Warning: This build has drifted.
The coverage report for this pull request build may be inaccurate because its base commit is no longer the HEAD of its target branch.
This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

    • Learn more: For more information on this, see Tracking coverage changes for pull request builds.
    • Fix now: For a quick fix, rebase this PR at GitHub. Your next report should be accurate.
    • Prevent going forward: To avoid this issue with future PRs, see these Recommended CI Configurations.

fix(codegen): skip permission bits on Windows, not just default them

Addresses @StevenACoffman's feedback on the tailscale/atomicfile
reference (https://github.com/99designs/gqlgen/pull/4262#issuecomment-5011193760):
tailscale's WriteFile explicitly does

    if runtime.GOOS != "windows" {
        f.Chmod(perm)
    }

i.e. permission handling is SKIPPED on Windows, not attempted with a
default value. My prior code called tmp.Chmod(perm) unconditionally on
every platform. That's not a correctness bug (Chmod on Windows just
toggles the read-only attribute off, since it has no real owner/group/
other bits to set to 0644), but it's not the tailscale contract either
- Windows doesn't have the concept these bits are trying to express, so
attempting the call there is a category error even when harmless, and
I'd represented the comparison as more careful than it was. This gates
the whole Chmod call (and the perm-resolution stat) on
runtime.GOOS != "windows", matching tailscale's own code exactly, with
the reasoning written down inline (and a link back to the review
comment) so a future reader isn't left to rediscover why.

Confirmed while re-checking this: os.Rename on Windows already calls
MoveFileEx(MOVEFILE_REPLACE_EXISTING) internally (internal/syscall/
windows.Rename) - the exact same underlying API natefinch/atomic's
ReplaceFile wraps - so it is not a weaker primitive than the
alternatives; what it lacks is retry, which is what renameWithRetry
(the previous commit) already adds. Documented that in the retry
function's comment so the choice not to switch to a raw syscall isn't
left unexplained.

Verified: go build ./... clean; go test ./codegen/templates/...
./api/... green (including TestWriteIsAtomicPreservesPermissionsAndLeavesNoTemp,
TestWriteIsAtomicAndUnchangedShortCircuit, TestTemplateOverride,
TestRenderFS, TestGenerateAtomicWritePreservesOutputOnFailure);
gofmt/go vet/golines/gci all clean.