close())
 
 	f, err = fs.TempFile("/above/cwd", "prefix")
-	require.ErrorContains(t, err, fmt.Sprint(dir, filepath.FromSlash("/above/cwd/prefix")))
-	assert.Nil(f)
+	require.NoError(t, err)
+	assert.NotNil(f)
+	assert.Contains(f.Name(), filepath.Join(dir, "/above/cwd", "prefix"))
+	require.NoError(t, f.Close())
 
-	tempDir := os.TempDir()
+	dir = os.TempDir()
 	// For windows, volume name must be removed.
-	if v := filepath.VolumeName(tempDir); v != "" {
-		tempDir = strings.TrimPrefix(tempDir, v)
+	if v := filepath.VolumeName(dir); v != "" {
+		dir = strings.TrimPrefix(dir, v)
 	}
 
-	f, err = fs.TempFile(tempDir, "prefix")
-	require.ErrorContains(t, err, filepath.Join(dir, tempDir, "prefix"))
-	assert.Nil(f)
+	f, err = fs.TempFile(dir, "prefix")
+	require.NoError(t, err)
+	assert.NotNil(f)
+	assert.Contains(f.Name(), filepath.Join(dir, "prefix"))
+	require.NoError(t, f.Close())
 }
 
 func TestChroot(t *testing.T) {